Bank of America Fined $1.2 Billion: What the Record Penalty Means for Customers

If you bank with Bank of America, the headline figure is alarming but the practical answer is simple: your deposits are not at risk, your accounts work as before, and the money is coming out of the bank's profits, not yours. What changed on October 13, 2026, is that Bank of America, the second-largest U.S. bank, admitted it willfully failed to run an adequate anti-money-laundering program, and it now owes the federal government more than $1.21 billion.

Here is what regulators found, how the penalty is structured, why it landed when it did, and what it realistically means for the roughly 70 million people who hold accounts there.

The short version

On Tuesday, the Treasury Department announced three coordinated actions against Bank of America:

The two large numbers overlap. FinCEN's $1.2 billion credits the OCC's $750 million, so Bank of America pays roughly $450 million to FinCEN on top of the OCC amount. Combined with the OFAC settlement, the total is just over $1.21 billion, according to the Treasury's announcement and the OCC's news release.

Two records were set. The OCC says its $750 million civil money penalty is the largest in that agency's history. Treasury says the FinCEN penalty is the third-largest it has ever assessed.

What regulators say went wrong

The Bank Secrecy Act is the 1970 law that requires banks to watch for and report transactions that might involve crime. The core tool is the Suspicious Activity Report, or SAR, a confidential filing that tips off law enforcement. A bank that files too few SARs, or files them late, can leave investigators blind.

According to Treasury and FinCEN, Bank of America's monitoring failed on several fronts:

• Priority national-security risks slipped through. Treasury said the bank failed to mitigate and report risks tied to Chinese money-laundering networks and illicit finance along the southwest border, including activity that looked like trade-based money laundering.
• Referrals from other banks were not acted on. CNBC reported that Bank of America received inquiries and referrals from other financial institutions about suspicious customers but effectively outsourced part of its detection duty rather than investigating.
• Problems persisted after a warning. In December 2024, the OCC issued a cease-and-desist order requiring the bank to fix its compliance program. That order carried no fine. Treasury said that even afterward the bank still did not prioritize its monitoring responsibilities.

Comptroller of the Currency Jonathan Gould described the violations as "egregious and continued" in the OCC's statement. Treasury Secretary Scott Bessent said that when a bank this size fails on money-laundering controls, the risk spreads to the entire U.S. financial system.

One detail matters for anyone wondering whether the bank got a discount: Treasury said the FinCEN penalty reflects no reduction from the base amount, with no credit for remediation or cooperation. That is unusual and signals how seriously regulators viewed the lapses.

What Bank of America admitted and what it said

Unlike many bank settlements in which the institution neither admits nor denies wrongdoing, Bank of America admitted the facts in FinCEN's consent order, including that it willfully violated the Bank Secrecy Act and failed to file required SARs, according to ABC News.

In its statement, the bank said: "Financial crime compliance is serious, and we are responsible for getting it right." It added that the penalties stem from violations already cited in the 2024 OCC order and FinCEN's investigation, and that it will keep supporting law-enforcement investigations and filing hundreds of thousands of SARs each year.

What Bank of America must do now

The money is only part of the resolution. The FinCEN consent order requires the bank to:

1. Run a lookback. Working with an independent third party, the bank must review past transactions, identify suspicious activity its systems missed, and report it to FinCEN.
2. Submit to independent reviews of its transaction-monitoring system, customer due diligence, foreign correspondent-account checks, and the data governance behind its anti-money-laundering program.
3. Meet reporting deadlines set out in the order, which runs about 95 pages.

Plain-language version: an outside firm will dig through old transactions, and regulators will check whether the bank's systems actually work, not just whether the bank says they do. The 2024 order required similar fixes; this one adds a fine and tighter oversight.

Why the timing stung: earnings the next morning

The penalty was announced less than a day before Bank of America reported third-quarter results. In an SEC filing on October 14, the bank reported net income of $6.9 billion, or $0.91 per diluted share, for the quarter ended September 30. Analysts had expected roughly $1.11 per share before the fine, so the charge took a visible bite out of an otherwise profitable quarter.

For context, Bank of America's largest-ever regulatory bill was the $16.65 billion mortgage-securities settlement in 2014. This penalty is a fraction of that, but it targets something different: not the quality of products sold to investors, but the bank's basic duty to watch for criminal money moving through its accounts.

What this means for Bank of America customers

Your money is safe. Deposits remain FDIC-insured up to the standard limits, and nothing in these actions affects account access, cards, or online banking. The penalty is paid from the bank's earnings.

Expect more compliance friction, not less. The lookback and independent reviews push the bank to tighten monitoring. Customers who move large sums, send money abroad, deal in cash or money orders, or run small businesses with unusual payment patterns may see more verification requests or temporary holds. That is the system working as intended, even when it is inconvenient.

Watch for scams that ride the news. Big bank headlines reliably trigger phishing campaigns. Bank of America will not call, text, or email asking you to "verify" account numbers or passwords because of a regulatory matter. If you get such a message, contact the bank through the number on your card.

Hypothetical example (not a real case): A freelance importer who receives several wire transfers a month from overseas suppliers might, under tightened monitoring, be asked to document the source of funds or the nature of the business relationship. Providing invoices and contracts promptly usually resolves this; ignoring the request is what leads to account restrictions.

A quick checklist if you bank there

• Confirm your contact information is current so legitimate verification requests reach you.
• Keep records for large or international transfers: invoices, contracts, proof of source.
• If a transaction is held, respond to the bank's questions rather than re-attempting the transfer elsewhere, which can itself look suspicious.
• Treat any unsolicited "security update" message about this fine as a likely scam.
• If you are an investor rather than a depositor, note that compliance costs and the lookback's findings could affect future quarters; that is general information, not investment advice.

The bigger picture

This case fits a pattern of Treasury treating money-laundering controls as a national-security issue rather than a paperwork matter, with Chinese laundering networks and cross-border drug finance named explicitly. The record OCC fine, the refusal to discount the FinCEN penalty, and Bank of America's admission of willful violations all point the same direction: regulators expect the largest banks to fix problems the first time they are told.

For Bank of America, the next test is not the check it writes but what the lookback finds. If the independent review surfaces significant missed activity, the story will not be over.