What Happened

Bank of America, N.A., headquartered in Charlotte, North Carolina, agreed to pay $11,662,930 to settle 475 apparent violations of OFAC sanctions programs covering Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. Between September 18, 2021 and April 24, 2025, the bank handled transactions worth about $14,834,082 that it should have stopped. Four separate problems caused the violations.

Payments involving blocked banks

In May 2021, the bank automated how it routes cross-border payments through correspondent banks. Its systems used a “routing directory” of banks supplied by a third-party vendor to pick the intermediary banks for each payment. Sometimes an employee entered the routing manually, and customers could also name intermediary banks themselves. Each payment was screened for sanctions once its details were generated.

In March 2022, after sanctions were imposed over Russia’s invasion of Ukraine, the bank learned that the routing directory included banks OFAC had blocked under the Russian Harmful Foreign Activities Sanctions Regulations (RuHSR). The bank was screening these payments, yet it still processed some of them to or through blocked banks, for three main reasons.

1. Some payments went through shortly after a bank was blocked, before the bank had updated its screening filter.
2. Analysts in the sanctions screening or payments teams mistakenly treated some alerts as false positives and approved the payments.
3. Some alerts were released automatically by an “alert suppression rule,” which hides a new alert when it matches the exact criteria of an alert an analyst previously cleared as a false positive.

The bank tried several fixes over the following months. In January 2023, it put in place an automated, longer-term solution that removed the blocked banks from the routing directory its payment engine used. By then it had processed 403 transactions totaling $14,340,100 between February 2022 and March 2025 through 35 blocked banks. Thirty-two of those banks were blocked under the RuHSR, two under the Belarus Sanctions Regulations, and one under Executive Order 13902, which targets additional sectors of Iran’s economy.

The bank knew from March 2022 that blocked banks were in its directory and that it had processed payments involving them. It also told OFAC more than once that it was investigating. Even so, it ran only one narrow lookback, and it did not find the full scope of the problem until OFAC demanded information about its recent lookbacks in a January 2025 administrative subpoena.

Exact matches to blocked persons were not treated as high priority

A design flaw in the bank’s customer screening system ranked alerts as low or medium priority even when an individual customer’s name and date of birth both matched a blocked person exactly. The flaw lasted a long time, and review of those alerts was delayed. As a result, three individuals designated under the Burma, Russia, and Foreign Narcotics Kingpin sanctions programs made 31 transactions totaling $56,258 through their bank or credit card accounts between September 2021 and February 2024. The bank corrected the filter in February 2024, six months after the issue was first identified, and reclassified these matches as high priority.

Watchlist updates that did not happen

Between May 24 and June 28, 2023, a human error at a third-party vendor meant the watchlist file the bank screened against did not reflect changes to OFAC’s SDN List. The bank processed six transactions totaling $100,828 for entities designated under the Burma, Somalia, and Illicit Drug Trade sanctions programs. It did not catch the vendor’s error until July 2023, about a month after another U.S. bank blocked one of those payments downstream.

On February 7, 2025, the watchlist file again failed to load the previous day’s designations, this time because of technical problems inside the bank’s own systems. The bank processed 26 transactions that day totaling $146,543 for a ship management company designated under the Global Terrorism Sanctions Regulations. The update was fully activated on February 12, almost a week later. The bank then ran a lookback and self-disclosed these transactions to OFAC.

Two business accounts mishandled

In May 2023, a sanctions analyst mistakenly dismissed an alert about an individual recently designated under the RuHSR. The alert showed that the individual owned a business, so the business was blocked too, but its account stayed open. The bank rescreened the account in September 2023 while moving to a new screening platform. It still did not review the alert or recognize the blocked interest until about July 2024, 14 months after the designation, because the rescreening of all customer records produced more alerts than the bank was prepared to handle. In that time it processed six transactions totaling $340 for the business. Internal communications after the discovery noted the need for more formal processes, resources, and governance around self-disclosures.

Separately, in April 2025, the bank restricted two business accounts after an authorized signer was designated under the Illicit Drug Trade and Global Terrorism sanctions programs. About a week later, the business owner, who was the designated person’s adult child and had recently been served with a blocking notification by OFAC, asked to close the accounts and move the money into an unrestricted account. Anti-money laundering operations staff approved the request because they misunderstood how to treat accounts with a blocked authorized signer, and branch staff moved $189,869 into a new account. Sanctions compliance staff caught the error before the owner could use the funds and blocked the new accounts. The bank reported the blocked funds and self-disclosed the transfer to OFAC.

Incomplete cooperation with OFAC

For many of these violations, the bank gave OFAC piecemeal or incomplete disclosures and responses, sometimes over a long period, and it did not respond promptly to every request for information. This slowed OFAC’s investigation and delayed resolution of the case.

The conduct resulted in apparent violations of RuHSR § 587.201, BelSR § 548.101, E.O. 13902 § 1(a), BSR § 525.201(a), FNKSR § 598.202(a), SoSR § 551.201(a), IDTSR § 599.201, GTSR § 594.201(a), and E.O. 14065 § 4(a).

