The US Treasury Department's $1.21 billion penalty against Bank of America is one of 2025's major AML enforcement actions. The penalties came from three agencies: FinCEN imposed $1.2 billion, the OCC added $750 million (credited against FinCEN's total), and OFAC contributed $11.6 million for sanctions violations. Treasury's statement that BSA and AML enforcement is a "top priority" clarifies the regulatory direction.
This isn't just about one institution's failures. The multi-agency coordination and penalty structure reveal how regulators are addressing systemic compliance gaps in 2025.
What the Enforcement Action Shows
The three-agency approach signals a shift in enforcement strategy. FinCEN's $1.2 billion penalty addresses BSA program deficiencies. The OCC's $750 million focuses on safety and soundness concerns tied to compliance infrastructure. OFAC's $11.6 million targets specific sanctions control failures. Each agency used its authority to address different aspects of the same compliance breakdown.
When regulators coordinate at this scale, they're documenting patterns, not isolated incidents. The penalty structure suggests ongoing deficiencies across transaction monitoring, customer due diligence, and sanctions screening systems.
Five Critical Findings for Your Program
1. Transaction monitoring gaps create compounding liability
Banks face penalties not just for missing suspicious activity, but for operating monitoring systems that couldn't reasonably detect it. If your rules haven't been updated in 18 months, you're running a compliance theater, not a control framework. Regulators expect you to document rule performance, false positive rates, and scenario coverage against your risk assessment.
2. Sanctions screening failures carry separate penalties
OFAC's $11.6 million fine shows that sanctions violations are treated as distinct regulatory failures, even when stemming from the same systemic weaknesses. Your sanctions screening can't rely on outdated name-matching algorithms from 2018. Fuzzy matching thresholds, transliteration tables, and screening frequency all require documented risk-based decisions.
3. Multi-agency coordination means overlapping examinations
When FinCEN, OCC, and OFAC coordinate, you're not getting three separate exam cycles. You're getting one comprehensive review where each agency focuses on its jurisdiction while sharing findings. Your response can't be siloed. If your transaction monitoring team doesn't coordinate with sanctions compliance and your BSA officer, examiners will document that gap.
4. Remediation timelines matter as much as initial violations
Large penalties often reflect not just the original failure, but inadequate or delayed remediation. If you've received MRAs (Matters Requiring Attention) or MRIAs (Matters Requiring Immediate Attention) from your primary regulator, your board should track remediation weekly, not quarterly.
5. Technology gaps are no longer acceptable excuses
The scale of these penalties suggests that "we're working on system upgrades" doesn't satisfy examiners anymore. If your transaction monitoring system can't ingest real-time data, apply risk-based thresholds by customer segment, or requires manual workarounds for sanctions screening, you're documenting your own liability.
What This Means for Your Team
Your executive leadership will ask whether you're exposed to similar risks. You need specific answers, not reassurances.
Run a gap analysis against these questions: Can your transaction monitoring system detect structuring below your CTR threshold? Does your sanctions screening occur before payment execution for all channels, including wires, ACH, and card transactions? Do you have documented evidence that your monitoring rules detect the typologies in your risk assessment?
If you're at a regional or community bank, don't assume this doesn't apply to you. Regulators scale expectations to your size, but they don't scale their intolerance for documented deficiencies. A $50 million bank with broken monitoring rules faces the same enforcement risk as a $2 trillion bank, just with smaller absolute penalties.
Your board needs to understand that AML compliance isn't a cost center you can optimize through efficiency. It's a risk management function that requires sustained investment. When Treasury publicly announces that BSA enforcement is a "top priority," your board's fiduciary duty includes ensuring adequate compliance resources.
Action Items by Priority
Immediate (Next 30 Days)
Review your most recent regulatory exam findings and internal audit reports. Document the status of every open MRA and MRIA. If any remediation deadline has slipped, escalate to your board's risk committee with a revised timeline and resource request.
Verify that your sanctions screening occurs pre-transaction for every payment channel. If you're screening post-execution for any channel, document the risk acceptance and mitigation controls.
Short-Term (60-90 Days)
Conduct a transaction monitoring rule validation. For each scenario, document: the typology it's designed to detect, the threshold rationale, the last tuning date, and the alert-to-SAR conversion rate. If you can't produce this documentation for every rule, you're not operating a risk-based program.
Test your Customer Due Diligence refresh process. Pull a sample of high-risk customers and verify that you've updated beneficial ownership, source of funds, and expected activity within your policy timeframes.
Ongoing
Establish a quarterly compliance technology assessment. Your MLRO, CTO, and a board member should review system limitations, vendor roadmaps, and technology gaps that create manual workarounds. Document decisions to accept technology risk with specific compensating controls.
Create a regulatory coordination protocol. When one agency issues findings, assess whether the same gap affects other compliance areas. FinCEN findings about transaction monitoring often reveal sanctions screening weaknesses.
