“Not Above the Law”: Lessons from Treasury’s Record Action Against Bank of America
On October 13, the U.S. Treasury announced more than $1.21 billion in penalties against Bank of America, the third-largest penalty in Treasury history. It failed to report more than $5 billion in suspicious transactions on time, and over $1 billion of that was tied to priority risks like Chinese money laundering networks and trade-based money laundering along the southwest border. The OCC added a $750 million civil money penalty for what it called a “deficient and ineffective” BSA/AML program, and OFAC settled 475 apparent sanctions violations for $11.6 million.
The Treasury says the bank relied on law enforcement inquiries and requests from other institutions to catch suspicious activity instead of its own controls while alerts sat uninvestigated, and the approach stayed in place even after testing exposed these problems. Management knew for years that activity wasn’t reaching investigators, showing a pattern of negligence and non-compliance.
We gathered former OCC bank examiners, BSA Officers, and certified fraud examiners from RiskScout to weigh in on what went wrong and what institutions like you can learn from these costly mistakes.
Insights from the Experts
Corey Lynch, CAMS - AML & Fraud Solution Expert
“Set it and forget it!” Ron Popeil made that line famous selling Showtime Rotisseries, and it works fine for a chicken. It doesn’t work for a compliance platform.
Buying software isn’t the finish line, and neither is a clean implementation with good data. Institutions need a way to keep checking what their systems produce. That means quality assurance testing to confirm alerts reach investigators and get worked. It means monitoring dashboards that show backlogs and model drift before an examiner does. And it means peer comparisons that flag when your alert or SAR volumes are out of step with similar institutions.
Your vendor matters just as much. It has to be a partner, not just a supplier, and it should meet with you on a regular schedule to tune the system, walk through updates and hear your feedback on what you need. This discipline will matter even more as artificial intelligence takes on more of the work. Criminal networks are more intertwined and systems more complex, and software alone can’t close that gap. Automation is taking over repetitive, low-level reviews. That frees investigators to build expertise where judgment and intuition matter, and to be the human in the loop who keeps testing the results. We expect staffing to shift toward complex investigations and quality assurance. Bank of America’s alerts were firing; nobody made sure they reached an investigator.
Ryan McInerny, APRP, CAMS, FRM, MSBA - Former OCC Bank Examiner
When I was an examiner, findings weren't written to tell the rest of the industry what to worry about. A consent order describes one institution's program, measured against the same laws and guidance every bank is held to. So I read this one for the reasons behind the failures first, and the typologies second. The specific risks will look different at a community bank. The causes carry over: monitoring that doesn't cover every product, thresholds nobody has tested, and known problems left open.
Where this order does look ahead is national security. FinCEN defined four "Priority Illicit Finance Risks": the southwest border, cartels, and narcotics; Chinese money laundering networks; Iran; and Russia. It directed the bank's lookback to review those first, using graph analytics and network analysis. I would expect examiners to ask whether a risk assessment reflects the priorities that touch an institution's own footprint, such as check deposits from auto dealers or wires to high-risk jurisdictions, and whether monitoring can link related customers and accounts as well as single transactions.
The sequence matters too. The OCC issued Bank of America a cease-and-desist in 2024. The 2026 orders found the bank hadn't made sufficient progress, and FinCEN found the violations willful (big distinction). An MRA (which probably happened before the cease and desist) is the cheapest point to fix a problem. But in this case, the root causes permeated over a longer period of time.
Just take a look at the difference between this action vs. the recent American Express enforcement action. The misconduct period is shorter, but there was already a formal action cited in 2024 (and more significant findings). Allowing findings or systemic issues to sit (willful or unwillful) forces the hand of regulators to take more severe actions to ensure the safety and soundness of the institution.
Kristin Parker, CAMS, CAFP - Former BSA Officer
“Alerts sat uninvestigated” is the line from Treasury’s findings that stuck with me. I’ve sat in the BSA chair, and alert queues rarely grow because nobody cares. They grow because the work outpaces the people trained to do it. A new product launches, a fraud trend spikes, a threshold tightens after an exam, and suddenly your one-and-a-half-person BSA department is drinking from a fire hose. And skill matters as much as headcount: an analyst who’s never been trained to spot elder exploitation or trade-based laundering can clear alerts all day long and still miss what counts. A tidy queue isn’t the same as a working program.
Treat staffing like any other risk. Track alert volume, time to disposition, and aging every month, and when the numbers start creeping because the work is growing, walk them into the boardroom with a specific ask, not a memo about your feelings. Cross-train so one beach vacation doesn’t put your SAR deadlines in jeopardy, and tie training to your actual risk assessment, not just the annual checklist. My rule of thumb: if your risk profile has changed in the last three years and your staffing plan hasn’t, you’ve got a gap. Much better for you to find it than for your examiner to.
Stephanie Macrafic, CFE - Veteran Fraud Investigator
One detail in Treasury’s findings should stop every fraud team cold: Bank of America relied on law enforcement inquiries and requests from other banks to surface suspicious activity, instead of its own controls. Someone outside the building was connecting dots the bank should have connected first.