The Penalty

OFAC treated this as a non-egregious case, and the bank did not voluntarily self-disclose most of the violations. The settlement amount equals the base penalty with no reduction at all, so the bank received no credit for remedial measures or cooperation.

Of the 475 apparent violations, OFAC found that 413 were not voluntarily self-disclosed and 62 were. Under OFAC’s Economic Sanctions Enforcement Guidelines (31 C.F.R. part 501, app. A), the base penalty for a non-egregious case is built from two pieces. For each violation that was not self-disclosed, OFAC uses the penalty amount set in the Guidelines’ schedule. For each violation that was self-disclosed, it uses one-half of the transaction value. Added together, these produce the base penalty of $11,662,930. The release does not break that figure down by type of violation.

OFAC then weighed the General Factors in the Guidelines and decided not to move the penalty up or down from the base amount.

Aggravating factors

• Reckless conduct. The bank failed to quickly fix its screening for payments involving blocked banks, left its watchlist out of date for more than a month, left exact name and date of birth matches at low priority for a long time, and did not make sure staff were trained and following procedures.
  • General Factor A (Willful or Reckless Violation of Law): OFAC treated the repeated delays in fixing known screening gaps as a failure to take even minimal care to avoid violations.
  • General Factor E (Compliance Program): The same gaps in screening and training show that the bank’s compliance program was not working as designed.
• Harm to sanctions program goals. The bank processed more than $14 million in payments to or through blocked banks, which ran directly against the aims of the Russia sanctions program after the February 2022 invasion. Other banks stopped some of these payments, but most went through, which benefited the blocked banks.
  • General Factor C (Harm to Sanctions Program Objectives): The blocked banks received an actual benefit, and the conduct undercut U.S. foreign policy goals in several programs.
• Size and sophistication. Bank of America is a very large, commercially sophisticated financial institution.
  • General Factor D (Individual Characteristics): OFAC holds an institution of this size and sophistication to a higher standard of care.
• Prior warnings. OFAC had already sent the bank several cautionary letters about substantially similar conduct.
  • General Factor D (Individual Characteristics): The bank’s sanctions history showed it had been put on notice about the same kind of problem.

Mitigating factor

• Tolling agreement. The bank agreed to extend the time OFAC had to act on the violations tied to the individual designated under the Foreign Narcotics Kingpin Sanctions Regulations. Given everything else in the case, OFAC found this did not justify any reduction in the penalty.
  • General Factor G (Cooperation with OFAC): Agreeing to a tolling agreement is a form of cooperation, but it was outweighed by the bank’s piecemeal responses to OFAC’s requests.

What are the Takeaways?

• A strong sanctions compliance program needs managers who pay close attention to detail, look for risks across the whole organization, connect separate problems to find systemic causes, and put lasting fixes in place quickly.
• Violations that keep recurring in similar ways cast doubt on whether a compliance program is effective overall. Programs need enough design and resources to spot violations fast, understand what they mean more broadly, and prevent a repeat.
• Decisions about screening alert settings and rules, such as suppression rules, should be based on risk, properly supervised, and regularly tested and audited so that small errors do not compound.
• Screening software must work and stay current. A company is responsible for its own compliance even when a third-party vendor supplies the tools.
• Moving to a new screening tool, or updating an existing one, should be done in a controlled way that does not create delays, gaps, or alert backlogs the company cannot manage.
• Everyone who touches sanctions risk, including customer-facing staff in a large organization, needs training on sanctions obligations, procedures, and evasion techniques. Front-line staff are often best placed to stop a violation before it happens. Testing and audits should confirm that procedures are followed, and staff should have easy access to guidance and clear escalation paths.
• Institutions that find a possible compliance failure should investigate promptly, find every root cause, fix it thoroughly, and self-disclose. Cooperating fully with OFAC is what earns voluntary self-disclosure credit and mitigation for remedial response and cooperation under the Guidelines.

Other resources

OFAC enforcement and compliance resources

On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments. It describes OFAC’s view of the essential parts of a sanctions compliance program, for organizations subject to U.S. jurisdiction and for foreign companies that deal with the United States, U.S. persons, or U.S.-origin goods and services. The Framework also explains how OFAC may factor those parts into its evaluation of apparent violations and settlements, and an appendix covers common root causes of violations that OFAC has seen in its investigations.

Information on the civil penalty process appears in the regulations for each sanctions program, the Reporting, Procedures, and Penalties Regulations (31 C.F.R. part 501), and the Enforcement Guidelines (31 C.F.R. part 501, app. A). These and recent enforcement information are on OFAC’s civil penalties and enforcement page.

Whistleblower program

The Financial Crimes Enforcement Network (FinCEN) runs a whistleblower incentive program covering violations of OFAC-administered sanctions, as well as violations of the International Emergency Economic Powers Act and the Bank Secrecy Act. People in the United States or abroad who provide information leading to a successful enforcement action with penalties above $1,000,000 may be eligible for an award. The program covers potential violations in any commercial sector.