Bank of America missed $5 billion in suspicious money. The bill came to two weeks of profit.

Twice every working day, a computer at Bank of America decided which of the bank's customers deserved a second look, and it decided with points. A large cash deposit at an ATM was worth one point. A grand jury subpoena, twenty points, which was the magic number, because at twenty a human being was finally asked to open the file. Below twenty nothing happened, and after thirteen months the points began to expire. The bank's own records say the twenty was set by "stakeholder judgment" when the system was built in 2010, and it stayed there until December 2023. On October 13, 2026, three bureaus of the United States Treasury put a price on those thirteen years, and for the second-largest bank in the country the price came to about two weeks of profit.

The question this piece sets out to answer from the paper is narrower than the press release and better. Who inside the bank knew the alarm was set wrong, when did they know it, and what did the regulator with examiners stationed inside the building do while they knew?

The paper is unusually good. FinCEN, the Treasury bureau that collects suspicious activity reports, published a 95-page consent order that the bank signed and, in the order's words, "admits to." The Comptroller of the Currency published a ten-page penalty order the same day, to which the same bank "neither admits nor denies." The Office of Foreign Assets Control added six pages on sanctions, and the chief executive took questions the next morning, in a transcript the bank posted itself. The documents name no customer and no executive, but they quote the bank's emails and put dates on nearly everything.

The machine

In 2010 the bank built a system it called Event Processor. Its records, as FinCEN summarizes them, called EP the first of its kind in the industry, built with "very little documentation or literature to draw from in its creation," and named the problem it solved: "there were not enough investigators to work all of the alerts that were being generated by detection channels." So the alerts would not go to investigators. They would go to a scoring engine, which bundled every alert on a customer into an "Event Group," summed the weights, and promoted the group to a "case" for human eyes only when the total reached 20. The 20 was "initially set by stakeholder judgment." The 13-month expiry was stakeholder judgment too, chosen because a longer window "increases the probability that a few false positive[s] . . . might combine to reach the case [creation] threshold." The window was sized to keep alerts from adding up. The federal rule gives a bank 30 days from detection to file a report; under EP, "a material portion" of the bank's reports went in over six months late, because the machine was still waiting for points.

The weights were the second problem, and the bank measured it for years with a yardstick it called SAR yield, the share of investigated groups that ended in a report. An April 2019 report found that the ATM Large Cash Deposit factor, worth one point, had a SAR yield of 56.75 percent: more often than not, something the bank had to report to the government, valued at one point out of twenty. Between 2018 and 2023, 76 percent of all the weights in EP never changed, and of the quarter that did, about 80 percent went down. A 2021 recalibration lowered 106 weights, raised 17, and described the resulting "SAR loss" as "permissible," without, FinCEN notes, explaining "how permissibility was determined." A bank told for years that its alarm was too quiet responded by turning it down.

What did reach 20? The government, much of the time. Subpoenas, seizure warrants, requests from other banks and employee referrals carried an automatic 20 points and became cases on the spot. For several years over one-third of all the cases the bank investigated began that way, and in 2023 the figure approached half. The nation's second-largest bank had built a dirty-money detector whose most reliable sensor was a prosecutor at the door. The Treasury Department's release says the bank "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations." I would put it less delicately. The alarm worked best once somebody else had already called the police.

The tests

The bank did not have to guess at any of this. It tested EP every year, and the tests told it that the line was in the wrong place. From 2018 to 2020, groups scoring 20 to 24 points, just over the line and therefore investigated, produced reports 33 to 34 percent of the time. In 2022 and early 2023, sampled groups scoring 16 to 19, just under the line and therefore ignored, produced reports 38 to 45 percent of the time. The suspects below the threshold were more suspicious than the suspects above it. The 2022 validation report concluded that "the appropriateness of the current case creation score threshold (20) needs to be justified."

The suspects below the threshold were more suspicious than the suspects above it.

