Lessons From the Recent $1.5 Billion AML Crackdown: What Every Bank Needs to Know

Recent enforcement actions against Bank of America and American Express demonstrate that BSA/AML and sanctions compliance remain top priorities for federal banking regulators. The size of the institutions involved and the more than $1.5 billion in aggregate penalties have attracted significant attention, but the more important message for banks is found in the detailed findings and remediation requirements accompanying these actions. The consent orders provide insight into regulators’ current expectations for transaction monitoring, customer due diligence, sanctions screening, governance, and board oversight, offering valuable lessons for financial institutions of every size.

Overview

In October 2026, federal regulators announced a cluster of enforcement actions against two of the largest U.S. card and banking franchises for Bank Secrecy Act/anti-money laundering (BSA/AML) and sanctions compliance failures. Bank of America, N.A. faces combined monetary penalties of roughly $1.2 billion from FinCEN and the OCC (with the OCC payment credited against the FinCEN penalty), plus a separate $11.66 million OFAC settlement. American Express National Bank consented to an OCC cease-and-desist order and a $350 million civil money penalty, while its holding companies consented to a Federal Reserve cease-and-desist order. Together, the actions signal that regulators expect transaction monitoring, customer due diligence (CDD), and sanctions screening to be empirically grounded, adequately resourced, and overseen by engaged boards.

Bank of America

FinCEN found that, from at least January 2018 through July 2025, Bank of America willfully failed to maintain an adequate AML program, conduct due diligence on correspondent accounts for foreign financial institutions, and timely and accurately file suspicious activity reports (SARs). The bank admitted the facts and admitted willfulness as that term is used in civil BSA enforcement. Key findings include:

• Flawed monitoring system. The bank’s proprietary transaction monitoring system relied on risk weights and a 20-point case-creation threshold that lacked empirical support, used “rescore” and “suppression” rules without adequate governance, and was not meaningfully updated despite adverse internal testing. FinCEN found missed or delayed reporting of more than $5 billion in suspicious activity, roughly $1 billion of it tied to priority risks such as Chinese money laundering networks, fraud, and trade-based money laundering (TBML) with a southwest border nexus.
• Coverage gaps. Monitoring provided only limited coverage of negotiable instrument deposits and inadequate credit card monitoring. Two online auto auction customers deposited tens of billions of dollars in money orders, including over $600 million in suspicious deposits bearing structuring red flags such as sequential money orders totaling just under $3,000.
• CDD failures and revenue over risk. Customer risk ratings changed mainly in response to subpoenas rather than the bank’s own processes. The business retained high-risk customers despite compliance recommendations to offboard them, and in one instance a senior financial crimes leader directed that an unfavorable test be re-performed to obtain a more favorable result.
• Correspondent due diligence. Until late 2024, the bank applied “simplified” due diligence to correspondent accounts for its own foreign branches and affiliates, which together maintained accounts for more than 250 non-bank financial institutions, including MSBs.
• Over-reliance on external triggers and limited cooperation. More than one-third of investigations were driven by “promotion” events such as law enforcement outreach. FinCEN also found the bank’s document productions were often unreasonably delayed.

The OCC found that Bank of America’s BSA/AML program remains deficient after the December 2024 cease-and-desist order and that the bank has not made sufficient progress addressing internal control weaknesses. Findings include written reports showing that between 2019 and 2023 the bank was not filing SARs on approximately 18% to 44% of potentially suspicious activity not referred for investigation; an investigation backlog that peaked at nearly 200,000 cases in 2024; a systemic gap in credit card monitoring; failures of the BSA Officer and Corporate Audit to identify significant deficiencies; failure to collect required information for due diligence on foreign branches and affiliated foreign financial institutions; and roughly 33,300 outgoing wires, totaling about $1 billion, with inaccurate transmittor information in violation of the Travel Rule.

OFAC found 475 apparent violations of multiple sanctions programs between September 2021 and April 2025, valued at approximately $14.8 million. The violations stemmed from (1) an automated payment routing directory, supplied by a vendor, that included blocked Russian, Belarusian, and Iranian banks; (2) a design flaw in the bank’s alert prioritization logic that assigned low or medium priority to alerts on exact name and date-of-birth matches; (3) delayed watchlist updates caused by vendor error and later internal technical problems; and (4) human error in handling business accounts tied to blocked persons. OFAC also cited the bank’s lack of full cooperation with OFAC investigations. OFAC treated the bank’s recklessness, harm to sanctions program objectives, size and sophistication, and prior cautionary letters as aggravating, and it granted no reduction for remediation or cooperation, citing piecemeal and incomplete disclosures.

American Express

The OCC found that American Express National Bank, one of the largest U.S. card issuers, did not maintain a reasonably designed BSA/AML program. Critical deficiencies included a risk assessment focused on the bank’s relatively narrow deposit products rather than its dominant credit and charge card business; ineffective ongoing CDD and customer identification program (CIP) procedures; systemic breakdowns in suspicious activity monitoring and reporting amounting to a pattern or practice of SAR noncompliance; ineffective independent testing; inadequate staffing; and training that was not tailored to job-specific duties. From approximately June 2014 to May 2025, the bank processed approximately $13 billion in suspected TBML activity, in some instances through accounts associated with bank insiders.

