The US Treasury Department fined Bank of America $1.21 billion for systemic failures in anti-money laundering (AML) and sanctions compliance — the third-largest penalty in Treasury history. The enforcement action centers on what regulators describe as wholesale outsourcing of the bank's detection and reporting obligations to third parties, allowing over $5 billion in suspicious transactions to go unreported to the Financial Crimes Enforcement Network (FinCEN). The violations aren't abstract. FinCEN specifically flagged failures to mitigate "priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border." The bank's suspicious activity reporting and customer due diligence processes were found to be structurally deficient — not a one-off lapse, but an institutional pattern of underinvestment in compliance relative to the bank's scale and exposure. Three separate enforcement bodies piled on. FinCEN assessed the headline $1.2 billion. The Office of the Comptroller of the Currency (OCC) levied a $750 million fine — the largest in its own history — for the bank's "deficient and ineffective" AML compliance programme. FinCEN's penalty includes credit for the OCC amount. Separately, the Office of Foreign Assets Control (OFAC) settled 475 apparent violations across sanctions programmes covering Iran, Russia, narcotics, and global terrorism for $11.6 million. Treasury Secretary Scott Bessent framed the action as systemic risk management: "When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks." The message is calibrated — too-big-to-fail banks are not too big to fine. Bank of America's response follows the standard playbook: acknowledge seriousness, cite billions already spent on compliance technology and thousands of dedicated employees, and promise remediation. The OFAC settlement includes forward-looking compliance commitments around training, testing, audit, and future cooperation. Whether these commitments produce structural change or merely more paperwork remains the open question. The economics tell the real story. Bank of America reported $26.5 billion in net income in 2024. A $1.2 billion fine represents roughly 4.5% of annual profit — painful but survivable. The $5 billion in unreported suspicious transactions dwarfs the penalty. The fine-to-failure ratio still favors noncompliance at the margin, which is why the same pattern repeats across megabanks every few years. The enforcement action is real and the numbers are large. But until penalties approach the scale of profit generated by lax compliance — or until individual executives face personal consequences — the incentive structure remains tilted toward underinvestment in detection. The fine is a cost of doing business, not a structural reform.
