Bank of America: Late Suspicious Activity Reports, Retired Alerts and the Lookback

The Bank of America money laundering fine announced on October 13, 2026 included a $1.2 billion civil penalty from the Financial Crimes Enforcement Network for failures to detect and report suspicious activity. The bank’s own testing repeatedly exposed problems with the system deciding which alerts reached an investigator. Alerts could accumulate, wait and eventually stop counting toward an investigation. For a monitoring analyst, model validator or compliance officer, the important story is what happened after the bank learned that its controls were missing activity worth reporting.

The FinCEN consent order credits payment of the Office of the Comptroller of the Currency’s $750 million penalty against its assessment, leaving $450 million payable to Treasury under FinCEN’s order. The Office of Foreign Assets Control resolved the sanctions failures separately.

What Was Bank of America Fined For?

Bank of America admitted in its FinCEN civil consent order that it failed to maintain an adequate anti-money laundering program, conduct required foreign-correspondent due diligence and file timely, accurate suspicious activity reports. The order covers conduct from at least January 1, 2018 through July 1, 2025.

FinCEN identified over $5 billion in suspicious transactions that the bank failed to report timely and accurately. Over $1 billion involved national security and other priority risks, including activity indicative of Chinese money laundering networks, fraud and potential trade-based money laundering with a substantial southwest-border connection.

The admitted failures connect decisions across the bank: how monitoring scores were set, which products the system covered, how customer information was updated and what happened when compliance staff raised concerns. A warning could reach the business without changing the controls governing the account.

How Alerts Aged Out Before Investigation

Bank of America’s Event Processor generally held individual alerts for scoring and aggregation before human review. It grouped alerts, usually by customer, and combined their weighted risk scores. An Event Group ordinarily needed 20 points to become an investigation, unless a separate trigger promoted it directly.

That score also had a clock. Alerts older than 13 months stopped contributing to the group’s total unless the group was already under investigation. They remained in the group, but their points retired. With weights set too low, activity that warranted a suspicious activity report could accumulate without ever getting enough points for review.

Some alerts could contribute only once. An alert for certain large incoming wire totals carried one point at the group level, however often it fired. Repeated activity did not move the customer any closer to an investigator.

Other rules reset risk scores to zero. For some customers exempt from routine currency transaction reports, Event Processor suppressed cash-structuring alerts even though suspicious-activity reporting still applied. FinCEN found inadequate testing of those rules. A reporting exemption had become a reason for reducing the score attached to potentially suspicious behavior.

Outside information could get an investigation started immediately. Law-enforcement contacts, other institutions’ requests and manual referrals prompted more than one-third of the bank’s investigations in several years. FinCEN connected that reliance to gaps in automated monitoring. The bank often needed someone else to make activity visible that its own transaction data should have brought forward.

The order quotes the bank’s account of why it originally built the system:

The same resource problem resurfaced when testing suggested changing the threshold. The bank rejected an alternative approach partly because it would send too many additional groups for investigation. The number of cases investigators could handle was shaping which activity they would see.

Event Processor also appeared in the Securities and Exchange Commission’s June 29, 2026 order against Merrill Lynch. The SEC assessed that company a $7.5 million civil penalty over missed suspicious activity reports. Merrill Lynch relied on Bank of America Corporation’s enterprise anti-money laundering program while retaining its own reporting duty.

Testing Found the Problem and the Threshold Stayed

Internal testing repeatedly found reportable activity below the investigation threshold. A report covering performance in 2019 and 2020 found that groups scoring 18 or 19 points produced suspicious activity reports more often than groups scoring 20 or 21. The supposedly lower-risk groups were yielding more reports than the groups selected for investigation.

The bank also left 76% of risk-factor weights unchanged from 2018 through 2023. Of the changes it did make, approximately 80% reduced the weights. FinCEN describes tests that identified underweighted risks, followed by responses that failed to correct them.

In 2023, the bank’s former head of financial crimes directed a senior manager to repeat a test of activity below the threshold. The second report discounted the earlier findings, pointing to investigator inexperience and biased sample selection, and supported the existing threshold. That sequence makes the testing process itself part of the story: who reviewed an adverse result, what they challenged and whether the underlying monitoring changed.

