Bank of America's $1.21 Billion Compliance Failure: A Wake-Up Call for Every Bank's Internal Audit Department
Why Internal Auditors Must Reevaluate Their BSA/AML Audit Programs, Challenge Management, and Strengthen Audit Committee Oversight
October 13, 2026 | John C. Balckshire, Jr. The Accountware Group
The Most Disturbing Finding Was the Failure of Internal Audit
On October 13, 2026, federal regulators announced enforcement actions against Bank of America totaling approximately $1.21 billion for serious violations of the Bank Secrecy Act (BSA), anti-money laundering (AML) requirements, and economic sanctions regulations.
The penalties were substantial. The Financial Crimes Enforcement Network (FinCEN) assessed $1.2 billion, the Office of the Comptroller of the Currency (OCC) assessed $750 million, with the OCC amount credited against FinCEN's assessment, and the Office of Foreign Assets Control (OFAC) announced an additional $11.66 million settlement.
But the size of the penalty is not the most important issue for the internal auditing profession.
The OCC reported that Bank of America's BSA audit function failed to identify longstanding compliance deficiencies that federal examiners subsequently uncovered.
That finding should concern every Chief Audit Executive, Internal Audit Manager, and bank Audit Committee member.
Internal Audit is supposed to provide independent assurance concerning the effectiveness of governance, risk management, and internal controls.
When regulators discover major deficiencies that the organization's own independent testing failed to identify, fundamental questions arise about the quality and effectiveness of the internal audit function.
Did the auditors understand the risks?
Were they testing the right controls?
Did they have sufficient technical expertise?
Were they relying too heavily on management representations?
Were significant warning signs overlooked?
And perhaps most importantly, did the Audit Committee receive meaningful independent assurance about the actual condition of the bank's BSA/AML compliance program?
These questions should be examined by every banking institution, regardless of size.
1. What Went Wrong at Bank of America?
The October 13 enforcement actions identified serious weaknesses across multiple components of Bank of America's financial crime compliance program.
Regulators reported that the bank:
Failed to timely report more than $5 billion in suspicious transactions.
Had deficiencies in transaction monitoring affecting trillions of dollars in transactions.
Failed to escalate potentially suspicious activity for investigation.
Had significant customer due diligence weaknesses.
Did not provide certain BSA personnel with adequate training.
Lacked sufficient expertise in important areas of its compliance function.
Failed to identify longstanding deficiencies through independent BSA auditing.
Did not adequately remediate problems identified in a December 2024 OCC enforcement order.
Processed transactions involving potential trade-based money laundering because of a systemic monitoring gap.
Entered an OFAC settlement involving 475 apparent sanctions violations.
These findings reflect more than isolated employee errors.
They indicate broad weaknesses in the bank's compliance processes and internal control environment.
The regulators also reported that management had known about significant problems for years without correcting them adequately.
That is an especially important governance issue.
2. Management Owns the Internal Control Framework
Before examining Internal Audit's responsibilities, one principle must be clear.
Bank management—not Internal Audit—owns the institution's internal control framework.
Management is responsible for identifying financial crime risks, establishing appropriate controls, assigning competent personnel, operating transaction monitoring systems, investigating suspicious activity, and correcting deficiencies.
The BSA Officer coordinates and monitors the compliance program, but senior management remains accountable for the effectiveness of the bank's controls.
The Audit Committee and Board provide governance oversight.
Internal Audit provides independent assurance concerning the design and operating effectiveness of those controls.
These responsibilities should not be confused.
The IIA's Three Lines Model provides a useful way to understand this structure.
Governance function | Primary responsibility |
Business management | Owns and manages risks and controls |
Risk management and compliance | Provides expertise, monitoring, support, and challenge |
Internal Audit | Provides independent assurance and advice |
Board and Audit Committee | Oversee management and the effectiveness of governance arrangements |
Bank of America's enforcement findings illustrate the consequences when these functions do not operate effectively together.
