1. A record bill for the country's second-largest bank
On 13 October, three arms of the US government came down on Bank of America on the same day. FinCEN, the Treasury's financial intelligence unit, imposed a $1.2 billion penalty for violations of the Bank Secrecy Act, the US anti-money laundering law. The Office of the Comptroller of the Currency (OCC), which supervises national banks, added $750 million, the largest penalty in its 163 years, credited against FinCEN's. OFAC, which enforces sanctions, settled 475 apparent violations for $11.6 million. In total, the bank pays more than $1.21 billion.
The bank admits that it "willfully" violated the Bank Secrecy Act, in the civil sense of the term, where reckless disregard is enough. It failed to maintain an effective anti-money laundering programme, to carry out due diligence on correspondent accounts of foreign financial institutions, and to report suspicious activity. Over the period from 1 January 2018 to 1 July 2025, more than $5 billion of suspicious activity was not reported, or reported late, including roughly $1 billion tied to national security and other priority risks, FinCEN says.
The amount puts Bank of America third in FinCEN's history, behind the crypto exchange Binance and TD Bank. But unlike those two cases, there is no criminal case from the Justice Department, CNN notes.
2. A machine tuned to see less
The heart of the case is a piece of software. Bank of America's transaction monitoring system, called the "Event Processor", scored groups of transactions and sent to investigators only those that reached 20 points. According to FinCEN's consent order, that threshold was "initially set by stakeholder judgment", not by testing. Groups that scored just below it, between 16 and 19 points, still led to a suspicious activity report in generally 38% to 45% of cases in 2022 and early 2023. Some risk factors were badly weighted: large cash deposits at ATMs counted for a single point, although they led to a report in nearly 57% of cases.
The bank knew what fixing it would cost. A correct threshold would have added 16,000 investigations a month in the United States, "double" the previous volume, and required an "incremental 750" staff. A 2024 lookback found that the system had missed nearly 8,900 suspicious activity reports, on activity worth nearly $4 billion. FinCEN concludes that the bank "prioritized the revenue associated with these customer relationships" and "had likely saved hundreds of millions of dollars in compliance-related expenditures".
Instead, the bank relied on others. More than one third of its investigations were triggered by law enforcement requests, subpoenas, alerts from other banks or manual referrals, the order says. The Treasury puts it bluntly: the bank "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations."
3. The salvaged-car trail
The most striking pages of the order describe not cartels, but a business few would associate with money laundering: salvaged vehicles. The order itself notes that used-vehicle transactions "have repeatedly been publicly linked" to trade-based money laundering and terrorist financing networks, citing FinCEN's 2011 action against Lebanese Canadian Bank.
Customer A, an online marketplace for salvaged cars, relied on "money orders from unknown purchasers". Between late 2021 and mid-2022, its transaction volume rose by "upwards of $1.7 billion" involving jurisdictions bordering Russia, and it received about 290 wires from Belarus in August 2022 alone. Its account generated more than 100 investigations between 2020 and August 2022, about 90% of them related to fraud. In 2022, compliance recommended closing the relationship. The relationship team described the customer as "a large and valued client", and the recommendation was withdrawn in March 2023. Between September 2022 and May 2025, roughly 72,000 groups of suspicious deposits were processed for Customer A without being reported on time.
The money orders tell the same story. Customers A and B received more than 680,000money-order transactions between October 2020 and May 2025, forming about 220,000 groups of suspicious deposits worth more than $660 million. Roughly one in three of those groups was bought at locations with a southwest border nexus. Elsewhere, the order says the bank failed to report suspicious money-order deposits totalling over $600 million.
4. The shadow of Chinese money laundering networks
The Treasury also cites transactions "indicative of Chinese Money Laundering Networks", with a substantial nexus to the southwest border. The order describes "hundreds of millions of dollars" of such activity, through customers presenting themselves as logistics or electronics firms, with back-to-back credit card purchases, wires to China marked "for goods" and counterparties operating from residential addresses.
FinCEN calls these networks "one of the most significant money laundering threat actors facing the U.S. financial system". In an advisory of August 2025, FinCEN described how they serve Mexican cartels without moving the cash across the border: a "mirror transaction" in which dollars stay in the United States and pesos are paid in Mexico. In five years of reports, from 2020 to 2024, FinCEN counted 137,153 filings on potential activity by these networks, covering about $312 billion of suspicious activity.
Caution is needed, however. The order does not establish that the funds that went through Bank of America were cartel proceeds, and even an International Business Times article headlined on "potential cartel money" notes that regulators did not establish that all the transactions involved criminal proceeds or identify specific cartels. What the regulators established is that the bank failed to look closely enough, and to report in time.
5. Payments through blocked Russian banks
OFAC's part of the case is smaller in money but telling. Between February 2022 and March 2025, Bank of America processed 403 payments worth $14.34 million through 35 blocked banks, 32 of them under Russian sanctions, through correspondent banking, which the Treasury attributes to "technical and human error". Three sanctioned individuals made 31 transactions although their names and dates of birth were exact matches with the sanctions list. OFAC found the case non-egregious but noted that most violations were not voluntarily disclosed, that the bank had received earlier cautionary letters for similar conduct, and that its disclosures were "piecemeal or incomplete". It gave no reduction.
6. Two years of warnings
None of this came as a surprise to the supervisors. In December 2024, the OCC had already ordered the bank to fix a "systemic failure" in its transaction monitoring thresholds, without a fine. According to the OCC, the bank then "did not complete many of the significant steps needed" and kept failing to escalate potentially suspicious activity to investigators more than a year later.
The bank must now hire a third party to find and report the suspicious transactions it missed, and undergo independent reviews of its monitoring, customer due diligence, foreign correspondent accounts and data governance. Unlike TD Bank in 2024, it faces no cap on its growth. "No, there is no asset cap here," said chief financial officer Alastair Borthwick.
7. The market's verdict
The charge, $1.2 billion and not tax-deductible, cut 17 cents from earnings per share in the third quarter. Net income fell to $6.9 billion, from $8.3 billion a year earlier, according to the bank's filing. On 14 October, the shares fell as much as 8.7% during the day before closing down 4.76%, also hit by weaker trading revenue. Chief executive Brian Moynihankept it short with analysts.
He added that remediation cost "a couple hundred million dollars plus" this quarter and involved "thousands of people". The bank says it has "invested billions of dollars in technology and dedicated thousands of employees to combat financial crime".
8. Le Détroit's reading
The Bank of America case follows a now familiar pattern. At TD Bank in 2024, US prosecutors described a "flat cost paradigm": a mandate from senior executives that budgets, compliance included, should not increase from year to year. At American Express, fined $350 million by the OCC on 8 October, about $13 billion of suspected trade-based laundering went inadequately monitored for nearly eleven years, while its risk assessment focused on its narrow deposit business rather than its dominant card business. At Bank of America, a threshold set by judgment and never fixed kept the workload, and the bill, under control.
In each case, the core failure lies less in individual misconduct than in a design choice: how much to look, and how much to spend looking. At Bank of America, the bank leaned on outsiders, from police to other banks, to catch what its own systems let through. For a bank that processes trillions of dollars, a 20-point threshold is not a technical detail. It is where the system decides what it does not want to see.
