Bank of America's anti-money laundering fine: what happened (2026)

FinCEN, the OCC and OFAC fined Bank of America $1.21 billion on October 13, 2026. The five failures, the warnings it ignored and the lessons for Mexico.

Pablo Rodríguez · October 14, 2026

Bank of America's $1.2 billion fine for violating anti-money laundering law

On October 13, 2026, the U.S. Treasury Department announced penalties of more than $1.21 billion against Bank of America, the second-largest bank in the United States, for failures in its anti-money laundering program. It is the third-largest penalty in Treasury history and the largest ever imposed by the OCC, the regulator of national banks.

The bank signed a 74-page consent order in which it admits the facts. This is not an accusation: it is the version the bank itself accepted. That is why it is worth reading carefully, because what it describes are not sophisticated schemes but things any business with anti-money laundering obligations will recognize: alerts nobody reviews, customers who pay with other people's money, and warnings from outsiders answered with "we see nothing unusual here."

Here is what happened, which warning signs the bank let pass, what it has been ordered to do and, above all, what anyone who carries out vulnerable activities in Mexico can learn from it. Every source is linked in the text and listed at the end.

What happened, in short

Three Treasury agencies acted on the same day, in a coordinated way:

The OCC's $750 million is credited against FinCEN's penalty, so the bank pays about $1.21 billion in total: $450 million to the Treasury, $750 million to the OCC and $11.7 million to OFAC. By size, it ranks behind Binance's $3.4 billion in 2023 and TD Bank's $1.3 billion in 2024. Unlike those two cases, there was no criminal action by the Department of Justice here, and the order does not cap the bank's growth, as the bank itself confirmed.

The bank admitted acting willfully, in the sense that word has in U.S. civil enforcement: with reckless disregard or willful blindness, not necessarily with an intent to launder money. It takes the full charge in its third-quarter 2026 results, without being able to deduct it from taxes. Its shares fell about 8% the next day.

Five failures that explain the fine

The period under review runs from January 1, 2018 to July 1, 2025. In those seven and a half years, the bank failed to report on time more than $5 billion in suspicious transactions; of that, about $1 billion touched what FinCEN calls national security priorities. The failures come down to five.

1. A system that let alerts pile up for months

The bank monitored its transactions with an in-house system called Event Processor. The problem was not that it did not exist, but how it was calibrated: the thresholds for opening an investigation had no empirical basis, the system aggregated a customer's activity for months before an analyst saw it and, in some cases, the alert came more than a year after the transaction.

The result is telling. For several years, more than a third of the bank's investigations were triggered by someone outside: a law enforcement agency, another bank, a subpoena. Not its own controls. When it finally lowered the threshold in December 2023, a single review of what had been sitting below it uncovered nearly $4 billion in activity that would never have been reported and forced the bank to file more than 8,000 late reports. The bank's own testing and audit teams had been flagging the problem; the OCC added that the compliance officer and staff lacked sufficient expertise and that internal audit never caught it.

2. Money orders in threes, just under the threshold

This is the part of the case most worth understanding. Two of the bank's customers, with accounts dating back to 1995 and 1996, run online platforms that auction salvage vehicles, that is, wrecked or written-off cars, to buyers around the world. Between October 2020 and May 2025 they deposited tens of billions of dollars in money orders purchased at other institutions.

FinCEN analyzed those deposits and found more than 680,000 money orders bundled into some 220,000 groups of three, with sequential numbers, round amounts and totals between $2,900 and $3,000. That is no coincidence: in the United States, anyone buying money orders with $3,000 or more in cash has to identify themselves to the money transmitter. Three $999 money orders dodge the record. One in three purchases was made along the southwest border, far from the normal geographic footprint of those businesses. In all, more than $660 million with indicators of trade-based money laundering that the bank did not report on time.

Why didn't it see it? Because its system barely monitored deposits of negotiable instruments and could not even tell a check from a money order. And although it knew these customers were high risk, it left money orders out of their quarterly activity reviews.