It was never justified. It was defended. In 2023, when a test of the groups below the line came back with an 18 percent yield, the bank's former Global Head of Financial Crimes "directed a senior manager to repeat" it. The second test pronounced the first "incorrect" and "unreliable," blamed investigator inexperience and biased sample selection, and concluded that the team was "confident that EP is working as intended." FinCEN's gloss is the sentence in the order I would frame: "when this status quo was jeopardized by an unfavorable result from an internal test, the then-Global Head of Financial Crimes directed a senior manager to repeat the test at issue and achieved a more favorable result."

The line moved in December 2023, "Following engagement with the Bank's prudential regulators." The threshold fell to 10 or 12 points, and the bank then looked back at the groups that had sat between the old line and the new one and found nearly 8,900 reports it had never filed, covering nearly $4 billion. A 2024 planning document promised to move the bank off "the prior overly complex Event Processor model." Fourteen years after its records called EP the first of its kind, the bank's own planners called it overly complex, which is the adjective an institution reaches for once the machine has become somebody else's fault.

Three customers and a stack of money orders

The second half of the FinCEN order concerns three customers it declines to name: two online marketplaces for salvaged vehicles, Customer A, a client since 1995, and Customer B, publicly traded and a client since 1996, and Customer C, an exporter the bank filed as a "small-medium" business with expected annual sales of $1 million to $4 million. If you want to buy a wrecked car at auction with cash you would prefer not to explain, you buy money orders, and because the store that sells them must record your identity at $3,000, you buy three at a time totaling a little less. Between October 2020 and May 2025, FinCEN found, Customers A and B deposited over 680,000 such instruments in roughly 220,000 groups totaling over $660 million, about one group in three purchased near the southwest border. Event Processor had no coverage of money-order deposits at all.

The bank was told, repeatedly, by people it paid to tell it. In June 2020 an investigator wrote: "although [Customer A] is considered a suspect, account will not be closed. Issue has been escalated to the client team on multiple occasions; however, closure is not supported." In September 2021 the company that issued the money orders asked about dozens of suspicious instruments landing in Customer B's account; the bank replied that it saw nothing unusual and changed nothing. In July 2022 compliance recommended closing Customer A's accounts. One employee tallied over 100 cases since 2020, most of them "fraud cases due to incoming payments via wires [and] checks." A colleague replied "YESSSSSSSSSSSS," and on another thread, "WOW." Compliance expected "some pushback on the closure," because Customer A was a "longstanding client and there is significant credit exposure." A slide deck for the bank's then-BSA Officer, the compliance officer the statute requires every bank to designate, counted over 250 referrals and over 125 investigations since 2020, roughly 90 percent fraud. The relationship manager conceded that "the industry isn't the cleanest so there is always fraudster risk here" and argued that "a closure here would be detrimental given the impact of this relationship."

Detrimental won. In January 2023 a law enforcement officer told compliance that an investigation "considers the activity through these [online auto auction] companies to be money laundering." In March 2023 the relationship manager negotiated four mitigation steps with the customer instead, and compliance withdrew its recommendation. The customer kept accepting third-party payments until June 2025 and money orders until about July 2025. In November 2023 one of the two auction companies disclosed in a securities filing that the Justice Department was investigating it for possible money-laundering violations, and the bank changed nothing. Of nearly $1 billion in suspicious wires FinCEN identified, over $850 million involved Customers A and C, and the bulk was reported in June 2025, "only after the Bank received certain requests for information from FinCEN." Roughly 51,000 groups of suspicious money orders for Customer B after the September 2021 warning, and roughly 72,000 for Customer A after the July 2022 closure recommendation, were never reported on time.

The regulator in the building

None of this happened in the dark. The Comptroller of the Currency keeps examiners inside Bank of America year round; the 2024 order routes every submission to an "Examiner-in-Charge." And Congress wrote the Comptroller's duty in the imperative. When a bank "has failed to correct any problem" with its anti-money-laundering procedures that the agency previously reported, says Section 1818 of the banking code, "the agency shall issue an order." That is the provision the OCC invoked in its order of December 23, 2024, which found that the bank "failed to make acceptable substantial progress towards correcting a deficiency related to the Bank's Customer Due Diligence ('CDD') processes that was previously reported to the Bank by the OCC." The order does not say when "previously" was. It imposed no penalty. The directors signed it neither admitting nor denying, and it found deficiencies in "the internal controls, BSA Officer, independent testing, and training components" of the program, which is every component the Comptroller's own regulation requires. The OCC's release that day ran to a few paragraphs.

