Bank of America's $1.2B FinCEN Penalty: What Happened, Where It Failed, How to Avoid It

The short version

In October 2026, FinCEN assessed a $1.2 billion civil money penalty against Bank of America, N.A. for willful violations of the Bank Secrecy Act. The OCC concurrently assessed $750 million, credited against FinCEN's penalty, and OFAC announced an $11.6 million sanctions settlement. Bank of America admitted the facts and admitted willfulness, in the civil sense of reckless disregard or willful blindness.

The headline is the number. The lesson is in the 95 pages behind it. Over seven and a half years (January 2018 to July 2025), the second-largest bank in the United States failed to report, or reported late, more than $5 billion in suspicious activity. Roughly $1 billion of it touched FinCEN's national-security priorities: Chinese money laundering networks (CMLNs), fraud, and trade-based money laundering (TBML) along the southwest border.

None of this happened because the bank lacked data, staff or technology. It happened because of decisions: a case threshold set by "stakeholder judgment" and left untouched for over a decade, suppression rules built ad hoc, test results that were re-run until they came out favourable, and compliance recommendations to exit high-risk customers that the business overruled. Each of those is a governance failure, and each was visible inside the bank years before FinCEN arrived.

This post walks through the consent order section by section: how the monitoring system worked, exactly where it broke, how the customer due diligence and correspondent banking failures compounded it, and what a program would have needed to look like to avoid each miss.

The case in numbers

How Event Processor worked

To understand the misses you need to understand the machine. Bank of America's primary control for finding suspicious activity was a proprietary system called Event Processor (EP), first deployed as a proof of concept in 2010. Internal records described it as the first of its kind in the industry, built with "very little documentation or literature to draw from." It existed to solve a capacity problem: there were not enough investigators to work every alert the detection models produced.

EP's answer was to stop reviewing alerts one at a time. Instead:

• 1. Upstream models generate alerts ("events") on individual transactions: large cash deposits, structuring patterns, wires, peer-to-peer activity and so on.
• 2. Each alert is converted into one or more risk factors, each carrying a weight between 0 and 20 points. EP held hundreds of them.
• 3. Alerts are pooled per customer into an Event Group. Some risk factors scored every time they fired (event level). Others scored only once per group no matter how often they fired (Event Group level). One large-aggregated-incoming-wires factor could never contribute more than 1 point, however many times it triggered.
• 4. The group's points are summed and compared with a case threshold of 20. Below 20, nobody looks. At 20 or more, the group becomes a case for an investigator.
• 5. Groups have a 13-month clock. Alerts older than 13 months "retire": they stay in the group but stop counting toward the score.
• 6. Some factors auto-promote. Weighted at 20 points, they push a group straight into a case. Many were external events: seizure warrants, grand jury subpoenas, law enforcement requests, 314(b) requests and employee referrals.
• 7. Other rules rescore to zero. Suppression logic stripped points from alerts on customers deemed low risk, such as listed companies or CTR-exempt businesses.

On paper this is a reasonable prioritisation engine. In practice it meant that the bank's ability to detect suspicious activity depended almost entirely on three numbers that nobody could justify: the weights, the 20-point line and the 13-month window. The bank's own documentation conceded that simple summation was chosen as "the simplest way to combine weights" even though detection channels "could interact in a non-linear fashion."

The design also built in delay. Because points accumulated over a year, many SARs were filed more than six months after the activity, and investigators were sometimes handed a year of consolidated activity they could not meaningfully review. FinCEN found SARs that, as a result, did not report the full scope of what the customer had done.

Where the monitoring failed: five misses

Miss 1: Risk weights that ignored the bank's own evidence

Bank of America measured each risk factor by its SAR yield: the share of Event Groups containing that factor that ended in a SAR. That is a sensible metric. The problem is that the bank kept collecting it and then did not act on it.