Management's failure to correct deficiencies is not excused by inadequate Internal Audit testing.
Likewise, Internal Audit cannot fulfill its responsibilities merely by reporting that management has established a compliance department.
3. Why Did Independent BSA Auditing Fail?
The OCC explicitly identified weaknesses in Bank of America's BSA audit function.
The public enforcement findings do not fully explain why the auditors failed to identify every deficiency.
Nevertheless, the findings justify a broader examination of how banks perform independent BSA/AML testing.
A weak BSA audit program may emphasize whether policies and procedures exist rather than whether controls operate effectively.
For example, an auditor may verify that the bank maintains a suspicious activity monitoring system.
But that does not establish whether the system identifies the relevant suspicious transactions.
An auditor may verify that the bank has procedures for filing SARs.
But that does not establish whether potentially suspicious activity is being identified, investigated, and reported on time.
An auditor may review a sample of completed investigations.
But that does not establish whether the monitoring system failed to generate alerts for significant transactions in the first place.
Internal Audit must test the effectiveness of the entire BSA/AML control process, not merely examine documentation produced by that process.
This distinction is critical.
An audit that tests only the alerts generated by a monitoring system may fail to identify transactions that the system never detected.
4. Every Bank Should Reassess Its BSA/AML Audit Risk Assessment
The first action a Chief Audit Executive should take is to reconsider the bank's BSA/AML risk assessment and the scope of independent testing.
This does not necessarily require launching an entirely new audit immediately.
It does require evaluating whether the current audit plan adequately addresses the risks illustrated by the enforcement action.
Important considerations include:
Transaction monitoring coverage: Does the system capture all relevant products, accounts, customers, and transaction types?
Data integrity: Are monitoring inputs complete, accurate, and appropriately reconciled?
Scenario effectiveness: Are monitoring rules and thresholds designed to identify significant risks?
Investigation processes: Are alerts reviewed promptly and by qualified personnel?
SAR reporting: Are decisions properly documented, and are required reports timely and accurate?
Customer due diligence: Are changes in customer behavior reflected in risk assessments?
Corrective actions: Are significant findings actually resolved?
The Chief Audit Executive should determine whether the existing audit universe and risk-based plan provide adequate coverage.
If they do not, the plan should be revised and the reasons communicated to the Audit Committee.
5. Internal Audit Must Test Transaction Monitoring Completeness
One of the most important lessons from Bank of America concerns transaction monitoring.
A monitoring system can generate thousands of alerts while still failing to identify important suspicious activity.
The question is not how many alerts are generated.
The question is whether the system appropriately covers the bank's financial crime risks.
Internal Audit should evaluate the completeness and accuracy of information entering the monitoring process.
Testing may include:
Identifying the systems that originate relevant transactions.
Understanding how transactions move into the monitoring platform.
Reconciling transaction populations between source systems and monitoring systems.
Evaluating excluded transactions and filtering rules.
Reviewing scenario thresholds and configuration changes.
Testing whether selected high-risk transactions would generate appropriate alerts.
Evaluating system changes and model validation processes.
For a smaller community bank, this may involve relatively straightforward system reconciliations and targeted transaction testing.
For a large financial institution, it may require specialized data analytics, technology auditors, and independent model expertise.
The principle is the same.
A control cannot detect suspicious transactions that never enter the monitoring process.
6. Internal Audit Should Test the Transactions That Were Not Flagged
Traditional BSA audit testing frequently begins with a population of monitoring alerts.
Auditors select alerts and determine whether investigations were performed appropriately.
That is useful, but it addresses only part of the risk.
The more difficult question is whether the bank's monitoring system failed to identify suspicious activity that should have received attention.
Internal Audit should consider independently analyzing selected transaction populations for risk indicators.
Examples include:
Repeated cash transactions near reporting thresholds.
Rapid movement of funds between accounts.
Unusual wire transfer activity.
Transactions inconsistent with customer profiles.
Payments involving unexplained third parties.