3. Wires that did not match the customer

A third customer, a vehicle exporter linked to the two auction platforms, was on file as a small business with expected sales of $1 to $4 million a year. In about three years it received more than $700 million in wires from high-risk jurisdictions, mainly Georgia and other former Soviet countries, and much of that money started moving right after Russia's invasion of Ukraine. In total, FinCEN counted nearly $1 billion in wires of this kind reported late. The bank closed that account in January 2024, but never reassessed the risk of the two auction platforms, which kept doing business with it.

4. Credit cards in the service of Chinese money laundering networks

Another group of customers claimed to be in logistics or electronics. Their pattern was different: back-to-back credit card purchases at big retailers and shipping companies, payments on credit cards held by unrelated third parties, wires to China described only as "for goods" and counterparties with no website operating from residential addresses. It is the typology of the Chinese money laundering networks that FinCEN described in its August 2025 advisory. The bank had built a trade-based money laundering indicator in January 2024, but only applied it to cases already open; it never used it to generate new alerts. Hundreds of millions of dollars were reported late.

5. Correspondent banking with files for show

Until late 2024, the bank applied "simplified" due diligence to the correspondent accounts of its own foreign branches and affiliates. FinCEN reviewed twelve of them and found files that described the business as "treasury services," named the local regulator and said nothing more, and even included charts of the bank's share price. Meanwhile, those branches served more than 250 non-bank financial institutions, including money transmitters, whose flows the parent did not understand. OFAC also found payments routed through blocked banks and exact name-and-date-of-birth matches with sanctioned persons that were not handled in time.

The warnings it let pass

What turns a system failure into a fine of this size is the list of warnings the bank received and did not act on. The order lists them:

• 2016. Its own investigators note that the first auction platform receives wires from high-risk jurisdictions, that nobody knows who is buying the cars, and that there are cases tied to narcotics investigations involving the purchase and shipment of vehicles.
• September 2021. Another bank asks about dozens of suspicious money orders deposited by the second auction platform. Bank of America replies that it sees no increase in money orders, no unusual patterns and no indicators of illicit activity. More than 51,000 groups of suspicious money orders go through after that answer.
• September 2022. Compliance recommends closing the first auction platform's account because of the third-party payments and the opacity of the source of funds. The bank does not accept the recommendation and takes two years to start restricting money order deposits.
• November 2023. One of those customers publicly discloses that the Department of Justice is investigating it for possible violations of anti-money laundering laws. The bank does not step up monitoring.
• December 2024. The OCC issues a cease-and-desist order for systemic failures. More than a year later, according to the OCC, the bank was still not escalating suspicious activity to its investigators.
• June 2025. An outside reviewer, required by regulators, confirms that the problems with the monitoring system are still there.

The order sums it up in one line: the bank prioritized its revenues and minimized the impact on its compliance resources. The second auction platform brought it more than $25 million over the period; for the first, it had led a $200 million refinancing within a credit facility of more than $1 billion.

What it has been ordered to do

Besides paying, the bank must hire independent consultants, at its own expense, for four jobs, reporting to FinCEN:

1. A lookback from January 2022 to find and report everything it missed: credit cards, negotiable instruments, wires involving high-risk countries and the alerts that sat below the old threshold. It has explicit priorities: the southwest border, cartels and narcotics trafficking; Chinese money laundering networks; Iran; and Russia. The final report is due no later than December 2028, and the reports must be filed within the following 90 days.
2. Effectiveness testing of monitoring, first of the interim controls and then of the corrected system.
3. Testing of due diligence on customers and correspondent accounts.
4. A review of the quality of the data that feeds all of the above.

One detail says a lot about where supervision is heading: the order expressly allows the consultant to use artificial intelligence models to comb through transactions, but requires supervised models, trained on labeled data from the bank itself, with a person deciding what gets reported. Technology helps find; the decision remains human.

