Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets Control and Bank of America, N.A.

DEPARTMENT OF THE TREASURY
OFFICE OF FOREIGN ASSETS CONTROL
Enforcement Release: October 13, 2026
Bank of America, N.A. Settles with OFAC for $11,662,930 Related to Apparent Violations of Multiple Sanctions Programs Bank of America, N.A. (Bank of America), a national banking association headquartered in Charlotte, North Carolina, has agreed to pay $11,662,930 to settle its potential civil liability for 475 apparent violations of OFAC sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. The apparent violations occurred when Bank of America processed payments involving blocked banks, failed to appropriately prioritize alerts for customers who were exact name- and date of birth-matches to blocked persons, failed to promptly update watchlists following OFAC designations, and mishandled two business accounts associated with blocked persons due to human error. The settlement amount reflects OFAC’s determination that Bank of America’s apparent violations were non-egregious but largely not voluntarily self-disclosed. This settlement amount also reflects no reduction to the base penalty, including no mitigation for remedial measures or cooperation. Description of the Apparent Violations Between September 18, 2021 and April 24, 2025, Bank of America engaged in 475 apparent violations of OFAC sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. The total value of these apparent violations was approximately $14,834,082. The apparent violations occurred due to the following four issues:
Processing of Payments Involving Blocked Banks In May 2021, Bank of America implemented an automated process to determine the routing for transmitting certain cross-border payments on behalf of its customers via correspondent banks. Pursuant to the process, Bank of America’s systems consulted a “routing directory” of banks provided by a third-party vendor, then automatically routed each payment via one or more intermediary banks. In some instances, Bank of America’s systems were unable to map the routing automatically, and routing was input manually by a bank employee. Bank of America’s customers could also manually identify banks (e.g., intermediary banks) when inputting payment details. Once payment details were generated, they were screened by Bank of America for compliance with OFAC-administered sanctions. In March 2022, following the imposition of sanctions in connection with Russia’s February 2022 invasion of Ukraine, Bank of America became aware that the routing directory included banks that had been blocked by OFAC pursuant to the Russian Harmful Foreign Activities Sanctions Regulations (“RuHSR”), 31 C.F.R. part 587, and that although it was screening these payments, including the details of the banks involved in the payments, for compliance with OFAC￾administered sanctions, it was nevertheless processing certain payments to or through blocked banks. This generally occurred because:

1. The payments were processed shortly after the relevant bank was blocked by OFAC and
   before Bank of America updated its sanctions screening filter to reflect the bank’s blocked status;
2. Due to human error, the payments were identified as false positives and approved for
   processing by analysts in the sanctions screening or payments teams; or
3. Despite alerting in Bank of America’s system, the payments were released automatically
   due to an “alert suppression rule,” a screening function used by Bank of America that automatically “suppressed” alerts in certain circumstances—for example, if an alert was based on the exact same criteria as an alert that a Bank of America analyst manually dispositioned as a false positive in the past. Over the next several months, Bank of America attempted to address this issue by implementing various fixes. In January 2023, Bank of America implemented an automated, longer-term technical solution to remove the blocked banks from the version of the routing directory used by Bank of America’s payment engine. Ultimately, Bank of America processed 403 transactions totaling $14,340,100 between February 2022 and March 2025 via 35 blocked banks, including 32 banks blocked pursuant to the RuHSR, two banks blocked pursuant to the Belarus Sanctions Regulations (“BelSR”), 31 C.F.R. part 548, and one bank blocked pursuant to Executive Order (E.O.) 13902 of January 10, 2020, “Imposing Sanctions With Respect to Additional Sectors of Iran.” Despite being aware since March 2022 that its routing directory included blocked banks and that it had processed transactions involving them, and despite telling OFAC in more than one instance that it was investigating payments it had processed involving blocked banks, Bank of America initially performed only a single, narrowly tailored lookback and did not identify the full scope of its payment activity involving blocked banks until after OFAC directed it to provide information about recent lookbacks it had conducted in a January 2025 administrative subpoena. Not Prioritizing Alerts for Customers Who Were Exact Name- and Date of Birth-Matches to Blocked Persons Due to a design flaw in its alert prioritization logic, Bank of America’s sanctions relationship screening system classified alerts associated with individual customers whose name and date of birth both matched exactly those of a blocked person as low- or medium-priority, rather than high￾priority. This design flaw remained in place for an extended period of time. Because these alerts were not identified as high-priority, Bank of America’s review of the alerts was delayed, allowing three individuals designated pursuant to the Burma Sanctions Regulations (BSR), 31 C.F.R.
   part 525; the RuHSR; and the Foreign Narcotics Kingpin Sanctions Regulations (FNKSR),
   31 C.F.R. part 598, respectively, to engage in 31 transactions totaling $56,258 between September 2021 and February 2024, using their Bank of America bank or credit card accounts. Six months after the issue was initially identified, in February 2024, Bank of America fully implemented adjustments to its sanctions screening filter to correct this deficiency and reclassified as high￾priority customers with exact name- and date of birth-matches to blocked persons.