The cease-and-desist order requires, among other things:

• A board compliance committee of at least three members, a majority of them independent directors, appointed within 15 days and reporting quarterly.
• An action plan within 90 days, with detailed corrective actions, timelines, and accountable persons, subject to supervisory non-objection.
• An institution-wide BSA/AML risk assessment refreshed at least every 12 months and covering products (including supplemental cardholders), insiders, affiliates, and shared services.
• Enhanced CDD/CIP, a financial crimes risk management program covering third-party risk and ACH limits, and a strengthened suspicious activity review program with tested and documented thresholds and remediation of alert suppression and prioritization weaknesses.
• An independent SAR look-back, an improved independent testing program, staffing and succession assessments, role-based training (including for third parties), and a dedicated insider activity program.

The Federal Reserve cited significant deficiencies in American Express’s enterprise-wide financial crimes risk management, including transaction monitoring, fraud referral processes, and third-party risk assessment. Within 90 days, the board must submit an oversight plan to hold senior management accountable and ensure adequate resources. The company must also submit enterprise-wide BSA/AML and OFAC compliance plans covering oversight of network partnerships, ATM partners, and third parties. Notably, the company may not in the future retain any individual who participated in the underlying misconduct, was subject to formal disciplinary action, and separated from the firm, and it must cooperate in investigations of individuals.

While the specific deficiencies identified at Bank of America and American Express reflect the complexity of large financial institutions, the regulatory expectations underlying the orders are broadly applicable. Banks should view these actions as a supervisory blueprint and evaluate whether similar risks exist within their own BSA/AML and sanctions compliance programs.

Implications and Best Practices for Banks

Though these actions involve very large financial institutions, regulators’ findings and OFAC’s compliance commentary point to lessons for banks of every size.  Key take aways from these orders include:

• Ensuring monitoring is grounded in evidence and that action occurs on test results. Calibrate scenarios, risk weights, and thresholds to your actual risk profile; document the rationale; validate models independently; and respond to adverse testing by changing the controls rather than defending the status quo. Require senior management approval and board reporting for threshold changes.
• Govern suppression, rescoring, and prioritization rules. Both Bank of America (in AML and sanctions screening) and American Express were faulted on alert suppression or prioritization. These rules should be risk-based, supervised, and specifically covered by audit and testing.
• Map coverage across all products and channels. Conduct coverage assessments to ensure that negotiable instrument deposits, credit card activity, and other non-deposit products are monitored, and align the risk assessment with the institution’s dominant business lines.
• Make CDD dynamic and responsive. Update customer risk profiles based on internal alerts, information requests from other institutions, adverse media, and public disclosures, not only on subpoenas. Investigate material deviations between expected and actual activity, including geography and third-party payments.
• Empower compliance against business pressure. Establish clear escalation and decision rights for offboarding or restricting high-risk relationships, and document when the business overrides a compliance recommendation. FinCEN treated prioritizing revenue and avoided compliance spending as aggravating factors.
• Resource the AML program and manage backlogs. Perform staffing and skills assessments, plan for the increase in alert volume that remediation often brings, and report backlogs to management and the board.
• Strengthen independent testing. In both matters, audit and independent testing did not identify deficiencies that examiners found. Testing should be appropriately scoped to the risk profile and should validate corrective actions.
• Manage vendor and technology risk. Each institution remains responsible for its own compliance when it relies on third-party data, routing directories, or screening tools. Monitor vendor watchlist updates, and implement system migrations in a controlled manner to avoid alert backlogs.
• Apply real due diligence to affiliates and correspondents. Do not apply “simplified” due diligence to internal foreign branches or affiliates; understand their customers (including MSBs) and expected account activity.
• Expect board accountability and individual consequences. Both orders place responsibility on the board to oversee remediation and hold management accountable, and the Federal Reserve order restricts the rehiring of individuals involved in misconduct.
• Self-identify, disclose, and cooperate fully. OFAC denied mitigation for piecemeal disclosures, and FinCEN cited delayed productions. Prompt, thorough look-backs, timely responses, and voluntary self-disclosure remain the most reliable paths to penalty mitigation.
• Remediate existing orders on schedule. The OCC penalty against Bank of America followed insufficient progress under a 2024 order, and the orders reserve the right to impose additional penalties for failure to correct violations.

These actions demonstrate that regulators are focused not only on whether institutions maintain written BSA/AML and sanctions policies, but also on whether those controls operate effectively in practice, are supported by adequate resources, and receive meaningful oversight from senior management and the board. Financial institutions should consider reviewing their programs against the themes reflected in these orders to identify and address potential gaps before they become examination findings or enforcement issues. Winthrop & Weinstine’s Bank Regulatory attorneys are available to assist with program assessments, look-back reviews, regulatory responses, and board training.