Same Failures, Same Fines: Why AML Enforcement Must Finally Reach Licences, Boards and Victims

EFRI Briefing · FinCEN Consent Order No. 2026-03 (Bank of America, N.A., 13 October 2026); OCC cease-and-desist order and civil money penalty against American Express National Bank (8 October 2026) · Published 14 October 2026

Within one week, US regulators imposed a $1.2 billion penalty on Bank of America and a $350 million penalty on American Express for anti-money laundering (AML) failures. The headlines focus on national security, Chinese money laundering networks and trade-based money laundering. What the headlines leave out is that behind every laundered dollar stands someone who lost it.

Read side by side with the Dutch prosecutors’ 2018 findings against ING — the Houston investigation, the new orders describe the same failures in almost the same words: monitoring systems configured to the capacity of the compliance department rather than to the risk, internal warnings overridden by business considerations, and remediation that begins only once a regulator insists. So, eight years and several record fines later, it shows that nothing structural has changed. EFRI’s conclusion is that it will not change as long as the type of sanction stays the same.

1. Laundered money always has victims

AML enforcement is usually discussed in the language of reporting obligations, systemic integrity and national security. That language is accurate, but incomplete. Money laundering is not a victimless paperwork offence. The funds that move through deficient controls are the proceeds of drug trafficking that destroys lives and communities, of corruption that steals from entire populations, of human trafficking and sexual exploitation, and in the field EFRI works in of online investment and payment fraud that wipes out savings, often of older people, often irreversibly. But in all cases laundering results in harm to real people.

A bank that leaves known control weaknesses unresolved does not merely miss a regulatory tick-box. It keeps open – and sometimes as the Houston report evidence and as the US judgement evidence in full sight – the channel through which criminals receive and move stolen money, and it shortens the window in which that money can still be traced, frozen and returned.

2. Bank of America: what FinCEN found

The resolution. FinCEN assessed a $1.2 billion civil money penalty; the OCC’s concurrent $750 million penalty — the largest in the OCC’s history — is credited against it. OFAC separately settled 475 apparent sanctions violations for $11.6 million, bringing the total to more than $1.21 billion. The relevant period runs from at least 1 January 2018 to 1 July 2025 (Consent Order, p. 4). Bank of America admits the Statement of Facts and Violations (p. 1) and admits that it acted “willfully” — a term that, in civil BSA enforcement under 31 U.S.C. § 5321(a)(1), is satisfied by reckless disregard or willful blindness (p. 5, fn. 13).

The scale. The bank failed to report, or reported late, more than $5 billion in suspicious activity, roughly $1 billion of which involved priority risks including Chinese money laundering networks, fraud and potential trade-based money laundering with a nexus to the US southwest border (p. 6). The Chinese money laundering networks named in the order are documented by FinCEN as laundering cartel drug proceeds, with red flags such as repeated credit card purchases of electronics and luxury goods (p. 28, fn. 33, citing FinCEN Advisory FIN-2025-A003). The same underground banking infrastructure is also used by the Southeast Asian scam compounds whose victims EFRI supports — a link FinCEN itself drew when it severed the Cambodia-based Huione Group from the US financial system under Section 311 of the USA PATRIOT Act (see EFRI, Asian Scam Compounds…).

A monitoring system calibrated to capacity, not risk. The bank’s proprietary transaction monitoring system (“Event Processor”) grouped alerts by customer and opened an investigation only once a combined score of 20 points was reached within 13 months. That threshold was “initially set by stakeholder judgment” and remained unchanged until December 2023 (p. 10). The order documents, among other things:

Risk factors with SAR yields above 50% — including cash structuring and High Intensity Drug Trafficking Area indicators — carried a weight of only 1 point (pp. 14–15). Between 2018 and 2023, 76% of risk weights never changed, and around 80% of the changes that were made were reductions (p. 16).
A 2021 recalibration reduced the number of cases requiring investigation by more than 8,200 and described the associated “SAR loss” as “permissible”, without explaining how that was determined (p. 17).
In 2022 the bank tested an alternative threshold that would have uncovered far more reportable activity (85.4% vs. 20.2% on below-the-line samples) and rejected it because the larger volume “may exhaust the investigation resources” (pp. 22–23).
In 2023, after a test found an 18% SAR yield below the threshold, the then Global Head of Financial Crimes directed that the test be repeated; the repeat test declared the first result “incorrect” and concluded that the system was “working as intended” (p. 23).
Rescoring and suppression rules set certain alerts to zero “in an ad-hoc and subjective fashion”; when the logic was finally switched off in December 2023, around 150,000 active event groups were affected (pp. 23–24).
For several years more than one-third of all investigations — nearly 50% in 2023 — were triggered not by the bank’s own monitoring but by subpoenas, seizure warrants, law-enforcement requests and manual referrals (pp. 7, 25).

Once the threshold was lowered under regulatory pressure, a one-time, limited-scope lookback in 2024 found nearly 8,900 SARs that had not been filed, covering nearly $4 billion in transactions. The bank estimated that the corrected threshold would double its monthly investigative volume and require an additional 750 staff, plus 800 consultants for the lookback (p. 13). A material portion of SARs had been filed more than six months after the activity (p. 8). In Treasury’s summary, the bank prioritised its revenues and minimised the impact on its required compliance resources.

The victim connection is in the bank’s own files. “Customer A”, an online marketplace for salvaged vehicles, appears throughout the order. Between June and July 2020, bank investigations linked its accounts to business email compromise, elder fraud and other fraud schemes; internal notes recorded that “although [Customer A] is considered a suspect, account will not be closed” (p. 37). By August 2022 compliance staff had counted more than 100 AML cases, around 90% fraud-related, and told the business line that “[o]verwhelming evidence suggests that [Customer A] is receiving payments from numerous victims of mass marketing scams” (p. 41). Compliance recommended closure. The relationship team described Customer A as “a large and valued client” generating around $6 million in annual revenue (p. 42) and argued that “a closure here would be detrimental given the impact of this relationship” (p. 44). The closure recommendation was withdrawn in March 2023 in favour of a mitigation plan (pp. 45–46). In autumn 2023, internal reviews found “the same typology of cases are still present” and that fraudsters were using the accounts to “obfuscate funds from victims” (p. 47). Customer A kept accepting third-party payments until June 2025 (p. 46).

FinCEN records that there was no evidence Customer A orchestrated the underlying fraud, and that in one virtual-currency investment scam its account had been compromised without its knowledge (p. 39, fn. 44; p. 43). The finding concerns the bank: it knew, from its own investigations, that fraud victims’ money was arriving in these accounts, and it kept the channel open for commercial reasons.

Other warnings were handled the same way. In September 2021 a money services business alerted the bank to possibly structured money-order purchases deposited into Customer B’s account; the bank replied that it saw no unusual pattern and changed nothing (p. 38). When Customer C’s accounts were closed in January 2024, the bank did not reassess Customers A and B, which continued to do business with it (p. 34). The bank’s revenue from Customer B exceeded $25 million over the relevant period (p. 34).

Persistence after the first order. The OCC had already issued a cease-and-desist order in December 2024. A third-party review commissioned at a regulator’s request found continued critical issues with the monitoring system as late as June 2025 (pp. 8, 14).

3. American Express: a programme aimed at the wrong risk

On 8 October 2026 the OCC issued a cease-and-desist order and a $350 million civil money penalty against American Express National Bank. The OCC found that the bank’s BSA/AML programme lacked adequate resources and expertise, had systemic internal control gaps and weak independent testing and training, and was not tailored to the bank’s actual business: it focused on the relatively narrow deposit-account business rather than the dominant credit and charge card business. Systemic breakdowns in monitoring and reporting meant that approximately $13 billion in suspected trade-based money laundering activity between June 2014 and May 2025 was not timely identified, evaluated and sufficiently reported. The Federal Reserve Board issued a parallel enforcement action against American Express Company, citing significant deficiencies in the implementation of the enterprise-wide AML programme. The OCC penalty is paid to the US Treasury.