The October 2026 penalty order fills in the dates the 2024 order left blank. "Between 2019 and 2023, Bank management, including the then-BSA Officer, received written reports showing that the Bank was failing to file suspicious activity reports ('SARs') on approximately 18%-44% of potentially suspicious activities not referred for investigation (depending on the year)." On the money-order deposits, the bank "failed to effectively monitor these accounts for at least another two years after the OCC communicated its concern." Examiners pulled "a small sample" from the bank's $102 billion credit card portfolio, found ten accounts with signs of trade-based laundering, and the bank then filed reports on "hundreds of millions of dollars in suspicious transactions" in five of them. "Absent the OCC's request," the order says, "there is no indication that the Bank would have reviewed these accounts or filed these SARs." And nearly two years into the regulator's direct supervision: "As of the date of this Order, the Bank's BSA/AML program remains deficient."

So the regulator knew. It had reported the diligence problem before December 2024, on a date it does not give. It raised the money-order red flags and watched the bank fail to act on them for at least two more years. It issued its first formal order in December 2024 with no money attached, and its first penalty in October 2026. Comptroller Jonathan V. Gould's release supplies the interval itself, "Almost two years ago, the bank signed an order with the OCC," and warns that banks without effective programs "can expect swift and significant action from the OCC." Significant, yes. The record will not bear the other adjective.

Two orders were signed here on the same facts, by the same bank, for the same department, on the same day, and they disagree about what happened. To FinCEN, Bank of America "admits that it willfully violated the BSA," willfulness being defined in a footnote as "reckless disregard or willful blindness." To the Comptroller, the same bank "neither admits nor denies" findings that describe the same machine and the same backlog. A bank can apparently be willfully blind on one floor of the Treasury and agnostic on the next.

The machine had a third regulator. Merrill Lynch, the bank's brokerage arm, leaned on EP for its own filings, and the Securities and Exchange Commission has sanctioned Merrill three times for missing them: in 2017; in July 2023, when its parent had used a $25,000 reporting threshold where the rule says $5,000; and on June 29, 2026, when the SEC found that "at least as early as April 2020" Merrill's own analyses showed that groups below EP's 20-point line would have produced reports, and that Merrill "did not change the Event Processor promotion threshold until December 2023." Merrill paid $7.5 million without admitting the findings. Three agencies, one scoring engine, one number.

The bill

FinCEN assessed $1.2 billion and then credited the Comptroller's $750 million against it, so the bank wires $450 million to one bureau and $750 million to another, in FinCEN's third public enforcement action of the year. OFAC's $11,662,930 covers 475 apparent sanctions violations, including payments through 35 blocked banks. OFAC granted "no reduction to the base penalty, including no mitigation for remedial measures or cooperation," and recorded that it "had previously issued Bank of America multiple cautionary letters regarding substantially similar conduct."

The Treasury Department's release is headlined "Record Enforcement Actions." The record is the Comptroller's: $750 million is the largest penalty the OCC has imposed on a bank. FinCEN's $1.2 billion is $100 million under the $1.3 billion FinCEN assessed against TD Bank in October 2024, which FinCEN then called "the largest penalty against a depository institution in U.S. Treasury and FinCEN history," and most of this one is the Comptroller's money counted a second time. FinCEN's order puts Bank of America's last reported annual net income at about $30.5 billion, which makes $1.21 billion about two weeks of earnings. The bank's third-quarter results, released the next day, show net income of $6.9 billion after the $1.2 billion charge, and the chief financial officer told analysts that "Capital distributions exceeded net income": the bank returned $8.3 billion to shareholders in the quarter it booked the penalty. FinCEN's own arithmetic is that by declining to staff investigations the bank "had likely saved hundreds of millions of dollars in compliance-related expenditures." The fine, then, is a multiple of the savings, paid once, not deductible, and absorbed inside a quarter that still cleared almost seven billion dollars.

