Bank of America pays OFAC $11.66 million to settle 475 apparent sanctions violations, with no reduction from the base penalty

Bank of America agreed on 13 October to pay the Office of Foreign Assets Control $11,662,930 to settle 475 apparent sanctions violations. They ran from 18 September 2021 to 24 April 2025, under seven programmes, and were worth about $14.8 million.

The amount is the base penalty, unreduced. OFAC found the case non-egregious, which sets a lower starting point, and then gave no credit for remediation or cooperation. It said the bank had received "multiple cautionary letters" about substantially similar conduct, had acted recklessly, and had given OFAC "piecemeal or incomplete" answers that slowed its investigation.

The sanctions settlement was the smallest of three penalties announced the same day. FinCEN imposed $1.2 billion for Bank Secrecy Act failures from at least January 2018 to July 2025; the bank had failed to report more than $5 billion in suspicious transactions on time. The Office of the Comptroller of the Currency, the OCC, imposed $750 million, which FinCEN credited against its own figure. Treasury's total of "more than $1.21 billion" is FinCEN's $1.2 billion plus OFAC's $11.66 million, not the sum of all three headline numbers.

OFAC sorts the violations into four groups. The counts below are ours, taken from the release.

The release itemises 472 of the 475 violations and does not say how it counted the $189,869 transfer, which may account for the other three. Every dollar figure it gives, the transfer included, adds up to $14,833,938, within $144 of its stated total.

Read the table by row, not by size. About 85 percent of the violations and 97 percent of the money sit in the first row. The first row is a correspondent bank's plumbing problem. The other three are problems any firm with a screening tool can have this week.

In May 2021 the bank automated the routing of some cross-border payments. Its systems chose intermediary banks from a vendor's "routing directory". After Russia invaded Ukraine in February 2022, OFAC blocked some of the banks in that directory. Bank of America noticed in March 2022.

The payments were screened, intermediary banks included. OFAC gives three reasons they went through anyway. Some were sent in the days after one of those banks was blocked and before Bank of America updated its filter. Some alerted, and analysts in the sanctions or payments teams marked them false positives. And some alerted and were released automatically by an "alert suppression rule". The rule silenced alerts in certain circumstances, for example when an alert rested on exactly the same criteria as one an analyst had already closed as a false positive.

The third reason is the one to study. A suppression rule stores a decision made against yesterday's list and applies it to today's. Take a Russian bank that was not blocked in January 2022: an analyst's false-positive decision was correct in January and wrong in March.

The bank removed the blocked banks from its payment engine's copy of the directory in January 2023, ten months after it found the problem. The last of the 403 payments went out in March 2025. OFAC adds that the bank ran "a single, narrowly tailored lookback" and found the full scope only after an administrative subpoena in January 2025.

The second failure is the simplest. A design flaw in the bank's alert prioritisation gave low or medium priority to individual customers whose name and date of birth both exactly matched a blocked person's. Three designated people, one each under the Burma, Russia and Kingpin Act programmes, made 31 transactions worth $56,258 on their Bank of America accounts and cards while the alerts waited.

The bank fixed the flaw in February 2024, six months after it found it. An exact match on two identifiers is the strongest signal a name-screening system produces. A priority model that ranks it below fuzzier hits is upside down.

Between 24 May and 28 June 2023, a vendor's human error meant the bank's watchlist file carried no changes to the SDN List. The bank processed six transactions worth $100,828 involving entities designated under the Burma, Somalia and illicit-drug programmes. It did not find the error until July 2023, about a month after another US bank blocked one of the payments further down the chain.

On 7 February 2025 it happened again, this time through technical problems on the bank's side. The file did not load the vendor's update reflecting the designations of 6 February. That day the bank processed 26 payments, worth $146,543, for a ship management company designated under the global terrorism regulations. The update was fully active on 12 February. The release does not name the company.

The lesson is not about vendors. A list feed fails silently: a screen against a five-week-old file returns a no-match that looks exactly like one against today's. The check that catches a silent failure is simple: on any day OFAC publishes designations, the file you screen against must change, and if it does not, someone is paged.

In May 2023 an analyst dismissed an alert by mistake. The alert identified an individual newly designated under the Russia programme as the beneficial owner of a business customer. The business account stayed open. In September 2023 the bank re-screened every customer record as it moved to a new screening platform, and the account alerted again. Nobody reviewed that alert until about July 2024, 14 months after the designation, because the re-screen produced more alerts than the bank was prepared for. Six transactions went through, worth $340.

The amount is trivial; the pattern is not. A migration is the one moment a firm re-screens its whole book, and OFAC says such changes "should be implemented in a controlled manner" to avoid "backlogs that cannot be effectively managed". Re-screening everything is right. Doing it without sizing the alert volume and staffing the review is how a correct alert sits unread from September to the following July.

The last case involved a branch. In April 2025 the bank restricted two business accounts because their authorised signer had just been designated. About a week later the business owner, the designated person's adult child, asked to close the accounts and move the money to a new account without the parent as signer. OFAC had recently served the owner with a third-party blocking notice over the parent's designation. Staff agreed and moved $189,869. Sanctions compliance caught it and blocked the new accounts before any of the money was used.

The release is about a US bank. Every component in it, though, exists at a European fintech or an exporter that pays in dollars: a list feed, payments reference data, alert rules, a priority score, a migration plan and branch staff. Five tests follow from the four failures.

1. Compare your list file's date with OFAC's publication dates. For the last five OFAC publication days, check when each change reached your file. Then alert on any publication day your file does not change.
2. Make suppression rules expire when the list changes. A rule that closes an alert because an analyst once closed a similar one must stop closing it when the matched entry is newer than that decision.
3. Seed an exact name and date-of-birth match into a test record. Check that it lands at the top of the queue and is reviewed the same day.
4. Screen the reference data, not only the transaction. Re-screen bank directories, supplier masters and correspondent lists after every major designation day.
5. Before moving to a new screening tool, estimate the alerts a full re-screen will produce and staff the review in advance. Then tell branch and operations staff what to do when a signer, owner or beneficiary is designated: the money stays blocked, whoever asks to move it.

For a firm whose customer file is a spreadsheet, the cheapest version of tests 1 and 4 is a scheduled re-run of the whole file against current lists. ScreenVeritAI's batch re-screening does the re-run from a CSV or XLSX file or the API. Each check is stored as dated, point-in-time evidence, so a later reviewer can see the date and the sources a decision was made against.

This is a report of OFAC's enforcement release and recent-actions notice of 13 October 2026, Treasury's press release of the same day, and the penalty section and conduct period of FinCEN's consent order. It does not assess the FinCEN or OCC findings, which are about transaction monitoring, not sanctions screening. We read all of them on 15 October 2026.

OFAC's release describes "apparent violations" and a settlement of potential civil liability, not a court finding. The release names no blocked bank, customer or ship management company, and neither do we. The counts and sums in the table are our own, from the figures OFAC gives. Nothing here is legal advice.