Bank of America $1.2 Billion Fine: Lessons for AML Teams

On October 13, 2026, the Financial Crimes Enforcement Network (FinCEN) imposed the Bank of America $1.2 billion fine after the bank admitted willful Bank Secrecy Act violations. Regulators found deficient transaction monitoring, customer due diligence, and correspondent-account controls, and over $5 billion in suspicious transactions not reported on time.

The most instructive detail sits in the bank's own testing. According to FinCEN's Consent Order, alert groups scoring just below Bank of America's investigation threshold produced SARs at least as often as groups above it for years, and the threshold stayed in place until regulators pressed for change. A control can look acceptable by its own metrics while billions in reportable activity sit outside them, and the same measurement problem applies to crypto exposure.

In this article, we break down how the penalties fit together, what regulators found, how to read the $5 billion figure, and what our benchmark of 99 crypto exchanges adds to the picture.

How the Bank of America Fines Fit Together

Treasury announced three coordinated actions on October 13. Because the OCC's record $750 million penalty is credited within FinCEN's $1.2 billion, the Bank of America AML fine package totals just over $1.21 billion. FinCEN's penalty is the third-largest in Treasury history, after Binance in 2023 and TD Bank in 2024.

Each action addresses a different part of the same compliance program:

The detailed findings sit in FinCEN's Consent Order, which covers conduct from January 2018 through July 2025 and attributes the internal control failures primarily to one system: the bank's proprietary transaction monitoring engine.

What Regulators Found in Bank of America's AML Program

That system sits at the center of five failures named by Treasury, the OCC, and OFAC:

• Transaction monitoring gaps: trillions of dollars were not properly monitored, producing late SARs on billions (OCC).

• Outsourced detection: outside inquiries did much of the bank's detection work (Treasury).

• Failed escalation: suspicious activity still was not reaching investigators more than a year after the 2024 order (OCC).

• Weak customer due diligence: heavy reliance on unknown third-party payments went unaddressed despite staff escalations (Treasury).

• Sanctions screening breakdowns: blocked-bank payments, poor alert calibration, and late watchlist updates led to the Bank of America sanctions violations (OFAC).

The OCC also found that BSA staff lacked sufficient expertise and training, and that the audit function missed problems examiners later uncovered.

How the Monitoring Threshold Kept Activity From Investigators

The Consent Order shows how the first three failures connected. Event Processor, the bank's monitoring engine, scored alerts, grouped them by customer, and opened a case only when a group reached 20 points within 13 months. The bank set that threshold by "stakeholder judgment," and its own testing repeatedly contradicted it:

• Testing in 2022 and early 2023 found SAR yields of 38% to 45% for groups scoring 16 to 19 points, above the 33% to 34% measured earlier at or just above the threshold.

• A 2022 test showed an alternative threshold would catch far more of those SARs; the bank kept the existing one, citing case volume.

• Rescoring rules zeroed out certain alerts across about 150,000 active event groups before their removal in December 2023.

With reportable activity held below the line, the bank came to depend on outside triggers. For several years, more than a third of its cases started from subpoenas, seizure warrants, referrals, and similar events, peaking near 50% in 2023.

How Due Diligence and Sanctions Controls Missed Known Risks

The CDD findings show the same problem at the level of a single relationship. By August 2022, compliance staff had linked an online auto auction customer to more than 100 AML cases since 2020, about 90% of them fraud-related, and recommended closing its accounts. The relationship team described it as "a large and valued client," and in March 2023 compliance withdrew the recommendation in favor of a mitigation plan. The customer kept accepting third-party payments, the main concern, until June 2025.

Sanctions controls failed on calibration as well. OFAC found that alerts on exact name and date-of-birth matches to blocked persons were not prioritized, so designated individuals could make payments and withdraw funds. Our guide to sanctions screening for banks covers alert prioritization, and Global Ledger's sanctions screening solution applies it to crypto transactions and counterparties in real time.

What $5 Billion in Missed Suspicious Activity Means for Risk Assessment

Together, the AML failures produced the case's central figure: more than $5 billion in suspicious activity that Bank of America failed to report on time. Regulators made no finding that the full amount was laundered, so reading the Bank of America money laundering fine as a $5 billion laundering case misstates it. More than $1 billion of the activity involved priority risks, including Chinese money laundering networks, fraud, and potential trade-based money laundering with a nexus to the southwest border.

