Recent anti-money laundering actions signal regulatory risk for US banks

A string of enforcement actions and fines is putting US banks on notice that anti-money laundering compliance failures remain a costly regulatory risk.

Federal bank regulators and US Treasury financial enforcement agencies such as the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control have been active in Bank Secrecy Act/anti-money laundering (BSA/AML) enforcement recently. In June, EagleBank agreed to pay nearly $10 million to settle a US Justice Department investigation. Earlier this month, American Express Co. received a cease and desist order and a $350 million fine from the Office of the Comptroller of the Currency, as well as a separate cease and desist order from the Federal Reserve.

In the latest example, Bank of America Corp. agreed to pay $1.21 billion related to a FinCEN action, including a credit for a related $750 million fine from the OCC — the largest fine by the agency.

The BofA fine "removes any doubt — if there were any — about whether the Trump administration is willing to go after the industry," Capital Alpha Partners analyst Ian Katz wrote in an Oct. 19 note. "The big banks are generally being treated sympathetically on regulatory issues like capital rules. But not in enforcement, climate change or many politically tinged issues."

While the recent uptick in fines is partly due to a recurring year-end push by regulators and banks to settle outstanding matters that would impact a bank's financials before the new year, advisers expect public enforcement actions and record-breaking fines to continue into 2027.

"I expect to see, with the emphasis on an effective AML program, a lot more of what we call 'whale' fines," Rory Doyle, head of financial crime policy at Fenergo, said in an interview.

Recent BSA/AML actions show that regulators are scrutinizing not just whether financial institutions have policies on paper, but whether those controls work in practice, advisers said.

Both Doyle and Carlton Greene, a partner and co-chair of the financial services group at Crowell & Moring LLP, emphasized the need for accurate customer-risk assessments, effective transaction monitoring, current files and timely suspicious activity reporting (SARs) without backlogs.

"They all seem to be quite, 'You stated a policy, your policy was in line with what we expected, but your effectiveness in making sure that that policy happened was inadequate,'" Doyle said.

Banks need to ensure they are allocating their limited BSA/AML staff and resources toward the highest risk threats.

"Every financial institution, whether you're a Tier A multi-jurisdictional financial institution or you're a community bank in Waco, Texas, you have a finite amount of resources available to you to fight financial crime. So you should move those resources towards the higher risk areas of your financial business," Doyle said. "You can't move those resources to the higher risk unless you know what those higher risk areas are."

In April, the OCC and the Federal Deposit Insurance Corp., along with the National Credit Union Administration, proposed updates to AML requirements, recommending that financial institutions shift their AML resources toward higher-risk activities and customers. The proposal also sought to increase FinCEN's role in supervision and enforcement for banks. The day before the bank regulators' proposal, FinCEN also issued a proposal amending its approach to BSA/AML supervision.

"They want to give relief for lesser violations, but they still want financial institutions to correctly file SARs on the bad guy," Crowell & Moring's Greene said.

SARs have climbed every year since 2022, and 2026 is on pace to continue this trend with about 1.5 million SARs through Aug. 31, compared to just under 2 million in 2025.

Current events

The current administration is also intensifying its efforts to address domestic threats, with a particular focus on cartel activity.

"There's still some focus on foreign threats, especially Iran, but I would say a shift towards closer to home threats in terms of cartels and narcotics traffic," Greene said. Regulatory agencies "have been given some mandates from the administration to kind of really attack the cartel problem. And so the BSA/AML laws, they're an obvious tool to try to address it."

Cartel activity can be harder for banks to identify because they are more integrated into the traditional financial system than other threat actors, such as terrorist groups, according to Greene.

As such, "You're going to continue to see a steady drumbeat of stuff in this area, especially because of the cartel focus among regulatory agencies," Greene said. "It's going to keep AML as a very active space for enforcement and supervision even as the administration moves towards more flexible standards."

One of the largest BSA/AML fines ever imposed on a bank operating in the US was against The Toronto-Dominion Bank in 2024. TD Bank pleaded guilty to massive AML failures after charges claimed that lapses in its compliance program led to drug cartels and criminal networks laundering over $670 million through its US branches.

The current administration has been putting out more detailed advisories, marking a "significant shift," Greene said. "There's been tons of guidance and actions related to cartels in terms of red flags for banks to be looking for, investigation of money services businesses operating along the Southwest border, advisories on different kinds of cartel schemes and activity." The administration expanded banks' potential liability by deeming cartels as terrorist organizations last year, he added.

At the same time, ongoing geopolitical events such as Russia's invasion of Ukraine and the war with Iran have upped the ante in recent years. Both conflicts have significantly increased the number of global sanctions to record highs.

"This has put a large amount of pressure on screening teams to make sure that people are identified, accounts are blocked, accounts are reported, that there are no issues around sanctions," Fenergo's Doyle said.

Managing sanctions has been made even more complicated by a lack of cohesion between the US and the EU, as well as Brexit resulting in the UK having its own sanctions list.

"They tended up to the last two years to quite mirror each other. But now that doesn't seem to be the case," Doyle said. "Which means for multijurisdictional financial institutions, it brings an extra pressure around demonstrating the effectiveness of their AML sanction and anti-terrorist financing programs."