Bank of America, N.A. OFAC Settlement: $11.7M (2026)

Between September 18, 2021 and April 24, 2025, Bank of America engaged in 475 apparent violations of OFAC sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. The total value of these apparent violations was approximately $14,834,082. The apparent violations occurred due to four issues.

In May 2021, Bank of America implemented an automated process to determine the routing for transmitting certain cross-border payments on behalf of its customers via correspondent banks, under which its systems consulted a "routing directory" of banks provided by a third-party vendor and then automatically routed each payment via one or more intermediary banks. In March 2022, following the imposition of sanctions in connection with Russia's February 2022 invasion of Ukraine, Bank of America became aware that the routing directory included banks that had been blocked by OFAC pursuant to the Russian Harmful Foreign Activities Sanctions Regulations ("RuHSR"), 31 C.F.R. part 587, and that although it was screening these payments for compliance with OFAC-administered sanctions, it was nevertheless processing certain payments to or through blocked banks. Ultimately, Bank of America processed 403 transactions totaling $14,340,100 between February 2022 and March 2025 via 35 blocked banks, including 32 banks blocked pursuant to the RuHSR, two banks blocked pursuant to the Belarus Sanctions Regulations ("BelSR"), 31 C.F.R. part 548, and one bank blocked pursuant to Executive Order (E.O.) 13902 of January 10, 2020, "Imposing Sanctions With Respect to Additional Sectors of Iran." Despite being aware since March 2022 that its routing directory included blocked banks and that it had processed transactions involving them, Bank of America initially performed only a single, narrowly tailored lookback and did not identify the full scope of its payment activity involving blocked banks until after OFAC directed it to provide information about recent lookbacks it had conducted in a January 2025 administrative subpoena.

Due to a design flaw in its alert prioritization logic, Bank of America's sanctions relationship screening system classified alerts associated with individual customers whose name and date of birth both matched exactly those of a blocked person as low- or medium-priority, rather than high-priority. Because these alerts were not identified as high-priority, Bank of America's review of the alerts was delayed, allowing three individuals designated pursuant to the Burma Sanctions Regulations (BSR), 31 C.F.R. part 525; the RuHSR; and the Foreign Narcotics Kingpin Sanctions Regulations (FNKSR), 31 C.F.R. part 598, respectively, to engage in 31 transactions totaling $56,258 between September 2021 and February 2024, using their Bank of America bank or credit card accounts.

Between May 24 and June 28, 2023, due to human error by a third-party vendor, the sanctions watchlist file Bank of America used to perform sanctions screening was not updated to reflect changes to OFAC's List of Specially Designated Nationals and Blocked Persons, and as a result Bank of America processed six transactions totaling $100,828 involving entities designated pursuant to the BSR, the Somalia Sanctions Regulations ("SoSR"), 31 C.F.R. part 551, and the Illicit Drug Trade Sanctions Regulations (IDTSR), 31 C.F.R. part 599. On February 7, 2025, Bank of America's sanctions watchlist file failed to implement an update from its vendor reflecting the previous day's designations, this time due to a series of technical problems with Bank of America's systems, and as a result Bank of America processed 26 transactions on February 7 totaling $146,543 on behalf of a ship management company designated pursuant to the Global Terrorism Sanctions Regulations (GTSR), 31 C.F.R. part 594.

In May 2023, a Bank of America sanctions analyst dismissed an alert associated with an individual recently designated pursuant to the RuHSR, and as a result of that human error the business's Bank of America account remained unrestricted despite the business being blocked, during which time Bank of America processed six transactions totaling $340 on behalf of the business. Separately, in April 2025, Bank of America restricted two Bank of America business accounts that had as an authorized signer an individual who had just been designated pursuant to the IDTSR and GTSR, after which anti-money laundering operations personnel authorized a requested account closure based on a misunderstanding regarding how to handle accounts with blocked authorized signers, and branch staff transferred the funds in the accounts, totaling $189,869, into a new, unrestricted account before the blocked individual's adult child could conduct any transactions involving the funds, at which point Bank of America sanctions compliance personnel identified the error and blocked the new accounts.

OFAC determined that Bank of America did not voluntarily self-disclose 413 Apparent Violations and voluntarily self-disclosed 62 Apparent Violations, and that the Apparent Violations constitute a non-egregious case. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A., the base civil monetary penalty applicable in this matter is $11,662,930, which equals the sum of (i) the applicable schedule amount for each non-voluntarily self-disclosed apparent violation and (ii) one-half of the transaction value for each voluntarily self-disclosed apparent violation.

The settlement amount of $11,662,930, which reflects no reduction to the base penalty, is based on OFAC's consideration of the General Factors under the Enforcement Guidelines.

Collectively, this enforcement action emphasizes how an effective sanctions compliance program requires detail-oriented management oversight that proactively identifies risks across the enterprise, connecting the dots to locate potentially systemic problems, and that promptly and effectively implements durable solutions. The recurrence of thematically similar violations can raise doubts about the overall effectiveness of a sanctions compliance program. Organizations should make sure their programs are designed and sufficiently resourced to quickly identify violations, understand potentially broader implications, and implement effective controls to prevent recurrences. Moreover, decisions concerning sanctions screening alert parameters and rules should be risk-based, adequately supervised, and subject to audit and testing in order to prevent errors from compounding.

This case also highlights the importance of ensuring that technical solutions on which organizations rely, such as sanctions screening software, are both effective and up to date. Each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers. Technical changes, such as transitions to new screening tools or updates to existing ones, should be implemented in a controlled manner to avoid creating delays, gaps, or backlogs that cannot be effectively managed.

This case also calls attention to the importance of properly training all relevant personnel throughout a large enterprise, including customer-facing employees, on sanctions compliance obligations and procedures as well as potential evasion techniques. Personnel at the front lines are often best positioned to spot and stop potential violations before they occur. Training should be complemented by testing and auditing processes to confirm that compliance procedures are followed appropriately by staff and include easily accessible resources, materials, and escalation processes.

Finally, OFAC strongly encourages financial institutions and others that identify potential sanctions compliance failures within their organizations to investigate promptly in order to identify all relevant root causes, implement thorough remedial measures, and self-disclose apparent violations. Organizations should cooperate fully with OFAC to take advantage of the opportunities for voluntary self-disclosure credit, and for mitigation based on remedial response and cooperation with OFAC, as described in the Enforcement Guidelines.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.