Americas

Experts warn Bank of America’s hefty AML fine signals a reckoning for aging banking compliance.

When Bank of America released third-quarter financials on Oct. 14, shareholders took note of a $1.2 billion non-tax-deductible blow to earnings. The anti-money laundering, or AML, and sanctions penalty shaved 17 cents off its per-share net income.

But the fine itself may be the least of the bank’s worries.

Financial crime and AML experts told Global Finance that this penalty was not an outlier but a warning to the rest of the industry.

“If you looked at every bank in detail, you’d find problems,” ThetaRay CEO Brad Levy said in an interview. “It’s kind of like every house — when the inspector comes, there’s something wrong.”

What Happened

The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) addressed the penalty. The segment cited Bank of America’s “failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.”

The fine is the third-largest in the department’s history, behind a roughly $4 billion settlement with Binance in 2023 and an approximately $3 billion settlement with TD Bank in 2024.

This particular cost includes $750 million that goes to the Office of the Comptroller of the Currency — the largest fine that regulator has ever imposed— plus $11.6 million to the Treasury’s Office of Foreign Assets Control over apparent violations of sanctions programs covering Iran, Russia, narcotics and global terrorism.

A Bank of America spokesperson issued the following statement to Global Finance: “Financial crime compliance is serious, and we are responsible for getting it right. We worked with regulators to reach these penalty resolutions stemming from violations cited in the previously reported 2024 OCC Consent Order and FinCEN’s investigation. We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators.”

Fallout Extends Beyond Government Agencies

For Nikhil Raghuveera, CEO of Predicate, a startup that uses blockchain technology for AML enforcement, the real government-inflicted damage is not to Bank of America’s coffers but to its goodwill.

“The bank faces business and reputational damage with counterparties,” Raghuveera said. Partner institutions, clearing banks, and corporate clients typically tighten their own risk thresholds to protect themselves from secondary liability and run their own risk assessments. And a Bank Secrecy Act violation feeds directly into them, he explained.

“A large bank doesn’t lose its ability to operate, but it does face greater scrutiny and the potential loss of business opportunities,” Raghuveera added. “The regulator now sees the bank as unable to fix things itself. As a result, every new product or expansion gets reviewed through that lens.”

Regulatory Trust Broken

The hefty fine grabbed headlines, but according to Will Lawrence, CEO of San Francisco-based AML software maker Bretton AI Inc., the money matters less than what the bank has lost in regulatory trust.

“For a large bank, even a significant financial penalty may be manageable,” Lawrence said in an email. “What’s much harder is operating once regulators lose confidence in the institution’s ability to manage risk.”

That can mean independent monitoring, more board scrutiny and limits on growth.

“Even without formal restrictions on growth or acquisitions, unresolved compliance issues can complicate a bank’s expansion plans,” he said. “The financial penalty may be immediate, but remediation can take years.”

Big-name banks are also vulnerable if their methods for flagging suspicious activity remain outdated.

For example, when a typical analyst pulls data from different systems, reconstructs transactions, and documents the findings, that approach often falls short against sophisticated laundering networks, Lawrence explained.

“These are not necessarily risks you can understand by looking at one transaction or one customer in isolation,” he said. “You need to connect activity across accounts, counterparties and payment channels to identify broader patterns.”

Large penalties are rarely a one-time blip, Raghuveera said. “They tend to reflect patterns: transaction monitoring that’s poorly calibrated, SARs filed late or not at all, watchlists that aren’t kept current, and compliance teams lacking the staff, tools or authority to escalate.”

24/7 Reality Check

For Lawrence, true accountability raises certain questions: Who knew about the risks? Who had the authority to address them? Was appropriate action taken?

“A bank can have sophisticated monitoring systems, but if serious issues aren’t escalated or leadership doesn’t respond, the program isn’t working,” he added.

Also, Lawrence said, a bank can’t spend its way out of the problem. Regulators want evidence that changes are working, not just new policies or software.