Unusual activity involving recently opened accounts.
Transaction patterns associated with potential trade-based money laundering.
The results should be compared with the bank's monitoring output.
Transactions identified through independent analytics but not through the monitoring system may indicate scenario design weaknesses, data problems, or other control deficiencies.
These exceptions require investigation.
Not every unusual transaction represents suspicious activity requiring a SAR, but unexplained monitoring gaps deserve serious attention.
7. Reevaluate the Competency of Internal Audit Personnel
The OCC found that certain Bank of America BSA personnel lacked sufficient skills and training.
The bank's independent testing failures also raise an important question for Internal Audit Departments: Do the auditors assigned to BSA/AML engagements possess the expertise necessary to evaluate the compliance program?
BSA auditing requires more than general accounting knowledge.
Relevant competencies may include:
BSA/AML regulatory requirements.
Suspicious activity monitoring.
Customer due diligence.
Financial crime typologies.
SAR and CTR reporting.
Information technology controls.
Data analytics.
Sanctions compliance.
Fraud risk assessment.
Investigation processes.
A generalist auditor may be able to evaluate certain governance and control activities.
However, complex monitoring systems and financial crime scenarios may require specialized expertise.
The Chief Audit Executive should perform a competency assessment before assigning significant BSA engagements.
If the department lacks necessary skills, it should consider training, co-sourcing, or qualified specialists.
The Audit Committee should understand material competency gaps and their effect on audit coverage.
8. Challenge Management's Corrective Action Process
Bank of America's December 2024 OCC order identified significant BSA and sanctions compliance deficiencies.
The October 2026 enforcement action reported that many significant corrective steps had not been completed.
This is a major lesson concerning management accountability.
Internal Audit should not simply accept management's statement that a corrective action is complete.
The department should evaluate whether the action was implemented and, when appropriate, whether it is operating effectively.
Consider a finding involving inadequate transaction monitoring.
Management may report that it implemented a new monitoring scenario.
That does not necessarily mean the deficiency has been corrected.
Internal Audit should consider whether:
The scenario addresses the original risk.
Relevant transactions are included.
Thresholds are appropriately configured.
The scenario generates expected alerts.
Investigators respond appropriately.
Relevant documentation supports the control's operation.
A corrective action should not be treated as successfully implemented merely because a policy was revised or a technology project was completed.
Corrective action closure requires evidence—not management optimism.
9. Establish a High-Risk Findings Escalation Process
Internal Audit should maintain a formal process for monitoring significant findings.
A useful corrective action register should identify:
Field | Purpose |
Finding | Description of the control deficiency |
Risk rating | Severity and potential consequences |
Root cause | Why the deficiency occurred |
Management owner | Individual accountable for correction |
Corrective action | Specific remediation commitment |
Due date | Agreed implementation deadline |
Current status | Open, overdue, pending validation, or closed |
Audit validation | Evidence supporting closure |
Escalation status | Whether the matter has been reported to senior management or the Board |
The Chief Audit Executive should establish criteria for escalating overdue high-risk findings.
Repeated extensions should not be treated as routine administrative matters.
When significant deficiencies remain unresolved, the Audit Committee should understand the risk exposure and management's reasons for delay.
10. Evaluate the Bank's Compliance Culture
The enforcement findings also raise questions about the effectiveness of the bank's compliance culture.
Regulators reported that management minimized significant deficiencies and failed to prioritize necessary corrective actions.
A healthy compliance culture requires more than statements about ethical behavior.
It requires management to respond appropriately when employees, compliance personnel, and auditors identify problems.
Internal Audit should consider whether:
Compliance concerns receive appropriate management attention.
Employees can report concerns without retaliation.
Significant findings are escalated promptly.
Management challenges or suppresses adverse information.
Compliance resources reflect the bank's risk profile.
Senior executives are held accountable for corrective actions.
Repeated control failures affect management performance evaluations.
The COSO Control Environment component provides a useful framework for this assessment.