In December 2023, after engagement with regulators, Bank of America lowered the investigation threshold to 10 or 12 points and shortened the grouping window to four months. Its subsequent limited review led to over 8,000 suspicious activity reports covering approximately $3.96 billion in previously unreported suspicious activity. The bank estimated that the revised threshold would double its ongoing monthly investigation volume and require additional personnel. Yet independent testing in 2025 still found critical problems with transaction monitoring and Event Processor.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper Anti-Money Laundering: Opportunities for Improvement reports that annual SAR filings rose from 1.7 million in 2014 to 3.6 million in 2022. It finds that available data cannot readily distinguish defensive, low-quality reporting from increased fraud and better detection. Here, the bank’s own tests supplied something a national filing count cannot: evidence about the suspicious activity its particular system was missing.

A related staffing problem appeared at U.S. Bancorp. Under its deferred prosecution agreement, the company accepted responsibility for conduct that included limiting its bank’s transaction-monitoring alerts to staffing capacity. That criminal-case account illustrates the same practical question for an insider: did available staffing determine how much suspicious activity the institution would investigate?

Auto Auction Customers and Payments From Strangers

FinCEN’s account of the bank’s auto auction customers shows what those control failures looked like in a business relationship. The order calls the companies Customer A and Customer B. Both operated marketplaces connecting sellers of U.S. salvaged vehicles with buyers, including buyers overseas.

Customers accepted payments from people other than the registered vehicle buyer, including money orders from unknown purchasers. Bank compliance personnel recognized that this obscured the source of funds. A vehicle could connect a domestic payment to an overseas buyer while leaving the bank with an incomplete account of who supplied the money.

Quarterly customer reviews were supposed to compare actual activity with expected activity. Instead, some repeated prior observations and omitted negotiable-instrument deposits altogether. Raising a customer’s risk rating also failed to produce meaningful changes in monitoring or due diligence.

The bank had warnings from outside as well as inside. In September 2021, another financial institution asked about potentially structured money-order purchases deposited into Customer B’s account. Bank of America did not revise the customer’s risk profile, undertake additional due diligence or change the monitoring that omitted those deposits.

For Customer A, compliance staff recommended account closure in July 2022. The relationship team emphasized the customer’s commercial importance. After a later meeting between the BSA officer and the business-line head, the relationship manager wrote:

The bank adopted a mitigation plan in March 2023. A central recommendation was to accept vehicle payments only from registered buyers or dealers. Customer A continued processing third-party payments through its Bank of America account until June 2025, while the bank failed to update monitoring and customer information adequately for that continuing risk.

That is the part an insider can recognize: the recommendation, the commercial response, the proposed fix and the activity that continued afterward. Compliance staff believed fraud victims’ money was passing through the accounts. The business kept the relationship, and later internal reviews found the same activity continuing.

A vehicle exporter, identified as Customer C, showed a different mismatch. The bank recorded expected annual sales of $1 to $4 million, yet the business received hundreds of millions of dollars in cross-border wires. Its customer files also missed commercial relationships in high-risk jurisdictions. The account description and the actual payment stream were telling very different stories. FinCEN found that the bank failed to respond adequately to those discrepancies.

Missing Deposits and Credit Card Activity

The negotiable-instrument monitoring model covered certain purchases but omitted deposits. The bank’s systems also failed to distinguish adequately between instrument types, such as checks and money orders, limiting product-specific monitoring. That gap mattered to customers receiving substantial payments through instruments purchased at other financial institutions.

A customer review could not compensate when it omitted the same activity. For the auto auction relationships, the automated and periodic reviews both missed important parts of the payment stream. FinCEN found that the bank introduced a control to identify suspicious negotiable-instrument deposits only after its investigation identified the broader problem.

Credit cards presented another gap. The order describes repeated purchases at major retailers and shipping companies, payment of other people’s credit card balances and wires to Chinese counterparties without a discernible business rationale. FinCEN identified these as suspicious patterns indicative of Chinese money laundering networks involving likely trade-based laundering.

The bank developed a trade-based money laundering detection feature in January 2024, but used it only on activity already under investigation. It did not use the feature during the relevant period to generate alerts or start investigations. A tool that could help explain an existing case was not bringing the missing cases to investigators.

What Is Correspondent Banking in AML?

Correspondent banking lets a bank provide deposits, payments or transaction processing for a foreign financial institution.