• An April 2019 performance analysis found the ATM Large Cash Deposit factor carried 1 point but had a SAR yield of 56.75%. It also required five conditions to fire, when SAR narratives from 2016 to 2018 showed SARs being filed when only one was met.
• The 2022 model validation listed the factors with the highest predictive importance. "High Intensity Drug Trafficking Area" and "cash structuring" were weighted 1 point each with SAR yields above 50%.
• An April 2020 review of 14 large-wire alert types found weights uncorrelated with yield: one alert at 30.03% yield weighted 6 points, another at 27.69% weighted 2. The report suggested raising the weight on a third high-yield factor. It stayed at 2 points through 2022 and moved to 2.5 in 2023.
• A peer-to-peer model was generating millions more alerts each year at 1 to 2 points, with yields above 40%. Most of those alerts never became cases. They simply retired after 13 months.

The weights did not just stand still. They drifted the wrong way. From 2018 to 2023, 76% of risk-factor weights never changed, and of those that did, about 80% went down. A 2021 "Risk Factor Calibration Model" cut 106 weights and raised 17, a net reduction of 187 points across the system, and removed over 8,200 cases from the investigation queue. Internal documentation called the resulting "SAR loss" "permissible" without saying who decided that, or on what basis. Five of the seven cash-structuring factors earlier flagged at 50%+ yield were reduced.

The root cause is visible in an internal presentation: the recalibration aimed to make "the whole system of weights" produce a better SAR yield. Optimising for yield is optimising for investigator efficiency. Without a ceiling on missed SARs (a false-negative tolerance), it will always push weights down. Bank of America had no such tolerance until late 2023, when it adopted 5% (7.5% for board escalation). By then a 2025 third-party review found ATM Large Cash Deposit yields at more than twice that tolerance, "indicating an unacceptable level of missed SARs", and the weights on four ATM cash factors had fallen between 2018 and 2024.

Miss 2: A 20-point threshold that nobody could defend

The threshold that decided whether a human ever looked at a customer's activity was "initially set by stakeholder judgment" and stayed at 20 points until December 2023. The bank tested it regularly. The tests kept saying it was wrong.

Read the table from left to right. In 2018-20 the bank treated a roughly 34% yield as worth investigating. By 2022, groups just below the line were generally yielding 38% to 45%, more than the groups above the line had yielded when the line was last justified, and seven to nine times the 5% miss tolerance the bank later adopted.

The internal record is explicit:

• A 2018-19 performance report found groups scoring 14 to 19 had "the highest SAR yield among all strata", that this had been true for three years, and that the yield had been rising since 2016.
• A 2019-20 report found groups at 18 and 19 points out-yielding groups at 20 and 21.
• The 2022 validation found no statistically significant difference between uncased groups at 15 to 19 and actual cases, and said the threshold "needs to be justified."
• In 2022 the bank tested an "unconstrained" threshold that would have found 85.4% of below-the-line SARs versus 20.2% under the existing model. It rejected the change over the "practical concern of pushing too many below-the-line event groups to cases", in other words, investigator capacity.

When the bank finally lowered the threshold to 10 or 12 points and cut the window from 13 to 4 months, the one-time lookback found nearly 8,900 SARs it should have filed, covering nearly $4 billion. Monthly U.S. investigations were projected to double, by 16,000 a month, requiring about 750 more staff. That is the size of the capacity gap the threshold had been hiding.

Miss 3: Overrides without governance, and dependence on outsiders

EP let alerts be rescored to zero. The bank's documentation describes these rules as developed in an "ad-hoc and subjective fashion." Two examples show the risk:

• A suppression list exempted companies listed on certain "approved" stock exchanges. Internal documents referred to a list of approved exchanges. The bank's records do not show that any such list was maintained.
• Structuring and ATM alerts were zeroed for customers on the bank's CTR exemption list. A CTR exemption removes a currency reporting duty, but 31 CFR 1020.315(h) states plainly that it does not reduce the SAR obligation. Customer B alone had 20+ Event Groups between 2018 and 2024 whose structured-cash alerts were rescored to zero. Only three ever reached 20 points.

