The Office of the Comptroller of the Currency has issued a formal cease and desist order against Bank of America, N.A., requiring the institution to implement comprehensive corrective measures across its anti-money laundering and sanctions compliance programmes. The OCC publicly announced the action on 16 January 2025, though the order itself — designated Docket AA-ENF-2024-56 — was signed on 23 December 2024 and covers violations of the Bank Secrecy Act, anti-money laundering obligations, and sanctions compliance frameworks administered by federal regulators.
The public release of the order confirms the scope of the OCC's concerns about one of the largest banks in the United States. The regulator had previously signalled the enforcement action through News Release 2024-140, published in December 2024, alerting the market that formal proceedings against Bank of America were under way. The January announcement provides the full details of what the OCC found and what it is now requiring the bank to do in response, placing the institution under sustained supervisory scrutiny as it works through the remediation process.
COMPLIANCE DEFICIENCIES SPAN MULTIPLE AREAS
The order identifies deficiencies across Bank of America's BSA and AML compliance infrastructure, indicating that the OCC regards the shortcomings as systemic rather than isolated. The Bank Secrecy Act requires financial institutions to maintain robust programmes for detecting and reporting suspicious activity linked to money laundering, financial crime, and illicit fund flows. A failure to meet those standards in an institution of Bank of America's size carries elevated risks given the volume and complexity of transactions the bank processes daily across its retail, commercial, and institutional businesses.
Sanctions compliance was also identified as an area of concern, adding an international dimension to the order. Sanctions programmes administered through bodies such as the Office of Foreign Assets Control require banks to screen transactions and counterparties against lists of prohibited individuals, entities, and jurisdictions. Deficiencies in this area can expose institutions to liability under both domestic law and international regulatory frameworks, and the OCC has made clear that Bank of America's existing controls in this sphere require substantial improvement.
Enforcement actions at this level are relatively uncommon for the largest US banks, and the formal cease and desist mechanism gives the OCC considerable leverage to monitor and enforce remediation on an ongoing basis. The regulator can require the bank to report its progress at specified intervals and retains the ability to escalate further if the corrective action plan falls short of expectations. Failure to satisfy the order's requirements could expose Bank of America to additional regulatory consequences, including civil money penalties.
BANK FACES MANDATORY CORRECTIVE ACTION PLAN
Under the terms of the order, Bank of America is required to develop and implement a comprehensive corrective action plan specifically designed to address each deficiency identified by the OCC across its BSA, AML, and sanctions compliance functions. The plan must be reviewed and approved by the regulator and is subject to ongoing supervisory oversight, meaning the bank's remediation efforts will be closely monitored over the months ahead rather than simply accepted on the basis of internal assurances.
Bank of America has not publicly disputed the OCC's findings. The bank must now carry out the work of rebuilding compliance architecture across relevant business lines while continuing to operate one of the most extensive retail and commercial banking networks in the country. The OCC's cease and desist order does not specify a financial penalty in its public terms, but the reputational and operational costs of a public enforcement action of this nature are substantial. Regulators, investors, and institutional counterparties will watch closely to assess how quickly Bank of America demonstrates measurable progress against the required remediation plan.