Bank of America permitted reduced due diligence for its own foreign branches and affiliates until late 2024. FinCEN found files with insufficient information about expected activity, account purpose and local supervision. Some contained graphs of the parent company’s stock price.

The branches and affiliates maintained accounts for more than 250 nonbank financial institutions, including money services businesses. That business differed from the bank-to-bank transfers emphasized in the bank’s account of its foreign operations. Without sufficient information about those downstream customers and expected payments, the bank lacked the understanding needed to monitor the correspondent accounts effectively.

The Earlier OCC Order Required More Than Plans

The OCC’s December 23, 2024 order identified deficiencies in controls, governance, customer due diligence, staffing, audit and training, and required improvements. Independent consultant work included transaction-monitoring validation and retrospective reviews for missed reports.

It also tied expansion to controls. Before introducing new products or services or expanding into new markets, the bank had to evaluate the risks and establish adequate controls. High-risk expansion needed the regulator’s written go-ahead first.

In its October 2026 penalty order, the OCC found insufficient progress after the earlier order and continuing control gaps.

The Separate Sanctions Settlement

Bank of America agreed to pay $11,662,930 to settle 475 apparent sanctions violations, according to the Office of Foreign Assets Control’s announcement. The sanctions programs covered Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism.

Treasury’s sanctions office described payments routed through blocked banks. A third-party directory used to select intermediary banks included blocked institutions. According to the office, delayed screening updates, mistaken false-positive decisions and alert-suppression rules allowed payments through. Some alerts were automatically suppressed because an analyst had previously cleared an alert based on the same criteria.

The office also described exact matches to a blocked person’s name and date of birth receiving low or medium priority. The match existed, but the bank’s prioritization delayed review. According to the release, the bank fully corrected that defect in February 2024, six months after identifying it.

OFAC reported a vendor error that left watchlist changes unapplied until another U.S. bank blocked a payment downstream. Its account also describes staff dismissing a beneficial-owner alert and mishandling an account with a blocked authorized signer. These alleged failures reached beyond software: people reviewing alerts and handling accounts also let restrictions fail.

The office said the bank initially performed only a narrowly tailored lookback after discovering the routing issue. The full scope emerged only after the agency requested information about recent lookbacks.

What the Lookback Requires

FinCEN requires an independent consultant to review customer activity from January 2022 through completion of the relevant monitoring repairs. The review covers credit cards, negotiable instruments, higher-risk cross-border transactions and previously uninvestigated groups below the old threshold. Its endpoint depends on the remediation work.

The consultant must prioritize potential connections to the southwest border, cartels, narcotics trafficking, Chinese money laundering networks, Iran and Russia.

Other independent reviews address the effectiveness of suspicious-activity monitoring, customer and foreign-correspondent due diligence, and data governance. Monitoring testing covers both interim controls and the revised system after remediation. The work therefore reaches beyond finding old missed reports to whether the replacement controls actually work.

The data review reaches the information feeding those controls: its accuracy, completeness, consistency and timeliness, the systems it passes through and the people responsible for it. That matters in a case where the bank’s inability to distinguish types of negotiable instruments helped leave a monitoring gap open.

What Are the Red Flags for AML Transaction Monitoring?

In this case, the red flags include alerts retiring before review, tests identifying missed reports without effective correction, product categories missing from monitoring and customer warnings that failed to change risk profiles. The evidence sits across model documentation, validation reports, escalation emails, customer reviews and management decisions.

An investigator may understand why a pattern warranted review. An engineer may know how a scoring or suppression rule kept it out. A relationship manager may know what the business was told and what it decided. We work with insiders to connect those views into an account of how the institution’s controls failed and who knew.

FinCEN’s whistleblower program covers Bank Secrecy Act and sanctions violations. Qualifying whistleblowers can collectively receive 10% to 30% of qualifying collections from covered actions with monetary penalties exceeding $1 million. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Our whistleblower experts assess the program that fits your information and bring in whistleblower lawyers who understand bank AML and sanctions cases.

You Know What Happened After the Warning

If you saw testing dismissed, monitoring gaps left open or a customer retained without the promised controls, speak to one of our Whistleblower Experts about what the bank did after the warning. We bring in bank AML whistleblower lawyers with the right experience and stay beside you to build your strongest bank whistleblower case.