The 2022 validation identified rescored factors with high yields: cash structuring at 37%, multi-location large cash deposits at 58%, prepaid high ATM withdrawals at 53%. The rescoring logic stayed in place until December 2023, by which point about 150,000 active Event Groups had been affected.

The flip side was auto-promotion. Because internally generated scores rarely crossed the line, the bank leaned on external triggers. For several years, more than a third of all cases came from "promote" factors such as subpoenas, seizure warrants, 314(b) requests and staff referrals, peaking at nearly 50% in 2023. For Customer B, 80% of AML cases between 2018 and 2023 included at least one employee referral or external event. A monitoring program whose main detector is the arrival of a subpoena is not detecting; it is responding.

Miss 4: Testing that could be overruled

Bank of America did test EP, repeatedly. The independent testing function's failure was in what it concluded and what happened next.

• The April 2020 report found several cash-structuring alerts at 1 to 2 points with high yields. Its recommendation was to lower the weight of the one alert with a low yield, and to say nothing about raising the others.
• Threshold testing asked whether yields above and below 20 were statistically different, rather than how much suspicious activity was being missed and whether that number was growing.
• In 2023, after one test found an 18% SAR yield below the threshold, the then-Global Head of Financial Crimes directed a senior manager to repeat it. The repeat called the first result "incorrect" and "unreliable", blamed investigator inexperience and sample bias, and concluded the team was "confident that EP is working as intended."

FinCEN cited that episode directly in assessing management's role. The issue is not that a test was repeated. It is that the second result replaced the first, with no independent arbitration and no record that would have let an examiner see both.

Miss 5: Products the monitoring never saw

Some of the largest losses came from activity EP had no meaningful coverage of at all.

• Negotiable instrument deposits. The bank's negotiable-instrument model covered certain purchases, not deposits. Its systems could not distinguish a money order from a check, so product-specific monitoring was impossible. Two online auto auction customers deposited tens of billions of dollars of instruments bought at other institutions, effectively unmonitored. The same gap let a precious-metals customer receive 3,500+ round-dollar instruments (about $3 million) and an individual claiming to be an investment adviser deposit sequential money orders, neither generating a single alert.
• Credit cards. CMLN-style activity, including back-to-back card purchases of electronics and luxury goods and third-party payments of card balances, went unreported or was reported late, some of it after the 2023 threshold change. Small-business card accounts had no limit on additional cards or authorized users. The Cash Structuring model did not cover credit cards until October 2024.
• TBML. A "TBML Feature" built in January 2024 was used only on activity already under investigation, not to generate alerts. A 2025 third-party review found no sufficient detective monitoring for the TBML red-flag theme.

The bank added a negotiable-instrument deposit control only after FinCEN's investigation identified the breadth of the gap. As of 2025, a consultant found it still had not run a coverage assessment for negotiable instrument products.

The customer due diligence failure: Customers A, B and C

If the monitoring failures explain how activity slipped through, the CDD findings explain why nobody stopped it. FinCEN's narrative centres on three related customers. The order does not name them, and neither will we.

• Customer A: a global digital marketplace selling U.S. salvaged vehicles to domestic and international buyers. A client since 1995, generating several million dollars a year in revenue; the bank was lead agent on a $200 million refinancing within a facility of more than $1 billion.
• Customer B: a publicly traded company with a similar salvage-vehicle platform. A client since 1996, worth more than $25 million in revenue to the bank over the period, with a rising share of international buyers.
• Customer C: a vehicle exporter trading with both A and B. Onboarded as a "small-medium" business with expected annual sales of $1 million to $4 million. It went on to process over $700 million in wires involving high-risk jurisdictions, principally Georgia, in about three years.

Used and salvaged vehicles are a long-documented TBML channel. FinCEN's 2010 TBML advisory names third-party payments and money orders as indicators, and Treasury's 2024 National Money Laundering Risk Assessment describes criminals buying bulk money orders with cash, using them to buy cars, and exporting the cars. The bank's own investigators knew this.

