BofA Takes $1.2B Money-Laundering Penalty, and Merrill's Own SAR Record Sits Close Behind

Federal regulators hit Bank of America with more than $1.21 billion in anti-money-laundering and sanctions penalties on Oct. 13, and the findings point at the same monitoring system Merrill Lynch relies on for its own suspicious activity reporting.

Federal regulators on Oct. 13 hit Bank of America with more than $1.21 billion in anti-money-laundering and sanctions penalties, and the findings land on the same monitoring machinery that Merrill Lynch leans on to meet its own reporting duties. No regulator named Merrill in this week's orders. But in June the Securities and Exchange Commission fined the brokerage $7.5 million for missed suspicious activity reports, and the agency traced that lapse to the bank's enterprise-wide system.

The headline number comes from the Financial Crimes Enforcement Network, which assessed $1.2 billion. Treasury called it the third-largest penalty in the department's history. Inside that total sits a $750 million civil money penalty from the OCC, the national-bank regulator, which the OCC described as the largest it has ever imposed; FinCEN credits the OCC amount against its own fine rather than stacking the two. A separate $11.6 million settlement with the Office of Foreign Assets Control covers 475 apparent sanctions violations tied to programs on Russia, Belarus, Iran, Burma, Somalia, narcotics and terrorism. OFAC said it treated the conduct as non-egregious and mostly not self-reported, and gave no credit for cooperation or remediation.

The FinCEN findings are the harsher read. Bank of America admitted it willfully broke the Bank Secrecy Act by running a deficient compliance program, skipping required diligence on foreign correspondent accounts and failing to file suspicious activity reports. According to Treasury, more than $5 billion in suspicious transactions went unreported on time, and over $1 billion of that touched priority risks such as Chinese money-laundering networks, fraud and possible trade-based laundering linked to the southwest border. Regulators said the bank put revenue ahead of compliance spending and relied so heavily on tips from police and other banks that it had, in Treasury's words, "effectively outsourced" much of its own detection work. Under FinCEN's consent order, a third party must run a lookback to find and report transactions the bank missed, and independent reviewers will test its monitoring, customer diligence, correspondent-account controls and data governance, with Iran, Russia and cartel-linked activity singled out.

This week's penalty grows directly out of a cease-and-desist order the OCC issued on Dec. 23, 2024. That order carried no fine. It cited late suspicious activity reports, an uncorrected customer due diligence problem, weak sanctions controls, and gaps in governance, testing and training, and it required an outside consultant plus a lookback review. The OCC now says that, more than a year after signing, the bank still was not escalating potentially suspicious activity to investigators. Comptroller Jonathan Gould called the bank's response "unacceptable."

Bank of America said the penalties will produce a $1.2 billion charge in third-quarter results that is not tax deductible and trims net income by roughly 17 cents per share, CNBC reported. The bank said remediation spending is already in its expense base. Shares slipped roughly 2% in after-hours trading, according to CNBC. On the Oct. 14 analyst call, finance chief Alastair Borthwick said much of the work required by the order is already done, Reuters reported.

For the wealth business, the closest link is the June 29 SEC case. The agency found that from April 2020 through September 2024 Merrill depended on the parent company's anti-money-laundering program to meet its separate obligation to file reports as a broker-dealer. That program scored clusters of alerts and investigated only those above a set cutoff, even though internal testing as early as April 2020 showed that some lower-scored clusters would have produced filings. Merrill paid $7.5 million, accepted a censure and a cease-and-desist order, and neither admitted nor denied the findings. InvestmentNews counted it as Merrill's third suspicious-report enforcement case since 2017, after settlements in December 2017 and July 2023, and reported that the threshold was not lowered until December 2023.

What that means at the desk is still an open question. No order this week imposes new rules on Merrill accounts, and neither the bank nor regulators have described changes to brokerage onboarding. The FinCEN order does require independent reviews of customer diligence and monitoring across the bank, and the SEC has already established that Merrill's reporting runs through that shared system. Advisors whose books include international clients, entities with complicated ownership or heavy third-party money movement are the ones most likely to notice if the bank tightens review as the lookback proceeds, although Bank of America has not said it will.