“A bank can hire more analysts, purchase new technology, and rewrite its policies without fundamentally improving its ability to identify financial crime,” Lawrence said. Banks have also long tracked activity counts, such as the number of alerts reviewed or cases closed. “Those numbers tell you something about workload, but not necessarily whether you’re managing risk effectively.”

Levy, who spent nearly 20 years at Goldman Sachs before joining ThetaRay, expressed a similar sentiment. To put it plainly, legacy technology hasn’t kept pace.

“Most of these systems and processes are 10 to 30 years old,” he said, stressing the need for serious internal audits to accommodate the 24/7 banking world.

“Ten years ago, you could get away with it,” he said. “In the next five, you actually can’t… the speed-up in technology is going to be breathtaking.”

Anthony Noto covers corporate finance and private credit. Contact him at anoto@gfmag.com

Deeper integration could attract more nearshoring, but governments will have to step up, too.

This article appears in the October issue of Global Finance Magazine.

With Panama joining Mercosur and Costa Rica wrapping up negotiations to join the Trans-Pacific Partnership, the rest of Spanish-speaking Central America risks being left behind.

Regional integration efforts have hitherto focused on custom unions, stock market interoperability, the Central American Integration System (SICA), the Central American Parliament, and the Central American Free Trade Agreement (FAUCA). 

“Panama’s accession to Mercosur as an associate state creates competitive pressure on the rest of Central America,” said Costa Rica-based financial analyst Daniel Suchar. “This could divert foreign direct investment that traditionally viewed Central America as a gateway to the Americas, forcing the other countries in the region to accelerate their own trade agreements to avoid falling behind.”

As a Mercosur member, Panama gains access to a market of 260 million people as well as value chains in Brazil, Argentina, and Uruguay, notably in logistics, financial services, and agribusiness. This opens the door to negotiations for a Central American bloc to join Mercosur, using Panama as a bridge.

“From a business perspective, the more connected, competitive, and open to trade Central America is, the greater the possibilities for developing regional value chains and attracting investment,” said Rosmer Jurado, president of the Union of Panamanian Industrialists.

Since last year, talk of a renegotiation of the Dominican Republic-Central America-United States Free Trade Agreement (CAFTA-DR) has been circulating among governments in the region. Should talks begin—the Dominican Republic is pushing hard for a trade deal—they would likely include proposals for further integration and increased rules and regulations. 

“A new agreement would be expected to include chapters on the digital economy, SMEs, resilient supply chains, and more stringent labor and environmental standards,” said Suchar. “A modernized CAFTA-DR should also address trade facilitation and regional cumulation of origin so that Central America can sell as a bloc and not as six separate countries.”

Opportunities in Nearshoring

Central America remains a diverse region, however, both politically and economically, which makes further integration challenging. Nicaragua is in danger of being frozen out of US trade after effectively banning elections, and Costa Rica has historically prioritized market diversification over Central American integration. Forging closer ties with the U.K. is part of its strategy to insert itself into high-value global production chains, particularly in medical devices, services, and technology.

The future of the Northern Triangle states—Guatemala, Honduras and El Salvador—is likely to be conditioned by their capacity to attract nearshoring and reduce non-trade costs. If they improve legal security, infrastructure, and energy, Suchar said, they can position themselves as alternatives for light manufacturing and textiles for companies leaving Asia. 

Nearshoring has been hailed as the region’s magic bullet; a 2024 report by the Center for Strategic and International Studies suggested that U.S. nearshoring alone could add at least $3.3 billion a year to Central American exports. But this is where governments will have to step up, Jurado noted. “Central America can take advantage of nearshoring,” he said, “but the opportunity will not automatically arise simply because of our location. The region must transform its proximity to the U.S. and its strategic position into concrete advantages: better infrastructure, lower logistics costs, specialized talent, competitive energy, trade facilitation, and clear rules for investment.”

Trade agreements, supply chain conditions, and geopolitical risk will all play a role. “Trade agreements are no longer just about tariffs,” said Suchar. “They focus on supply chain resilience, ESG standards, and geopolitics.”

Nic Wirtz is a contributing writer based in Guatemala.