The core risk: third-party payers

Both A and B accepted payment for vehicles from people other than the registered buyer: international wires from unrelated originators, and money orders bought with cash at money services businesses. Compliance staff put it bluntly in 2022: the client "does not have visibility or understanding of source of funds," with "to[o] much risk and no evident way to control/mitigate it."

The data bore that out. Between October 2020 and May 2025, A and B deposited 680,000+ money orders in about 220,000 groups, worth over $660 million, carrying textbook structuring signals:

• round-dollar amounts and sequential serial numbers;
• repeated groups of three sequential money orders totalling $2,900 to $3,000, just under the $3,000 point at which the issuing MSB must record the purchaser's identity (31 CFR 1010.415);
• for about one group in three, a purchase location with a nexus to the U.S. southwest border.

The wire side showed the same pattern. Dozens of different originators sent funds to a single buyer ID on Customer A's platform, some wire instructions asked for funds to be "stored", and certain buyer IDs appeared in both the wire data and the money-order deposits. One appears in a wire from a UAE entity and on a round-dollar U.S. money order.

Risk ratings that followed subpoenas, not evidence

The bank had a "Dynamic Risk Rating" model meant to update customer risk from products, geography and negative news. In practice, the ratings moved when law enforcement called.

• Customer B stayed "Standard" through years of alerts and investigations until a grand jury subpoena in February 2020. It then went to "Elevated" and "High", with no meaningful change to due diligence or monitoring. It was back at "Standard" from July 2022 until March 2023, when another subpoena moved it to "Elevated".
• In November 2023 one of the customers disclosed in a securities filing that the DOJ was investigating it for potential money laundering violations. The rating model, designed to ingest negative news, did not reflect it, and nothing changed in its monitoring.

Periodic reviews that reviewed nothing

High- and elevated-risk customers received quarterly "Client Activity Monitoring" reviews. FinCEN found observations copied from quarter to quarter, no analysis of geography even when EP had already alerted on high-risk jurisdictions, and no analysis of negotiable instruments at all, despite tens of billions of dollars of them. In Q4 2022, Customer B received about $1.1 billion from its UAE affiliate, up more than 200% year on year. The quarterly review did not mention it.

Warnings from outside, answered with "nothing unusual"

• September 2021: an MSB asked about possible structured purchases of its money orders deposited into Customer B's account. Bank of America replied that it saw no unusual pattern and no indication of illicit activity. About 51,000 further suspicious groups went through B's accounts before May 2025 without timely reporting.
• July 2022: another financial institution asked about Customer A transactions with a Georgia nexus, and about Customer C. The bank's first SAR on this wire activity came in August 2023 and covered about 10% of it. The bulk was reported in June 2025, after FinCEN's own requests.
• From late 2021 to mid-2022, Customer A's international wires grew by up to $1.7 billion, with flows involving jurisdictions bordering Russia during the invasion of Ukraine. In August 2022 alone, A received 290 wires from Belarus. Customer A's risk profile was not updated.

Compliance said exit. The business said no.

The most consequential part of the order is a decision, not a model.

• 1. 2016: staff flag Customer A for high-risk-jurisdiction wires, opaque buyers and unclear source of funds, alongside narcotics-related vehicle investigations.
• 2. June 2020: case notes record that "although [Customer A] is considered a suspect, account will not be closed... closure is not supported."
• 3. May to July 2022: a crypto investment-scam website instructs victims to wire money to Customer A's account. Compliance recommends A for closure.
• 4. August 2022: compliance tells the business line that A has been linked to more than 100 AML cases since 2020, about 90% of them fraud, with law enforcement interest from at least five federal agencies. One compliance employee replied to the case count "YESSSSSSSSSSSS", adding a concern about source of funds; another, "WOW."
• 5. September 2022: the relationship manager writes a memo describing A as "a large and valued client" worth about $6 million a year, with the line of business "very supportive of our important relationship."
• 6. November to December 2022: the briefing deck for the BSA Officer cites 250+ referrals, 125+ AML investigations and out-of-footprint wires, and still recommends closure. The BSA Officer meets the head of the business line.
• 7. March 2023: a four-point mitigation plan is developed, the main point being that A accept payment only from registered buyers. Compliance withdraws the closure recommendation.
• 8. 2023 to 2025: A keeps taking third-party payments until June 2025 and some money orders until about July 2025. Case volumes in 2023 run at the same level as before the plan.

