Bank of America hit with $750M OCC fine

The Office of the Comptroller of the Currency imposed a $750 million civil penalty on Bank of America for deficiencies in its compliance program under the Bank Secrecy Act and its implementing rules. The action includes a cease-and-desist order that has been in place since December 2024. At the same time, FinCEN assessed a $1.2 billion penalty and credited the OCC sanction against it, leaving the total exposure at roughly that amount.

What penalty did Bank of America receive?

Bank of America was hit with a $750 million civil penalty and a cease-and-desist order already in effect since December 2024, according to the OCC. FinCEN, for its part, assessed a $1.2 billion penalty and took the banking regulator's sanction into account.

The action rests on BSA/AML compliance deficiencies. According to the information released by the cited sources, the bank allegedly failed to adequately monitor transactions worth trillions of dollars and had known for years about failures to escalate potentially suspicious activity to investigators. Banking Dive also said the OCC fine was the largest penalty in the agency's 163-year history, a characterization attributed by the outlet to its own reporting.

What other recent OCC cases did it show?

The OCC also announced a $350 million fine against American Express National Bank for failures in its BSA/AML program, along with a cease-and-desist order. The regulator cited problems in internal controls, risk assessment, independent testing, training, and suspicious activity monitoring.

In that case, the Federal Reserve ordered American Express's parent companies to address enterprise-wide financial crime deficiencies and create a board-level compliance committee, according to American Banker. Fintech Futures added, citing the OCC, that the failures were linked to the late identification, assessment, and reporting of about $13 billion in trade-based money laundering activity over the past decade, a figure that should be read as attributed to that coverage and not as an independently confirmed additional fact.

What are regulators saying about AI and cybersecurity?

According to people familiar with the matter cited by Journal Record, the Federal Reserve, the OCC, and the FDIC are asking U.S. banks about the use of advanced artificial intelligence models, including autonomous agents applied to cyber defense. That reporting indicates regulators are still collecting information and have not set specific prescriptive requirements.

The focus of those questions includes human oversight, traceability, and shutdown capability. For now, the available material does not show a new formal requirement, only an ongoing supervisory review of cybersecurity risks tied to the deployment of those systems.