By Chuck Gallagher — Business Ethics Keynote Speaker and Trainer
TL;DR: Chuck Gallagher, business ethics keynote speaker, argues that Bank of America’s $1.2 billion anti-money laundering penalty proves the costliest compliance failures are the ones leaders already know about and choose not to fix.
On Tuesday, October 13, 2026, the U.S. Treasury Department announced roughly $1.21 billion in penalties against Bank of America, the nation’s second-largest bank. The headline number got everybody’s attention. The detail underneath it deserves more. Regulators said the bank failed to report more than $5 billion in suspicious transactions on time. More than $1 billion of that activity carried national security risks, including links to Chinese money laundering networks and illicit finance along the southwest border.
Now, here is the part that ought to keep every compliance officer up at night. The Office of the Comptroller of the Currency first identified significant deficiencies in 2023. It issued a cease-and-desist order in December 2024. According to regulators, the bank knew for years that potentially suspicious transactions were not being referred for investigation, and it did not correct the problem. This was not a hidden failure. It was a known one.
What Does the Bank of America Fine Actually Tell Us?
As a business ethics keynote speaker, I have spent two decades telling audiences that the most dangerous moment in any organization is not when someone breaks a rule. It is when someone sees the problem, understands it, and decides it can wait. I know that moment personally. Trust me. I was a young CPA who knew the rules cold and made choices anyway, and those choices cost me my license and my freedom. Institutions make the same decision people do. They just do it with more paperwork.
The numbers here are historic. FinCEN’s $1.2 billion assessment is the third-largest in its history, behind Binance’s $3.4 billion in 2023 and TD Bank’s $1.3 billion in 2024. The OCC’s $750 million share, credited against the FinCEN penalty, is the largest that agency has ever imposed. A separate $11.6 million OFAC settlement covered 475 apparent sanctions violations involving countries including Iran, Russia, and Belarus. Bank of America admitted it willfully violated the Bank Secrecy Act. Willfully.
Why Do Smart Organizations Keep Getting AML Compliance Wrong?
Two years earlier, TD Bank gave the whole industry a preview. In October 2024 it pleaded guilty and agreed to pay about $3.09 billion, including a record $1.8 billion criminal penalty from the Justice Department. It also accepted a $434 billion cap on its U.S. assets. Prosecutors described a “flat cost” approach in which leadership held compliance spending steady while the bank grew. Employees reportedly joked that the bank was an easy target for criminals. When people inside a company joke about the controls, the culture has already fessed up.
The pattern repeats because the incentives repeat. Compliance spending shows up on this quarter’s budget. Compliance failure shows up years later, often after the executives who made the trade-off have moved on. That gap between choice and consequence is where good people talk themselves into bad decisions. I’ve watched it happen. I’ve done it. Every choice has a consequence. The bill just arrives late.
What Are the Five Signs You’re Getting AML Compliance Right?
Lexology Pro framed the Bank of America case as a reason to ask whether your program is on the right track. Here are the five signs I would look for, drawn from what went wrong at both banks. The first one is simple. Flagged problems get fixed, not filed. If an examiner, an auditor, or your own team names a deficiency, there should be an owner, a deadline, and a date it closed. Bank of America had a cease-and-desist order in hand. The breakdowns kept coming anyway.
The second sign is that the compliance budget grows when the business grows. TD Bank’s leaders treated compliance as a fixed cost while transaction volume climbed, and that is how a program quietly falls behind the risk it is supposed to manage. The third sign is that alerts get worked. A monitoring system that generates alerts nobody investigates is downright dangerous. It creates a paper trail proving you knew.
The fourth sign is that people raise concerns without fear and without jokes. Ask your frontline staff whether they believe a red flag they escalate will be taken seriously. Their honest answer tells you more about your program than any policy manual. The fifth sign is that you can prove the program works, not just that it exists. Let me be clear. That last point is about to become the standard regulators hold you to.