About 72,000 suspicious money-order groups were processed for Customer A between September 2022, by which time closure had been recommended, and May 2025 without timely reporting. In late 2022 compliance said it would analyse every online auto auction client. That analysis happened two years later, after FinCEN's investigation was well under way. And when the bank exited Customer C in December 2023, it did not reassess A or B, which continued to do business with C.

FinCEN is careful to say that closure was not the only acceptable answer. The failure was accepting the relationship without changing anything about how it was profiled or monitored.

Correspondent due diligence on the bank's own foreign branches

The third violation is the one most likely to be underestimated outside the U.S. Under 31 U.S.C. 5318(i) and 31 CFR 1010.610, a covered institution must run risk-based due diligence on every correspondent account it keeps for a foreign financial institution. The regulation lists what that assessment must consider: the respondent's business and markets, the account's purpose and expected activity, the length of the relationship, the AML and supervisory regime of the licensing jurisdiction, and the respondent's AML record.

Until late 2024, Bank of America's policy allowed "simplified" due diligence with "reduced requirements" for correspondent accounts of its own foreign branches and affiliates. FinCEN reviewed twelve of them and found files that:

• did not describe the account's purpose or expected activity;
• summarised the business in two words, such as "treasury services" or "cash management";
• described supervision by little more than the name of the local regulator;
• included material irrelevant to monitoring, such as charts of the parent's share price.

Separate branch risk assessments were often years old and written for local management, not for the correspondent relationship. Industry questionnaires were sometimes completed by the bank on behalf of all branches at once, or filled in shortly before the policy changed in December 2024.

The bank's reasoning was that its branches served large corporates, large banks and institutional investors, and that flows were "interbank settlement" and "bank-to-bank bulk flows." FinCEN found the twelve branches and affiliates maintained accounts for more than 250 non-bank financial institutions, including MSBs and their foreign equivalents, whose payments looked nothing like interbank settlement. A 2025 third-party review added that monitoring models applied to correspondent accounts were too narrow and let high-risk relationships continue unchecked.

The lesson is that intra-group status is not a risk rating. A branch is a respondent like any other for 1010.610 purposes, and its customer base, not its parent's brand, determines the risk.

Timeline: from first warnings to the consent order

The striking feature of the timeline is how early the bank knew. Nearly every failure was documented internally years before it was fixed.

How it could have been avoided

Every miss above had a known fix, and in most cases the bank's own testing had already pointed to it. What was missing was not insight but a mechanism that forced insight into action. The fixes fall into three layers.

Layer 1: Make every tuning decision a documented, owned, reviewable rule

Layer 2: Govern exceptions and testing as hard as the rules

• Treat every suppression as a named exception. Each rescore, whitelist or exemption needs an owner, a stated basis, a population count, an expiry date and a scheduled back-test. A suppression list that refers to an "approved exchanges" list nobody maintains would not survive that.
• Never let an exemption from one obligation suppress another. CTR exemptions and SAR obligations are separate in the regulation. They must be separate in the code.
• Measure dependence on external triggers. If a third or more of cases originate from subpoenas and referrals, that is a monitoring coverage KPI in breach, and it should be reported to the BSA Officer as one.
• Keep every test result. A re-run is legitimate. Replacing a result is not. Both runs, their samples and the reason for the re-run should sit in an immutable record that independent testing and examiners can see.
• Run product coverage assessments. Map every product and instrument (money orders, cashier's checks, credit cards, card-balance payments from third-party institutions) to the models that monitor it. A product with no model is a finding, not an assumption.

