Bank of America let more than $5 billion in suspicious transactions pass through its systems without alerting the government, and on Tuesday the Treasury Department handed the bank a $1.2 billion bill for it. The fine is the third-largest the Treasury has ever imposed, and it comes with an admission that stings: the bank, by its own account, willfully broke federal law.

The violations were not minor paperwork failures. According to the Treasury, roughly $1 billion of those unreported transactions carried national security and illicit finance risks. The department specifically flagged transactions that may have involved Chinese money laundering networks and trade-based laundering tied to the southwest border, the kind of financial activity that federal agencies treat as a direct threat to US security infrastructure, not just banking compliance.

How the bank let it happen

The Treasury's core finding is almost counterintuitive for an institution of this size. Bank of America, the country's third-largest bank, was not simply understaffed or inattentive. It effectively handed its monitoring obligations to outside parties, relying on tips from law enforcement and other financial institutions rather than building the internal controls that federal law requires. In the Treasury's words, it "outsourced to third parties a substantial portion of its proactive detection and reporting obligations."

That is what the Bank Secrecy Act exists to prevent. Banks are required to maintain their own anti-money laundering programmes precisely because they sit inside the financial system and see transaction flows that no outside agency can. Waiting for law enforcement to flag a suspicious account is a little like a bank teller waiting for a robbery to finish before calling the police.

As part of the settlement, Bank of America admitted it willfully violated that law, failing to run a compliant monitoring programme, failing to conduct required checks on foreign accounts, and failing to file suspicious activity reports. The Treasury's sanctions enforcement arm, the Office of Foreign Assets Control, separately found 475 apparent violations tied to sanctions programmes covering Russia, Iran, narcotics trafficking, and global terrorism.

What this costs, and who pays

The $1.2 billion figure breaks down across two regulators. The Office of the Comptroller of the Currency levied $750 million, the largest penalty that office has ever imposed. The remaining portion came from Treasury's sanctions enforcement arm.

For Bank of America, the immediate financial hit is specific: the bank said the charge will reduce its quarterly earnings by roughly 17 cents per share, and because it is non-tax-deductible, there is no accounting cushion. The announcement landed less than 24 hours before the bank's scheduled quarterly earnings report.

For everyone else, the costs are harder to see but not trivial. When large banks fail to flag suspicious money, that money moves more freely through the system. It funds the networks the sanctions were designed to isolate. It crosses borders, changes hands, and becomes harder to trace. Treasury Secretary Scott Bessent said it plainly: "When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks."

The bigger pattern here is worth holding onto. Fines at this scale tend to follow years of gradual drift, where compliance functions are treated as cost centres rather than core obligations, and where the gap between what regulators expect and what banks actually do quietly widens. The Bank Secrecy Act has been on the books since 1970. The rules are not new. What changes, periodically, is whether regulators decide to enforce them at full force. This week, they did.

Bank of America said it is "far along" in fixing the problems and has already committed substantial resources to remediation. Regulators will be watching whether the commitment holds.