Bank of America admitted willful Bank Secrecy Act violations after regulators found billions in late suspicious-activity reports. The action puts CEO Brian Moynihan's call for crypto firms to face bank rules under scrutiny.
Regulators announced more than $1.21 billion in coordinated penalties and settlements against Bank of America on Oct. 13, 2026. The case involved more than $5 billion in transactions covered by late suspicious activity reports, or SARs. That figure does not mean regulators confirmed $5 billion in laundered money. The Treasury announcement said the bank admitted willful Bank Secrecy Act violations involving its anti-money-laundering program. The findings also covered due diligence on foreign correspondent accounts and the timing of SAR filings.
The penalties overlap in part. FinCEN imposed a $1.2 billion penalty, and the amount paid under the OCC penalty will be credited against it. The OCC separately assessed a $750 million civil money penalty. The Office of Foreign Assets Control, or OFAC, reached its own settlement for $11,662,930. The OCC said its penalty would go to the U.S. Treasury.
That record puts a policy argument from CEO Brian Moynihan under the microscope.
In 2023, Moynihan told senators that crypto companies handling financial transactions should face the same anti-money-laundering obligations as banks. Regulators have since documented extensive failures in those controls at one of the country's largest banks.
More than $1 billion of the late-reported activity involved priority illicit-finance and national-security risks. That activity included Chinese money-laundering networks and fraud. The Treasury also cited potential trade-based money laundering with significant links to the U.S. southwestern border. It said the bank's failures kept it from identifying and reporting such activity to FinCEN on time.
The OCC found that Bank of America's deficient transaction-monitoring system failed to properly monitor activity involving trillions of dollars in transactions. Its findings included violations of 12 CFR 21.21, which governs BSA compliance programs, and 12 CFR 21.11, which covers suspicious-activity reporting. The $750 million assessment was the largest civil money penalty in OCC history. The agency's enforcement announcement linked the action to a December 2024 cease-and-desist order requiring the bank to address BSA/AML deficiencies.
Treasury said the bank relied on outside signals to spot suspicious activity. Those included law-enforcement inquiries and referrals from other financial institutions. The OCC described the BSA/AML program as deficient and ineffective, citing monitoring weaknesses that led to late SARs.
OFAC separately settled potential civil liability for 475 apparent violations of U.S. sanctions programs. The cases involved restrictions relating to Russia and Belarus. Other cases concerned Iran and Myanmar, as well as Somalia. OFAC also cited narcotics trafficking and global terrorism. The violations involved payments to blocked banks and mishandled customer matches to blocked persons. The agency cited delays in updating sanctions lists, along with human error affecting two commercial accounts. It characterized the violations as non-egregious and said most had not been voluntarily self-disclosed.
At a Senate Banking Committee hearing on Dec. 6, 2023, Senator Elizabeth Warren asked whether Bank of America had systems to detect potential terrorist-financing activity. She also asked whether the bank could report it and stop it. Moynihan said it could, then endorsed applying equivalent anti-money-laundering rules to crypto companies handling financial transactions.
Moynihan also sits on the Bank Policy Institute's board and has served as its chair, according to Bank of America investor materials. In August 2026, BPI published a paper titled "Same Risks, Same Safeguards". It argued that digital-asset rules leave illicit-finance gaps in secondary markets. The paper focused on exchanges and custodians, then discussed DeFi firms, with particular attention to stablecoins. The institute has also backed efforts to extend Bank Secrecy Act requirements across the digital-asset industry.
That position remains part of a wider regulatory debate, not a completed policy change. A separate EU oversight proposal would shift only the largest cross-border crypto providers to direct ESMA supervision. It is not final and concerns a different jurisdiction with a different regulatory framework.
Crypto executives have pointed to the Bank of America action to argue that the industry handles customer verification, or KYC, better than U.S. banks. But KYC is only one piece of compliance. The bank findings also concern ongoing transaction monitoring and suspicious-activity reporting. They cover due diligence on correspondent accounts, too. A comparison based on onboarding alone falls short of addressing those controls.
Crypto companies have their own serious enforcement records. Binance pleaded guilty in 2023 to Bank Secrecy Act conspiracy. It also pleaded guilty to failure to register as a money transmitter and to sanctions violations. The company agreed to pay $4.3 billion and accepted an independent monitor. The case does not show that crypto firms as a group perform better than banks.
FinCEN analysis of Bank Secrecy Act reports filed from September 2023 through December 2025 identified about $12.7 billion in suspected digital-asset investment-scam-related financial activity. That amount reflects activity identified in reports. It is not a confirmed measure of losses, nor proof that every reported transaction involved a crime.
Broader Bank Secrecy Act coverage for exchanges, custodians and stablecoin intermediaries remains a possible policy direction. These bank penalties do not establish that it will happen. Any comparison will turn on whether firms detect suspicious activity, document it and report it promptly, rather than on customer checks at sign-up alone.
Anti-money-laundering compliance combines customer checks with ongoing transaction review. It also requires reporting to authorities. Correspondent due diligence adds another layer when a bank provides services to foreign financial institutions. On-chain monitoring may give crypto firms different tools, but the regulatory findings concern whether controls worked and reports were timely. They do not establish that one sector's systems are inherently more effective than the other's.