Layer 3: Make customer risk profiles live, and decisions binding

• Capture expected activity as structured data at onboarding. Volume bands, corridors, payer types (including whether third parties pay on the customer's behalf) and instruments used. Customer C's $1 million to $4 million baseline would have been breached within weeks if anything had compared it with actuals.
• Re-rate on events, not on subpoenas. Inbound RFIs and 314(b) requests, adverse media, public filings, a spike in investigations and an exit of a related counterparty should all trigger a re-rating. The 2021 MSB request and the 2023 DOJ disclosure each should have moved a rating and a monitoring plan.
• Link related customers. When Customer C was exited, Customers A and B, which transacted with C, should have been re-assessed automatically.
• Make periodic reviews data-driven. Pull volume, counterparties, geographies and instrument mix into the review template so that a 200% jump in UAE inflows cannot be missed or copied forward.
• Record the exit decision. A compliance recommendation to exit should have an owner, a deadline and an escalation path. If the business overrides it, the override, its conditions and the date they will be checked should be recorded, and missed conditions should re-open the recommendation automatically. Customer A was asked in March 2023 to accept payments only from registered buyers and was still taking third-party payments in June 2025.
• Know your customer's customers where the risk sits there. For platforms and marketplaces, the bank's risk lies with the payers. Either require the customer to identify them, or monitor for the patterns that show it is not.

For correspondent banking

Apply full 1010.610 due diligence to intra-group respondents. Document each branch's customer mix (especially MSBs and other non-bank FIs), the account's expected activity and the actual supervisory regime, not just the regulator's name. Refresh it on a cycle tied to risk, and feed it into correspondent monitoring models.

What the undertakings signal for every BSA/AML program

Section VI of the order imposes four independent-consultant workstreams. They are binding only on Bank of America, but they are the clearest public statement of what FinCEN now expects an effective program to evidence. Treat them as a test plan.

Two details deserve attention.

FinCEN is now writing advanced analytics into remediation. The lookback consultant is directed to consider "super intelligence models", graph analytics and segmentation, and where machine learning is used to identify suspicious activity, to apply a supervised model trained on labelled bank data. This is a regulator endorsing AI in AML while insisting on explainability and oversight in the same document. Institutions adopting AI for alert scoring or investigation will be expected to show the same: what the model decided, why, and who reviewed it.

Correspondent review is pointed at Iran proxies. The foreign correspondent workstream must prioritise respondents in countries with elevated risk of Iran-related sanctions evasion through proxies and facilitators outside Iran, and test for structuring, smurfing and reverse structuring. Respondent banks in Gulf and Asian financial centres should expect sharper questions from their U.S. correspondents.

Lessons by institution type

Banks, including sponsor banks. Assume an examiner will ask you to produce, for every threshold and every suppression, the rationale, the test that supports it and the date it was last reviewed. If the answer lives in a slide deck or someone's memory, it does not exist. Set a false-negative tolerance before you tune, not after.

Fintechs, BaaS programmes and marketplaces. Customers A and B were not banks. They were platforms whose payment model became their bank's problem. If your users can be paid by third parties, by cash-funded instruments or from jurisdictions outside your stated footprint, expect your sponsor bank to ask how you identify those payers, and to ask for expected-activity data it can monitor against. Platforms that can answer will keep their banking.

MSBs. The structuring in this case was visible at the point of sale: three sequential money orders for just under $3,000, repeatedly, many near the southwest border. Issuers are the first control point for the 1010.415 recordkeeping line, and FinCEN's priorities put cash-to-instrument conversion squarely in scope.

Respondent banks outside the U.S. If you clear dollars through a U.S. correspondent, the BofA findings tell you what your correspondent's file on you must now contain: your actual customer mix, especially MSBs and other non-bank FIs; the expected activity on the account; and a real description of your regulator's AML regime. Respondents in international financial centres such as GIFT IFSC, Singapore and the UAE should be able to produce that on request, mapped to their own regulator's rules.

