On 13 October, the US Treasury fined Bank of America $1.21 billion for failing to stop money laundering. It’s the third-largest penalty in Treasury history. The bank admits it broke the law wilfully.
The bank’s defence was revealing. A spokesperson said it had invested billions of dollars in technology and dedicated thousands of employees to fighting financial crime. Regulators found that the same operation still let more than $5 billion in suspicious transactions go unreported on time.
If you run compliance at a bank in Nairobi, a remittance firm in Dhaka or a lender in Suva, this can look like someone else’s problem. It probably won’t stay that way. Big-bank failures travel down the chain, to the smaller institutions that rely on those banks to move money across borders.
Here’s how that happens, and the four questions you’re likely to be asked next.
Why a US fine reaches your bank#
Most banks outside the US reach American dollars through a correspondent: a big bank that holds an account for them and moves payments on their behalf. Think of it as the on-ramp to the global payments system. Bank of America is one of the biggest on-ramps.
A failure Bank of America admitted was not doing proper due diligence on the foreign banks it held accounts for. The settlement now forces an independent review of exactly that, tested against the risks Washington cares most about: cartels and the US southwest border, Iran, and Russia.
This isn’t a one-off. American Express took a $350 million anti-money laundering penalty only days earlier. TD Bank paid $1.3 billion in 2024. Every large correspondent’s compliance team is reading these orders and asking one question: could that be us?
The cheapest answer is to look harder at the banks they serve. Expect more detailed questionnaires, more requests for information, and shorter patience with slow replies. Pacific and African banks know the harsher version well: relationships quietly closed because keeping them felt riskier than losing them.
That’s not inevitable. The respondent banks that keep their access tend to be the ones that can answer hard questions quickly, with evidence. Bank of America’s failures tell you what those questions will be.
Question 1: Do you find suspicious activity yourself, or wait to be told?#
This is Treasury’s sharpest finding. Bank of America leaned on law enforcement inquiries and requests from other banks to spot suspicious activity, instead of its own monitoring. In Treasury’s words, it effectively outsourced much of its detection to third parties.
The bank’s monitoring system failed to properly watch trillions of dollars in transactions. Suspicious activity piled up uninvestigated for long periods. By the time reports reached the authorities, many were too late to be much use.
Many smaller institutions work the same way without admitting it. The first time anyone looks closely at a customer is when a correspondent sends a request for information. If that’s your alert system, your correspondent is doing your monitoring for you. After this week, they’ll notice.
A correspondent is now more likely to ask for evidence, not assurances:
- How many alerts did your own system raise last quarter?
- How quickly were they reviewed?
- How many became suspicious transaction reports, and how many came from outside tip-offs?
If most of your reports start with someone else’s question, that’s the gap to close first.
Question 2: Are your sanctions lists up to date today?#
The smallest number in this story is the most instructive. Bank of America paid $11.6 million to OFAC, the US sanctions office, over 475 apparent violations. The programmes involved included Russia, Belarus, Iran, Burma, Somalia, narcotics and terrorism.
None of the causes were sophisticated. The bank routed payments through banks that were already blocked. Poorly tuned alerts let sanctioned individuals make payments and withdraw cash. Watchlists weren’t updated promptly after new designations.
Sanctions screening works like a bouncer checking IDs at the door. A bouncer holding last month’s list will wave the wrong people in, however good his eyesight. OFAC also gave the bank no credit for cooperation or fixes, and found most of the violations weren’t voluntarily disclosed.
Worth checking this week:
- How long does a new designation take to reach your screening list? Same day, or whenever someone gets to it?
- When were your alert thresholds last tested, and by whom?
- Do you screen the banks in a payment chain, or only your own customers?
Question 3: What happens when your compliance team raises a flag?#
This is the part of the story that isn’t about technology. Treasury found that Bank of America prioritised its revenues and kept compliance resources to a minimum. Internal testing showed serious problems, and the bank didn’t act on them.
Compliance staff did their jobs. They escalated concerns about possible trade-based money laundering and fraud, including customers with potential links to drug money. The red flags went unanswered. More than a year after regulators ordered a fix in 2024, the bank was still failing to pass suspicious activity to its own investigators.
The scale helps explain why. The $1.2 billion charge is about a fifth of the roughly $6 billion the bank spends buying back its own shares each quarter. Regulators also stopped short of an asset cap, which would have limited how big the bank could grow. For an institution that size, a fine can feel like a cost of doing business.
That’s why regulators and correspondents increasingly judge evidence of action, not money spent. Treasury put it plainly: documenting concerns, or running long internal reviews without fixing anything, doesn’t meet your obligations.
No software makes a bank listen. What good tools can do is make a warning impossible to lose. Every alert gets an owner, a timestamp and a recorded outcome. That trail is what you show a correspondent when they ask how your team handles a red flag.
Question 4: How exposed are you to money flows Washington treats as national security?#
Read the Treasury announcement closely and it frames the biggest penalty as a national security failure. FinCEN, the US financial intelligence unit, fined the bank for failing to report priority threats, naming Chinese money laundering networks and illicit finance along the US–Mexico border.
More than $1 billion of the unreported activity touched those priorities, including potential trade-based money laundering. That means disguising dirty money as payment for goods, often by over- or under-invoicing. Treasury also said the bank’s customer checks failed to account for heavy reliance on payments from unknown third parties.
The direction is clear. US anti-money laundering enforcement is now pointed explicitly at geopolitical priorities. Treasury also urged institutions to stop treating money laundering and sanctions as separate problems, because the risks increasingly overlap.
For institutions across Africa, Asia and the Pacific, trade with China is ordinary commerce. Nobody is suggesting it’s suspect. But a US correspondent will now want to see that you’d notice when a trade payment doesn’t add up:
- an invoice that doesn’t match the goods
- payments arriving from parties with no clear link to the deal
- a customer whose trade volumes outgrow their business overnight
Get ahead of the questions#
Bank of America can absorb a $1.2 billion fine. A mid-sized bank that loses its dollar correspondent can’t absorb that so easily. The difference between the two outcomes is often how fast you can show your work.
So ask yourself these four questions before someone else does. Do you find suspicious activity yourself? Are your lists current today? Do your team’s warnings lead somewhere? Would you spot a trade payment that doesn’t add up?
If any answer is “not sure”, start with screening. Anqa offers 100 free screens a month, so you can test your customers against current sanctions and watchlists today. Sign up here. For training and reference tools, see our free resources.