Experts warn Bank of America’s hefty AML fine signals a reckoning for aging banking compliance.
When Bank of America released third-quarter financials on Oct. 14, shareholders took note of a $1.2 billion non-tax-deductible blow to earnings. The anti-money laundering, or AML, and sanctions penalty shaved 17 cents off its per-share net income.
But the fine itself may be the least of the bank’s worries.
Financial crime and AML experts told Global Finance that this penalty was not an outlier but a warning to the rest of the industry.
“If you looked at every bank in detail, you’d find problems,” ThetaRay CEO Brad Levy said in an interview. “It’s kind of like every house — when the inspector comes, there’s something wrong.”
What Happened
The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) addressed the penalty. The segment cited Bank of America’s “failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.”
The fine is the third-largest in the department’s history, behind a roughly $4 billion settlement with Binance in 2023 and an approximately $3 billion settlement with TD Bank in 2024.
This particular cost includes $750 million that goes to the Office of the Comptroller of the Currency — the largest fine that regulator has ever imposed— plus $11.6 million to the Treasury’s Office of Foreign Assets Control over apparent violations of sanctions programs covering Iran, Russia, narcotics and global terrorism.
A Bank of America spokesperson issued the following statement to Global Finance: “Financial crime compliance is serious, and we are responsible for getting it right. We worked with regulators to reach these penalty resolutions stemming from violations cited in the previously reported 2024 OCC Consent Order and FinCEN’s investigation. We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators.”
Fallout Extends Beyond Government Agencies
For Nikhil Raghuveera, CEO of Predicate, a startup that uses blockchain technology for AML enforcement, the real government-inflicted damage is not to Bank of America’s coffers but to its goodwill.
“The bank faces business and reputational damage with counterparties,” Raghuveera said. Partner institutions, clearing banks, and corporate clients typically tighten their own risk thresholds to protect themselves from secondary liability and run their own risk assessments. And a Bank Secrecy Act violation feeds directly into them, he explained.
“A large bank doesn’t lose its ability to operate, but it does face greater scrutiny and the potential loss of business opportunities,” Raghuveera added. “The regulator now sees the bank as unable to fix things itself. As a result, every new product or expansion gets reviewed through that lens.”
Regulatory Trust Broken
The hefty fine grabbed headlines, but according to Will Lawrence, CEO of San Francisco-based AML software maker Bretton AI Inc., the money matters less than what the bank has lost in regulatory trust.
Bretton AI
“For a large bank, even a significant financial penalty may be manageable,” Lawrence said in an email. “What’s much harder is operating once regulators lose confidence in the institution’s ability to manage risk.”
That can mean independent monitoring, more board scrutiny and limits on growth.
“Even without formal restrictions on growth or acquisitions, unresolved compliance issues can complicate a bank’s expansion plans,” he said. “The financial penalty may be immediate, but remediation can take years.”
Big-name banks are also vulnerable if their methods for flagging suspicious activity remain outdated.
For example, when a typical analyst pulls data from different systems, reconstructs transactions, and documents the findings, that approach often falls short against sophisticated laundering networks, Lawrence explained.
“These are not necessarily risks you can understand by looking at one transaction or one customer in isolation,” he said. “You need to connect activity across accounts, counterparties and payment channels to identify broader patterns.”
Large penalties are rarely a one-time blip, Raghuveera said. “They tend to reflect patterns: transaction monitoring that’s poorly calibrated, SARs filed late or not at all, watchlists that aren’t kept current, and compliance teams lacking the staff, tools or authority to escalate.”
24/7 Reality Check
For Lawrence, true accountability raises certain questions: Who knew about the risks? Who had the authority to address them? Was appropriate action taken?
“A bank can have sophisticated monitoring systems, but if serious issues aren’t escalated or leadership doesn’t respond, the program isn’t working,” he added.
Also, Lawrence said, a bank can’t spend its way out of the problem. Regulators want evidence that changes are working, not just new policies or software.
“A bank can hire more analysts, purchase new technology, and rewrite its policies without fundamentally improving its ability to identify financial crime,” Lawrence said. Banks have also long tracked activity counts, such as the number of alerts reviewed or cases closed. “Those numbers tell you something about workload, but not necessarily whether you’re managing risk effectively.”
Levy, who spent nearly 20 years at Goldman Sachs before joining ThetaRay, expressed a similar sentiment. To put it plainly, legacy technology hasn’t kept pace.
“Most of these systems and processes are 10 to 30 years old,” he said, stressing the need for serious internal audits to accommodate the 24/7 banking world.
“Ten years ago, you could get away with it,” he said. “In the next five, you actually can’t… the speed-up in technology is going to be breathtaking.”
Anthony Noto covers corporate finance and private credit. Contact him at anoto@gfmag.com