What this has to do with Mexico

More than it seems, even though the order barely names the country. Mexico appears once, in the title of FinCEN's advisory on the use of Chinese money laundering networks by Mexico-based criminal organizations, and the word "cartels" only in the priorities of the lookback. Some press reports spoke of $600 million "from Mexican drug trafficking"; the order does not say that. What it says is that there were indicators of trade-based money laundering through salvage vehicles and that a third of the money orders were bought at the border.

But the typology is ours. According to FinCEN itself, Mexican cartels turn to Chinese networks because since 2010 Mexican banks have limited cash deposits in U.S. dollars, which pushed laundering into the United States: the cartel hands dollars to the network there and receives pesos in Mexico within hours, without a single bill crossing the border. Used and salvage cars are one of the classic ways of turning that money into exportable goods. And the case comes little more than a year after FinCEN cut CIBanco, Intercam and Vector off from the U.S. financial system for their role in that same circuit.

The underlying lesson is the same on both sides of the border: having a system is not the same as having a system that works. And what gets examined is not your manual, but your evidence.

Four lessons if you carry out vulnerable activities

1. Splitting transactions just under the threshold is the oldest trick there is, and it still works. Three $999 money orders in the United States are the equivalent of several transactions that, added together, exceed the reporting threshold in Mexico. That is why the Regulations to the Law add up the same customer's transactions of the same type over a period of up to six months. If your threshold control looks at each transaction on its own, it is not doing its job.
2. Find out who is paying. The auction platforms' problem was that they received money from unknown third parties. The Law requires you to identify your customer's beneficial owner, with the more-than-25% threshold of the 2025 reform. A customer who pays with someone else's funds is an open question, not just another payment.
3. If someone outside warns you, you are already late. A request from the UIF, a question from a bank or a news story about your customer are not paperwork: they are the sign that your own system did not catch it. And whatever you say in your reply stays on the record, as Bank of America learned in 2021.
4. Alerts get handled, not stockpiled. The difference between an alert and a finding is that someone reviewed it, decided and documented it. If you sell vehicles, for instance, the Law bars you from taking cash from 3,210 UMA and requires a notice from 6,420; what an inspection will ask for is proof that this was checked transaction by transaction.

That is exactly what SiennaDocs keeps for you: each customer's file with its beneficial owner, automatic aggregation of transactions for threshold control, alerts with who handled them and when, and notices to the UIF with their history. Book a demo and we will review together where your company stands.

Frequently asked questions

How much did Bank of America pay, and to whom? About $1.21 billion in total: $450 million to the Treasury for FinCEN's penalty, $750 million to the OCC, credited against FinCEN's, and $11.7 million to OFAC for sanctions violations.

Is it the largest anti-money laundering fine ever? No. It is the third-largest in U.S. Treasury history, behind Binance, with $3.4 billion in 2023, and TD Bank, with $1.3 billion in 2024. It is the largest the OCC has ever imposed.

Were there criminal charges? No. Unlike Binance and TD Bank, the Department of Justice was not involved. These are civil and administrative penalties, and the bank keeps operating without an asset cap.

What is a SAR, and what is its equivalent in Mexico? It is the suspicious activity report that U.S. banks file with FinCEN, normally within 30 days. Its closest equivalent for those who carry out vulnerable activities is the notice (aviso) to the UIF, and for financial institutions, the unusual transaction report.

What are Chinese money laundering networks? Groups of professional launderers who buy cash dollars from cartels in the United States and sell them to Chinese citizens who want to move money out of China, while delivering pesos to the cartel in Mexico. FinCEN published an advisory on them in August 2025 and a Spanish translation in January 2026.

Does this affect the bank's Mexican customers? The order does not mention accounts or customers in Mexico. What does change is that the bank will have to review, as a priority, every transaction since 2022 with a nexus to the southwest border and cartels, and report what it finds.

This content is informational and does not constitute legal advice. Information current as of October 14, 2026; always verify the current sources or consult a specialist.