Bank of America draws the largest penalty in OCC history

FinCEN assessed a $1.2 billion penalty against Bank of America on October 13. The bank admitted that it willfully violated the Bank Secrecy Act. It failed to maintain an AML program that met minimum requirements, to conduct due diligence on correspondent accounts, and to file suspicious activity reports. The OCC assessed a $750 million civil money penalty on the same day, and FinCEN’s fine credits it. OFAC settled 475 apparent sanctions violations for $11.6 million. Treasury put the combined total at more than $1.21 billion.

The OCC called the case its largest civil money penalty ever. “The second largest bank’s egregious and continued BSA violations warrant the OCC imposing its largest CMP ever assessed against a bank,” Comptroller Jonathan Gould said. Treasury said the bank failed to timely report more than $5 billion in suspicious transactions. More than $1 billion of that involved priority risks, including Chinese money laundering networks, fraud, and trade-based money laundering tied to the southwest border.

American Express, five days earlier

On October 8 the OCC issued a cease-and-desist order and a $350 million penalty against American Express National Bank of Sandy, Utah. The OCC found that the bank’s risk assessment focused on its deposit products instead of its dominant card business. About $13 billion of suspected trade-based money laundering went unreported over a decade. The Federal Reserve issued a concurrent cease-and-desist order against American Express Company.

The standard Treasury wrote down

The amounts belong to two very large institutions, but Treasury’s release states expectations for every bank. Institutions cannot “rely on law enforcement inquiries, referrals from other financial institutions, or other external sources as substitutes for their own effective internal monitoring and controls.” It adds that “merely documenting concerns or engaging in prolonged internal reviews without appropriate corrective action does not satisfy an institution’s compliance obligations.” The American Express order makes a related point about risk assessment. It has to follow the products where the risk actually sits.

An open finding with a long review attached is no longer a defense. Treasury has now said so in writing.