FinCEN flags major AML failures at Bank of America, including weak transaction monitoring, delayed suspicious activity reporting and gaps in detecting money laundering and cross-border financial crime.
The US Financial Crimes Enforcement Network (FinCEN), a bureau of the Department of the Treasury, issued a civil enforcement consent order against Bank of America on 13 October 2026, citing serious deficiencies in the bank’s anti-money laundering (AML) controls and compliance with the Bank Secrecy Act (BSA).
FinCEN’s investigation highlighted several weaknesses in the bank’s AML programme, including gaps in transaction monitoring, customer due diligence and suspicious activity reporting. The major deficiencies identified by the regulator are listed below:
Transaction monitoring system
One of the most significant findings concerned Bank of America’s proprietary transaction monitoring system, known as Event Processor (EP), which served as the bank’s primary mechanism for identifying potentially suspicious activity. The system relied on assigning weighted risk scores to transaction alerts and combining them into customer-level groups. An investigation was initiated only when the cumulative score reached a threshold of 20 points. However, FinCEN found that the threshold and underlying risk-weighting were not adequately aligned with the bank’s actual money laundering risks.
FinCEN also found that the bank relied heavily on external referrals and manual processes to identify suspicious activity. For several years, more than one-third of its suspicious activity investigations were triggered by external events, including law enforcement inquiries, subpoenas and referrals from other financial institutions, rather than its own automated monitoring controls.
Testing
The investigation also identified shortcomings in the bank’s independent testing function, which failed to adequately assess the effectiveness of its transaction monitoring system. Internal testing reports had identified inconsistencies between the risk weights assigned to certain transaction alerts and their corresponding SAR yields. Despite these findings, the bank failed to make meaningful adjustments to the underlying risk weights. In some instances, testing reports identified weaknesses but recommended changes that did not address the most significant issues.
Customer Due Diligence
FinCEN found that Bank of America failed to adequately understand the nature and purpose of certain high-risk customer relationships and did not incorporate material risk indicators into their customer risk profiles. Its Dynamic Risk Rating process was another area of concern. In certain instances, customer risk ratings increased only after the bank received law enforcement subpoenas or other external inquiries.
FinCEN also identified failures in Bank of America's due diligence programme for correspondent accounts maintained for foreign financial institutions, including its own foreign branches and affiliates. In several instances, due diligence files contained broad descriptions such as treasury services or cash management without providing sufficient information to assess the actual risks associated with the accounts. The investigation also found that certain foreign branch risk assessments were several years old and did not specifically address correspondent account activity or expected transaction volumes.
Chinese money laundering network (CMLN)
FinCEN identified hundreds of millions of dollars in transactions indicative of CMLN activity and potential Trade Based Money Laundering (TBML), including high volumes of back-to-back credit card purchases. Despite these multiple indicators of suspicious activity, Bank of America failed to identify and report the transactions promptly. Notably, many of the suspicious transactions continued even after the bank had introduced certain enhancements to its Event Processor (EP) monitoring thresholds.
SAR delay
Following the bank's decision to reduce the Event Processor (EP) investigative threshold from 20 points to either 10 or 12 points, depending on the applicable criteria, it conducted a limited, one-time review of Event Groups that had previously fallen below the original threshold but met the revised scoring requirements.
This review resulted in the filing of more than 8,000 Suspicious Activity Reports (SARs), covering approximately $3.96 billion in previously unreported suspicious transactions. Among these, 34 SARs involved significant money laundering indicators, including potential trade-based money laundering (TBML) involving commingled funds and counterparties in high-risk jurisdictions.
FinCEN's consent order requires Bank of America to pay a $1.2 billion civil money penalty, with a $750 million credit for the penalty paid to the Office of the Comptroller of the Currency, leaving $450 million payable to the U.S. Department of the Treasury within ten days of the order's effective date. The deficiencies identified by FinCEN reflect gaps in Bank of America's AML compliance framework, particularly in transaction monitoring, independent testing, customer due diligence and timely suspicious activity reporting. The bank's reliance on external referrals, inadequate risk assessments and failure to act on internal testing results affected the effectiveness of its financial crime controls. Thus, compliance must be embedded into an institution’s day to day operations, with clear accountability and a proactive approach to managing risks specific to the entity.
Source: FinCEN consent order, 13 October 2026
