Misturat AlausaOn October 13, 2026, the U.S. Department of the Treasury announced enforcement actions against Bank of America, including a $1.2 billion penalty imposed by the Financial Crimes Enforcement Network (FinCEN) for failures involving anti-money laundering controls and suspicious activity reporting.
The enforcement action came after findings revealed that the bank had failed to report more than $5 billion in suspicious transactions on time. Regulators also identified weaknesses in its customer due diligence processes, transaction monitoring systems and internal compliance controls.
For fintechs managing customer funds and financial transactions, the case highlights important lessons. It shows that businesses must go beyond simply having an AML policy and implement effective systems and processes that can identify suspicious behaviour, support timely investigations and demonstrate that compliance controls are working.
What Led to Bank of America’s $1.2 Billion AML Penalty?
The enforcement action involved several regulatory agencies. FinCEN imposed a $1.2 billion penalty on Bank of America for failing to maintain an effective AML programme, conduct adequate due diligence on foreign correspondent accounts and file Suspicious Activity Reports (SARs).
The Office of the Comptroller of the Currency (OCC) also issued a $750 million civil money penalty, which was credited towards FinCEN’s assessment. This followed findings that the bank’s Bank Secrecy Act (BSA)/AML programme remained inadequate despite an earlier enforcement order in December 2024. Separately, the Office of Foreign Assets Control (OFAC) reached an $11.6 million settlement with the bank over apparent sanctions violations.
Some of the key failures identified by regulators included:
- Ineffective transaction monitoring: The bank’s monitoring system failed to properly monitor trillions of dollars in transactions, leading to large numbers of delayed suspicious activity reports.
- Delayed investigations and reporting: Suspicious transactions accumulated without timely investigation, even after internal testing had identified gaps in its processes.
- Inadequate customer due diligence: The bank failed to properly review customers who received substantial payments from unknown third parties, despite emerging risk indicators.
- Insufficient compliance resources: Regulators found that the bank had not provided its compliance teams with sufficient skills, training and expertise needed to manage its AML programme.
- Weak internal controls: The bank relied heavily on external referrals and law enforcement inquiries to detect suspicious activity instead of consistently identifying risks through its own monitoring systems.
These failures resulted in more than $5 billion in suspicious transactions being reported late to FinCEN, including activity linked to potential money laundering, fraud and other priority financial crime risks.
The case shows why transaction monitoring, customer due diligence and suspicious activity reporting must work together. A gap in one area can weaken the effectiveness of the entire AML compliance programme.
5 AML Compliance Lessons Fintechs Can Learn
Although the case involved a major U.S. bank, the lessons apply to fintechs and financial institutions across different markets. As transaction volumes increase and financial crime methods evolve, businesses need to implement compliance controls that can adapt to changing risks. Here are five important lessons fintechs can take from the case.
1. Build transaction monitoring systems around your business risks
An effective transaction monitoring system should go beyond flagging transactions that exceed a fixed amount. It should identify unusual activity based on customer behaviour, transaction history, risk profiles and the nature of the services being used. For example, sudden increases in transaction volume, frequent transfers between unrelated accounts, unusual transaction patterns and activity inconsistent with a customer’s established profile may indicate further investigation. It is also essential for Fintechs to regularly review their monitoring rules and thresholds to ensure they reflect emerging threats, new products and changing customer behaviour.
2. Make customer due diligence an ongoing process
Customer due diligence (CDD) should not end after onboarding. A customer’s risk profile may change over time due to shifts in transaction patterns, business activities, ownership structure or geographic exposure. Fintechs should put in place clear procedures for reviewing customer information, verifying beneficial ownership where applicable, screening customers against relevant sanctions and politically exposed persons (PEP) lists, and updating risk assessments as new information emerges. The Bank of America case demonstrates why businesses must respond to emerging red flags rather than simply documenting them.
3. Investigate suspicious activity alerts promptly
Businesses need more than just generating alerts. They must also have clear processes for reviewing alerts, investigating suspicious activity and escalating cases when necessary. It is also important to define responsibilities, set investigation timelines and document decisions to close or escalate alerts. Where suspicious activity is identified, businesses must also meet applicable reporting requirements, including filing Suspicious Activity Reports (SARs).
4. Invest in qualified compliance teams and adequate resources
Technology alone cannot ensure effective AML compliance. Teams need the knowledge, training and resources to interpret alerts, investigate unusual activity and respond to emerging financial crime risks. Fintechs should ensure their compliance officers understand the risks associated with their products, customers and operating markets. It is also essential to provide regular training and clear reporting lines to senior management.
5. Test your AML controls and act on identified weaknesses
Having an AML system in place does not automatically make it effective. Businesses need to regularly assess whether their controls are identifying the risks they were designed to detect. This includes testing transaction monitoring rules, reviewing alert outcomes, assessing data quality, conducting independent audits and documenting areas that need improvement. Fintechs should also ensure that issues identified through internal reviews or external audits lead to corrective action. Failure to address recurring issues can turn minor control weaknesses into serious compliance failures.
The Bank of America enforcement action shows that financial institutions cannot depend solely on policies, external referrals or technology to meet their AML obligations. Effective compliance requires the right combination of customer due diligence, transaction monitoring, trained personnel and consistent oversight.
Talk to our team to find out how Prembly can support your KYC, AML screening and fraud monitoring needs.