Anyone deploying AI in AML. The order simultaneously criticises a scoring system nobody could explain and invites machine learning into the remediation. The resolution is governance: deterministic records of what each model decided, on what inputs, under which approved configuration, and who reviewed the output.

Frequently asked questions

Why was Bank of America fined $1.2 billion by FinCEN?

For willfully violating the Bank Secrecy Act from January 2018 to July 2025: failing to maintain an effective AML program, failing to conduct required due diligence on correspondent accounts for foreign financial institutions, and failing to file timely and accurate suspicious activity reports on more than $5 billion of activity.

How much will Bank of America actually pay?

FinCEN's penalty is $1.2 billion, but it credits the $750 million paid to the OCC, so Bank of America pays $450 million to Treasury under the FinCEN order. Together with the $750 million OCC penalty and OFAC's $11.6 million settlement, Bank of America pays about $1.21 billion in total.

What is Event Processor?

Bank of America's proprietary transaction monitoring aggregation system, launched in 2010. It scored alerts with weighted risk factors, pooled them by customer into Event Groups, and sent a group for investigation only once it reached 20 points within 13 months.

What does "willful" mean in this order?

In civil BSA enforcement, willfulness includes reckless disregard or willful blindness. FinCEN does not need to show the bank knew it was breaking the law or acted with bad intent. Bank of America admitted willfulness in that civil sense only.

What are Chinese money laundering networks (CMLNs)?

Networks that buy illicit dollars, often cartel drug proceeds, and settle the value through trade goods or Chinese currency demand. FinCEN's August 2025 advisory (FIN-2025-A003) lists red flags including businesses paying many unrelated individuals' credit cards and heavy card purchases of electronics or luxury goods.

Why do salvaged vehicle auctions matter for money laundering?

Vehicles hold value, move easily across borders and are often bought by overseas buyers. Paying for them with cash-funded money orders or third-party wires lets illicit funds become an exportable asset. The order cites Treasury's 2024 National Money Laundering Risk Assessment and FinCEN's 2010 TBML advisory on this pattern.

What is SAR yield, and is it a good tuning metric?

SAR yield is the share of alerts or cases that end in a SAR. FinCEN accepts it as useful, but not as the only metric. Used alone, it rewards cutting alerts. It must be paired with a tolerance for missed suspicious activity.

Does the order apply to other banks?

Its undertakings bind only Bank of America. Its findings show how FinCEN reads the AML program, CDD and correspondent due diligence rules, so every covered institution should expect examiners to test the same points.

About this analysis

This analysis was written by the team at Omnified, which builds compliance orchestration for regulated financial institutions: KYC/KYB/CDD onboarding across verification vendors, Policy Register for rulebook-as-code and attestation, and Pilcrow for clause-cited regulatory research across IFSCA and MAS rules. We wrote it because most of what went wrong at Bank of America sits in the layer we work in: how rules, thresholds, exceptions and customer risk decisions are recorded, owned and revisited.

Sources

• FinCEN, Consent Order Imposing Civil Money Penalty, In the Matter of Bank of America, N.A., Number 2026-03 (95 pages)
• U.S. Department of the Treasury, "U.S. Treasury Announces Record Enforcement Actions Against Bank of America" (press release sb0657)

Authorities cited within the order: 31 U.S.C. 5318(g), (h), (i); 31 CFR 1010.415, 1010.610, 1020.210, 1020.315(h), 1020.320; FinCEN Advisory FIN-2025-A003 on CMLNs (Aug 2025); FinCEN Advisory FIN-2010-A001 on TBML (Feb 2010); FinCEN Alerts FIN-2022-Alert001 and FIN-2022-Alert003 on Russian sanctions and export-control evasion; Treasury 2024 National Money Laundering Risk Assessment; OCC cease-and-desist order against Bank of America (Dec 2024).

This article summarises a public enforcement action for general information. It is not legal advice. All facts are as stated in FinCEN Consent Order No. 2026-03, which Bank of America admitted; customers are referred to as the order refers to them.