Two record fines, one payment: the Bank of America penalty is smaller than it looks

Two totals, both correct

Add the three penalties Bank of America was handed on 13 October and you get just under $1.96 billion: $1.2 billion from the Financial Crimes Enforcement Network, the Treasury unit that administers America’s anti-money-laundering rules; $750 million from the Office of the Comptroller of the Currency, which supervises national banks; $11.6 million from the Office of Foreign Assets Control, which runs sanctions. Treasury’s own release says the total is “more than $1.21 billion.” Both numbers are right. The difference is that the OCC’s penalty — the largest in that agency’s 163-year history — was credited toward FinCEN’s.

So the record-breaking OCC fine costs the bank nothing beyond what FinCEN was already demanding. Treasury does not conceal this; the crediting is stated plainly. But the subtitle on the press release reads “Third-Largest Penalty in Treasury History; Largest in OCC History.” Two superlatives, one payment. If the deterrent value of a fine lies in the number other banks’ boards remember, the agencies have just advertised a figure that nobody actually paid.

That is worth saying out loud because the underlying conduct is serious on its own terms and does not need inflating. Bank of America admitted willful violations of the Bank Secrecy Act. It admitted it did not maintain an anti-money-laundering programme meeting the statute, and that it failed to conduct due diligence on correspondent accounts held for foreign financial institutions — the accounts through which overseas banks reach the dollar system. FinCEN found no suspicious activity reports were filed on $5 billion of transactions. The OCC found the bank failed to monitor trillions of dollars of flows and knew for years that potentially suspicious activity was not being escalated to investigators, and that the officer and staff responsible lacked sufficient skills and expertise to run the programme.

What a cheque cannot buy

Read that list again and ask what a fine does to it. Every finding is about capacity and incentives: too few alerts reviewed, escalation thresholds that suppressed work, a function staffed below the job. A civil money penalty is a one-off transfer out of a single year’s earnings. It does not hire investigators, rewrite escalation rules, or change the relative standing of the compliance function against the business lines it has to argue with next budget cycle.

No asset cap was imposed. An asset cap — a hard limit on how large a bank may grow until supervisors are satisfied — is the one sanction that alters that internal arithmetic permanently, because it makes growth conditional on controls keeping pace. Alert volume scales with transaction volume. An institution that monitors trillions and knows it is not escalating has, by definition, a problem that gets worse as it grows. Leaving growth unconstrained while taking cash leaves the ratio that caused the failure exactly where it was.

The strongest case for doing it this way

There is a real argument on the other side, and it starts with the crediting. Two agencies charged overlapping conduct arising from the same compliance failure. Making the bank pay both in full would be double punishment for one set of facts, and the law should not work that way. The crediting is the fair part.

Asset caps are also genuinely blunt. They fall on borrowers who are refused credit and on depositors at a bank told it may not grow, none of whom failed to file a suspicious activity report. And $1.2 billion is not nothing: it is real cash, accompanied by admissions of willfulness that carry consequences in later litigation and in how supervisors treat the bank for years.

All true — and it is precisely because the crediting is correct that the superlatives should go. You cannot claim the deterrent benefit of a historic penalty and then net it off three paragraphs later. If the message to other large banks is that this is what AML failure costs, the message should be the figure that leaves the building.

And the choice is not binary between a fine and an asset cap. Between them sits the remedy nobody announced: dated remediation milestones — monitoring coverage, alert backlog, staffing in the Bank Secrecy Act function — with a stated supervisory consequence if the dates are missed. That is narrower than a cap, falls on nobody but the bank, and converts a one-off payment into a standing obligation.

What would settle it

The honest test of this action is not the headline but what gets measured afterwards. If, a year from now, the public record contains nothing about whether the monitoring gaps that produced trillions in unreviewed flows have closed, then the enforcement was a price and not a correction. If it contains dated milestones and progress against them, the agencies will have done the harder thing and simply failed to say so on the day.

The second-largest bank in the United States admitted it knew for years that suspicious activity was not reaching the people paid to investigate it. That is a sentence worth more than a league-table entry.