Delays in Watchlist Updates Following OFAC Designations Between May 24 and June 28, 2023, due to human error by a third-party vendor, the sanctions watchlist file Bank of America used to perform sanctions screening was not updated to reflect changes to OFAC’s List of Specially Designated Nationals and Blocked Persons. As a result, Bank of America processed six transactions totaling $100,828 involving entities designated pursuant to the BSR, the Somalia Sanctions Regulations (“SoSR”), 31 C.F.R. part 551, and the Illicit Drug Trade Sanctions Regulations (IDTSR), 31 C.F.R. part 599. Bank of America did not identify the vendor’s error until July 2023, approximately one month after one of the payments it processed involving a recently designated entity was blocked downstream by another U.S. bank. On February 7, 2025, Bank of America’s sanctions watchlist file failed to implement an update from Bank of America’s vendor reflecting the previous day’s designations, this time due to a series of technical problems with Bank of America’s systems. As a result, Bank of America processed 26 transactions on February 7 totaling $146,543 on behalf of a ship management company designated pursuant to the Global Terrorism Sanctions Regulations (GTSR), 31 C.F.R. part 594. Bank of America fully activated the relevant updates on February 12, 2025, almost a week later, and subsequently performed a lookback and self-disclosed these transactions to OFAC. Mishandling of Two Business Accounts Associated with Blocked Persons Due to Human Error In May 2023, a Bank of America sanctions analyst dismissed an alert associated with an individual recently designated pursuant to the RuHSR. The dismissal of the alert, which identified the individual as the beneficial owner of a business, was a result of human error, and the business’s Bank of America account remained unrestricted despite the business being blocked. Bank of America rescreened the account in September 2023 during its transition to a new sanctions screening platform, but it did not review the alert or identify the blocked interest associated with the blocked individual’s business account until approximately July 2024, 14 months after the individual was designated. During that time, Bank of America processed six transactions totaling $340 on behalf of the business. This delay was due to a significant volume of alerts generated by the voluntary rescreening of all existing customer records in connection with the transition to the new screening platform, for which Bank of America was insufficiently prepared. In internal communications following its identification of the account, Bank of America compliance personnel highlighted the need for more formalized processes, resources, and governance regarding self￾disclosures. Separately, in April 2025, Bank of America restricted two Bank of America business accounts that had as an authorized signer an individual who had just been designated pursuant to the IDTSR and GTSR.
Approximately a week later, the business owner, who was the blocked individual’s adult child and who OFAC had recently served with a third-party blocking notification in connection with their parent’s designation, requested to close the accounts and move the funds into another unrestricted account without the blocked individual as an authorized signer. Bank of America anti￾money laundering operations personnel authorized the account closure as requested by the blocked individual’s adult child based on a misunderstanding regarding how to handle accounts with blocked authorized signers, and branch staff transferred the funds in the accounts, totaling $189,869, into a new, unrestricted account. Shortly thereafter, before the blocked individual’s adult

child could conduct any transactions involving the funds, Bank of America sanctions compliance personnel identified the error and blocked the new accounts. Bank of America subsequently reported the blocked funds and submitted a self-disclosure to OFAC regarding its branch staff’s transfer of the blocked funds between Bank of America accounts. Lack of Fulsome Cooperation with OFAC’s Investigation With respect to many violations described above, Bank of America submitted piecemeal or incomplete disclosures or responses to OFAC, in some cases over an extended period of time. In particular, Bank of America did not promptly respond to all requests for information. Bank of America’s delays and less than fulsome cooperation slowed OFAC’s investigation and prolonged resolution of this matter. Altogether, Bank of America’s conduct resulted in apparent violations of RuHSR § 587.201, BelSR § 548.101, E.O. 13902 § 1(a), BSR § 525.201(a), FNKSR § 598.202(a), SoSR § 551.201(a), IDTSR § 599.201, GTSR § 594.201(a), and E.O. 14065 § 4(a) (the “Apparent Violations”). Penalty Calculations and General Factors Analysis OFAC determined that Bank of America did not voluntarily self-disclose 413 Apparent Violations and voluntarily self-disclosed 62 Apparent Violations, and that the Apparent Violations constitute a non-egregious case. Accordingly, under OFAC’s Economic Sanctions Enforcement Guidelines (Enforcement Guidelines), 31 C.F.R. part 501, app. A., the base civil monetary penalty applicable in this matter is $11,662,930, which equals the sum of (i) the applicable schedule amount for each non-voluntarily self-disclosed apparent violation and (ii) one-half of the transaction value for each voluntarily self-disclosed apparent violation. The settlement amount of $11,662,930—which reflects no reduction to the base penalty—is based on OFAC’s consideration of the General Factors under the Enforcement Guidelines. OFAC determined the following to be aggravating factors:
(1) Bank of America acted recklessly by failing to (i) promptly implement needed screening enhancements with respect to payment processing involving blocked banks; (ii) update its sanctions watchlist for over a month; (iii) appropriately prioritize alerts for exact name- and date of birth-matches in its sanctions screening system for an extended period of time; and (iv) ensure that its sanctions compliance analysts and other bank staff were adequately trained and correctly following established procedures. (2) Bank of America’s processing of the Apparent Violations harmed the U.S. foreign policy objectives of multiple OFAC-administered sanctions programs. In particular, by processing over $14 million in payments to or through blocked banks, Bank of America’s conduct ran directly counter to the objectives of the Russia sanctions program following Russia’s invasion of Ukraine in February 2022. While some of these payments were stopped by other banks, the majority were not, conferring a benefit to the blocked banks involved.

