By Reed R. Kathrein

Budget-Optimized Money Laundering

There is a fundamental tension in modern banking: moving money generates revenue, but checking to see if that money belongs to international cartels or sanctioned entities generates payroll. As a corporate executive, you are legally allowed to run a bank that is operationally terrible at catching illicit finance. What you are not allowed to do is run a bank that is terrible at catching illicit finance on purpose to save money, ignore the explicit warnings of your compliance officers, and then assure shareholders that your risk management is state-of-the-art. Bank of America (NYSE: BAC) recently solved this tension with an elegant, if highly illegal, piece of algorithmic willful blindness.

On October 13, 2026, the U.S. Department of the Treasury dropped a staggering series of enforcement actions against the bank imposing more than $1.21 billion in penalties. This included a $1.2 billion civil money penalty from FinCEN for systemic Bank Secrecy Act (BSA) violations, a $750 million penalty from the OCC (credited against the FinCEN fine), and an $11.6 million settlement with the Office of Foreign Assets Control (OFAC) for sanctions violations involving Iran, Russia, narcotics, and global terrorism. Following the news, the bank's stock dropped approximately 4.76% on October 14. But the real story isn't just that Bank of America failed to detect money laundering; it is the specific, documented reason why they failed to detect it. When faced with the choice of staffing a compliance department capable of monitoring its massive transaction volume or artificially suppressing the alerts so the existing staff wouldn't be overwhelmed, management simply hard-coded their way out of the problem.

The Mechanics of the Mirage

The basic plumbing of Bank of America's anti-money laundering compliance relied on a proprietary automated transaction monitoring software called "Event Processor" (EP). The bank hard-coded a 20-point threshold into the system. If an event group scored a 19, the computer assumed it was perfectly legitimate commerce; if it scored a 20, it was flagged for human review. The problem, according to the FinCEN Consent Order No. 2026-03 and the OCC Cease and Desist Order, and the securities fraud class action complaint filed in New England Teamsters Pension Fund v. Bank of America Corporation, Case No. 1:26-cv-09137, S.D.N.Y., was that the bank knew this threshold was actively suppressing actual Suspicious Activity Reports (SARs) and routinely ignored "counterintuitive" risk weights that undervalued known high-risk activities.

The systemic nature of these failures was not exactly a surprise; the OCC had already issued a formal Cease-and-Desist Order against the bank in December 2024 demanding sweeping overhauls to its BSA and sanctions compliance programs. After agreeing to the 2024 Order, the bank still failed to prioritize BSA/AML compliance and continued to ignore potentially suspicious activities. FinCEN found that, as the result of EP deficiencies, Bank of America did not timely and accurately report over $5 billion of suspicious activity, with roughly $1 billion implicating national security and other priority illicit finance risks. Even when the bank made core adjustments to its EP and finally ran a limited scope lookback with lowered thresholds, it found nearly $4 billion in suspicious activity that had slipped through the cracks, estimating that fixing the threshold would double the monthly investigation volume and require hiring 750 additional compliance personnel. Simultaneously, the bank's OFAC screening mechanisms were processing payments to blocked Russian and Belarusian banks simply because of "human error," alert suppression rules, and failures to prioritize exact name and date-of-birth matches.

The Texts

It is a timeless corporate mystery why executives involved in questionable securities behavior always feel compelled to leave a pristine, fully costed paper trail of their own willful blindness. When Bank of America's compliance personnel started digging into an online auto auction client ("Customer A") that was receiving billions in international wire transfers from high-risk jurisdictions and third-party money orders with a nexus to the southwest border, the internal reaction was less than subtle.

After identifying that the client had generated over 100 AML cases mostly related to fraud, the internal chats lit up:

"...prompting a fellow compliance employee to reply 'YESSSSSSSSSSSS 🤩 Concern that the client does not have visibility or understanding of source of funds,' and, on a related email thread, another compliance employee to respond to the case volumes and inquiries from law enforcement related to Customer A with 'WOW.'"

Compliance eventually recommended closing the client's accounts due to "an insane amount of cases/investigations" and glaring money laundering concerns. The relationship manager's response? They fought to keep the client, noting it was a "large and valued client" generating $6 million in annual revenue, adding that "a closure here would be detrimental given the impact of this relationship."

Ah, yes. The classic corporate pivot where you accidentally facilitate billions of dollars in suspected trade-based money laundering because offboarding the client would be "detrimental" to the specific relationship manager's revenue goals. Following the penalty, CEO Brian Moynihan framed the nearly $2 billion in fines as just a decision to "call this a settlement and move forward."

The Enforcement Deficit

This is exactly why these cases inevitably land in federal court. Regulators like the OCC can issue Cease and Desist orders in 2024, and FinCEN and OFAC can eventually drop $2 billion in fines and penalties years after the fact. But the SEC is perennially understaffed, underfunded, and drowning in filings. Without private enforcement and FOLS (Fear Of Lawsuit), corporate executives have near-zero economic incentive to tell the truth. To a systemically important financial institution generating billions in net income, a regulatory fine is just a retroactive tax on doing business. Class actions aren't an annoyance; they are the market’s primary mechanism for enforcing reality and cleaning up the mess.

If You Bought the Float

If you happened to purchase $BAC securities during the period when management claimed their risk and compliance controls were highly effective, and you are interested in seeing the bill for that discrepancy, our litigation team at Hagens Berman is reviewing the paper trail.

• Case Hub: hbsslaw.com/BAC
• Email: [email protected]