The $1.21 billion penalty against Bank of America for anti-money laundering (AML) and sanctions violations has sparked urgent discussions in compliance teams. This isn't just a headline; it's a wake-up call for every AML program relying on outdated systems or delayed remediation plans.
Here's what your team needs to know and how to ensure your program isn't the next to face scrutiny.
Understanding "Willful" Violations
The term "willful" in the Treasury's announcement doesn't mean intent to break the law. It means the institution was aware of compliance gaps and failed to act promptly. Bank of America knew in March 2022 that its payment directory included sanctioned banks, yet payments continued due to outdated filters and errors. The full scope wasn't addressed until OFAC's subpoena in January 2025. If your team has identified a control gap and hasn't acted, you're at risk of being labeled "willful". Regulators expect immediate action, not delays.
Are Your Sanctions Screening Filters Up to Date?
Outdated screening filters were a key issue for Bank of America. This isn't about software versions; it's about whether your filters align with current OFAC list formats and naming conventions. Modern screening requires:
- Entity graph resolution to connect owners, subsidiaries, and aliases
- Transliteration handling for non-Latin scripts
- Regular tuning based on false positives and missed matches
Ask your team: When did we last validate our screening logic against an OFAC test set? Relying solely on vendor updates isn't enough. You need to ensure your matching thresholds and transaction flows are tested.
The Risk of Delayed Alert Escalation
Bank of America delayed escalating suspicious activities, even after a cease-and-desist order. Delays lose operational context and signal governance failures. If alerts sit unaddressed, your compliance model is ineffective. Measure your time from alert to investigator assignment. If it's over 72 hours, address the backlog. Create a dashboard to track aging alerts and ensure your Chief Compliance Officer reviews it weekly.
Consequences of Ignoring Cease-and-Desist Orders
Ignoring a cease-and-desist order led to Bank of America's second enforcement action and a $750 million fine. These orders are binding commitments with deadlines. If your order requires "enhanced transaction monitoring," it means implementing and proving effectiveness, not just planning. Map each requirement to a deliverable, responsible executive, completion date, and validation evidence. If you're behind, escalate to your board.
Scheduling Lookbacks for Missed SARs
Bank of America must conduct a third-party lookback for undetected suspicious transactions. Don't wait for a consent order. Schedule lookbacks annually, especially after system upgrades, alert parameter changes, or team turnover. A lookback queries historical data with current detection logic. If you find unreported activity, file a Suspicious Activity Report and document why it was missed.
How Major Banks Miss Billions in Suspicious Transactions
Bank of America failed to report over $5 billion in suspicious transactions. This points to systemic issues like:
- Aggressive alert suppression rules
- Incomplete customer due diligence
- Siloed monitoring without cross-channel aggregation
- Investigator overload
Regulators now measure compliance failures by the dollar volume of unreported activity. This changes your risk assessment. A large volume of small transactions can be a bigger issue than a few large ones.
Immediate Actions for Your Team
Don't wait for your next exam. Take these steps this quarter:
Run a sanctions screening validation test. Re-screen recent transactions against current OFAC lists. Compare results with your vendor's test outcomes. Discrepancies indicate configuration issues.
Map your alert escalation paths. Review recent alerts closed without filing a SAR. Ensure there's a clear decision trail and adequate audit documentation.
Calculate your undetected exposure. Estimate transaction volume through any control gaps before they were fixed. This helps decide if a lookback is needed.
Where to Go for More Information
The FFIEC BSA/AML Examination Manual is your guide for examiner expectations. Treasury's enforcement actions are on FinCEN's website, showing how regulators describe deficiencies. If facing a consent order or exam, ensure your third-party validation firm tests detection logic against known typologies, not just policies. Effective compliance means your controls work in practice, not just on paper.
