Bank AML and Sanctions Orders: The Alerts a Bank Chose to Leave Unread

Bank AML sanctions enforcement cases show how failures in transaction monitoring, customer checks and sanctions screening can bring several regulators into the same bank. Bank of America kept an investigation threshold after testing showed it missed reportable activity. Other orders show understaffed review, unmonitored payments and repairs that failed to fix known gaps. For someone who designs the monitoring, investigates alerts or tests the controls, the useful story is inside those decisions: which activity went unseen, who knew the system was missing it and what happened after the bank promised to fix it.

One Bank Can Face Several Regulators

Bank AML penalties from the Federal Reserve, OCC and OFAC arise under different instruments, even when announcements carry the same bank name. The Financial Crimes Enforcement Network administers the Bank Secrecy Act. The Office of the Comptroller of the Currency and the Federal Reserve supervise banks within their authority. Treasury’s Office of Foreign Assets Control administers sanctions, while the New York Department of Financial Services can bring its own state action.

The distinction reaches inside the group. A holding company, a U.S. bank and a New York branch can appear in different orders. In HSBC’s coordinated resolution, for example, the Federal Reserve addressed holding-company oversight while the Financial Crimes Enforcement Network addressed the U.S. bank’s controls.

What Are Violations of the Bank Secrecy Act?

Violations of the Bank Secrecy Act include failures to maintain an effective AML program, perform required customer and foreign-correspondent due diligence, and file accurate, timely suspicious activity reports. Banks also have cash-reporting and transfer-record duties. The orders below identify failures in those controls and reports. The Office of Foreign Assets Control’s sanctions findings concern prohibited dealings and blocked property.

These duties meet in the bank’s systems. A correspondent account gives another financial institution access to banking services, with downstream customers whose activity may be less visible to the bank providing that access. The due-diligence questions and the actual payment flows need to tell the same story.

Selected Bank Orders and Their Payment Terms

Concurrent bank orders can address different failures and credit the same payment. Bank of America’s orders pair overlapping civil assessments with a separate sanctions settlement.

A Repeated Bank Name Can Tell Different Stories

When the same bank’s name appears again in a sanctions enforcement archive, the entry can reflect an acquired business or a different respondent. A new misconduct finding tells us what failed: an uncorrected control, a missed warning or another reporting gap.

Bank of America’s later Comptroller of the Currency order makes the connection explicit. The agency found insufficient remediation after its December 2024 corrective order and continuing internal-control gaps. Its sanctions history adds another warning: the latest sanctions release describes earlier cautionary letters concerning substantially similar conduct. The Financial Crimes Enforcement Network, meanwhile, says the bank had no prior enforcement history with that agency.

Bank of America’s Financial Crimes Enforcement Network action announced in October 2026 covers conduct from at least January 1, 2018 through July 1, 2025. The Office of Foreign Assets Control release covers apparent violations from September 18, 2021 through April 24, 2025.

TD Bank’s Earlier Reporting Case and Later Monitoring Failures

TD Bank’s September 2013 Financial Crimes Enforcement Network assessment concerned failures to detect and report suspicious activity connected to a Ponzi scheme. Its $37.5 million assessment and the concurrent Comptroller of the Currency assessment required one Treasury payment.

The October 2024 Financial Crimes Enforcement Network order addressed broader AML, monitoring and reporting failures at TD Bank, N.A. and TD Bank USA, N.A. It assessed $1.3 billion and required $757 million payable to Treasury. The Federal Reserve’s parallel action named the parent and holding companies.

In its guilty plea, TD Bank admitted that budget constraints left domestic ACH payments and most checks outside transaction monitoring. The separate Financial Crimes Enforcement Network order required a four-year monitor from retention. The Comptroller of the Currency’s corrective order restricted asset growth at the two U.S. banks. Those requirements reached both the controls and the bank’s capacity to expand.

HSBC’s Bank Controls and Holding-Company Oversight

HSBC’s December 2012 Financial Crimes Enforcement Network assessment addressed AML-program, foreign-correspondent due-diligence and suspicious activity reporting failures at HSBC Bank USA. Its $500 million civil assessment was satisfied by the same payment as the concurrent Comptroller of the Currency assessment.

The Federal Reserve imposed a separate $165 million assessment on HSBC Holdings and HSBC North America Holdings for Bank Secrecy Act and sanctions oversight. The bank’s customer and transaction controls sat within a group whose oversight also came under scrutiny.

Standard Chartered’s Sanctions and Surveillance Orders

Standard Chartered’s September 21, 2012 New York consent order imposed $340 million over sanctions-related transaction concealment. Its August 19, 2014 New York order imposed $300 million over transaction-surveillance deficiencies exposed by the independent monitor. The later order concerned what the monitoring work uncovered.

The April 9, 2019 New York order imposed $180 million in a coordinated sanctions resolution. The Office of Foreign Assets Control’s corresponding notice separated an Iran-related resolution from a Zimbabwe matter.

Bank of America’s Concurrent Agency Actions

Bank of America admitted AML-program, foreign-correspondent due-diligence and suspicious activity reporting failures in its Financial Crimes Enforcement Network resolution. The Comptroller of the Currency made its own findings, including inaccurate information accompanying outgoing wires. The Office of Foreign Assets Control separately resolved apparent sanctions violations involving screening and payment controls.

What Consequences May a Bank Face for Failing to File a Required Suspicious Activity Report?

A bank can face civil penalties and orders requiring retrospective review, missed-report filings, independent consultants and repairs to its monitoring. Bank of America’s Financial Crimes Enforcement Network order requires a suspicious activity report lookback, testing of interim and completed monitoring changes, customer and correspondent due-diligence review, and work on data quality and controls.

The earlier Comptroller of the Currency order also requires supervisory approval for high-risk additions or expansion. Its demand for implementation, sustained effectiveness and verification reaches beyond adopting a corrective plan. A plan is something management can approve. Effectiveness is something the controls have to demonstrate.

The Decision Behind the Missing Alert

The most useful comparison between these orders is the decision that let the failure continue. USAA’s order identifies understaffed alert review. Bank of America’s identifies threshold testing, suppression rules and internal escalation. Standard Chartered’s later surveillance order arose from deficiencies exposed by a monitor. Each points toward people who knew how the control behaved and who had authority to change it.

Anti-Money Laundering: Opportunities for Improvement, published by the Wharton Initiative on Financial Policy and Regulation in 2024, examines the incentives inside this system. It describes compliance officials who see themselves as aligned with law enforcement while others inside their institutions view their work as an expense to minimize. Its criticism of judging the system through penalties is direct:

For an insider, that brings the comparison back to ordinary work: testing results, staffing decisions, customer information and approvals for exceptions. Those records can explain why an alert disappeared or a known gap remained open. We work with people who can connect the system’s behavior to the decisions behind it.

The Financial Crimes Enforcement Network’s whistleblower program covers bank AML and sanctions violations. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program. We assess your knowledge of the bank’s conduct and work with you on the right whistleblower case.

When You Know Why the Control Failed

If you know who kept an ineffective threshold, dismissed a sanctions match or approved an incomplete repair, talk with our bank AML and sanctions whistleblower experts. We turn your knowledge of those decisions into a case strategy and bring in whistleblower lawyers who understand bank monitoring and sanctions enforcement. We stay beside you as the case develops, connecting the technical failure to the people and business decisions behind it.