Particularly relevant are management's commitment to competence, assignment of responsibilities, and accountability for internal controls.
11. Internal Audit Should Examine Its Own Past Work
Perhaps the most uncomfortable lesson from the Bank of America case is that Internal Audit must be willing to question its own performance.
If a regulator identifies a significant deficiency that previous internal audits did not detect, the Chief Audit Executive should consider whether the audit methodology was adequate.
Every bank should periodically perform a retrospective review of significant BSA audit engagements.
Questions include:
Did the audit identify the most significant risks?
Were the procedures appropriately designed?
Was the testing population complete?
Did the auditors obtain reliable evidence?
Were relevant exceptions investigated?
Did supervision and workpaper review challenge unsupported conclusions?
Were findings communicated to the appropriate governance level?
Did the engagement provide meaningful assurance?
This type of review should be integrated with the Internal Audit's Quality Assurance and Improvement Program.
Under the IIA's Global Internal Audit Standards, the Chief Audit Executive is responsible for establishing a program to evaluate and improve the quality of the internal audit function.
A review of missed significant deficiencies can provide valuable information about audit methodology, supervision, staffing, and professional competence.
12. The Audit Committee Must Challenge Internal Audit
The Audit Committee should not assume that an Internal Audit report provides effective assurance simply because the engagement was completed.
The committee should understand the scope, methodology, limitations, and significant conclusions of BSA audits.
Important questions include:
Did the audit test whether the monitoring system captures the complete relevant transaction population?
Were transaction monitoring scenarios evaluated?
Did the auditors perform independent transaction analytics?
Were SAR investigation and reporting controls tested?
Did the audit address the bank's highest-risk customer relationships?
Were significant information technology dependencies evaluated?
Did the audit team possess appropriate BSA/AML expertise?
Were significant exceptions investigated?
Were management corrective actions independently validated?
Were any scope restrictions, resource limitations, or unresolved disagreements reported?
The Audit Committee should also meet privately with the Chief Audit Executive when appropriate.
An effective committee should be willing to ask difficult questions about the quality of Internal Audit's work.
The Audit Committee's responsibility is not merely to receive the audit report. It is to oversee whether Internal Audit is providing meaningful independent assurance.
13. Applying the IIA's Global Internal Audit Standards
The Global Internal Audit Standards, effective January 9, 2025, provide a framework for evaluating the internal audit function's response.
Several principles are particularly relevant.
Principle 6 — Authorized by the Board
Internal Audit should have an appropriate mandate and authority to examine significant BSA/AML risks.
Principle 7 — Positioned Independently
The Chief Audit Executive should be able to communicate significant findings without inappropriate management interference.
Principle 8 — Overseen by the Board
The Board or Audit Committee should oversee Internal Audit's effectiveness, resources, quality, and performance.
Principle 9 — Plan Strategically
The internal audit strategy and plan should reflect significant organizational risks.
Principle 10 — Manage Resources
The Chief Audit Executive should evaluate whether the function has sufficient personnel, financial resources, and technology.
Principle 12 — Enhance Quality
The internal audit function should evaluate its performance and continuously improve.
Principle 13 — Plan Engagements Effectively
BSA audit engagements should be based on appropriate risk assessments and clearly defined objectives.
Principle 14 — Conduct Engagement Work
Auditors should gather and evaluate information sufficient to support findings and conclusions.
Principle 15 — Communicate Engagement Conclusions and Monitor Action Plans
Significant findings should be communicated appropriately, and management's corrective actions should be monitored.
These principles provide a useful structure for reviewing the effectiveness of the bank's internal audit function.
14. A 90-Day Action Plan for Bank Internal Audit Departments
The Bank of America case should result in concrete action rather than another compliance presentation.
The following is a practical 90-day plan that a Chief Audit Executive can adapt to the bank's size and risk profile.
