Bank of America Fined $1.2 Billion for Failing to Report Suspicious Transactions

U.S. regulators have imposed a $1.2 billion penalty on Bank of America after finding that the bank failed to report billions of dollars in suspicious transactions.

The enforcement action, announced on October 13, 2026, raises questions about how the bank monitored potentially illicit financial activity and whether its compliance systems were doing enough to catch it.

The U.S. Treasury said the bank failed to report more than $5 billion in suspicious activity, including approximately $1 billion linked to national security concerns and other priority illicit finance risks.

For a bank operating under extensive regulatory requirements, that is a significant failure. And the penalties did not stop at the headline figure.

What Regulators Found at Bank of America

The enforcement action involves several regulatory findings and penalties.

Here is what happened:

• More than $5 billion in suspicious transactions went unreported. The Treasury identified failures to report suspicious activity that should have been flagged for further investigation.

• A $750 million OCC penalty followed earlier compliance concerns. The Office of the Comptroller of the Currency imposed its largest-ever civil penalty against the bank, citing weaknesses in its anti-money laundering program that had already been identified in a 2024 cease-and-desist order.

• Regulators criticized the bank’s approach to monitoring. The Treasury said the bank relied too heavily on information from law enforcement and other financial institutions instead of maintaining effective internal monitoring.

• A separate $11.6 million sanctions penalty was imposed. The Treasury’s Office of Foreign Assets Control cited more than 400 apparent sanctions violations involving payments connected to restricted jurisdictions, including Russia and Iran.

The penalties are not simply additive. The $750 million OCC penalty is credited against the larger FinCEN penalty, while the sanctions penalty is separate.

Bank of America must also engage an independent third party to review past transactions, identify previously missed suspicious activity, and report it to the Financial Crimes Enforcement Network.

The Problem Was Bigger Than Missing Transactions

One of the most significant aspects of this case is that regulators had identified compliance weaknesses before the latest enforcement action.

That raises an important question: what happens when an organization knows its controls have weaknesses but those weaknesses remain unresolved?

Effective compliance requires more than written policies or periodic reviews. Monitoring systems must work, employees need clear responsibilities, and identified problems must lead to corrective action.

The Bank of America case illustrates what can happen when those elements fall short in a heavily regulated environment.

What Marketing Compliance Teams Can Take From This Case

Bank of America’s penalties concern anti-money laundering and sanctions compliance, not advertising violations. Still, the case offers useful lessons for marketing teams operating under strict regulatory requirements.

1. Make compliance part of the workflow.

Waiting until a campaign is ready to publish before checking its compliance creates unnecessary risk. Teams need clear review stages, defined approval responsibilities, and checks that happen before content goes live.

2. Keep a record of reviews and approvals.

When a regulator or internal auditor asks how a decision was made, teams should be able to show what was reviewed, who approved it, and whether concerns were addressed. A documented process makes accountability easier to establish.

3. Follow through when something goes wrong.

Identifying a problem is only the first step. Teams need to assign responsibility, track corrective actions, and verify that the issue has been resolved. Repeatedly flagging the same weakness without addressing it leaves the underlying risk in place.

These practices matter particularly for financial services companies, where promotional claims, disclosures, and customer communications may be subject to multiple regulatory requirements.

Building Compliance Into Everyday Marketing

The Bank of America case is a reminder that compliance controls need to work in practice, not just exist on paper.

For marketing teams, that means having reliable processes for reviewing content, managing approvals, tracking changes, and ensuring that required checks are completed before publication.

Warrant helps regulated marketing teams review content, manage approvals, and apply compliance checks throughout the content lifecycle. By bringing these steps into a more structured workflow, teams can improve visibility into reviews and reduce their reliance on scattered, manual processes.