When the Treasury imposes a $1.21 billion penalty on Bank of America for willful anti-money laundering and sanctions violations, including failure to report over $5 billion in suspicious transactions, the message is clear: your compliance program must be effective before regulators test it.
This checklist guides you through the core requirements your BSA/AML/CFT Framework must meet to avoid the systemic failures that led to Bank of America's record fine and the $350 million American Express settlement that preceded it. Each item reflects obligations under the Bank Secrecy Act, FinCEN regulations, and OFAC sanctions requirements.
Prerequisites
Before starting this checklist, ensure you have:
- Access to your BSA/AML compliance program documentation (policies, procedures, risk assessment)
- Current sanctions screening configuration (filters, lists, matching logic)
- Transaction monitoring rules and alert disposition logs from the past 12 months
- Suspicious Activity Report filing records and escalation workflows
- Board and senior management meeting minutes related to BSA/AML oversight
If you don't have immediate access to these documents, that's your first red flag.
Core Compliance Checklist
1. Independent Risk Assessment (31 CFR 1020.210)
☐ Done state: You've completed a written BSA/AML risk assessment within the past 12 months that identifies specific money laundering and terrorist financing risks based on your products, services, customers, and geographic footprint.
Good looks like: A board-approved document that names high-risk customer segments, quantifies exposure by product line, and drives resource allocation decisions. Not a vendor template with your logo added.
2. Sanctions Screening Coverage (31 CFR Part 501)
☐ Done state: Your screening filters cover all OFAC-administered sanctions programs. You've verified no "blocked banks" or designated persons appear in your payment directory, and you screen payments at origination and upon receipt.
Good looks like: Documented evidence that you identified and removed sanctioned entities from your correspondent banking directory. Bank of America continued processing $14.3 million in payments through 35 blocked banks due to outdated filters. You can't afford that gap.
3. Alert Escalation Protocols
☐ Done state: You have written procedures requiring analysts to escalate potentially suspicious activity to investigators within a defined timeframe, typically 24-48 hours for high-risk alerts, and you can prove investigators received those escalations.
Good looks like: An audit trail showing that alerts flagged as "potentially suspicious" moved to investigation queues, not dispositioned as false positives by first-line reviewers. Treasury noted Bank of America "failed to escalate potentially suspicious activities to investigators for review" more than a year after receiving a cease-and-desist order. Your escalation log should show the opposite.
4. Transaction Monitoring Rules Validation
☐ Done state: You've tested your transaction monitoring rules within the past 12 months using known suspicious activity patterns and confirmed the rules generate alerts as designed.
Good looks like: Documentation showing you ran test scenarios and the monitoring system flagged them. If your rules didn't catch $5 billion in reportable activity, you have a detection problem, not just a reporting problem.
5. Suspicious Activity Report Filing (31 CFR 1020.320)
☐ Done state: You file FinCEN SARs within 30 days of initial detection for transactions involving or aggregating $5,000 or more where you know, suspect, or have reason to suspect the transaction involves funds from illegal activity, is designed to evade BSA requirements, or lacks business purpose.
Good looks like: A Suspicious Activity Report log showing dates of detection, investigation completion, and BSA E-Filing System submission, with no gaps exceeding 30 days. Treasury's finding that Bank of America failed to report over $5 billion in suspicious transactions suggests systemic detection or filing failures.
6. Sanctions Violations Remediation
☐ Done state: When you discover a sanctions violation, you file a voluntary self-disclosure with OFAC within 30 days, block or reject the transaction, and conduct a lookback to find similar violations.
Good looks like: A documented response protocol that Bank of America lacked. Between September 2021 and April 2025, the bank committed over 475 sanctions violations. OFAC noted the bank acted "recklessly" and had received "multiple cautionary letters regarding substantially similar conduct" but didn't remediate. Your protocol should trigger immediate review when you detect one violation.
7. Board and Senior Management Oversight (12 CFR 21.21)
☐ Done state: Your board receives quarterly BSA/AML/CFT Framework reports including alert volumes, SAR filings, audit findings, and remediation status. Senior management approves policies and resource requests.
Good looks like: Meeting minutes showing board members asked specific questions about program deficiencies and management provided remediation timelines with accountability. Treasury found Bank of America's "management failed to ensure the Bank had an effective BSA/AML compliance program and continued to minimize the program's significant deficiencies." Your minutes should show the opposite: escalation, not minimization.
8. Independent Testing (31 CFR 1020.210(b)(3))
☐ Done state: You've completed an independent BSA/AML audit within the past 12-18 months (depending on your risk profile) that tested transaction monitoring effectiveness, SAR decision-making, and sanctions screening accuracy.
Good looks like: An audit report that identifies control gaps with specific remediation deadlines and assigns accountability to named executives. Not a clean opinion when your monitoring missed billions in suspicious activity.
Common Mistakes
Treating technology as a substitute for human judgment. Treasury noted Bank of America's violations resulted from "outdated screening filters, human error, and technological failings." Your screening system is only as good as your filter maintenance and analyst training.
Conducting reviews that don't find the full scope. Bank of America reviewed its sanctions compliance after discovering the issue in March 2022 but "did not identify the full scope of the transactions until after OFAC subpoenaed the firm in January 2025." Your lookback methodology must be comprehensive, not cosmetic.
Assuming prior penalties bought you time. The OCC's $750 million fine followed a December 2024 cease-and-desist order. A year later, regulators found the bank "still had not taken key steps to remediate the shortcomings." Consent orders don't pause enforcement; they accelerate scrutiny.
Next Steps
If you checked every box above with documentary evidence, schedule your next independent audit. If you found gaps, prioritize them by regulatory exposure:
- Sanctions screening gaps (immediate OFAC risk)
- Suspicious Activity Report backlogs (FinCEN enforcement risk)
- Alert escalation failures (program effectiveness risk)
- Board reporting deficiencies (governance risk)
Then document your remediation plan with specific completion dates and assign executive accountability. Treasury Secretary Scott Bessent said the penalties "send a clear message that even the biggest financial institutions are not above the law." Your checklist is your first line of defense.
