Update, Oct. 16, 2026: Bank of America reported third-quarter 2026 results on Wednesday, Oct. 14. Net income was $6.9 billion, or $0.91 a share, down from $8.3 billion, or $1.04, a year earlier. Revenue rose 3% to $30.0 billion and net interest income rose 8% to $16.4 billion. The results include the regulatory settlement charge of $1.2 billion, or $0.17 a share; the bank’s adjusted figures, which exclude it and are not an official accounting measure, were net income of $8.1 billion and earnings of $1.08 a share. The bank’s earnings release says the charge accrues the civil money penalties under the OCC and FinCEN orders announced Oct. 13 (SEC Form 8-K filed Oct. 14).
Treasury announced Tuesday that its Financial Crimes Enforcement Network, known as FinCEN, assessed a $1.2 billion penalty against Bank of America for failing to detect and report suspicious activity, including suspicious transactions that FinCEN said were indicative of Chinese money laundering networks, a laundering method, and of trade-based laundering with a link to the southwest border. The $750 million fine from the Office of the Comptroller of the Currency, or OCC, is credited against it, so the bank is to pay $450 million to the Treasury under the FinCEN order. Yahoo Finance and Fox Business reported that the bank said its third-quarter results will include a non-tax-deductible charge of $1.2 billion, about 17 cents a share; Yahoo reported results were due Wednesday morning; they are in the update above.
How the three penalties fit together
Treasury announced three actions at once. FinCEN imposed a civil money penalty of $1.2 billion. The OCC, which regulates national banks, assessed a $750 million civil money penalty. The Treasury’s Office of Foreign Assets Control, or OFAC, which enforces sanctions, announced a settlement of $11.6 million.
The FinCEN and OCC amounts are not stacked. The consent order says “FinCEN is imposing a Civil Money Penalty of $1,200,000,000 in this matter.” It then says “FinCEN has agreed to credit against the Civil Money Penalty payment of $750,000,000 to the OCC.” The bank therefore “shall make payment of $450,000,000 to the Department of the Treasury” under the FinCEN order.
In plain numbers, $1.2 billion minus the $750 million credited for the OCC penalty leaves $450 million for FinCEN. Adding the OCC’s $750 million and OFAC’s $11.6 million to the $450 million FinCEN receives comes to about $1.21 billion, matching Treasury’s top-line figure of “more than $1.21 billion in penalties.”
Treasury said the actions include “the third-largest penalty in Treasury history” and “the largest in the Office of the Comptroller of the Currency (OCC) history.” Yahoo Finance reported that the larger Treasury penalties were Binance’s $3.4 billion in 2023 and TD Bank’s $1.3 billion in 2024. That ranking comes from Yahoo, not from Treasury’s release.
What the bank admitted
In the consent order, Bank of America admits the facts FinCEN set out and admits that it willfully violated the Bank Secrecy Act, the main U.S. anti-money-laundering law. The order defines “willfully” in the civil-enforcement sense: the government need only show reckless disregard or willful blindness, not that the bank knew its conduct broke the law or acted with bad purpose.
FinCEN found three violations. The bank did not maintain an anti-money-laundering program that met the law’s minimum requirements. It did not carry out proper due diligence on correspondent accounts (accounts one bank keeps with another to move money across borders) for foreign financial institutions, which in this case were accounts for its own foreign branches and affiliates. And it did not accurately and timely report suspicious transactions.
The conduct ran “at least January 1, 2018 through July 1, 2025,” with some facts earlier. FinCEN said the failures led to more than $5 billion of suspicious activity being missed or reported late, with about $1 billion of that involving national-security-related and other priority illicit-finance risks.
The violations FinCEN found concern detecting and reporting suspicious activity; the order does not charge the bank with moving the money itself.
What FinCEN weighed
In setting the penalty, FinCEN found the bank gained financially by under-spending on compliance. It said the bank had likely saved hundreds of millions of dollars in compliance-related expenditures over the period, noting that when the bank began remediating its monitoring system it estimated that case volumes would double and that it would need about 750 additional personnel. FinCEN gave the financial-gain factor greater weight, citing the duration and extent of the gain and the substantial savings in compliance expenditures; it also said the bank decided to retain high-risk, high-value customers despite recommendations to the contrary from compliance.
On the bank’s record, the order says Bank of America has no prior enforcement history with FinCEN. A bank affiliate was the subject of Securities and Exchange Commission actions in 2023 and 2026 for failing to file suspicious-activity reports, and the order says the 2026 action involved missed reports attributable to the same monitoring system.
On cooperation, FinCEN said its investigation was proactive and was not the result of voluntary disclosure by the bank. The bank made dozens of productions of materials in response to FinCEN’s requests, but they were often the subject of unreasonable delays. The order also says the bank undertook no proactive investigation of the historical activity of concern and failed to timely produce responsive materials to a set of FinCEN requests. FinCEN said the bank began to address certain deficiencies only after FinCEN began its investigation and after extensive engagement with its regulators.
For scale, the order describes the bank as the second largest in the United States, with roughly $2.7 trillion in total assets, approximately 211,000 personnel, over 3,500 branches and approximately 15,000 ATM locations in the United States, and net income of approximately $30.5 billion in its most recent annual disclosure.
What went wrong inside the monitoring system
FinCEN traced the core problem to the bank’s own transaction monitoring system, an in-house tool called the Event Processor, created in 2010. Individual alerts generally were not sent to an investigator for manual review. Instead the system scored alerts and grouped them by customer into what the bank called Event Groups.
Absent what the order calls auto-promotion, in which events outside the system, such as seizure warrants or a subpoena, automatically sent an Event Group to an investigator, an Event Group generally would not be sent for investigation until its combined score reached “a threshold score of 20 points.” That level was “initially set by stakeholder judgment,” and it stayed in place until December 2023. Alerts also expired: older ones were retired and stopped counting after 13 months.
