OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance

The size of the assessment — the largest in OCC history — signals that regulators will pursue severe financial penalties where banks fail to maintain effective AML programmes, including customer due diligence, suspicious activity monitoring, and SAR filing. For compliance executives, the key lesson is that deficiencies in governance, data quality, and alert triage can escalate rapidly into enforcement. Firms should treat this as a sector-wide warning, not an isolated bank-specific event.

Immediate actions include: reassessing AML risk assessments across products and geographies; validating transaction monitoring and sanctions screening models; strengthening CDD/EDD and beneficial ownership processes; ensuring timely and complete SAR/CTR filings; and evidencing independent testing and board oversight. Resource allocation should reflect the expectation that examiners will test not just policies but outcomes. Smaller institutions may face proportionally greater strain, but the OCC’s message is clear: all national banks and federal savings associations must demonstrate effective, risk-based BSA/AML controls.

RegCanary recommends that compliance teams benchmark their programmes against the OCC’s findings, document remediation plans, and consider investing in RegTech solutions that improve alert quality and audit trails. The penalty also raises the stakes for third-party and correspondent banking relationships, where inadequate due diligence can create contagion risk. While the direct financial hit falls on Bank of America, the reputational and supervisory consequences will reverberate across the banking sector, potentially accelerating demands for enhanced AML technology and specialist expertise.

This is a moment to move from reactive remediation to proactive, evidence-led financial crime risk management.