A payment-routing problem, a stale watchlist, an incorrectly prioritized alert, and an employee processing error may initially appear to be separate operational incidents. OFAC’s Enforcement Release asks compliance leaders to examine the broader pattern. Its compliance considerations emphasize management oversight that identifies potentially systemic problems, implements durable solutions, and prevents errors from recurring across the enterprise.
Today, in Part 3 we focus on that connection. Fixing the first visible error is necessary. Establishing whether the same weakness exists elsewhere is the next responsibility.
A Separate Action with Familiar Governance Problems
According to the Enforcement Release, Bank of America agreed to pay $11,662,930 to resolve potential civil liability for 475 apparent violations involving approximately $14.8 million in transactions. The conduct involved sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. OFAC classified the matter as non-egregious but largely not voluntarily self-disclosed. These are separate findings from FinCEN’s anti-money laundering case. They should not be treated as findings about identical transactions merely because they reveal related governance concerns. Those concerns include control design, alert handling, staffing, technical changes, investigation scope, and the response to known weaknesses.
Payment Routing: A Control Must Work Across the Process
Bank of America used a third-party routing directory to help determine intermediary banks for certain cross-border payments. Some routing was automated; some could be entered manually. Once payment details were generated, the bank screened them for sanctions compliance.
In March 2022, the bank became aware that the directory included blocked banks and that some payments were still being processed to or through them. OFAC identified several causes: screening updates had not yet reflected new designations, analysts incorrectly dismissed alerts, or suppression rules automatically released payments based on earlier false-positive decisions.
OFAC ultimately identified 403 transactions totaling approximately $14.34 million routed through 35 blocked banks between February 2022 and March 2025. The bank implemented an automated directory solution in January 2023, but the release describes a broader set of payment-processing failures extending beyond that implementation.
The compliance lesson is to test the complete process. A current directory does not establish that manual entry works correctly. A screening alert does not establish that the alert is properly resolved. A prior false-positive decision does not establish that the same disposition remains appropriate after a sanctions designation.
Alert Prioritization: Strong Information Must Produce an Appropriate Response
OFAC describes a design flaw that assigned low or medium priority to customers whose names and dates of birth both exactly matched those of blocked persons.
Because those alerts were not classified as high priority, review was delayed. Three designated individuals conducted 31 transactions using bank or credit card accounts. The bank fully implemented the relevant correction in February 2024, six months after initially identifying the issue. This is a control-design issue with an operational consequence.
The existence of a queue does not establish effective prioritization. Compliance leaders should be able to explain which information triggers immediate attention, which activity may continue while an alert awaits review, and what interim protection applies when the prioritization logic is known to be deficient.
Watchlist Updates: Vendor Performance and Internal Processing Both Matter
Between May 24 and June 28, 2023, a third-party vendor error prevented the watchlist file used by Bank of America from reflecting changes to OFAC’s sanctions list. The bank did not identify the error until July, approximately a month after another U.S. bank blocked one of the affected payments downstream.
A separate failure in February 2025 involved technical problems in the bank’s own systems. The bank failed to implement a vendor update reflecting the previous day’s designations and processed transactions for a designated ship management company. The relevant updates were fully activated several days later; the bank subsequently conducted a lookback and self-disclosed those transactions.
The two events should not be collapsed into a single vendor failure. One originated with the vendor. The other involved the bank’s processing of an update. Together, they illustrate why oversight should verify the entire update process: issuance, receipt, loading, activation, and operation. A delivery confirmation is not proof that screening uses the new information.
Employee Errors and Technology Changes Need a Control Response
The Enforcement Release also describes a business account that remained unrestricted after an analyst dismissed an alert involving its blocked beneficial owner. A subsequent rescreening during a platform migration generated another alert, but the bank did not review it promptly. OFAC attributed the delay to the volume of alerts generated by the migration and inadequate preparation for that workload.
In another incident, personnel moved $189,869 from restricted business accounts into a new unrestricted account after misunderstanding how to handle accounts with a blocked authorized signer. Sanctions personnel identified the error and blocked the new accounts before the customer conducted further transactions involving the funds.
