Bank of America AML failures offer lessons to UK banks

US authorities recently announced coordinated action (95 pages/ 1MB PDF) against Bank of America, imposing more than $1 billion in penalties over anti-money laundering (AML) and sanctions compliance failings. The failing contributed to significant suspicious activity not being identified or reported promptly, according to regulators.

The action includes a $1.2 billion civil monetary penalty imposed by the Financial Crimes Enforcement Network (FinCEN), incorporating credit for a separate $750 million penalty imposed by the Office of the Comptroller of the Currency (OCC), alongside an $11.66 million sanctions settlement agreed with the Office of Foreign Assets Control (OFAC).

“While the scale of the penalties is eye-catching, the more significant lesson for UK-regulated firms lies in what the enforcement action reveals about the relationship between risk, compliance resources and governance,” said Ian Stott, financial crime and conduct regulation specialist at Pinsent Masons.

According to FinCEN, Bank of America admitted that it wilfully failed to maintain an effective AML programme, conduct required due diligence on correspondent banking relationships and report suspicious activity accurately and in a timely manner. The conduct spanned from at least January 2018 to July 2025 and contributed to more than $5 billion in suspicious activity being reported late or not being identified promptly, the action found.

Stott said: “The enforcement action provides a stark illustration of a challenge many large institutions face in deciding how to respond when internal testing demonstrates that financial crime controls are failing in ways that would result in materially more alerts, investigations and compliance costs.”

According to the order, the bank’s transaction monitoring system relied on weighted risk factors and scoring methodologies designed to determine when customer activity should be escalated for investigation. However, internal reviews and testing repeatedly identified concerns regarding monitoring thresholds, risk weightings and investigative processes.

The findings suggested potentially suspicious activity was being missed, including in areas where activity falling just below escalation thresholds was generating comparatively high suspicious activity report (SAR) rates.

The order records that when monitoring thresholds were eventually lowered, the bank estimated the changes would generate approximately 16,000 additional investigations per month and require around 750 additional personnel, together with substantial remediation support.

Stott said: “For UK firms, the case illustrates dangers that can emerge when the volume of financial crime risk identified by monitoring systems becomes influenced by the investigative capacity available to deal with it. Regulators increasingly expect firms to demonstrate that monitoring thresholds, risk models and alert-generation criteria are driven by risk assessments rather than operational constraints.”

Firms regulated by the UK’s Financial Conduct Authority (FCA) are already expected to maintain proportionate systems and controls to identify, assess, monitor and manage financial crime risks and to assess regularly whether those controls remain effective.

The consent order also contains examples involving customer relationships that had generated significant compliance concerns. In one instance, compliance personnel raised concerns regarding a commercially important customer following numerous investigations and fraud-related alerts. The relationship nevertheless remained in place.

The issue identified by the regulator was not simply that the customer relationship continued, but instead surrounded whether risk assessment, monitoring arrangements and mitigating controls evolved sufficiently to reflect the risks that had been identified.

Jonathan Cavill, financial regulation expert at Pinsent Masons, said: “That issue is likely to resonate with UK firms operating under FCA requirements and Joint Money Laundering Steering Group guidance, both of which place considerable emphasis on dynamic risk assessment, effective mitigation and ongoing monitoring.”

Alongside the AML findings, OFAC’s sanctions settlement identified failings including issues relating to sanctions screening, blocked parties and the handling of sanctions-related alerts.

The findings come at a time when sanctions controls are receiving heightened scrutiny from UK regulators. The FCA’s recent review of sanctions systems and controls focused on many of the same themes highlighted in the US action, including governance, risk assessment, screening effectiveness, alert management, resourcing and oversight of third-party providers.

“The case also serves as a reminder that weaknesses involving technology, data quality, screening vendors or outsourced processes do not necessarily shield firms from enforcement exposure”, said Stott.

He added: “Boards, senior managers, money laundering reporting officers and compliance teams may wish to test whether transaction monitoring thresholds and controls are genuinely risk based, whether adverse assurance findings drive meaningful action, whether investigative functions are adequately resourced, and whether governance frameworks provide a clear record of what was known, when it was known and how concerns were addressed.”