By market capitalization, Bank of America (BOFA) is the second-largest bank in the world. It has policies, monitoring systems, compliance personnel, investigators, and auditors. Despite these systems and controls, it will now pay over US$1.2 billion for violations of law that its systems and personnel should have caught.
Background
According to federal regulators, BOFA failed to timely report more than $5 billion in potentially suspicious transactions.
- FinCEN has now assessed a $1.2 billion penalty against the bank for willful violations of the Bank Secrecy Act. (BSA). BOFA admitted that it failed to maintain a legally sufficient anti-money laundering (AML program), conduct required due diligence for foreign correspondent accounts, and file Suspicious Activity Reports.
- The OCC concurrently assessed a $750 million penalty, the largest in OCC history, citing an ineffective BSA/AML program that failed to properly monitor trillions of dollars in transactions. (That amount is credited against FinCEN’s penalty.) The bank was already subject to a December 2024 cease-and-desist order that required it to address faults in its BSA/AML compliance program. According to the OCC, the bank failed to complete many significant remedial actions the order required.
- Separately, OFAC also announced an approximately $11.6 million settlement involving apparent violations of sanctions programs covering Iran, Russia, narcotics trafficking, and global terrorism.
The Takeaway
Having a compliance program is not the same as having an effective compliance program.
Regulators expect financial institutions to:
- Monitor transactions based on their actual risk;
- Investigate and report potentially suspicious activity on time;
- Employ qualified and properly trained personnel;
- Test the efficacy of their systems; and
- Promptly fix known deficiencies.
Policies are not enough. The government measures compliance by what a company actually detects, reports, and corrects. For BOFA, the difference costs more than $1.2 billion.
