The Treasury Department announced more than $1.2 billion in penalties against Bank of America on Tuesday, citing years of failures to report suspicious transactions and correct weaknesses in its anti-money-laundering program. The bank admitted to willfully violating federal requirements governing safeguards and suspicious-activity reporting.

Regulators said inadequate monitoring of trillions of dollars in transactions left more than $5 billion in suspicious activity unreported or reported late. Over $1 billion involved potential national security risks and other priorities, including Chinese money-laundering networks and suspected trade-based laundering connected to the U.S.-Mexico border.

The enforcement action included a $750 million civil penalty from the Office of the Comptroller of the Currency, its largest ever. Treasury also announced an $11.6 million settlement involving hundreds of apparent sanctions violations, including restrictions targeting Russia and Iran.

Officials said problems persisted after a December 2024 regulatory order that accused the bank of prioritizing revenue while limiting compliance resources. Bank of America said it has invested billions in technology and assigned thousands of employees to financial-crime prevention. It will record a $1.2 billion, non-tax-deductible charge in its third-quarter earnings.

While financial institutions cannot prevent every illicit transaction, they are required by law to identify warning signs and alert authorities. Missing these signs allowed criminal networks to keep operating, and regulators allege that Bank of America constrained compliance resources, raising questions about incentives.

Deficiencies that persist after a regulatory order carry serious consequences, suggesting that identifying a weakness and investing in repairs do not necessarily produce effective controls. Investors have reason to distinguish compliance spending from evidence that the underlying problems have been resolved.

American Express’s $350 million penalty, announced less than a week earlier, suggests a recurring weakness in banks’ controls. Punishment is easier to measure than improvement: a fine has a dollar value, whereas effective monitoring depends on what banks detect and how promptly they report it. While the settlements establish the cost of failure, they do not establish that the systems now work.

For customers, the penalty concerns how Bank of America monitored transactions, rather than a reported loss of deposits. Its size alone says little about your account's safety, and the main consequence falls on the bank’s earnings, with no announced requirement for customers to cover the charge. Stronger monitoring could nevertheless make banking more demanding.

Transfers may attract additional questions, and businesses may need to explain payments that previously passed without scrutiny. Such checks can inconvenience legitimate customers, particularly when automated systems struggle to distinguish unusual activity from suspicious activity.

The challenge Bank of America will face moving forward will be how to improve its detection of illicit activity without treating every irregular transaction as evidence of wrongdoing. Customers have a vested interest in both outcomes: a financial system that gives criminals fewer opportunities and banking services that remain usable. More spending and more checks help achieve that.