Treasury says the nation's second-largest bank failed to report more than $5 billion in suspicious transactions. For insurers and brokers, the case bears on D&O and financial institutions underwriting, fraud recoveries and the industry's own AML obligations.
Bank of America will pay more than $1.21 billion in penalties for breaking federal anti-money laundering and sanctions laws, the Treasury Department said on Tuesday. The largest piece, a $1.2 billion penalty from the Financial Crimes Enforcement Network (FinCEN), is the third-largest Treasury has ever imposed.
According to Treasury, the bank was late reporting over $5 billion in suspicious transactions. More than $1 billion of that involved what the department calls national security or priority risks, among them activity tied to Chinese money-laundering networks, fraud and possible trade-based laundering linked to the southwest border. The bank admitted it willfully violated the Bank Secrecy Act, including by skipping required due diligence on correspondent accounts held for foreign banks.
The Office of the Comptroller of the Currency assessed a $750 million civil money penalty, its largest ever, which counts toward the FinCEN total rather than adding to it. The Office of Foreign Assets Control settled separately for $11.6 million over 475 apparent violations of sanctions programs, including those aimed at Russia and Iran.
Treasury Secretary Scott Bessent said that when a bank this large falls short on these duties, "the consequences extend far beyond its own walls."
The OCC said the bank did not properly monitor trillions of dollars in transactions, knew for years that potentially suspicious activity was not being passed to investigators, and staffed its BSA function with people who lacked the expertise to run it. Treasury said the bank relied so heavily on referrals from law enforcement and other banks that it effectively handed off part of its detection work, and that it put revenue ahead of compliance spending.
The OCC had placed the bank under a cease-and-desist order in December 2024 over late suspicious activity reports and gaps in customer due diligence. More than a year later, the regulator said, a flaw in transaction monitoring was still letting potential trade-based laundering through.
Read next: Insurers allege Bank of America cleared $1M in flagged transfers
A Bank of America spokesperson said in a statement: "Financial crime compliance is serious, and we are responsible for getting it right." The bank said it has invested billions of dollars in technology and staff and is well advanced on the remediation regulators required. Third-quarter results due Wednesday will include a $1.2 billion charge that is not tax-deductible, reducing net income by about 17 cents a share. The stock fell about 1.8% in after-hours trading, Reuters reported.
On October 8, the OCC fined American Express National Bank $350 million and issued a cease-and-desist order. The regulator said monitoring failures meant about $13 billion in suspected trade-based money laundering over the past decade was not identified or reported in time. Before that, the OCC's most recent civil money penalty against a bank was the $450 million it imposed on TD Bank in October 2024.
Both cases come as Washington works to cut the paperwork side of AML compliance. In April, FinCEN proposed new AML program requirements meant to reduce burden and judge programs on whether they catch illicit finance. The two penalties show regulators are still punishing programs that miss it.
Insurers have their own obligations under these rules. Insurance companies that issue covered products count as financial institutions under the Bank Secrecy Act, and FinCEN's April proposal would revise their AML program requirements along with those for banks. Insurance trade groups have argued that general insurance carries almost no money-laundering risk and that the rules should focus on life products.
Read next: Public D&O claims are rising as the market keeps softening
For D&O and financial institutions underwriters, whether any part of a regulatory penalty can be insured depends on policy wording and the law where the claim is brought. Banks have tested the question. In Australia, Westpac sued its insurers seeking A$400 million after a record penalty from the financial intelligence agency AUSTRAC.
Defense costs and shareholder suits that follow enforcement are a more common source of claims, and their cost is rising: average securities class action settlements reached $54 million in the first half of 2026, the highest since 2017. Coverage counsel will be looking at whether the bank's admission of willful violations affects conduct exclusions in any later claim.
Carriers also pay when bank controls fail. In July, Arch Insurance and At-Bay Specialty sued Bank of America to recover about $1.04 million paid on a fraud claim, saying the bank processed transfers its customer had already reported as fraudulent. Both the Bank of America and American Express cases involved trade-based laundering, which marine, cargo and trade credit underwriters also screen for, and sanctions remain a live issue for those lines as US policy on Russian energy shipments changes.
Read next: Trump's Russian diesel deal creates sanctions minefield for marine insurers
Brokers placing financial institutions business can expect underwriters to ask about open consent orders, remediation deadlines, monitoring systems and who runs the BSA function. Those questions now reach more agencies too, as banks buy back into insurance distribution.
