Bank of America Warns of Possible New AML Penalties

Bank of America has disclosed that it could face new penalties as US regulators continue enforcement discussions over deficiencies in its anti-money laundering programme.

In a quarterly filing with the Securities and Exchange Commission, the bank said it was continuing to discuss a resolution with the Office of the Comptroller of the Currency concerning a December 2024 consent order, Public reporting indicates that .

Consent orders require demonstrable remediation

Regulators generally expect banks under a consent order to complete corrective actions, validate that controls operate effectively and address root causes rather than only close individual findings.

Boards and senior management should receive clear reporting on overdue milestones, data limitations and residual risk. Independent testing is particularly important where remediation changes customer risk scoring, transaction monitoring or suspicious activity reporting.

The disclosure does not establish the amount or outcome of any penalty. It does show that AML weaknesses can remain a financial and governance issue long after an initial order is issued. Institutions should maintain evidence that improvements are sustainable in day-to-day operations.

What a sustainable remediation programme includes

A bank responding to an AML order should maintain a single inventory of findings, dependencies and evidence. Technology changes may fail if customer data is incomplete, while new procedures may not work if investigators are not trained or alert volumes exceed capacity.

Independent validation should test real cases and confirm that risk ratings, monitoring scenarios and reporting processes produce appropriate outcomes. Management should distinguish temporary compensating controls from permanent fixes. Regulators will generally look for proof that the improved framework operates consistently across business lines, not only at the date of a milestone submission.

Questions management should answer

• Which consent-order actions are overdue or dependent on data remediation?
• Has independent testing challenged closure evidence?
• Are investigators able to manage current alert volumes?
• Do board reports distinguish completed tasks from effective controls?

Next focus: Future filings and OCC action will indicate whether discussions produce a monetary penalty, additional remediation requirements or another form of supervisory resolution.