On October 13, 2026, FinCEN imposed a $1.2 billion penalty on Bank of America for Bank Secrecy Act violations. The bank failed to timely report more than $5 billion in suspicious transactions, including over $1 billion tied to national security and priority illicit-finance risks.
The enforcement action wasn't due to a lack of systems or policies. Bank of America had established compliance responsibilities and monitoring infrastructure. The failure occurred between detection and action: suspicious activity went undetected, unresolved, or unreported for extended periods. Regulators found the bank relied heavily on external inquiries from law enforcement and other financial institutions to identify activity its own monitoring should have caught.
For compliance officers across industries, this case exposes a critical vulnerability: monitoring that doesn't connect to accountable decision-making creates the illusion of control while leaving risks unaddressed.
Timeline
Extended Period (Date Range Not Disclosed in Enforcement Action):
Bank of America's monitoring systems failed to consistently detect suspicious transactions. Over $5 billion in suspicious activity was not reported in a timely manner.
Detection Dependent on External Sources:
Instead of internal monitoring identifying concerns, the bank frequently learned of suspicious activity through inquiries from law enforcement agencies and other financial institutions.
Accumulated Weaknesses:
Identified suspicious activity accumulated without timely investigation or resolution. Warning signs existed but didn't consistently trigger corrective action.
October 13, 2026:
FinCEN announced the $1.2 billion penalty, coordinated with enforcement actions from the OCC and OFAC. The consent order required independent reviews of key elements of the bank's AML program.
Which Controls Failed or Were Missing
The enforcement action identified three categories of control failure:
Detection Failures:
Transaction monitoring systems failed to identify suspicious patterns that should have triggered alerts. Regulators described a compliance program unable to effectively monitor enormous transaction volumes, allowing potentially suspicious activity to go undetected.
Escalation and Investigation Breakdowns:
When suspicious activity was identified, it didn't consistently reach decision-makers authorized to act. Investigation processes failed to resolve concerns within required timeframes.
Accountability Gaps:
The most significant failure wasn't technical. Identified weaknesses and escalated concerns didn't consistently produce meaningful corrective action. The bank couldn't demonstrate that monitoring results connected to accountable owners, timely decisions, and verified remediation.
This third failure extends beyond banking. Organizations across industries face the same vulnerability: safeguards that exist on paper but fail during execution.
What the Relevant Standard Requires
Bank Secrecy Act Requirements:
The BSA requires financial institutions to establish and maintain effective anti-money laundering programs, including systems for detecting and reporting suspicious activity. Institutions must file Suspicious Activity Reports (SARs) within specified timeframes when transactions meet reporting thresholds.
The regulation requires effective monitoring that produces timely, accurate reporting to regulatory authorities.
COSO ERM Framework Principles:
While the BSA establishes specific requirements for financial institutions, the underlying control principles apply broadly. The COSO ERM Framework establishes that organizations must not only identify and assess risks but also implement responses and monitor performance.
Principle 16 (Reviews Entity Performance) requires organizations to review performance and evaluate whether risk management components are present and functioning. Principle 17 (Reviews Risk and Performance) requires identifying and analyzing changes that may significantly affect strategy and business objectives.
These principles establish that monitoring isn't complete until information produces action.
The Three Lines Model:
The Institute of Internal Auditors' Three Lines Model clarifies accountability for risk management:
- First Line (Operational Ownership): Business units own and manage risks, execute controls, and address identified weaknesses.
- Second Line (Risk and Compliance Oversight): Risk and compliance functions provide expertise, monitoring, and challenge, ensuring significant concerns reach appropriate decision-makers.
- Third Line (Independent Assurance): Internal audit provides independent verification that risk management and controls operate effectively.
Bank of America's case demonstrates what happens when these lines blur or fail to coordinate. The bank had compliance responsibilities established, yet regulators found significant shortcomings in execution and oversight.
Lessons and Action Items for Your Team
1. Test whether controls actually work, not just whether they exist.
Don't conflate documentation with effectiveness. When your testing identifies a control weakness, trace it through to an accountable decision, corrective action, and verification that the fix works. If you can't demonstrate that chain of accountability, you haven't closed the control gap.
Action: For each control in your compliance program, document who executes it, who verifies execution, and who provides independent assurance on effectiveness. When testing identifies a weakness, establish a closure standard: the finding isn't resolved until independent verification confirms the control now operates as designed.
2. Connect every monitoring output to a decision-maker.
A generated report isn't evidence of risk mitigation. Every significant warning sign, exception, or control failure needs a defined owner responsible for investigation and resolution within specified timeframes.
Action: Map your monitoring activities to accountability. For each report, dashboard, or alert your systems generate, identify who receives it, what decision authority they hold, what action they're expected to take, and what timeline applies. If monitoring produces information but no one is accountable for acting on it, you're collecting data, not managing risk.
3. Establish escalation triggers that don't depend on individual judgment.
Critical issues shouldn't rely on someone recognizing their significance or choosing whether to raise concerns. Define escalation triggers, timelines, and decision-making responsibilities in advance.
Action: Document escalation criteria for your compliance program. Specify what constitutes a material finding, who must be notified, within what timeframe, and what decision authority is required to resolve it. Remove ambiguity about when escalation is required.
4. Verify remediation independently before closing findings.
Completing a corrective action doesn't demonstrate the underlying weakness has been addressed. Before closing a material finding, verify that the control now operates as intended. Use reviewers sufficiently independent of the work, with verification depth proportionate to the risk.
Action: Separate remediation completion from remediation verification in your tracking systems. Establish a verification standard: who performs it, what evidence they review, and what sign-off is required. For high-risk findings, consider whether third-line assurance (internal audit) should verify effectiveness before closure.
5. Give leadership visibility into control effectiveness, not just compliance status.
Executives and boards need to understand which safeguards are working, where weaknesses exist, what business outcomes may be affected, and whether corrective actions are progressing. Distinguish controls that haven't been tested, failed tests, overdue remediation, and fixes awaiting verification.
Action: Redesign your compliance reporting to show control effectiveness, not just control existence. Report open findings by age, owner, and risk level. Highlight overdue corrective actions and findings awaiting independent verification. Give leadership the information they need to intervene when accountability breaks down.
The enforcement action against Bank of America demonstrates that compliance programs can fail even when policies, systems, and responsibilities are documented. The failure occurs when monitoring doesn't connect to accountability, when findings don't produce decisions, and when corrective actions aren't independently verified.
If one of your critical controls stopped working today, how quickly would your organization know, and who would be accountable for fixing it?
If you can't answer both questions immediately, you're carrying the same vulnerability that cost Bank of America $1.2 billion.
