The U.S. Treasury imposed more than $1.21 billion in penalties on Bank of America on Tuesday after the nation’s second-largest bank admitted willfully violating federal anti-money-laundering law and failing to report more than $5 billion in suspicious transactions.

The coordinated action includes a $1.2 billion Financial Crimes Enforcement Network penalty, which credits a $750 million Office of the Comptroller of the Currency assessment, plus an $11.6 million sanctions settlement. Treasury called the package the third-largest penalty in its history and the OCC’s largest ever. The Treasury release said more than $1 billion of the unreported activity implicated national-security or other priority illicit-finance risks; the Associated Press independently confirmed the size and historic ranking of the penalties.

Bank of America’s admission applies to the Bank Secrecy Act resolution with FinCEN. The separate sanctions case concerns 475 apparent violations that the Office of Foreign Assets Control classified as non-egregious and largely not voluntarily disclosed. That distinction matters: regulators documented serious and persistent control failures, but the public orders do not accuse the bank itself of committing the underlying drug trafficking, fraud or sanctions-evasion offenses that its systems were supposed to detect.

Regulators say warnings went unanswered

According to FinCEN, Bank of America failed to maintain a compliant anti-money-laundering program, perform required due diligence on correspondent accounts for foreign financial institutions and file required suspicious activity reports. The agency said the bank allowed alerts to remain uninvestigated for extended periods and depended heavily on law-enforcement inquiries and referrals from other financial institutions instead of its own automated controls.

The OCC reached a similar conclusion. Its enforcement release said the bank’s monitoring system failed to properly review trillions of dollars in transactions, producing large numbers of late reports involving billions of dollars. Regulators said key compliance personnel lacked appropriate training and internal audits failed to identify problems that examiners later found.

The findings are especially consequential because the bank was already operating under a December 2024 cease-and-desist order. Treasury said Bank of America still had not completed many of the required improvements more than a year later and continued to miss suspicious activity that should have been escalated to investigators.

National-security risks drove the case

Treasury said the unreported transactions included indicators associated with Chinese money-laundering networks, fraud and potential trade-based laundering tied to the Southwest border. Regulators also cited red flags involving possible narcotics-trafficking proceeds. Those are indicators identified in the bank’s transaction history, not findings that every flagged payment was criminal.

The sanctions resolution covered payments processed through blocked banks, transactions involving designated people and business accounts linked to blocked parties. The OFAC agreement said technical errors, poorly calibrated alerts, delayed watchlist updates and human mistakes allowed millions of dollars in apparent violations involving programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking and global terrorism.

Bank of America said it has already committed substantial staff and resources to remediation, according to Barron’s. The bank’s shares fell about 2% in after-hours trading after the announcement, a market reaction that indicates an immediate investor cost but does not by itself establish a lasting financial impact.

What happens next

The financial penalty is only one part of the resolution. A consent order requires an independent lookback for suspicious transactions that went undetected, followed by reporting to FinCEN where required. The bank must also undergo outside reviews of its transaction monitoring, customer due diligence, foreign correspondent accounts and the data governance supporting those systems.

That work will determine whether the enforcement action produces durable changes. The record establishes that Bank of America admitted federal compliance violations and that regulators found years of unresolved deficiencies. It does not yet show how many additional transactions the lookback will uncover, whether any will lead to criminal cases, or how quickly the bank can satisfy the new oversight requirements.