Bank of America sanctions screening failures
An $11.7 million settlement puts the focus on what happens after screening produces a match and whether changes reach the systems that release payments.
Enforcement · 13 Oct 2026
Your payment system finds a sanctions match. An analyst dismisses it, an automated rule suppresses it, or the alert enters a queue that nobody reviews promptly. Screening took place, but the payment still went through. Bank of America's October 2026 settlement shows why the existence of a screening tool says little about the decisions and data flows that follow it. For companies making cross-border payments, the practical question is whether their controls actually interrupt a risky transaction.
What happened
On October 13, 2026, Bank of America, N.A., agreed to pay $11,662,930 to settle potential civil liability for 475 apparent violations of sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. According to OFAC's Enforcement Release of October 13, 2026, pp. 1–6, the conduct occurred between September 18, 2021, and April 24, 2025, and involved approximately $14,834,082. OFAC characterized the case as non-egregious and largely not voluntarily self-disclosed.
The release identifies four problems: payments involving blocked banks; inadequate prioritization of exact customer matches; delayed watchlist updates; and human errors involving business accounts associated with blocked persons. This article reports that historical enforcement account. OFAC's compliance observations are persuasive U.S. agency guidance for the operational lessons below; this settlement does not establish a new, generally applicable screening rule.
Routing data and suppression rules let payments through
Bank of America introduced an automated cross-border payment routing process in May 2021. Its systems used a third-party routing directory to select correspondent banks. Employees and customers could also supply routing details manually. The resulting payment details were then screened.
By March 2022, the bank knew that the directory included blocked banks and that some screened payments were nevertheless being processed. OFAC describes three mechanisms: payments released before the sanctions filter reflected a new designation; analysts treating matches as false positives through human error; and automatic suppression of alerts, including alerts based on the same criteria as a previously dismissed match.
The bank tried various fixes and implemented an automated, longer-term solution in January 2023 to remove blocked banks from the directory used by its payment engine. Yet the release describes 403 transactions totaling $14,340,100 through 35 blocked banks between February 2022 and March 2025. A technical fix therefore should not be described as having ended the entire pattern when OFAC's account shows later activity.
OFAC also criticized the investigation's scope. Despite knowing of the problem in March 2022, the bank initially conducted only one narrowly tailored lookback. It did not identify the full scope until after a January 2025 administrative subpoena directed it to provide information about recent lookbacks.
For a corporate treasury team, the lesson is an oversight question, not a requirement to reproduce a bank's infrastructure. When a bank, supplier or payment route changes status, which systems still contain its details? Who tests whether a past false-positive decision remains reliable after that change? A historical dismissal can become a dangerous shortcut if its assumptions no longer hold.
Exact matches and current data still needed attention
A design flaw classified customers whose names and dates of birth both exactly matched blocked persons as low- or medium-priority rather than high-priority. Delayed review allowed three designated individuals to engage in 31 transactions totaling $56,258 between September 2021 and February 2024. The bank fully implemented the prioritization correction in February 2024, six months after initially identifying the problem.
Watchlist maintenance failed separately. Vendor human error left the bank's screening file without designation updates between May 24 and June 28, 2023. Six transactions totaling $100,828 followed. The bank identified the error only in July, approximately a month after another U.S. bank blocked one payment downstream. In February 2025, technical problems in the bank's own systems prevented another vendor update from taking effect, resulting in 26 transactions totaling $146,543 on February 7.
Those are different failure points: a vendor can fail to deliver current data, and a customer can fail to activate data that the vendor supplies. A useful control therefore checks the list version used by the screening engine, rather than treating receipt of a vendor file as proof that screening is current.
The penalty and why it landed where it did
OFAC counted 413 apparent violations as not voluntarily self-disclosed and 62 as voluntarily self-disclosed. The release explains that the $11,662,930 base penalty combined applicable schedule amounts for the former with one-half of transaction value for the latter. The settlement equaled that base penalty, with no reduction for remediation or cooperation. This is the calculation OFAC reports for this case, not a promise about another organization's penalty.
OFAC cited recklessness in delayed enhancements, stale watchlists, alert prioritization and staff training. It also cited harm to sanctions objectives, the bank's commercial sophistication, and earlier cautionary letters concerning substantially similar conduct. A tolling agreement for one group of apparent violations was mitigating, but OFAC found no net reduction warranted. Piecemeal or incomplete responses and delays slowed its investigation.
What this means for you
For a company with U.S. payment exposure, this account supports three practical checks. First, trace a payment from counterparty data through routing, screening, disposition and release. Include manual changes and automated exceptions. Second, test who owns urgent alerts and what happens when a platform migration generates more alerts than the team can resolve. Third, verify when designation updates became active in each relevant system and how the business responds to a failed update.
These are suggested questions for evaluating controls. They do not mechanically apply a large U.S. bank's obligations or systems to a foreign mid-cap. Your own legal exposure depends on the parties, transaction, jurisdiction and applicable sanctions measures.
Building the program you can stand behind
A defensible review starts with evidence: the active data version, the reason an alert was dismissed, the scope of any lookback, and the person responsible for an unresolved failure. Repeated problems deserve a broader inquiry into their common cause. If your company needs to assess the U.S. sanctions implications of its payment arrangements or a defined screening issue, Contact Zimmermann Law to discuss the scope of a company-side legal review.
This post provides general information, not legal advice. Sanctions analysis is fact-specific and changes over time.
Sources: Filed original `20261013_bofa.pdf`, OFAC Enforcement Release, October 13, 2026, pp. 1–6, read in full October 13, 2026; OFAC announcement of the settlement, published October 13, 2026. The release is the principal source for the historical enforcement facts; no current operative regulation or independent current-law analysis is asserted.
This post is for general information and is not legal advice.
Attorney Advertising. Zimmermann Law PLLC · New York · +1 (917) 426-4625 · contact@zimmermann-law.com