On the call, an analyst from Truist Securities asked the chief executive to explain "how it gets to this point." Brian Moynihan answered that "we have agreed to call this a settlement and move forward," and that "This settlement resolves the penalty that was in the 2024 cease-and-desist order." There was no penalty in the 2024 order; it reserved the Comptroller's right to seek one, and the one that arrived rests on findings that run past December 2024. Alastair Borthwick, the chief financial officer, assured another analyst that "there's no asset cap here" and that the orders "should not impact our clients in any way." Nobody asked whose job it had been. The orders describe a then-BSA Officer who was briefed and a former Global Head of Financial Crimes who had a test re-run, by title and by tense, never by name. FinCEN's order releases the bank and expressly does not release "any current or former director, officer, owner, or employee." In the documents I read, no such person is named, charged, fined or barred.

The remedy runs on a long clock. An independent consultant will re-read customer activity from January 2022 forward, may use what the order calls "super intelligence models" to do it, and owes its final report "no later than December 2028." The test of the rebuilt system begins when the bank says its remediation is complete, "but in no case will such testing commence later than October 2027." The people who will decide whether Bank of America can now see suspicious money are, in large part, people Bank of America pays.

What they said, and what the record shows

What they said	What the record shows
Treasury, October 13, 2026: "Record Enforcement Actions."	The OCC's $750 million is its largest. FinCEN's $1.2 billion is $100 million below its 2024 TD Bank penalty, and $750 million of it is the OCC's money credited over (Exhibits 9, 10).
Comptroller Gould, October 13, 2026: banks without effective programs "can expect swift and significant action from the OCC."	Management had reports of 18 to 44 percent failures from 2019; the first order came in December 2024 without a penalty, the penalty almost two years later (Exhibits 6, 7).
The bank's 2023 retest: the team was "confident that EP is working as intended."	The lookback under the lowered threshold found nearly 8,900 unfiled reports on nearly $4 billion (Exhibits 3, 5).
The bank to a money-order issuer, September 2021: nothing unusual in Customer B's deposits.	Roughly 51,000 groups of suspicious money-order deposits for Customer B between October 2021 and May 2025 went unreported on time (Exhibits 4, 5).
Brian Moynihan, October 14, 2026: "This settlement resolves the penalty that was in the 2024 cease-and-desist order."	The 2024 order imposed no penalty and reserved the right to seek one. The 2026 findings run past December 2024 and say the program "remains deficient" (Exhibits 6, 7).
OCC order, October 13, 2026: the bank "neither admits nor denies." FinCEN order, the same day: the bank "admits that it willfully violated the BSA."	Same bank, same facts, same department, same day (Exhibits 7, 9).

A proposal, sized to survive

None of what follows needs an act of Congress. When the Comptroller issues an order under Section 1818(s)(3) for a problem "previously reported," the order should say when, so the public can measure the distance between the report and the order; the 2024 order could have done it in a clause. When the consultant's lookback report lands by December 2028, FinCEN should publish the count and dollar volume of the reports it produced, as the order already publishes the 8,900 and the $4 billion from the first one. And Treasury should stop accepting, in the same matter on the same day, an admission of willful violation in one bureau's order and a refusal to admit in another's. If the bank will say it to FinCEN, the Comptroller can insist on hearing it too.

The charge

Start with the bank, because the bank has confessed, and the confession is better than the press release. The charge is not that a computer malfunctioned. The computer did exactly what it was built to do in 2010, which was to ration the attention of investigators the bank did not want to hire, and for thirteen years every test that said the alarm was set wrong was answered with a reason to leave it alone: it would cost staff, it would "exhaust the investigation resources," and when a test came back wrong a senior executive had it run again and, in FinCEN's words, "achieved a more favorable result." Every compliance officer who said a customer should go was answered with revenue and "significant credit exposure." FinCEN's finding, which the bank has admitted, is that "management focused on the impact to the Bank's resourcing rather than remediation" and that the bank "prioritized the revenue associated with these customer relationships." Strip the regulatory prose off that sentence and it says the second-largest bank in America decided, year after year, with the data in front of it, that catching suspicious money was a cost to be managed, and let about $5 billion of it go unreported, or reported late, until the government asked.

