Bank of America let more than $5 billion in suspicious money walk through its books — a billion of it tied to national-security threats — and the government’s own explanation for why is a single word: the bank prioritized its revenues. That word is the entire story.
The bill arrived this week: $1.21 billion in combined penalties from FinCEN, the OCC, and OFAC — three actions we covered when they landed — the third-largest fine in Treasury history.
Treasury Secretary Scott Bessent did not soften it. When a bank this size fails its anti-money-laundering and sanctions obligations, he said, “the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks.” That is not a metaphor. That is the Treasury secretary, on the record, naming the risk to the country’s financial plumbing and pointing at one institution.
The OCC’s piece of it — $750 million, the largest civil penalty in that regulator’s history — rests on a detail that ought to stop a reader cold: the bank had already been ordered to fix this. A 2024 cease-and-desist order flagged the shortcomings. The OCC called the program “deficient and ineffective” and said the bank’s transaction-monitoring system delayed suspicious-activity reports on billions of dollars. Two years. Two years to repair a compliance program that was not catching the most basic red flags, and the bank still could not get it right.
That is not a mistake. That is a choice.
OFAC added $11.6 million for more than 400 apparent violations, including payments that should never have cleared because they touched Russia and Iran. The dollar figure is the smallest on the page. It is also the item on that page that decides whether hostile states and criminal networks can move money through an American bank, and Bank of America’s controls let them through.
A Bank of America spokesperson supplied the standard boilerplate: the bank has “invested billions of dollars in technology and dedicated thousands of employees to combat financial crime.” That sentence is the indictment. Investing billions while your transaction-monitoring system lets $5 billion in suspicious activity walk out the door is not compliance. It is a marketing line — a too-big-to-manage bank explaining, in brochure language, why it was too busy to watch the money. The OCC’s own finding names the mechanism: the bank “prioritized its revenues” in building those programs. Compliance was run as a cost center to be optimized, not a defense to be funded.
Now put that next to what happens to everybody else. The same OFAC rules that cost Bank of America $11.6 million carry, for a human being, up to twenty years per willful violation and forfeiture of every dollar the payment touched. The banking statutes do the same to anyone who looks away on purpose: a check-cashing storefront that filed the same reports late loses its license and its correspondent accounts, and its owner, if the government decides the misses were willful, goes to federal prison. That is the treatment reserved for the small and the individual. It does not arrive with a press conference. Frank Wilhoit wrote the rule down and it has never once been wrong: an in-group the law protects but does not bind, an out-group the law binds but does not protect.
The sweep is real. American Express paid $350 million for the same category of failure days earlier. But every line of that sweep ends the same way: a charge, a consent order, a renewed commitment, and next quarter’s buyback.
The market priced it inside a day. Shares closed down 1.1 percent and slid another 2.7 percent after hours. The $1.2 billion charge is non-tax-deductible and will cut third-quarter net income by roughly 17 cents a share, dragging earnings below the $1.10 adjusted figure analysts had penciled in — and it lands ahead of Wednesday’s release. Do the arithmetic on the whole penalty: $1.21 billion against a bank running roughly $6 billion in share buybacks every quarter. Eighteen days. The largest penalty in the OCC’s history costs this franchise about eighteen days of buying its own stock back.
Which brings us to the tell. UBS’s Erika Najarian noted the thing that matters: no asset cap. The regulator’s menu has a cap on it — the one item on it that would actually restrain the franchise, limit how large the bank could grow, and put a number on what misbehavior costs the business rather than the quarter. The OCC, levying the largest civil penalty in its own history, did not reach for it. It reached for the item that gets paid out of one quarter’s income statement and never touches the balance sheet at all. That is not an oversight. That is the exception, written in the one place regulators still put it in writing.
The deepest entry on the docket is not the share price. It is the $1 billion in national-security-relevant activity the bank’s own systems failed to surface. It is the Russia and Iran payments that should have been blocked. It is the consent order’s requirement that Bank of America hire an independent third party to review past transactions — meaning the scope of what it missed is not yet known, and the bank could not be trusted to run the review itself. That $5 billion may be the floor, not the ceiling.
Bank of America will pay, reshuffle a few executives, renew its “commitment,” and let an outsider reconstruct what its own systems were built to find. The monitoring will get a facelift. And the next time a Treasury secretary has to explain how hostile actors and criminal networks move money through American banks, the answer will once again be that the bank prioritized its revenues.
That word keeps doing all the work. It should.