The Challenge
Bank of America faced a $1.21 billion enforcement action from three federal agencies for failures in its anti-money laundering (AML) program and alleged sanctions violations. The Financial Crimes Enforcement Network (FinCEN) levied a $1.2 billion penalty, the Office of the Comptroller of the Currency (OCC) imposed $750 million (credited against the FinCEN penalty), and the Office of Foreign Assets Control (OFAC) settled for $11.6 million.
For internal auditors, this enforcement action isn't just about the dollar figure. It's about understanding what breaks down when AML controls fail at a large scale in a major institution. The Treasury Department's announcement emphasized that Bank Secrecy Act (BSA) compliance is a "top priority," indicating that regulatory tolerance for program weaknesses has ended.
The core challenge: how do you audit and validate an AML program that processes millions of transactions daily while maintaining the risk-based approach required under the BSA? Bank of America's lapses suggest their controls couldn't keep pace with their transaction volume, their risk assessment had blind spots, or their governance structure failed to escalate red flags to decision-makers.
The Environment and Constraints
As the second-largest bank in the US, Bank of America operates under heightened regulatory expectations. Your AML program at this scale must satisfy:
- FinCEN's BSA requirements: Customer due diligence, suspicious activity reporting, currency transaction reporting, and recordkeeping obligations.
- OCC's safety and soundness standards: National banks must maintain compliance management systems that identify, measure, monitor, and control compliance risk.
- OFAC sanctions screening: Real-time transaction screening against prohibited parties and jurisdictions.
The main constraint: you can't pause operations to fix your controls. Every day, billions of dollars move through your systems. Your audit program must validate controls without disrupting business continuity, and your findings must translate into remediation plans that executives will fund and implement.
This creates a testing paradox. Sample-based auditing might miss systemic control gaps. Continuous monitoring generates alert volumes that overwhelm investigators. And if your risk assessment model is flawed, you're testing the wrong transactions anyway.
The Approach That Failed
While the enforcement orders don't detail Bank of America's specific control failures, the multi-agency action points to breakdowns across several BSA program pillars:
Transaction monitoring gaps: When FinCEN imposes penalties in the billions, it typically reflects either inadequate scenario coverage (your rules don't detect the typologies you should be watching) or tuning problems (thresholds set so high that reportable activity never generates alerts). Your monitoring system might be running, but it's not seeing what matters.
Customer due diligence weaknesses: OFAC penalties often stem from failures in customer screening or beneficial ownership identification. If you don't know who you're banking, you can't assess sanctions risk. This isn't a technology problem; it's a know-your-customer process failure that technology can't fix.
Governance and escalation failures: The OCC's $750 million penalty suggests the bank's board and senior management didn't receive accurate information about control effectiveness, or they received it and didn't act. Your three lines of defense model only works if the second line can challenge the first line's risk decisions and the third line reports findings that executives can't ignore.
What the Numbers Tell You
The $1.21 billion total breaks down into three distinct regulatory perspectives:
FinCEN's $1.2 billion penalty reflects BSA program failures: suspicious activity reporting lapses, transaction monitoring deficiencies, or recordkeeping violations. This is the functional regulator saying your financial crimes compliance program didn't meet statutory requirements.
The OCC's $750 million penalty (credited against FinCEN's total) addresses safety and soundness. This is the prudential regulator saying your compliance risk management endangered the institution itself.
OFAC's $11.6 million settlement is smaller but carries different weight. Sanctions violations expose you to criminal referrals, not just civil penalties. Even an $11.6 million settlement signals screening failures that let prohibited transactions through.
For your audit committee, these aren't just big numbers. They're a regulatory statement that control failures at this scale threaten financial system integrity.
What They Should Have Done Differently
Run model validation like you'd validate credit risk models: Your transaction monitoring scenarios are models. They predict which transactions warrant investigation. If you don't validate them against known typologies, test them with synthetic suspicious activity, and measure their false negative rates, you're flying blind. Bank of America's auditors should have been challenging the monitoring system's detection rates years before regulators arrived.
Audit the governance layer, not just the controls: Don't just test whether suspicious activity reports get filed. Test whether SAR decisions reach the Money Laundering Reporting Officer, whether the MLRO briefs the board on filing trends, and whether the board asks the right follow-up questions. The OCC's involvement suggests governance failed before controls did.
Treat OFAC screening as a continuous audit target: Sanctions lists change constantly. Your screening system must ingest updates, apply them to existing customers, and generate alerts for retrospective review. If you're only auditing screening at account opening, you're missing the ongoing monitoring requirement that likely triggered OFAC's enforcement.
Quantify your control gaps in risk terms: Instead of reporting "transaction monitoring rules need tuning," calculate the dollar volume of unmonitored activity and the number of customers in high-risk segments without enhanced due diligence. Executives fund remediation when you translate control gaps into exposure metrics they understand.
Takeaways for Your Audit Program
Your AML audit plan must cover all five BSA pillars: internal controls, independent testing, designated compliance officer, training, and risk assessment. If you're only testing controls, you're missing governance and risk methodology failures that regulators will find.
Test your risk assessment before you test your controls: If the institution's BSA/AML risk assessment is wrong, every control you test is potentially irrelevant. Start each audit cycle by validating whether the risk assessment identifies the right customer segments, products, and geographies as high-risk.
Build alert-to-SAR conversion metrics into every audit: If your monitoring system generates 10,000 alerts monthly but only 50 SARs get filed, either your scenarios are poorly tuned or your investigators are clearing alerts they shouldn't. Track conversion rates by scenario and investigator. Outliers reveal problems.
Audit the lookback process: When you find a control gap, does the institution have a methodology for identifying past transactions that should have been reviewed? The absence of a lookback process turns every control failure into a potential willful violation.
Challenge management's remediation timelines: A 24-month action plan to fix transaction monitoring isn't acceptable when you're processing suspicious activity today. Your audit reports should state explicitly whether proposed remediation timelines are reasonable given the risk exposure.
The Treasury Department's message is clear: AML compliance isn't negotiable, and penalties will reflect the scale of your failures. Your job as an auditor is to find the gaps before regulators do, and to report them in terms that force action.
