U.S. Treasury agencies say Bank of America must pay more than $1.21 billion in penalties for breaking anti-money-laundering and sanctions laws, in actions that, the Treasury says, include “the third-largest penalty in Treasury history and the largest in the Office of the Comptroller of the Currency (OCC) history.” The Treasury announced the package on Tuesday, October 13, and CNBC, CNN, Reuters and The Wall Street Journal reported it the same afternoon. Three pieces make up the total, according to the regulators’ own documents: a $1.2 billion civil money penalty from FinCEN, the Treasury’s financial-crimes unit; a $750 million penalty from the OCC, which FinCEN credits against its own fine; and an $11,662,930 settlement with OFAC, the Treasury’s sanctions office. The Treasury calls Bank of America “the second-largest bank in the United States.” The bank, in a statement carried by Reuters, CNN and CNBC, says it has spent heavily on compliance and that the penalty will hit the third-quarter results it reports on Wednesday.

FinCEN’s consent order says the conduct ran “from at least January 1, 2018 through July 1, 2025.” The order says Bank of America “admits to the Statement of Facts and Violations,” and the Treasury release says the bank “admits that it willfully violated the BSA” — the Bank Secrecy Act — by failing to run a compliant anti-money-laundering program, to vet correspondent accounts for foreign financial institutions and to file suspicious activity reports, or SARs. The order adds that the bank admits willfulness “only as the term is used in civil enforcement” of the law. Per the Treasury, the bank failed to report on time “over $5 billion dollars in suspicious transactions,” with “over $1 billion” of that activity implicating national-security and other priority risks, including activity the Treasury links to Chinese money-laundering networks, fraud and potential trade-based money laundering near the southwest border. The FinCEN order itself puts that slice at “roughly $1 billion,” and Reuters writes “$1 billion”; this desk reports all three wordings.

The Treasury also sets out its account of how the failures happened. It says that as problems arose, the bank “prioritized its revenues and minimized the impact on its required compliance resources,” and that leaning on law-enforcement inquiries and other banks’ requests meant the bank “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.” The Treasury also says the bank failed to respond to “mounting red flags” among some customers, “including potential ties to narcotics trafficking proceeds,” even after compliance staff escalated concerns. FinCEN’s order adds that a 2024 one-time lookback under revised thresholds found the bank “had failed to identify and file nearly 8,900 SARs, with transaction activity totaling nearly $4 billion.” Under the consent order, the Treasury says, the bank must work with a third party on a lookback for missed suspicious transactions and undergo independent reviews focused on three priority risks: the southwest border, cartels and potential narcotics trafficking; Iran; and Russia.

The OCC, which supervises national banks, says its $750 million civil money penalty answers violations of the Bank Secrecy Act and that the bank’s compliance program “has been deficient and ineffective.” It says that “more than a year after the 2024 Order, the bank still failed to escalate potentially suspicious activities to investigators for review.” Comptroller of the Currency Jonathan V. Gould says in the OCC release: “The bank’s poor response to its BSA deficiencies is unacceptable. The second largest bank’s egregious and continued BSA violations warrant the OCC imposing its largest CMP ever assessed against a bank.” The OCC’s order, docket AA-ENF-2026-41 and digitally signed October 13, also says that between November 2021 and October 2024 the bank sent about 33,300 outgoing wires, totaling about $1 billion, with inaccurate sender (“transmittor”) information. The OCC release says its penalty “will be paid to the U.S. Treasury”; CNN instead writes that “$750 million will go to the Office of the Comptroller of the Currency (OCC) as a civil penalty.” This desk follows the OCC’s own wording.

OFAC’s enforcement release says Bank of America agreed to pay $11,662,930 for 475 apparent violations of sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism, with a total value of about $14,834,082, between September 18, 2021, and April 24, 2025. OFAC says the bank processed payments involving blocked banks, “failed to appropriately prioritize alerts” for customers who exactly matched blocked persons’ names and dates of birth, failed to update watchlists promptly and mishandled two business accounts tied to blocked persons. OFAC judged the apparent violations “non-egregious but largely not voluntarily self-disclosed,” and the settlement carries no reduction for remedial measures or cooperation, it says. Reuters writes “over 400 apparent violations,” and FinCEN’s consent order rounds the OFAC figure to “an $11,000,000 penalty”; this desk uses OFAC’s own count and amount.

Bank of America answered in a statement. “Financial crime compliance is serious, and we are responsible for getting it right,” a spokesperson said, according to Reuters and CNBC, which names the spokesperson as Christa Robinson. “We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators,” the spokesperson added, per Reuters and CNN. The bank says its third-quarter results will include a $1.2 billion non-tax-deductible charge that cuts net income by about 17 cents a share, Reuters, CNN and CNBC report; CNN quotes the bank saying remediation costs already sit “in the current expense base.” Outlets give different after-hours share moves: Reuters says shares fell 2.7% after closing the day down 1.1%, CNN says the stock fell “more than 2.5%,” and CNBC says it fell “about 2%.” Reuters quotes UBS analyst Erika Najarian: “we think shares likely underperforming at open.” Reuters adds that she noted no asset cap came with the penalties.

Outlets add context the regulators’ releases do not carry. CNN writes that the $1.2 billion fine ranks third among FinCEN penalties, after a $3.4 billion fine against Binance in 2023 and a $1.3 billion penalty against TD Bank in 2024, and that no Justice Department action accompanies the Bank of America fine. Reuters says the fine comes days after American Express took a $350 million penalty for similar anti-money-laundering shortcomings; this desk did not check that case. CNBC says CEO Brian Moynihan plans to appear on its Squawk on the Street at 10:20 a.m. ET on Wednesday after the earnings report. Treasury Secretary Scott Bessent says in the Treasury release: “Today’s actions send a clear message that even the biggest financial institutions are not above the law.” Dennis Kelleher, CEO of the advocacy group Better Markets, said in a statement CNN quotes that the fine looks small next to the bank’s revenue, adding: “Banks don’t break laws; people do, and until those people – including most importantly executives and supervisors – are personally and meaningfully punished by firings, prosecution, fines and being barred from employment in the industry, these crimes are not going to be stopped.” This desk read the Treasury, OCC and OFAC releases and the FinCEN and OCC orders; it could not open AP’s report (403) or the full Wall Street Journal text (paywall), and Bank of America’s earnings release had not come out as of this writing.

Correction · Oct 14, 2026, 1:06 AM PT: An earlier version of the Evidence status said CNN and CNBC both frame the $1.2 billion FinCEN penalty as the third-largest in FinCEN’s own history. CNN does; CNBC instead writes that FinCEN said the penalty ranks as “the third-largest in Treasury history,” matching the Treasury release. The Evidence status now credits each wording to its own outlet.