The existence of policies and procedures does not absolve a business of its responsibility to implement them, monitor their effectiveness and ensure they are incorporated into its day-to-day operations. Compliance is not achieved simply by having the right provisions on paper; it requires consistent action.

This distinction is illustrated by the enforcement actions against Bank of America announced by the U.S. Department of the Treasury on 13 October 2026. The actions, which exceeded $1.21 billion, addressed significant anti-money laundering (AML) and sanctions compliance failures, including delays in reporting suspicious transactions, weaknesses in transaction monitoring, deficiencies in customer due diligence and shortcomings in sanctions screening. The case demonstrates that regulatory compliance is not measured solely by the existence of policies, systems or dedicated compliance teams, but by whether those arrangements operate effectively, respond to emerging risks and produce timely, defensible outcomes.

The Regulatory Findings

The U.S. Department of the Treasury identified deficiencies in Bank of America’s systems for detecting suspicious transactions and reporting them to the Financial Crimes Enforcement Network (FinCEN). More than $5 billion in suspicious transactions was not reported in a timely manner, including over $1 billion linked to national-security-related and illicit-finance risks. The finding also identified weaknesses in customer due diligence, foreign correspondent account due diligence and transaction monitoring. Suspicious activity accumulated without timely investigation, even though internal testing had already flagged significant deficiencies. Concerns raised by compliance staff about red flags — including payments from unknown third parties, possible trade-based money laundering and fraud — were not addressed adequately or promptly.

The findings detailed in the Treasury’s enforcement announcement and the Office of the Comptroller of the Currency’s enforcement notice point to weaknesses not only in detecting suspicious activity but also in responding effectively to identified risks. These failures compound one another. Weak due diligence limits an institution’s understanding of the parties it monitors, ineffective monitoring can allow unusual activity to go undetected, and delayed investigations reduce the value of reports to law enforcement.

FinCEN assessed a $1.2 billion penalty, against which the OCC’s $750 million civil penalty is credited as explained in the OCC’s enforcement announcement. Separately, the Office of Foreign Assets Control (OFAC) reached an approximately $11.66 million settlement concerning 475 apparent sanctions violations. The violations involved payments processed through blocked banks, poor prioritisation of screening alerts involving potential matches to blocked persons, delays in updating watchlists after new sanctions designations, and errors in handling accounts associated with blocked persons.

The bank must also conduct a retrospective review with third-party involvement to identify previously undetected suspicious transactions and report them to FinCEN. It must also commission independent reviews of transaction monitoring, customer due diligence, foreign correspondent-account due diligence and data governance. The significance lies not only in the fines but in the scrutiny and remediation imposed, and the need for management to demonstrate effective oversight.

Compliance Lessons

The Bank of America enforcement action offers several practical lessons for institutions seeking to strengthen their AML and sanctions compliance programmes. These are consistent with the U.S. Department of the Treasury’s compliance considerations:

• External referrals cannot replace internal controls: The bank relied heavily on law-enforcement inquiries and referrals from other institutions to spot suspicious activity. While such information can be useful, institutions must detect suspicious patterns themselves through risk-based monitoring, prompt alert investigation, appropriate escalation thresholds and documented reporting decisions.
• Customer due diligence must be continuous and risk-based: It is not a one-time onboarding exercise. Institutions should maintain reliable identification, beneficial ownership information, understand expected transaction behaviour, conduct ongoing monitoring and review customer information promptly when red flags arise. Onboarding data should also be kept current to support effective monitoring.
• Sanctions screening must work across the transaction lifecycle: A system is only as good as its data, configuration, alert handling and speed in applying new designations. Regular testing should establish whether screening identifies relevant risks and whether staff respond appropriately to alerts.
• Management must act on internal warnings: Boards and senior management need meaningful reporting on alert backlogs, reporting delays, audit findings, staffing gaps and remediation progress, with clear ownership and deadlines. A corrective-action plan is not complete because a policy was revised or a system upgraded; effectiveness must be tested and evidenced.
• Evidence of compliance matters as much as the control: Institutions should maintain records of alerts, investigation outcomes, customer reviews, screening decisions, suspicious transaction reports, escalations and remediation. Reliable, complete and integrated data underpins all of this and enables institutions to demonstrate that their controls are operating as intended.

Conclusion

Although the action arose under U.S. law, the issues are relevant to every institution subject to AML/CFT, sanctions, due diligence and reporting requirements. Institutions should assess whether their controls are proportionate to risk and effective in practice, covering due diligence quality, beneficial ownership, monitoring, screening, suspicious transaction reporting, staff competence, recordkeeping and independent testing. Repeated alerts, unresolved audit findings and delayed remediation should trigger escalation rather than become routine. However, specific obligations depend on the sector and regulatory status of each institution; the Bank of America case should therefore be treated as a compliance case study, not as a statement of the law in every particular jurisdiction.

The case also underscores the importance of translating compliance requirements into demonstrable results. Financial institutions should ensure that control deficiencies are identified, escalated and resolved promptly, with senior management accountable for effective remediation.

Sources:

• U.S. Department of the Treasury, “U.S. Treasury Announces Record Enforcement Actions Against Bank of America” (13 October 2026)
• Office of the Comptroller of the Currency, “OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance” (13 October 2026)
• Office of Foreign Assets Control, Settlement Agreement with Bank of America, N.A. (13 October 2026)

By:
JIN Legal & Compliance Consultants
Address: 4 Boke Close, Wuse 2, Abuja, Nigeria
Email: jinlegalcompliance@gmail.com | info@jinlegalcompliance.org
Phone: +234-9168-961-183
Website: jinlegalcompliance.org
LinkedIn: Jin Legal Compliance & Consultants