Five Lessons for Crypto Exchanges from the Bank of America AML Penalties
On October 13, 2026, the U.S. Treasury announced coordinated enforcement actions against Bank of America, N.A. totaling more than $1.21 billion. FinCEN assessed a $1.2 billion penalty and says the bank admitted it willfully violated the Bank Secrecy Act. The OCC assessed a $750 million civil money penalty, the largest in its history, which FinCEN's penalty credits. OFAC settled 475 apparent sanctions violations for $11,662,930.
None of the releases mention crypto. But the failures they describe are not specific to banks. Monitoring that misses activity, alerts that go unescalated, under-skilled staff, audits that miss known problems and slow list updates are all risks an exchange or VASP can face. Below are five themes from the public releases, each with questions a compliance lead can put to their own program.
What the regulators found
According to Treasury's announcement and the OCC release, the findings included:
a transaction monitoring system that failed to properly monitor "trillions of dollars" in transactions, with a "systemic gap" that let potential trade-based money laundering transactions be processed;
heavy reliance on law enforcement inquiries and requests from other institutions, rather than the bank's own automated controls;
a known, long-running failure to escalate potentially suspicious activity to investigators, still unfixed more than a year after a December 2024 cease-and-desist order;
a BSA Officer and staff who lacked sufficient skills and expertise, and key personnel without appropriate training;
an audit function that missed long-standing concerns examiners later found;
sanctions screening weaknesses, set out in OFAC's enforcement release.
1. Your monitoring should generate its own leads
Treasury says the bank relied heavily on outside inquiries instead of its own controls. At an exchange, the equivalent is a program where most investigations start from a law enforcement request, a bank partner's question or a counterparty's complaint, rather than from your own rules and blockchain analytics.
Questions to ask:
What share of investigations in the last 12 months opened from your own monitoring?
When were your scenarios last tested against the products, chains and customer types you actually have today, including new token listings, OTC activity and stablecoin flows?
Are on-chain exposure alerts and fiat-side alerts reviewed together, or in separate queues?
2. An alert backlog is a finding waiting to happen
The OCC states that "the bank knew for years that it was failing to escalate potentially suspicious activities to investigators." Exchange alert volumes can jump with market events, new listings or a marketing push, and a backlog can build within weeks.
Questions to ask:
Do you report alert aging to senior management, with a documented target for how quickly alerts are reviewed?
What happens operationally when alert volume doubles? Is there a written surge plan?
Can you trace an alert from creation to escalation to closure, with the reason recorded at each step?
3. Skills and training are examined, not assumed
Both Treasury and the OCC cite a BSA Officer and staff who lacked sufficient skills and expertise. For crypto firms, the gap is often technical: reading an analytics exposure score correctly, following funds across bridges and swaps, or recognizing when a "low risk" score reflects missing data rather than clean funds.
Questions to ask:
Is training role-specific, with on-chain investigation skills for the analysts who need them?
Could your BSA/AML officer explain to an examiner which risks the monitoring program covers, and which it does not?
Has staffing kept pace with transaction and alert volume?
4. Independent testing has to find what examiners would find
The OCC says "the BSA audit function failed to identify long-standing BSA concerns that examiners subsequently uncovered." Treasury adds that management did not act meaningfully even after testing revealed significant problems.
For exchanges, the independent test is often the first document a bank partner or regulator asks for. It only has value if its scope reaches the monitoring logic, the data feeding it and how alerts are handled, not only the written policies. Independent review is also showing up as a remedy: on October 8, 34 state regulators required crypto kiosk operator Coinme to hire an independent consultant to review its BSA/AML program, with a report due within six months.
Questions to ask:
Did your last independent test sample alerts and test the monitoring rules themselves?
Are findings tracked to closure, with owners and dates, and re-tested?
5. Sanctions failures often sit in the plumbing
OFAC's enforcement release is a useful read for anyone running wallet and customer screening. It describes:
403 transactions through 35 blocked banks, partly because a third-party routing directory still listed them and an "alert suppression rule" released payments automatically;
exact name and date-of-birth matches to blocked persons ranked as low or medium priority alerts, a design flaw fixed about six months after it was identified;
watchlists that were not updated promptly after designations, because of a vendor error and a separate technical failure.
OFAC's compliance considerations are direct: "Each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers." It adds that decisions on screening alert parameters and rules "should be risk-based, adequately supervised" and subject to audit and testing.
Questions to ask:
How long does it take for a new designation, including any listed digital currency addresses, to reach your live customer and wallet screening? Has anyone measured it?
Do you have suppression, auto-release or whitelisting rules, and who approved and last reviewed them?
How do you verify that your screening and analytics vendors' list updates actually arrived and loaded?
Are the lists you screen against matched to where you and your customers operate?
Why your bank partner will be reading this too
The day after the Bank of America actions, the OCC reported that all nine of the largest national banks it reviewed had policies, between 2020 and September 2025, restricting services to several sectors, including "digital asset activities." The OCC criticized broad reputation-risk policies that lacked objective, risk-based criteria.
Our view: if banking access for crypto firms widens, banks will still need evidence that a partner's AML and sanctions controls work. After October 13, we expect that evidence to be read closely. A program that can show its own leads, a controlled alert queue, trained staff, a meaningful independent test and measured list-update times is in a stronger position.
How we can help
ComplyChain works with crypto exchanges and VASPs on AML and sanctions program assessments, transaction monitoring tuning, and sanctions and wallet-screening reviews. Learn more about our work with crypto exchanges and VASPs and our AML and KYC compliance solutions, or email info@complychainsolutions.com to talk through how these themes apply to your program.
This article is general information, not legal advice. Speak to your counsel about the requirements that apply to your business.
