Beyond the Bank of America AML Penalties: Five Risk Management Lessons Every Financial Institution Should Apply.
A control environment can look complete on paper and still fail where it matters: in the hands of the people who operate it, in the data that feeds it, and in the oversight that is supposed to catch problems early. Recent enforcement actions by FinCEN , the OCC , and OFAC against Bank of America involving anti-money laundering (AML) and sanctions-related controls illustrate that point. Policies, procedures, and documented risk assessments do not, by themselves, demonstrate effective risk management.
The underlying matters concern financial crime compliance, but the questions they raise apply across products, operations, technology, vendors, and other critical activities. This article sets out five enterprise-wide themes and the practical questions leaders can use to test whether their own frameworks work as intended.
Table of Contents
Beyond AML: Five Enterprise-Wide Lessons From the Bank of America Enforcement Actions
The Bank of America enforcement actions provide a concrete example of how weaknesses in risk detection, technology, staffing, testing, and governance can reinforce one another. On October 13, 2026, the U.S. Department of the Treasury announced more than $1.21 billion in penalties across actions involving FinCEN , the OCC , and OFAC . The actions addressed failures involving suspicious activity identification and reporting, customer due diligence, transaction monitoring, and sanctions screening. The OCC also cited deficiencies in staffing expertise, training, and audit effectiveness, as well as a failure to correct previously identified problems.
These findings provide the factual starting point for the five enterprise-wide lessons that follow. The lessons are Versapien's broader risk management analysis, not a claim that every theme was separately identified as a formal finding in each enforcement action.
People & Accountability
Data & Technology Integrity
Risk Detection & Prioritization
Independent Testing & Self-Correction
Governance & Third-Party Accountability
The framework is illustrative and not a regulatory classification. Depth should be tailored to the institution's activities, risk profile, and operating context.
Five Risk Management Themes Every Institution Should Apply
1. People & Accountability
Lesson: Controls depend on people who have the expertise, training, resources, and authority to operate and challenge them. Ownership ambiguity, capacity constraints, and incentives that discourage escalation can weaken a well-designed control.
Diagnostic questions: Who owns each control and each open corrective action? Can reviewers challenge a business decision, and has that happened? Do staff escalate problems without concern for the consequences?
Evidence: Training records tied to roles, documented challenges and their outcomes, workload and staffing analyses, and corrective actions completed by named owners.
Management steps: Assign single accountable owners, align resources to workload, and review how escalations are received and resolved.
2. Data & Technology Integrity
Lesson: Monitoring and screening effectiveness depends in part on the quality of underlying data, system configurations, and ongoing testing.
Diagnostic questions: Does monitoring cover all relevant products and data sources? Are screening lists and system configurations updated and tested under change management? How are third-party data feeds and outsourced solutions validated?
Evidence: Data quality reviews, formal change approvals, testing results, issue remediation records, and ongoing performance monitoring of systems and vendor feeds.
Management steps: Inventory data sources and systems, require documented testing before and after changes, and set up recurring performance reviews. For related detail, see OFAC screening effectiveness.
3. Risk Detection & Prioritization
Lesson: Controls should detect relevant threats and direct attention to the highest-risk issues. Risk assessments should reflect operational evidence, customer behavior, product types, delivery channels, and emerging typologies, not static assumptions.
Diagnostic questions: When did observed activity last change the risk assessment? Do high-risk alerts and issues reach decision-makers first? Which risks are assumed rather than evidenced?
Evidence: Assessment updates traced to operational data, alert and case trends, and documented prioritization decisions.
Management steps: Feed monitoring results and customer activity back into assessments, connect identified exposures to control design and resource allocation, and review prioritization criteria with senior leadership. See also our work on financial crime risk management.
4. Independent Testing & Self-Correction
Lesson: Several functions test controls, and each has a distinct purpose. Compliance testing evaluates selected controls and processes; independent testing assesses the AML program under applicable requirements; management monitoring is a first-line and operational activity; and Internal Audit works under its own mandate.
Diagnostic questions: Does testing reach root causes or stop at symptoms? Is scope comprehensive enough to find related weaknesses elsewhere? How does the institution decide whether and when to self-disclose an issue to regulators?
Evidence: Root-cause analyses, scope assessments, validation of completed remediation, and a documented decision process for regulatory communication. Disclosure considerations depend on the facts and the applicable requirements; they are not automatic in every case.
Management steps: Expand scope when a weakness may recur elsewhere, and confirm that fixes are sustainable. See how to prove a remediated issue is sustainable.
5. Governance & Third-Party Accountability
Lesson: Board and executive oversight, escalation paths, and regulatory inquiry handling determine whether weaknesses reach those able to act. Outsourcing activities does not eliminate the institution's responsibility for appropriate oversight and management of the associated risks.
Diagnostic questions: What do the Board and executives see, and how often do material issues reach them? Do contracts provide audit and information rights? Is there a contingency plan if a provider fails?
Evidence: Governance reporting, vendor monitoring results, contract terms, remediation responsibilities, and exit or continuity plans.
Management steps: Define reporting for material issues, require contractual rights and monitoring, assign remediation responsibility, and test contingency plans. Related guidance: building a risk-based vendor inventory.
Executive Takeaways
People & Accountability: Name owners with the authority and capacity to act, and test whether escalation works in practice.
Data & Technology Integrity: Require evidence that data, configurations, and vendor feeds support controls across the enterprise.
Risk Detection & Prioritization: Update risk assessments with operational evidence and direct resources to the highest-risk issues.
Independent Testing & Self-Correction: Use distinct testing functions, address root causes, and confirm remediation is sustainable.
Governance & Third-Party Accountability: Keep oversight with the institution, supported by contract rights, monitoring, and contingency plans.
How Versapien Can Help
Versapien helps financial institutions strengthen risk management, regulatory compliance, and governance through practical, risk-based advisory services. Drawing on senior leadership and Big Four consulting experience, we work with organizations to identify control weaknesses, clarify accountability, strengthen oversight, and translate risk assessments into actionable improvements. Our services include enterprise risk assessments, control effectiveness reviews, remediation governance, third-party risk management, and regulatory exam readiness. We help leaders move beyond documented policies to evaluate whether controls operate effectively in practice, issues are addressed sustainably, and emerging risks receive appropriate attention.
Comments