By Naana Asare, Senior Manager, Legal, Risk and Compliance, Protiviti; Part-Time Lecturer, M.S. in Enterprise Risk Management Program, School of Professional Studies
What strikes me most in the recent consent order issued by the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, against Bank of America is how much the bank already knew. Its own testing had identified weaknesses in transaction monitoring. Compliance personnel had raised concerns about high-risk customers. Senior leaders had been briefed. Yet the risks continued without adequate controls.
On October 13, 2026, Treasury announced enforcement actions imposing more than $1.21 billion in penalties against the bank for anti-money laundering and sanctions violations. FinCEN found that the bank failed to timely report more than $5 billion in suspicious transactions. The Office of the Comptroller of the Currency found that significant deficiencies persisted after a December 2024 order requiring corrective action.
For risk leaders, the question is: What happens after a warning reaches someone with the authority to act?
Consider transaction monitoring: Internal testing showed that the bank’s transaction monitoring approach was leaving potentially reportable suspicious activity below the threshold for investigation. Yet the bank rejected an alternative approach that would identify more suspicious activity, citing concerns about overwhelming investigative resources. That is the critical point: When testing exposes a weakness, management must address both the controls and the capacity needed to make them work. Workload concerns cannot justify leaving known gaps unaddressed.
The customer relationships tell a similar story. Compliance personnel raised concerns about third-party payments, fraud and potential trade-based money laundering involving auto auction customers. FinCEN found that the bank prioritized revenue without corresponding changes to customer risk profiles or ongoing monitoring.
Keeping a high-risk customer is not, by itself, a compliance failure. The institution must understand the exposure and have controls capable of managing it. New information should inform both the customer’s risk assessment and the decision to continue the relationship.
For me, this is where financial crimes compliance becomes an enterprise risk management issue. Staffing decisions affect what gets investigated. Retaining a high-risk customer affects the controls required. Business and compliance leaders must weigh these decisions together and take responsibility for the risks that remain. An escalation should lead to a decision, a clear owner and a deadline. Testing must establish whether corrective action addressed the underlying weakness. Marking an issue closed does not, on its own, mean the risk has been mitigated.
The costs extend beyond the penalties. The bank now faces extensive independent reviews and corrective work. Its earlier reporting failures also deprived law enforcement of timely information about potentially illicit activity. In its third-quarter 2026 earnings release, Bank of America reported that the $1.2 billion regulatory settlement charge reduced diluted earnings per share by approximately 17 cents.
In the new Financial Crimes Compliance course I developed for Columbia University’s M.S. in Enterprise Risk Management program, launching in Spring 2027, students will examine these kinds of practical judgments. Through case studies and exercises, they will evaluate customer risk, investigate transaction monitoring alerts, and test compliance controls. They will also work through root-cause analysis, remediation planning, and issue validation to determine whether corrective actions address underlying weaknesses and support issue closure.
Bank of America’s case illustrates why these skills matter. Financial crimes compliance professionals need both regulatory knowledge and the judgment to determine what should happen when weaknesses emerge. An effective anti-money laundering program must turn that judgment into timely decisions, adequate resources, and controls that work. Identifying a risk is not enough. What matters is what management does about it.
Views and opinions expressed here are those of the authors, and do not necessarily reflect the official position of Columbia University School of Professional Studies or Columbia University.
About the Program
The Master of Science in Enterprise Risk Management (ERM) program at Columbia University prepares graduates to inform better risk-reward decisions by providing a complete, robust, and integrated picture of both upside and downside volatility across an entire enterprise. For both the full-time and part-time options, students may take all their courses on Columbia’s New York City campus or choose the synchronous online class experience.
The application deadline for the M.S. in Enterprise Risk Management program is May 1. Learn more about the program here.
