On October 13, 2026, the U.S. Financial Crimes Enforcement Network (FinCEN) announced a $1.2 billion penalty against Bank of America for failures involving the mitigation and reporting of priority national security risks, including risks linked to Chinese money laundering networks and illicit finance along the U.S. southwest border. Separately, the Office of the Comptroller of the Currency assessed a $750 million civil money penalty, while the Office of Foreign Assets Control announced an $11.6 million settlement concerning apparent violations of multiple sanctions programs.
According to FinCEN, Bank of America admitted violations of the Bank Secrecy Act. The agency said the bank failed to maintain an anti-money laundering program meeting minimum legal requirements, conduct required due diligence for certain correspondent accounts involving foreign financial institutions, and file Suspicious Activity Reports as required.
Although the case concerns traditional banking, its lessons are relevant to cryptocurrency exchanges, custodians, and payment providers. As digital asset activity expands, compliance programs must do more than identify risky customers. They must continuously monitor transactions, escalate suspicious activity, and maintain records that allow investigations and decisions to be reviewed.
What the $1.2 Billion Penalty Reveals About AML Controls
The enforcement action addressed several areas of concern, including the effectiveness of the bank’s AML program, due diligence for foreign financial institution correspondent accounts, suspicious activity reporting, and sanctions compliance. It illustrates that written compliance policies are not enough. Financial institutions must also demonstrate that their controls operate effectively in practice.
Similar weaknesses can arise at digital asset platforms during customer onboarding, wallet screening, transaction monitoring, and suspicious-activity investigations. If customer risk ratings are not updated or sanctions data is outdated, monitoring systems may fail to recognize changing risks. If alerts lack clear ownership, escalation criteria, and investigation deadlines, potentially suspicious transactions may not receive timely attention.
Suspicious activity reporting is another essential part of the control process. Detecting unusual transactions does not necessarily complete a compliance obligation. Institutions must assess whether reporting is required under applicable law and ensure that relevant records are accurate, complete, and timely. Monitoring, investigation, and reporting should operate as connected processes rather than isolated functions.
The legal requirements applicable to banks should not automatically be assumed to apply identically to every crypto business. Digital asset providers must determine their obligations based on their regulatory status, activities, and jurisdictions.
How KYT Helps Digital Asset Platforms Identify Transaction Risks
Know Your Transaction (KYT) analyzes blockchain records, address relationships, fund flows, and risk indicators to identify activity that may warrant further investigation. While Know Your Customer (KYC) focuses primarily on customer identity and due diligence, KYT examines transaction behavior and the movement of assets. Used together, they provide a more comprehensive view of risk.
For example, a customer’s identity information may appear normal, while their wallet receives funds associated with known scam activity and rapidly transfers the assets to other addresses. A KYT system can generate alerts based on transaction paths, address-risk indicators, and unusual fund movements, allowing compliance teams to examine the transaction context, customer behavior, and source of funds.
For sanctions-related risks, address screening and transaction-path analysis can complement each other. If monitoring identifies a connection between funds and a known sanctioned entity, the platform can verify the available information and determine appropriate next steps under applicable law and internal procedures. A risk label alone does not prove wrongdoing, so investigators should consider customer records, transaction context, and the reliability of the underlying data.
An effective KYT program also requires continuous monitoring. Businesses should regularly update risk intelligence, review alert rules, and preserve the reasons for alerts, associated transactions, investigation findings, and final decisions. Automation can improve efficiency, but it does not eliminate the need for human review, legal assessment, or formal reporting procedures.
Building an Auditable AML Monitoring Framework
Digital asset businesses can strengthen the connection between AML and KYT through three practical measures. First, establish clear risk categories and escalation criteria. Monitoring rules should reflect customer types, transaction volumes, sources of funds, address relationships, and business context. They should also be reviewed regularly to account for emerging fraud techniques and changing regulatory expectations.
Second, implement a complete alert-management workflow. Significant alerts should have clearly assigned investigators, defined response times, review requirements, and documented outcomes. For high-risk activity, firms should retain relevant blockchain records, risk indicators, investigative steps, and decision rationale to support internal audits and regulatory examinations.
Third, measure monitoring effectiveness continuously. Useful indicators include the speed of risk-data updates, alert accuracy, false-positive rates, investigation backlogs, and reporting timeliness. A system that identifies potential risks but cannot ensure that alerts are investigated and resolved appropriately still has a material control gap.
The Bank of America enforcement action demonstrates that effective AML compliance depends not only on policies and technology, but also on consistent execution and a complete evidence trail. For digital asset service providers, integrating KYT, customer due diligence, sanctions screening, and case management into a unified workflow can improve risk detection and make compliance decisions more transparent and auditable.