Specific typologies sit behind the figure. Online auto auction customers deposited groups of three sequential money orders totaling $2,900 to $3,000, just under the $3,000 level at which issuers must identify cash buyers. FinCEN counted over $660 million of these deposits between October 2020 and May 2025, while the bank's monitoring covered such deposits only to a limited extent.

For risk assessment, the more useful number is one the bank produced itself. It had no false-negative tolerance until December 2023. After it lowered its thresholds, a 2024 lookback found nearly 8,900 SARs it had failed to file, covering almost $4 billion in activity.

What the Bank of America Case Teaches Any AML Program

None of these failures depends on Bank of America's proprietary software. Each points to a control that any institution can test in its own program before an examiner does:

These tests hold for any institution. What changes is the environment they operate in once crypto enters the picture, whether through a bank's crypto clients, a payment company's stablecoin flows, or an exchange's own deposits.

Applying the Same Lessons When Crypto Is Involved

Crypto activity makes several of these controls harder to run: funds move faster, risk arrives through more intermediaries, and screening covers more identifiers. One part becomes easier, because every transfer is recorded on-chain.

Alert Calibration Under Time Pressure

At Bank of America, reportable activity could wait months before review. Crypto leaves far less time. Global Ledger's Laundering Speed report found that once funds from a hacker-controlled address reach a virtual asset service provider (VASP), compliance teams typically have a 10- to 15-minute window to act. A threshold that holds activity back for later review costs more here, which makes below-threshold testing even more important.

Unknown Third Parties Become Intermediary Wallets

Bank of America's CDD failed where customers relied on payments from third parties the bank could not see. In crypto, the equivalent is indirect exposure: risky funds reach a customer or platform through intermediary wallets. The trail is recorded on-chain, so the source can be traced, but it is getting longer. In our High-Risk Benchmark report, average exposure depth rose from 1.51 blockchain hops in 2021 to 2.78 by 2023, then stayed broadly stable.

Global Ledger KYT combines real-time risk scores, source and use of funds data, and direct and indirect exposure for each monitored transaction.

Sanctions Screening Extends to Wallets and Services

OFAC faulted Bank of America for late watchlist updates and unprioritized exact matches. In crypto, screening also has to cover wallet addresses, services, and exposure that arrives several hops away from a designated entity, so the same calibration and update discipline applies to a wider set of identifiers.

Our guide to crypto sanctions screening explains how to separate direct, ownership, and indirect exposure.

The Scale Problem in Crypto Exposure

At Bank of America, more than $5 billion in missed activity sat inside trillions of dollars of monitored transactions. Crypto exposure data shows a similar gap between share and scale. Our High-Risk Benchmark analyzed $36.28 trillion in inflows and outflows at 99 centralized exchanges (CEXs) between 2021 and 2025, covering BTC, ETH, and USDT on Tron, traced exposure within five blockchain hops, and measured it against each exchange's liquidity:

A benchmark average risky inflow share of 0.68% sits alongside $90.55 billion in risky inflows, and 41.3% of those inflows reached a single exchange. With exchange-level rates up to 24.78%, a counterparty review needs the individual exchange's figures rather than the market average. The risk mix also changed: fraud and hacks led risky inflows in 2021, while other categories had begun to dominate by 2025.

These figures measure on-chain proximity to attributed high-risk entities, not knowing participation in illicit activity, and the five-hop limit is the study's scope rather than a monitoring threshold. They also cannot be ranked against the Bank of America figures, which measure a different thing over a different period.

For counterparty reviews, Global Ledger's KYB solution provides entity exposure reports covering source and destination of funds.

Final Thoughts

The Bank of America $1.2 billion fine shows how a large compliance program can monitor trillions of dollars, test itself regularly, and still miss billions in reportable activity. The lessons apply to any institution, and they become more demanding where crypto is involved: funds move faster, risk arrives through more intermediaries, and a low average exposure share can still stand for billions of dollars.

FAQ