In this episode of Corruption, Crime and Compliance, Michael Volkov examines the more than $1.21 billion in Treasury penalties announced October 13, 2026 against Bank of America, including FinCEN’s $1.2 billion consent order, which credits the OCC’s record $750 million penalty and includes the bank’s admission that it willfully violated the Bank Secrecy Act. Volkov explains how the bank’s homegrown transaction monitoring system, Event Processor, relied on unsupported thresholds, miscalibrated risk weights, and unreviewed suppression rules, and how the bank’s own testing flagged these problems for years while more than $5 billion in suspicious activity went unreported or was reported late. He covers the customer due diligence findings, in which compliance recommended exiting high-risk customers and the business line pushed back, the order’s finding that a senior executive had a test repeated, and the status of DOJ, where no resolution was announced. He closes with seven practical steps for testing thresholds, setting tolerances, governing suppression rules, checking product coverage, and empowering compliance to say no.