They outsourced the detection and called it compliance. I know the sentence. It is what a bank says when it processes hundreds of trillions of dollars a year, lets suspicious activity pile up uninvestigated, leans on law enforcement tips and other banks’ referrals instead of its own machines, misses more than five billion dollars in reportable suspicion — over a billion of it tagged national security — and still sends the shareholders a paragraph about how seriously it takes financial crime.
On Tuesday, October 13, 2026 — covered into Wednesday’s papers — the Treasury Department announced enforcement actions imposing more than $1.21 billion in penalties on Bank of America, the second-largest bank in the United States: FinCEN’s $1.2 billion assessment for failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border; the OCC’s $750 million civil money penalty — largest in OCC history — for a deficient and ineffective BSA/AML compliance program, credited inside the FinCEN total; and an OFAC settlement of $11.6 million for 475 apparent violations of sanctions programs including Iran, Russia, narcotics, and global terrorism. Treasury said the FinCEN piece is the third-largest penalty in department history. Secretary Scott Bessent: “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls.” As part of the FinCEN resolution, Bank of America admits it willfully violated the Bank Secrecy Act — failing to maintain a minimum AML program, failing correspondent due diligence for foreign financial institutions, and failing to file suspicious activity reports. Treasury’s release is blunt about the business choice: as problems mounted, “Bank of America prioritized its revenues and minimized the impact on its required compliance resources,” and “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.” The bank failed to timely report to FinCEN over $5 billion in suspicious transactions, with over $1 billion implicating national security and other priority risks. The OCC, in News Release 2026-89, said the bank’s monitoring system “resulted in the Bank failing to properly monitor trillions of dollars in transactions,” producing large numbers of late SARs involving billions of dollars, many with indicia of money laundering; that the bank knew for years it was failing to escalate alerts to investigators and did not fix it; and that more than a year after a December 2024 cease-and-desist order it still failed to escalate and still processed potential trade-based money laundering through a systemic monitoring gap. Comptroller Jonathan V. Gould called the response “unacceptable” and said the second-largest bank’s “egregious and continued BSA violations warrant the OCC imposing its largest CMP ever.” OFAC said the $11.6 million settlement reflects non-egregious violations that were largely not voluntarily self-disclosed, with no mitigation for remediation or cooperation — correspondent payments through blocked banks, poor alert calibration, slow watchlist updates, mishandled blocked-person accounts. PBS News, citing the Associated Press, quoted the bank: “Financial crime compliance is serious, and we are responsible for getting it right,” and “We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime.” Axios noted Wednesday that the historic fine weighed on the bank’s third-quarter results; CFO Alastair Borthwick told investors that when rates rise 85 basis points in a quarter, clients slow down. The consent order requires a third-party lookback to find and report what the bank missed, plus independent reviews of monitoring, customer due diligence, foreign correspondent diligence, and AML data governance — tailored to southwest-border and cartel risk, Iran, and Russia.
Joey drew a SAR on a pizza box because there was no foam core and labeled it LATE. Cricket tried to laminate the $5 billion and the laminator needed Gary. Deb filed ‘invested billions in technology’ under ‘receipts that arrived after the crime.’ I love them. They are seasoning.
Compliance is the alibi. The outsource is the story. Sit with the five billion until it confesses. This is not a tragedy about a teller who missed a form. It is a yield machine that treated the detection of Chinese money-laundering networks and southwest-border illicit finance as a cost center to be minimized while the revenue side stayed fed — Treasury’s words, not mine. The anti-capitalist cut stays: a bank that can monitor trillions and still need the cops and the other banks to tell it what looks dirty is not a free market; it is a tollbooth with a compliance department for the brochure. I do not crown the stamp that wrote the fine, either. The same week the OCC brands itself the guardian of fair banking for belief, it proves it can count a record CMP when the spreadsheet is AML. Enforcement after the fact is not prevention; it is a receipt. The cardigan stays. Fill the notebook. Then ask, out loud, whose compliance it was when the detection was outsourced, the five billion went untimely, and the press release still said the team was far along.
Sources: U.S. Department of the Treasury, “U.S. Treasury Announces Record Enforcement Actions Against Bank of America,” Oct. 13, 2026; OCC News Release 2026-89, “OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance,” Oct. 13, 2026; PBS News / Associated Press, Paul Wiseman and Farnoush Amiri, “U.S. hits Bank of America with $1.2 billion fine, saying it violated money laundering and sanctions laws,” Oct. 14, 2026; Axios, Courtenay Brown, “For the big banks, a double-edged sword under Trump,” Oct. 15, 2026.
— Theo Ashford-Lindström
Leave a Reply