Identifying a risk is only the beginning. Treasury found that alerts sat uninvestigated while management knew for years that activity wasn’t reaching investigators. At community institutions, many of those dots already sit with the fraud team. A teller flags an elderly member’s unusual wire. An analyst closes a check-kiting case once the loss is recovered. Was that activity ever evaluated for a SAR? Too often, fraud and BSA run on separate systems, separate queues, and separate definitions of “done.”
When referrals start piling up, don’t wait for an examiner to tell you it’s a problem. A growing backlog is a signal to act now, not a concern to document and revisit later. Make escalation easy and expected: use a shared case record, set a clear trigger for when a fraud case becomes a BSA referral, and make one person accountable for closing the loop.
Your own staff should be your first source of intelligence, not a subpoena. If law enforcement is telling you what happened at your institution, your program has already failed its regulatory obligations and its account holders.
Key Takeaways
A list of practical, experience-driven advice that financial crime fighters can implement to avoid following in Bank of America's footsteps.
Make your own controls your first line of detection. If law enforcement or another bank keeps flagging activity before you do, look at your monitoring coverage, your thresholds, and how your fraud and BSA teams share what they see.
Track your queue like a risk metric. Review alert volume, time to disposition, and aging every month. When the numbers creep up, take a specific staffing or resource request to the board, not just a memo.
Staff and train to your current risk profile. If your products, customers/members, or fraud trends have changed in the last three years and your staffing plan hasn’t, you likely have a gap. Tie training to your risk assessment, not just the annual checklist.
Cross-train so coverage never depends on one person. A vacation, sick leave, or resignation shouldn’t put SAR deadlines at risk.
Keep testing after go-live. Use quality assurance testing to confirm alerts reach investigators and get worked. Watch dashboards for backlogs and model drift, and benchmark your alert and SAR volumes against similar institutions.
Connect fraud and BSA. Use a shared case record, set a clear trigger for when a fraud case becomes a BSA referral, and make one person accountable for closing the loop.
Act on red flags, don’t just record them. A growing backlog or a failed test means something needs to change now. The Treasury was clear that documenting concerns and running long internal reviews don’t satisfy your obligations.
Hold your vendor to a partner standard. Expect regular tuning sessions, update walkthroughs, and a real feedback loop, not a one-time install.
Closing Thoughts
Bank of America had resources most community institutions will never have, and it still ended up with one of the largest penalties in Treasury history. The failures weren’t exotic: alerts went unworked, red flags went unescalated, and known problems sat unfixed for years. Those same risks exist at a $500 million credit union as much as at a megabank. The difference is how quickly you catch and solve them.
Financial crime keeps getting more complex, and penalties like this one show regulators aren’t lowering the bar. Community institutions don’t need megabank budgets to meet it, they need the right tools, the right people, and a program that keeps getting tested and improved. If you want to talk through where your program stands, reach out to our team of experts that are eager to help.
Meet the Authors:
Ryan McInerny, Chief Product Officer
Ryan McInerny is the Chief Product Officer at RiskScout, where he is passionate about creating solutions to enhance the day-to-day lives of financial institution employees. He brings a wealth of regulatory and technical experience to his role as a former National Bank Examiner with the Office of The Comptroller of the Currency (OCC). At the OCC, Ryan was a member of the OCC’s northeast district committees for compliance and commercial credit, where he helped to identify changing industry trends and risk conditions.
Ryan brings a strong business sense with his banking expertise, having received his Masters Degree in Business Analytics from UVA's Darden School of Business.
Corey Lynch, CAMS, Senior Product Manager at RiskScout
Corey Lynch, CAMS, has been at the intersection of technology and financial crime since 2014. He has dedicated his career to collaborating with financial institutions to understand their product requirements, navigate industry challenges, and uncover opportunities for innovation. Passionate about leveraging technology to combat financial crime, Corey has worked with hundreds of credit unions and community banks across the United States and Canada and is a well known guest speaker on the conference circuit and for industry webinars.
Recently, Corey joined RiskScout as a Senior Product Manager. In this role, he serves as the vital bridge between industry needs and RiskScout’s product capabilities. Leveraging his extensive product expertise, Corey collaborates across Sales, Product, and Marketing teams to guide prospective partners toward tailored solutions that optimize their operations. He remains deeply committed to empowering community financial institutions to keep their communities safe and prosperous.
Stephanie Macrafic, CFE, Stategic Solutions Advisor
With over a decade in financial services, Stephanie brings a rare blend of frontline experience and strategic insight to the team. She started her career as a bank teller, where she caught her first case of internal fraud, and has since worked her way up through retail banking, branch leadership, and contact center operations into enterprise risk, fraud prevention, and risk management leadership at a credit union. A Certified Fraud Examiner and industry speaker, Stephanie doesn't just spot red flags, she turns complex regulatory problems into practical solutions. She currently serves as Vice President of the Twin Cities Chapter of the ACFE.
Kristin Parker, SVP of Customer Success
Kristin is a seasoned expert in BSA/AML and fraud prevention, with extensive experience building and implementing monitoring programs for higher-risk industries. She has contributed to significant updates in the FFIEC manual, provided practical, risk-based AML guidance at industry events, and played a key role in the development of RiskScout’s innovative, actionable BSA solutions. Recognized by her peers as PBC's 2024 Compliance Person of the Year, Kristin continues to champion efficient, technology-driven approaches that empower financial institutions to confidently manage regulatory requirements.
