Bank of America’s $1.2 billion AML penalty should put all financial crime compliance (FCC) teams on notice. The bank failed to timely report more than $5 billion in suspicious transactions, while weaknesses identified by its own testing remained unresolved.
What went wrong and how to prepare
On October 13, the U.S. Treasury announced more than $1.2 billion in penalties against Bank of America (BOA) for AML and sanctions failures. That is the third-largest penalty in Treasury's history, and the $750 million share from the Office of the Comptroller of the Currency (OCC) is the largest that agency has ever imposed.
In its resolution with the Financial Crimes Enforcement Network (FinCEN), the bank admitted it willfully violated the Bank Secrecy Act (BSA). It failed to maintain an adequate AML program, conduct due diligence on correspondent accounts for foreign financial institutions, and file required suspicious activity reports. From 2018 to mid-2025, weak controls caused the bank to miss or delay reporting on more than $5 billion in suspicious transactions, including roughly $1 billion tied to national security and other priority illicit finance risks. The U.S. Treasury flagged activity indicative of Chinese money laundering networks, fraud, and potential trade-based money laundering tied to the southwest border.
The core problem sat in how the bank calibrated its transaction monitoring system. BOA’s proprietary system aggregated alerts into customer-level groups that generally needed to reach a 20-point threshold before investigation. FinCEN found that key weights, thresholds, and aggregation periods lacked adequate empirical support. Further, the bank tuned its monitoring to keep investigation workload manageable, often resulting in significant “SAR loss” deemed “permissible.” Why the bank believed a loss of more than 8,200 SARs was permissible was never explained, and detection suffered.
The bank's own testing flagged the problems more than once. In 2022, testing identified an updated alert threshold that would have caught far more suspicious activity than the current settings, but the bank kept the existing threshold, citing case volume. Testing only protects a program when teams act on what it finds. The U.S. Treasury also found that BOA relied on law enforcement inquiries and requests from other financial institutions to surface suspicious activity, effectively outsourcing much of its own detection. For BOA, managing investigation volumes took priority over addressing gaps in detection, resulting in thousands of missed filings.
All FCC teams face the same operational pressures. As transaction volumes grow, rules can generate more alerts than a team can investigate promptly. Reducing unnecessary alerts is a valid goal, but a smaller queue does not demonstrate better monitoring. Raising thresholds or suppressing recurring alerts may ease that pressure, but without testing what those changes exclude, teams risk making the queue manageable while leaving more suspicious activity undetected, and open the door to significant regulatory action down the line.
Simply lowering every threshold creates another problem. More alerts can overwhelm investigators and delay attention to the cases that matter. Effective calibration requires teams to identify which rules generate unnecessary alerts, which thresholds miss relevant activity and how proposed changes affect both.
The OCC also noted that the bank had agreed to a cease-and-desist order in December 2024 to fix these deficiencies and still failed to prioritize BSA/AML compliance afterward. Regulators are watching remediation speed closely. FinCEN made the same point in August, when it fined UBS Financial Services $125 million, the largest BSA penalty ever imposed on a broker-dealer. That was its second action against the firm, which had entered a 2018 consent order over earlier BSA violations.
Four areas to review in your monitoring program
After a fine like this, FCC teams should take a hard look at their own programs. Systems should reflect a documented risk assessment, and teams should review and address every test result, updating controls where appropriate. Any decision not to act on a finding needs a documented rationale. Keeping the workload manageable is never the right answer. Start with four areas before your next regulatory exam:
- Calibration. Review your most recent threshold changes. Understand whether they are supported by testing, or primarily driven by pressure to reduce the queue. Compare current and alternative settings against the same transaction data. Examine activity just below the thresholds and check whether previously identified suspicious cases would still reach investigation. Tune rules for detection first. Before raising a threshold to cut alert volume, engage in at-the-line (ATL) testing, and document what activity would be missed should the level be raised. Financial institutions are not expected to catch every SAR, but should have a documented risk tolerance that can be pointed to when a regulator requests an explanation for the change.
- Coverage. A well-calibrated rule cannot detect activity it never receives. Map every product, payment rail, and corridor to the rules monitoring it, then check that the required transaction data actually reaches those rules, especially for recent launches. BOA’s automated monitoring effectively missed money order deposits, and the OCC found a separate gap that let potential trade-based money laundering through.
- Customer risk profiles. Check that material negative news and other new risk signals trigger a reassessment of the customer’s risk rating and monitoring. BOA’s risk rating model was designed to incorporate negative news, yet it missed one customer’s securities filing disclosing a Department of Justice money laundering investigation, and the bank made no corresponding changes to that customer’s risk profile or monitoring.
- Suppression and rescoring rules. Test every rule that suppresses or rescores alerts before it goes live, and retest it on a regular, documented schedule. FinCEN found that BOA rescored or suppressed alerts without adequate testing. Sample the activity those controls exclude and check whether their original justification still holds. A suppression introduced to remove routine activity can become a blind spot when customer behavior changes.
Beyond these four areas, compliance teams should understand what their systems actually do and use this moment to review their tech stack and governance across teams.
Keeping rule sets efficient and effective
Flagright’s simulation tools let teams compare existing and proposed rule settings against their own historical transaction data before deployment. Teams can measure changes in alert volumes, examine which transactions and customers would be flagged, and test proposed settings against known suspicious cases. This gives them evidence to assess whether a reduction in workload comes at the expense of detection.
For example, if a higher threshold removes unnecessary alerts but also excludes suspicious cases, the team can test more targeted conditions or different thresholds for different customer groups. That creates a practical route to reducing unnecessary investigation work while assessing the effect on detection.
The results also show examiners, auditors, banking partners and regulators what the team tested, what changed, and why it chose the final configuration.
Be ready to explain your monitoring decisions
Talk to Flagright about testing your transaction monitoring rules and evaluating proposed threshold changes.