The second intervention mattered. It prevented further activity. It did not eliminate the need to examine why the transfer had been authorized. Calling an event human error should begin the root-cause inquiry, not end it. Was the instruction clear? Did the employee have access to appropriate guidance? Were approval rights properly defined? Should another control have prevented the action?
What the Penalty Says About Disclosure and Cooperation
OFAC determined that 413 apparent violations were not voluntarily self-disclosed and 62 were. Its base penalty calculation already reflected that distinction: the applicable scheduled amounts for the former and one-half of transaction value for the latter. The settlement equaled the resulting base penalty. Consequently, saying that the bank received no recognition whatsoever for voluntary disclosure would be inaccurate.
The more precise lesson is that OFAC granted no additional reduction from the base penalty. The release expressly states that there was no mitigation for remedial measures or cooperation. OFAC also identified a tolling agreement as a mitigating factor but concluded that the circumstances did not justify a net reduction.
OFAC described piecemeal or incomplete submissions and delayed responses that slowed its investigation. It also criticized the bank’s initially narrow lookback into blocked-bank payments, with the full scope identified only after further OFAC direction. For compliance leaders, the lesson is to organize the response early. Investigation scope, document preservation, factual development, disclosure decisions, remediation, and regulatory responses should be coordinated rather than handled as disconnected tasks.
FinCEN’s Undertakings Show What Verification Requires
The FinCEN Consent Order requires independent work addressing historical suspicious activity, transaction monitoring effectiveness, customer and foreign correspondent due diligence, and data governance. Its lookback begins in January 2022 and extends through completion of relevant monitoring remediation, subject to the Consent Order’s scope provisions.
Two aspects are particularly instructive. First, the Consent Order addresses interim controls while remediation remains underway. A future system improvement is not treated as an answer to present exposure. Recommended interim measures may include manual processes, periodic reviews, and product-focused analyses. Second, the end-state review includes subsequent testing to validate whether enhancements meaningfully mitigate the relevant risks. Implementation and effectiveness are separate questions.
That distinction should shape remediation reporting. The board needs to know both whether the change was completed and whether testing demonstrates that it works.
Three Key Takeaways
First, investigate recurring themes across incidents. Similar errors may reveal shared weaknesses in data, approvals, staffing, training, or change management.
Second, treat disclosure and cooperation as disciplined processes. Determine the scope, preserve the record, develop the facts, and respond completely and promptly.
Third, distinguish implementation from effectiveness. Maintain interim safeguards and require independent evidence before declaring a material issue resolved.
The board question: Are we receiving evidence that remediation has reduced the risk, or only reports that remediation activities have been completed?
Summary
In Part 3, we examined how BOA’s sanctions failures exposed weaknesses across payment routing, alert prioritization, watchlist updates, and employee execution. The central lesson is that seemingly separate incidents should prompt an examination of shared weaknesses in oversight, resources, and operational processes, rather than a series of isolated fixes. We also considered vendor accountability, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation.
FinCEN’s requirements for interim safeguards and subsequent effectiveness testing illustrate why implementing corrective measures and proving that they work are separate responsibilities. For CCOs, this means identifying underlying causes, protecting against continuing exposure, and independently validating the response. For boards, it means demanding evidence of reduced risk rather than accepting reports of completed activities. The measure of remediation is whether the underlying control weakness has been effectively addressed.
Join Us Tomorrow
Tomorrow in Part 4, we turn from Bank of America’s enforcement record to the decisions facing compliance professionals outside banking. In it we translate BOA’s documented failures into 20 practical lessons covering governance, continuing due diligence, technology and data, vendor oversight, employee execution, investigations, and remediation. The objective is not to apply bank-specific obligations to every company, but to examine how comparable weaknesses could arise in customer relationships, distributor networks, procurement processes, payment controls, and automated compliance systems.
Each lesson connects a finding to a practical action, giving CCOs a framework for reviewing their own programs. The series concludes with an assignment: select three areas of greatest exposure, identify accountable owners, examine the evidence that existing controls work, and address what remains unresolved. The final question is where your organization has accepted a plan to address a material risk without verifying that the plan actually worked.