4. Déjà vu: Houston, 2018

On 4 September 2018 ING agreed to pay €775 million to the Dutch Public Prosecution Service, a €675 million fine and €100 million in disgorgement, to settle the Houston investigation. The prosecutors’ statement of facts covered 2010 to 2016 and found that customers had been able to use ING accounts to launder money “virtually undisturbed”. The findings read like a template for the orders published this month:

Finding	ING (Houston, 2010–2016)	Bank of America (FinCEN, 2018–2025)
Monitoring set by capacity	Alerts capped; for several categories at three per day	20-point threshold set by “stakeholder judgment”; better threshold rejected as it “may exhaust the investigation resources”
Systems not tested or updated	Monitoring neither tested nor updated 2010–2016 despite regulator warnings	76% of risk weights unchanged 2018–2023; most changes were reductions
Alerts dismissed	Alerts on unusual flows routinely closed as “not unusual”	Alerts rescored to zero “in an ad-hoc and subjective fashion”; adverse test result re-run until it supported the status quo
Understaffing	Insufficient compliance staff and budget	750 additional staff needed once the threshold was corrected
Business over compliance	Compliance “often found to be less important than the business”	Closure recommendation for a fraud-exposed client overridden by the relationship team

US regulators had drawn the same lesson in the same year. In February 2018 FinCEN penalised U.S. Bank for capping the number of alerts its system generated instead of increasing its capacity to investigate them. Eight years on, the pattern recurs at the second-largest bank in the United States.

The record of individual accountability is equally consistent. In December 2020 the Court of Appeal in The Hague ordered the prosecution of ING’s former CEO Ralph Hamers following an Article 12 complaint. In December 2024 the Public Prosecution Service announced that it would not prosecute, citing insufficient evidence for personal criminal liability, and declined to prosecute four former ABN AMRO board members after that bank’s €480 million settlement. In December 2025 the court ended the Hamers case, citing among other reasons the low probability of a conviction under existing case law on directors’ criminal liability. An absurd conclusion considering that Hamers was the one to acquire Payvision in late 2017 knowing that the company serves high risk merchants and knowing that the compliance within ING has structural issues. The FinCEN, OCC and OFAC resolutions with Bank of America are civil; the Treasury release names no individuals.

5. Why the type of sanction must change

Measured against the groups’ earning capacity, the penalties are minor expenses and by no way represents the harm done:

Group	AML penalty	Group net income 2025	Penalty as share of net income	Equivalent days of average net income
Bank of America	$1.2 billion	$30.5 billion	≈ 3.9%	≈ 14 days
American Express	$350 million	$10.833 billion	≈ 3.2%	≈ 12 days

EFRI calculation. Net income: FinCEN Consent Order p. 6 (Bank of America); American Express Q4 2025 earnings release. The OFAC settlement is excluded. Penalties were imposed on the banking entities; consolidated profits illustrate economic scale, not the profit derived from the violations.

When compliance expenditure is immediate, client revenue is recurring and enforcement arrives years later as a manageable charge, under-investment is a rational business decision. So now we now for sure that higher fines alone have not broken that calculation in the eight years since Houston.

Three instruments that exist on paper must become real:

Licence withdrawal. The European Central Bank withdrew the licences of Versobank (March 2018) and Pilatus Bank (November 2018) for serious AML failures. Both were small institutions. No large or systemically important bank has ever faced this consequence, and every market participant knows it. The new EU AML Directive (Directive (EU) 2024/1640, AMLD6) requires supervisors to be able to withdraw or suspend an authorisation (Art. 56(2)(f)) and to restrict or limit an institution’s business (Art. 56(2)(e)). Between a fine and full withdrawal lie graduated steps, growth caps such as the asset cap the OCC imposed on TD Bank’s US retail operations in October 2024, bans on onboarding new high-risk clients, the closing of individual business lines, that must be used when a bank fails to remediate after a first order, as Bank of America did after December 2024.