(3) Bank of America is a very large, commercially sophisticated financial institution. (4) OFAC had previously issued Bank of America multiple cautionary letters regarding substantially similar conduct. OFAC determined the following to be a mitigating factor:
(1) Bank of America entered into a tolling agreement regarding the Apparent Violations associated with the individual designated pursuant to the FNKSR. Nonetheless, given the totality of the circumstances in this case, OFAC found that no net reduction to the base penalty was warranted. Compliance Considerations Collectively, this enforcement action emphasizes how an effective sanctions compliance program requires detail-oriented management oversight that proactively identifies risks across the enterprise, connecting the dots to locate potentially systemic problems, and that promptly and effectively implements durable solutions. The recurrence of thematically similar violations can raise doubts about the overall effectiveness of a sanctions compliance program. Organizations should make sure their programs are designed and sufficiently resourced to quickly identify violations, understand potentially broader implications, and implement effective controls to prevent recurrences. Moreover, decisions concerning sanctions screening alert parameters and rules should be risk-based, adequately supervised, and subject to audit and testing in order to prevent errors from compounding. This case also highlights the importance of ensuring that technical solutions on which organizations rely, such as sanctions screening software, are both effective and up to date. Each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers. Technical changes, such as transitions to new screening tools or updates to existing ones, should be implemented in a controlled manner to avoid creating delays, gaps, or backlogs that cannot be effectively managed. This case also calls attention to the importance of properly training all relevant personnel throughout a large enterprise, including customer-facing employees, on sanctions compliance obligations and procedures as well as potential evasion techniques. Personnel at the front lines are often best positioned to spot and stop potential violations before they occur. Training should be complemented by testing and auditing processes to confirm that compliance procedures are followed appropriately by staff and include easily accessible resources, materials, and escalation processes. Finally, OFAC strongly encourages financial institutions and others that identify potential sanctions compliance failures within their organizations to investigate promptly in order to identify all relevant root causes, implement thorough remedial measures, and self-disclose apparent violations. Organizations should cooperate fully with OFAC to take advantage of the opportunities for voluntary-self disclosure credit, and for mitigation based on remedial response and cooperation with OFAC, as described in the Enforcement Guidelines.

OFAC Enforcement and Compliance Resources
On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments in order to provide organizations subject to U.S. jurisdiction, as well as foreign entities that conduct business in or with the United States or U.S. persons, or that use goods or services exported from the United States, with OFAC’s perspective on the essential components of a sanctions compliance program. The Framework also outlines how OFAC may incorporate these components into its evaluation of apparent violations and resolution of investigations resulting in settlements. The Framework includes an appendix that offers a brief analysis of some of the root causes of apparent violations of U.S. economic and trade sanctions programs OFAC has identified during its investigative process. Information concerning the civil penalties process can be found in the OFAC regulations governing each sanctions program; the Reporting, Procedures, and Penalties Regulations, 31 C.F.R. part 501; and the Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A. These references, as well as recent civil penalties and enforcement information, can be found on OFAC’s website at https://ofac.treasury.gov/civil-penalties-and-enforcement-information. Whistleblower Program The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) maintains a whistleblower incentive program for violations of OFAC-administered sanctions, in addition to other violations of the International Emergency Economic Powers Act and violations of the Bank Secrecy Act. Individuals located in the United States or abroad who provide information about sanctions violations may be eligible for awards if the information they provide leads to a successful enforcement action that results in monetary penalties exceeding $1,000,000. The incentive program is available for whistleblowers providing information relating to potential violations in any commercial sector.