Period | Internal Audit action | Expected deliverable |
Days 1–15 | Review enforcement findings and compare them with the bank's BSA risk profile | Initial gap assessment |
Days 1–30 | Evaluate the current BSA audit plan, prior findings, and overdue remediation | Audit coverage and findings analysis |
Days 15–45 | Assess monitoring data completeness, scenario coverage, and audit team competency | Targeted testing plan |
Days 30–60 | Perform risk-based testing of selected high-risk transactions and monitoring controls | Preliminary testing results |
Days 45–75 | Evaluate management's corrective action validation and escalation procedures | Remediation governance assessment |
Days 60–90 | Report results and proposed audit plan changes to the Audit Committee | Formal Audit Committee report |
The plan should be adjusted based on the institution's actual risks, staffing, and available resources.
For some banks, a targeted audit plan update may be sufficient.
Others may need a broader independent review.
The objective is to ensure that the bank's independent assurance program addresses the weaknesses illustrated by the enforcement action.
15. Five Questions Every Chief Audit Executive Should Answer
Before the next Audit Committee meeting, the Chief Audit Executive should be prepared to answer five fundamental questions.
First: Could the deficiencies identified at Bank of America exist in our institution?
The answer should be supported by a risk assessment rather than an assumption that a smaller bank faces fewer risks.
Second: Would our current internal audit procedures detect those deficiencies?
The Chief Audit Executive should identify the specific audit procedures that address the relevant risks.
Third: Do our auditors possess the necessary expertise?
Technical competency should be evaluated against the complexity of the institution's BSA/AML program.
Fourth: Are significant findings corrected and independently validated?
The Audit Committee should understand the status of unresolved high-risk deficiencies.
Fifth: What additional assurance does the Board need?
Internal Audit should recommend appropriate changes to the audit plan, methodology, or resources.
These questions can help transform a regulatory enforcement case into an opportunity to improve governance.
16. A Warning for Community Banks
Some community bank executives may view the Bank of America enforcement action as primarily relevant to large international institutions.
That would be a mistake.
Community banks may not process trillions of dollars in transactions, but they still face significant BSA/AML compliance responsibilities.
A smaller institution may have additional challenges involving:
Limited compliance staffing.
Dependence on a single BSA Officer.
Limited Internal Audit resources.
Outsourced transaction monitoring systems.
Reliance on third-party independent testing.
Limited access to specialized financial crime expertise.
Informal corrective action processes.
These limitations do not eliminate the need for effective controls.
They make risk-based planning and independent assurance especially important.
A $150 million community bank does not need the same compliance infrastructure as Bank of America.
But it does need controls appropriate to its risks and an independent testing function capable of evaluating whether those controls work.
The Bottom Line: Internal Audit Must Be Willing to Deliver Bad News
The Bank of America enforcement action is a serious warning about the consequences of ineffective BSA/AML controls.
But for the internal auditing profession, its most important lesson concerns the failure of independent assurance.
Regulators identified longstanding deficiencies that the bank's BSA audit function had not adequately identified.
Management also failed to correct significant problems despite an earlier enforcement order.
The combination is particularly troubling.
Internal Audit exists to provide independent, objective assurance about governance, risk management, and internal controls.
Its responsibility is not to reassure management that the organization is operating effectively.
Its responsibility is to evaluate the evidence and communicate what the evidence demonstrates.
Sometimes that means delivering findings that management would prefer not to hear.
Sometimes it means reporting that a major compliance program is not effective.
Sometimes it means telling the Audit Committee that significant risks remain unresolved.
The value of Internal Audit is not measured by how comfortable management feels after receiving an audit report. It is measured by the quality of the assurance provided and the organization's willingness to act on the findings.
Every bank's Chief Audit Executive should study the Bank of America case and ask one final question:
If our institution had the same control deficiencies, would our Internal Audit Department identify them before the regulators did?
If the answer cannot be supported with evidence, the internal audit function has work to do.
The Accountware Group provides commentary and analysis concerning corporate governance, internal auditing, internal controls, risk management, and organizational accountability.
Comments