Now the Comptroller, whose charge is slower and, to my mind, worse, because the Comptroller is the one actor in this story with no revenue to protect and a statute that says shall. Its examiners were in the building; its own handbook puts them there full time. By the Comptroller's findings, which the bank neither admits nor denies, management had reports from 2019 showing it was missing between a fifth and nearly half of the suspicious activity it never referred, and the agency raised the money-order red flags only to watch the bank fail to monitor those accounts for at least two more years. The order does not say when the agency first spoke. Its first formal order, in December 2024, carried no number. The number came almost two years after that, by which point the bank, per the regulator, still could not reliably send a suspicious transaction to a human. Why the OCC moved at that speed the paper does not say. It does say what the speed cost, and it says that the agency's answer, after all of it, was an order the bank signed without admitting anything and a penalty the bank could pay out of a fortnight's earnings.

And then the system, which is where the anger belongs, because the bank and the Comptroller only did what the system lets them do, and the system has a ritual. Two Octobers ago FinCEN assessed TD Bank $1.3 billion for a program its director said the bank had allowed to languish "For over a decade," called it the largest penalty against a depository institution in Treasury's history, imposed a four-year independent monitor, and announced it alongside the Justice Department, the Comptroller and the Federal Reserve. Two Octobers later the second-largest bank in the country admitted the same willful failure, drew a FinCEN number $100 million smaller, got no monitor, only consultants it proposes itself and FinCEN may veto, and, in the documents I read, no Justice Department at all; both orders reserve the Department's rights in the boilerplate, and neither mentions anything it has done. The Treasury called this a record. A record of what? Of the Comptroller's own penalties, which is true. The rest is a settlement smaller than the last one. A bank can admit willful blindness to one bureau and neither admit nor deny to another on the same afternoon. The people whose decisions the orders describe appear by job title and in the past tense, the then-BSA Officer, the former Global Head, and the orders preserve the government's right to pursue them while the government pursues no one; FinCEN's release of the bank carves out every "current or former director, officer, owner, or employee," and that reservation is as close as any document in this file comes to pursuing them. The fix is due in 2028. And the bill, two weeks of profit, was announced on a Tuesday and gone by Wednesday's earnings call, where the chief financial officer told analysts to adjust it out because the bank "wouldn't view that as being repeated," and reported in the same breath that the bank had returned $8.3 billion to its shareholders in the quarter. That is the ritual. The bank confesses to the bureau that requires it and shrugs at the one that does not, pays a fortnight's profit, buys back its stock, and hires the people who will certify, by 2028, that the machine is fixed. Nobody is named. Everybody moves forward. On the evidence of the SEC's three orders against Merrill, the last of them about this very machine, the forecast that this will not be repeated is the one forecast in this story the record has already contradicted, and if the pattern of the last two Octobers holds, the next record will be smaller than this one and will still be called a record.

What was read

This piece rests on documents, each opened on October 28, 2026: the FinCEN consent order; the OCC's 2026 penalty order and its December 2024 cease-and-desist order, with the OCC's releases on both; the Treasury Department's release; OFAC's enforcement release; FinCEN's October 2024 TD Bank release and its enforcement listing; the SEC's June 2026 Merrill Lynch order and its July 2023 release; Bank of America's third-quarter earnings release as filed with the SEC and the transcript of its October 14 call as posted by the bank; and the statute and regulations from govinfo.gov, with the Comptroller's Handbook for how the OCC staffs a bank of this size. The customers are unnamed in the orders and unnamed here. No document I read says when the OCC first reported the diligence problem. The bank's 2025 annual report could not be retrieved in full, so its own account of the 2024 order to shareholders is not quoted. No news report was used as a source of fact. Corrections, if any are needed, will run at the top of this page.

Columns are the views of their authors. They are not legal advice and not the position of the firm.