FinCEN said testing showed the setup was missing real cases. In 2022 and early 2023, for example, groups that scored 16 to 19 points, just under the line, generally produced suspicious-activity reports between 38% and 45% of the time, the order says.
The order also says that for several years more than one-third of all the investigations the bank conducted in a given year were prompted by such external events, such as law enforcement requests and requests from other financial institutions, and by manual referrals, rather than by its own automated controls. Treasury’s release said the bank “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.”
After engagement with its regulators in December 2023, the bank lowered the 20-point threshold to 10 or 12 points depending on the characteristics of the Event Group, cut the time Event Groups remain open from 13 months to four, and introduced false-negative tolerance thresholds for the first time: 5% for management oversight and 7.5% for escalation to the Board. The order adds in a footnote that since 2026 the bank has replaced those false-negative thresholds with lower and more granular thresholds for activity relating to FinCEN’s national priorities and other criminal-related typologies, for activity over $500,000.
In 2024 the bank conducted a one-time look-back under the revised parameters and found it had failed to identify and file nearly 8,900 suspicious-activity reports covering nearly $4 billion in transactions; elsewhere the order gives over 8,000 reports and about $3.96 billion. A third-party review found the monitoring problems “remained unresolved” as recently as June 2025, according to the order.
The examples FinCEN gives
The order refers to customers only by letters and names none of them.
One example involves money orders, with customers A and B. Between October 2020 and May 2025, two business customers received more than 680,000 individual deposits in roughly 220,000 groups, totaling over $660 million. Elsewhere the order describes activity of “over $600 million.” FinCEN pointed to round-dollar amounts and sequential numbering, including repeated groups of money orders totaling between $2,900 and $3,000, just under the $3,000 level at which identification is required. For roughly one in three groups, the purchase locations had a link to the southwest border.
A second example involves wires, with customers A and C. FinCEN described about $1 billion in suspicious wire transfers that primarily involved Georgia, Belarus and other former Soviet states. Two customers accounted for more than $850 million of it. The order says the bulk of the reporting happened in June 2025, after FinCEN asked the bank for information.
A third involves credit cards and wires of the kind FinCEN associates with Chinese money laundering networks, a term that describes a laundering method, not any customer’s nationality. The order cites back-to-back card purchases at major retailers and shipping companies that did not fit customer profiles, and large wires to counterparties in China with generic descriptions.
In May 2022, the order says, bank compliance staff looked into reports that a website directing people to buy virtual currency told them to wire funds to one of Customer A’s accounts, which suggested the account may have been used to move the proceeds of an investment scam. The bank later determined that Customer A’s account had been compromised and that Customer A was not knowingly participating in the suspected scam. The order makes no such statement about other customers.
What the bank must do
The order requires the bank to hire independent consultants, at its own expense, with FinCEN able to veto the choices. One will review transactions from January 2022 forward to find suspicious activity that went unreported. Its final look-back report is due no later than December 2028, and the bank must file the resulting reports within 90 days after that.
Other consultants will review the effectiveness of suspicious-activity monitoring, customer due diligence, foreign correspondent due diligence and data governance. The order lists priority risks that include the southwest border, cartels and narcotics, Chinese money laundering networks, Iran and Russia.
The bank cannot treat the penalty as a tax deduction. The order does not release claims against individuals, and it says other agencies, including the Justice Department, are not precluded from acting.
What the OCC and OFAC added
Treasury’s release says the OCC’s penalty responded to violations of the Bank Secrecy Act, and that the bank’s monitoring system resulted in it “failing to properly monitor trillions of dollars in transactions.” It also says the bank knew for years it was failing to escalate potentially suspicious activity, and that its Bank Secrecy Act officer and staff “lacked sufficient skills and expertise.” The bank is also under a December 2024 OCC cease-and-desist order.
OFAC’s settlement covers apparent violations of numerous sanctions programs, including Iran, Russia, narcotics and global terrorism, according to Treasury. OFAC’s own page puts the settlement at $11,662,930 across 475 apparent violations, which it classified as non-egregious and largely not voluntarily self-disclosed; its program list also includes Belarus, Burma and Somalia. Treasury’s release gives $11.6 million, and the consent order lists $11,000,000 without explaining the differences.
What the bank said and how the market reacted
A bank spokesperson said financial crime compliance is serious and the bank is responsible for getting it right, and that it has invested billions of dollars in technology and thousands of employees, according to Yahoo Finance and Al Jazeera. Fox Business reported that the spokesperson acknowledged the violations, pointed to investment in technology and staff, and said the bank is working with regulators and continues to assist law enforcement.
Yahoo reported that shares fell more than 2% in after-hours trading Tuesday. It also reported that Wells Fargo analyst Mike Mayo called the episode a black eye for the bank and described the one-time charge as digestible.
Treasury Secretary Scott Bessent said “Financial institutions are on the front lines of protecting our economic and national security,” and that “even the biggest financial institutions are not above the law.”
What is not known
The order’s published copy leaves its effective date blank, so the due date for the payment is not fixed.
The bank’s statements have been reported through news outlets. Details of the OCC’s order come from Treasury’s description of it.
It is not known how many reports the look-back will produce, or whether the Justice Department, state regulators or shareholders will act.
What comes next
Bank of America is due to report third-quarter results Wednesday morning, when the $1.2 billion charge is expected to show up in its numbers. The payment is due within ten days of the order’s effective date. The look-back consultant’s scope report is due within 150 days of its engagement, and the final look-back report within eighteen months of the scope report and no later than December 2028.