Personal criminal accountability. A board that knows its monitoring system is calibrated to staffing levels rather than to risk, and leaves it that way, does not act by accident. It accepts that criminal proceeds will pass through the bank. Bank of America’s admission of “willfulness”, defined to include reckless disregard and willful blindness, describes exactly this state of mind, yet the consequences remain institutional. AMLD6 allows sanctions against senior management and other responsible natural persons (Art. 53(4)), a maximum pecuniary sanction of at least €5 million to be available against responsible natural persons where the obliged entity is a credit or financial institution (Art. 55(3)(b)) and temporary bans on managerial functions (Art. 56(3)(e)), and it expressly preserves national criminal law (Art. 53(2)). Member States must transpose the Directive by 10 July 2027. The Hamers outcome shows where the gap lies: criminal liability of directors fails not for lack of facts but for lack of a clear enforcement requirements. Legislators should make it an offence for members of the management body to knowingly or recklessly maintain AML systems they know do not meet legal requirements.

Compensation for victims. The OCC penalties go to the US Treasury; ING’s €775 million went to the Dutch state. Not a single victim received anything from either. Where criminal forfeiture is involved, US law allows forfeited funds to be returned to victims through remission — but civil money penalties of the kind imposed this month have no such route. Victims must be able to register compensation claims against enforcement outcomes. The FinCEN order shows why this is practical: Bank of America’s own investigators identified fraud victims’ payments into Customer A’s accounts case by case. Lookbacks and independent reviews ordered by regulators reconstruct exactly the payment flows needed to identify victims and trace their money. That work should be used for redress, not only for late SARs.

Our Assessment

The orders against Bank of America and American Express are detailed, well documented and, in Bank of America’s case, rest on admitted facts and an admission of willfulness. That is precisely what makes them sobering. The causes FinCEN describes — thresholds set to staffing rather than risk, warnings re-tested until they disappear, profitable relationships protected against compliance — are the causes the Dutch prosecutors described in Houston in 2018. Eight years of record fines have produced better documentation of the problem, not its removal.

EFRI’s view is that the sanction model itself has reached its limit. A fine that equals two weeks of profit, paid to the treasury, without consequences for any decision-maker and without a cent for those harmed, is priced into the business. EFRI therefore calls for three changes:

Punish the infringement where it hurts. Licence restrictions and, ultimately, licence withdrawal must become a credible option for institutions that fail to remediate after a first order — regardless of size. AMLD6 gives EU supervisors the tools; the question is whether they will use them against a large bank.
Hold the decision-makers to account. Board members and senior managers who consciously leave AML systems below legal requirements must face personal criminal liability. The standard must be clear enough that a Houston or a Bank of America does not end, again, without any individual consequence.
Repair the harm. Penalties must be accompanied by a claims process through which victims can register and substantiate their losses, financed from the penalty or from disgorged profits. Regulator-ordered lookbacks should be required to identify victims, not only missed reports.

EFRI is aware of the counter-arguments. Licence withdrawal for a systemically important bank risks collateral damage to depositors and the financial system; criminal liability requires proof of individual knowledge that corporate structures are designed to diffuse; and the victims of trade-based or national-security-related laundering are often diffuse and hard to identify. These are reasons to design the instruments carefully, graduated restrictions before withdrawal, a clear statutory standard of director responsibility, and claims processes focused on identifiable victim groups such as the fraud victims in Customer A’s accounts. They are not reasons to leave the instruments unused.

For victims of online investment fraud, the point is concrete. The payment intermediary is the one actor through whose systems the money provably had to pass, and which held — as the Bank of America files show — the information that it was victims’ money. Accountability, and redress, must start there.