How Is FinCEN Changing What “Effective” Means?
On April 7, 2026, FinCEN proposed what it called a fundamental reform of anti-money laundering program requirements. The proposal shifts the standard from technical compliance to effectiveness. It separates whether a program is properly designed from whether it is actually carried out in all material respects. The comment period closed June 9, 2026, and a final rule is expected late this year or early next, with a twelve-month runway to comply. Translation: regulators will stop asking whether you have the pillars and start asking whether they hold any weight.
What Should Leaders Do Before the Next Exam?
Bank of America now has to work with an independent third party to go back through transactions it previously missed and report what it finds. Think about the cost of that lookback, in dollars and in reputation. Now compare it to the cost of working those alerts the first time. The bank has said it invested billions in technology and dedicated thousands of employees to fighting financial crime. I believe that. But investment is not the same as follow-through.
In my work as a business ethics keynote speaker, I tell leaders that compliance is not a department. It is a series of small decisions made by ordinary people on ordinary days, usually when nobody is watching. The fine is the headline. The real story is every single day someone could have said this can’t wait. And didn’t.
FREQUENTLY ASKED QUESTIONS
Why was Bank of America fined $1.2 billion in 2026?
On October 13, 2026, the U.S. Treasury announced roughly $1.21 billion in penalties against Bank of America for anti-money laundering and sanctions violations. Regulators found the bank failed to report more than $5 billion in suspicious transactions on time, including more than $1 billion tied to national security risks. The bank admitted it willfully violated the Bank Secrecy Act.
What are the largest anti-money laundering fines in U.S. history?
In FinCEN’s own history, Binance’s $3.4 billion penalty in 2023 is the largest, followed by TD Bank’s $1.3 billion in 2024 and Bank of America’s $1.2 billion in 2026. TD Bank’s full 2024 resolution totaled about $3.09 billion, including a $1.8 billion Justice Department penalty, the largest ever imposed under the Bank Secrecy Act.
What are the signs of an effective AML compliance program?
Flagged deficiencies get closed with a named owner and a deadline, and the compliance budget grows as the business grows. Alerts get investigated instead of piling up, and employees escalate concerns without fear. Chuck Gallagher, a business ethics keynote speaker, adds a fifth test: the organization can prove the program works, not just that it exists.
What is FinCEN’s 2026 proposed AML effectiveness rule?
On April 7, 2026, FinCEN proposed reforms that shift AML program requirements from technical compliance to demonstrated effectiveness. The proposal separates whether a program is properly designed from whether it is carried out in all material respects. Comments closed June 9, 2026, and FinCEN proposed a 12-month implementation period after a final rule is issued.
Why do banks ignore known compliance problems?
The cost of compliance shows up in the current budget, while the cost of failure often arrives years later. In the TD Bank case, prosecutors described leadership holding compliance spending flat while the bank grew. That gap between a decision and its consequence makes it easy for capable people to rationalize waiting.
BRING THIS CONVERSATION TO YOUR ORGANIZATION
Compliance programs do not fail in the exam room. They fail in a thousand small moments when someone decides a red flag can wait until next quarter. That is the conversation I bring to boards, banking associations, and leadership teams: how ordinary people make the choices that end up in Treasury press releases, and how to build a culture where the right choice is the easy one. If your organization wants its people to recognize that moment before a regulator does, connect with Chuck Gallagher at ChuckGallagher.com.
FIVE QUESTIONS FOR REFLECTION
1. Bank of America’s regulators identified deficiencies in 2023, yet problems continued after a 2024 cease-and-desist order. What in your organization has been flagged but not closed?
2. TD Bank held compliance spending flat while the business grew. Has your compliance investment kept pace with your growth over the last three years?
3. If you asked your frontline employees whether escalating a red flag actually changes anything, what do you think they would say?
4. Can your organization show evidence that its controls work, or only evidence that they exist?
5. Where in your own work is there a gap between a choice made today and a consequence that will not arrive for years?
