Bank of America has been fined $1.21 billion by US regulators for widespread failures to identify and report potentially illicit financial activity, exposing the lender to a significant earnings hit and renewed investor scrutiny over its compliance systems, operating costs and capital returns.
The penalty, which the US Treasury Department described as the third-largest in its history, stems from the bank’s failure to report more than $5 billion in suspicious activity to authorities, including $1 billion associated with national security-related and other priority illicit-finance risks. Regulators said the shortcomings extended across its anti-money-laundering controls and transaction-monitoring systems, raising concerns about the bank’s ability to detect potentially criminal activity without relying on outside intervention.
The enforcement action arrives at a sensitive time for Bank of America, which was due to report third-quarter earnings on Wednesday. The bank said the fine would result in a non-tax-deductible charge of approximately $1.2 billion, reducing quarterly net income by about 17 cents per share.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
The penalty could complicate the market’s assessment of the bank’s underlying profitability, particularly as investors weigh regulatory expenses against its capacity to sustain substantial shareholder distributions. Shares fell 2.7% in after-hours trading after closing Tuesday’s session down 1.1%.
Treasury Secretary Scott Bessent said the bank’s failures had consequences beyond its own operations because financial institutions play a central role in protecting the US financial system against illicit finance.
“Financial institutions are on the front lines of protecting our economic and national security,” Bessent said in a statement. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks.”
The Treasury also accused the bank of prioritizing revenue when developing its compliance programmes and relying excessively on inquiries from external parties, including law enforcement agencies and other financial institutions, instead of sufficiently effective internal controls.
Bank of America said it had invested billions of dollars in technology and deployed thousands of employees to combat financial crime. A spokesperson said the bank was committed to completing the work required to address the issues identified by regulators.
“Financial crime compliance is serious, and we are responsible for getting it right,” the spokesperson said.
The Office of the Comptroller of the Currency (OCC) imposed a $750 million civil penalty, the largest ever issued by the regulator, citing the bank’s failure to address deficiencies in its anti-money-laundering programmes.
The OCC said the shortcomings had been identified in a 2024 cease-and-desist order but were not adequately resolved. It described the bank’s compliance programme as “deficient and ineffective” and said weaknesses in its transaction-monitoring system had delayed the filing of suspicious activity reports covering billions of dollars in transactions.
The findings are concerning because banks are expected to identify and report suspicious transactions through their own monitoring and compliance systems. These controls are intended to help authorities investigate potential money laundering, fraud, sanctions evasion, and other financial crimes.
The Treasury’s criticism that Bank of America relied too heavily on information from external parties points to a broader concern about how the lender’s internal systems identified risks. External alerts can supplement a bank’s monitoring processes, but they are not a substitute for controls capable of independently flagging unusual transactions and escalating them for investigation.
Under the consent order, Bank of America must hire an independent third party to review historical transactions, identify suspicious activity that the bank failed to detect at the time, and report the transactions to the Financial Crimes Enforcement Network, known as FinCEN.
That requirement means the consequences may extend beyond the immediate financial penalty. Reviewing past transactions could require substantial investigative work, additional technology resources, and continued management attention as the bank seeks to demonstrate that its controls meet regulatory expectations.
The Treasury also disclosed a separate $11.6 million penalty imposed by the Office of Foreign Assets Control (OFAC) for more than 400 apparent violations of various sanctions programmes. The department said the bank mistakenly processed millions of dollars in payments that violated restrictions targeting countries including Russia and Iran.
The sanctions penalty adds a separate dimension to the enforcement action. Anti-money-laundering controls and sanctions screening address related but distinct risks: the former seeks to identify and report potentially illicit financial activity, while the latter is intended to prevent prohibited transactions involving sanctioned parties, jurisdictions or activities.
Together, the findings indicate that the bank’s compliance challenges involved both the detection of suspicious transactions and the processing of payments that allegedly breached sanctions requirements.
$1.2 Billion Charge Complicates Third-Quarter Earnings
Bank of America’s disclosure that the fine would reduce quarterly net income by approximately 17 cents per share provides investors with a clearer measure of the immediate financial impact.
Analysts surveyed by LSEG had estimated adjusted earnings of $1.10 per share, although that figure excluded exceptional items such as the penalty. The non-tax-deductible nature of the charge means the bank cannot offset it against taxable income, increasing the direct impact on reported results.
Investors will therefore need to distinguish between the bank’s operating performance and the one-off regulatory charge when assessing its third-quarter figures. At the same time, the size of the penalty makes it difficult to treat the matter as merely an accounting adjustment: the enforcement action also raises questions about the resources required to remediate compliance failures and prevent their recurrence.
UBS analyst Erika Najarian warned that the penalty could add to negative investor sentiment, increase concerns about expenses and prompt questions about the bank’s ability to maintain its roughly $6 billion quarterly share-buyback pace.
“We think shares likely underperforming at open,” Najarian said in a note ahead of the earnings release.
Her assessment highlights the potential tension between regulatory remediation and shareholder returns. Buybacks depend on the bank’s capital position, earnings outlook and management’s assessment of competing demands for cash. The fine does not automatically mean that the bank must reduce repurchases, but investors may scrutinize whether additional compliance spending or other regulatory consequences could affect future distributions.
Najarian also noted that the enforcement action did not include an asset cap, a regulatory measure that would restrict how large the bank could grow. The absence of such a restriction removes one potential constraint on expansion, although it does not eliminate the financial and operational burden of resolving the deficiencies.
The next question is whether the penalty represents a largely contained charge or the beginning of a more prolonged period of elevated compliance costs and regulatory scrutiny. The mandated independent review will require the bank to examine past transactions, while regulators will have an interest in whether its monitoring systems and reporting processes improve.
The Bank of America penalty comes days after American Express was hit with a $350 million penalty for similar anti-money-laundering shortcomings, reinforcing the regulatory focus on financial institutions’ ability to identify suspicious activity and maintain effective compliance systems.
The two enforcement actions place renewed attention on the cost of failures that may not be fully captured by a bank’s routine operating expenses. Financial-crime controls require ongoing investment in monitoring technology, data quality, investigations and personnel. When those systems fail, institutions can face not only fines but also expensive reviews of historical transactions, remediation programmes and reputational damage.
The scale of the penalty is consequential because it arrives alongside an earnings announcement and questions about shareholder distributions. The bank’s investments in technology and compliance personnel, cited in its response, will now be judged against regulators’ findings and the work required to correct the deficiencies.