FinCEN Takes Major AML Enforcement Action Against Bank of America
On October 13, 2026, the Financial Crimes Enforcement Network (FinCEN), an agency of the U.S. Treasury Department, announced a $1.2 billion penalty against Bank of America. The enforcement action concerns the bank's failure to adequately mitigate and report certain national security risks, including risks associated with China-related financial activity.
FinCEN is a key U.S. authority responsible for enforcing requirements under the Bank Secrecy Act (BSA). Financial institutions subject to these requirements must maintain effective anti-money laundering programs, identify suspicious financial activity, and submit Suspicious Activity Reports (SARs) when legally required.
The penalty highlights regulators' expectations regarding institutional risk identification and reporting. Banks cannot rely solely on standard customer identity verification procedures. They must also monitor account activity, identify unusual flows of funds, and ensure that internal controls can respond to potential financial crime risks in a timely manner.
Importantly, enforcement action concerning deficiencies in compliance controls and risk reporting does not mean that every transaction involving a particular country or region is unlawful. Financial institutions must assess individual transactions in light of customer profiles, transaction purposes, and relevant risk indicators.
Transaction Monitoring and SAR Filing Are Essential AML Controls
An effective AML framework typically includes customer due diligence, transaction monitoring, risk assessments, and suspicious activity reporting. Transaction monitoring is designed to identify activity that differs significantly from a customer's expected financial behavior.
Examples include unusually frequent transfers, rapid movement of funds between accounts, transaction volumes inconsistent with a customer's business profile, or payment flows involving high-risk jurisdictions. However, an individual risk indicator does not establish that money laundering has occurred. Financial institutions must consider the wider context, including customer information, transaction purposes, and the source of funds.
When a bank identifies potentially suspicious activity, it must determine whether a SAR should be filed under applicable legal and regulatory requirements. These reports help authorities identify financial networks, investigate potential criminal activity, and trace illicit proceeds.
Weak monitoring rules, outdated risk models, unresolved alert backlogs, and failures to escalate concerns can undermine an AML program. Even institutions with comprehensive written policies may fail to meet regulatory expectations if their controls do not operate effectively in practice.
Financial institutions should therefore test their monitoring systems regularly, verify that risk scenarios cover relevant business activities, and use human review and model adjustments to reduce missed alerts and unnecessary escalations. They should also retain investigation records, supporting risk assessments, and reporting documentation to demonstrate that controls are functioning as intended.
Traditional Banking AML Standards Offer Lessons for Digital Asset Firms
Although FinCEN's enforcement action concerns a traditional bank, its underlying regulatory principles are also relevant to digital asset service providers. Cryptocurrency exchanges, custodians, and payment platforms must identify customer risks, monitor unusual transactions, and meet applicable reporting obligations.
Digital asset businesses face additional challenges arising from blockchain transactions. These include cross-chain transfers, wallet clustering, exposure to mixing services, and the movement of funds through multiple platforms or intermediary addresses. Customer registration data and basic transaction thresholds alone may not be sufficient to identify complex financial flows.
Crypto businesses therefore need to combine blockchain analytics with conventional AML controls. Wallet screening, behavioral analysis, customer risk scoring, and continuous monitoring can help create a more comprehensive financial crime prevention framework.
Compliance should not be measured solely by whether a company has written AML policies or monitoring software. Businesses must also demonstrate that their systems can detect risks promptly, employees can handle alerts appropriately, investigations are documented, and regulatory reports are submitted when required.
The $1.2 billion penalty serves as another reminder that AML compliance is not a one-time policy exercise. It requires continuous operation, regular testing, and ongoing improvement. For both traditional financial institutions and digital asset businesses, effective transaction monitoring and reporting remain essential to protecting the integrity of the financial system.