Blocked banks in a routing directory: Bank of America's $11.7m lesson for EM lenders

Bank of America, N.A. has agreed to pay $11,662,930 to settle its potential civil liability for 475 apparent violations of US sanctions programmes covering Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism, the Treasury's Office of Foreign Assets Control (OFAC) announced on 13 October. The sum is small for the second-largest bank in the United States. The case matters for emerging-market lenders because of how the violations happened, and because OFAC applied no reduction to the base penalty, "including no mitigation for remedial measures or cooperation", its enforcement release says.

The settlement came with two larger actions. The Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion penalty for Bank Secrecy Act violations and the Office of the Comptroller of the Currency (OCC) a $750 million civil money penalty, which Treasury put at more than $1.21 billion in total, its press release shows. The figures overlap: FinCEN's consent order credits the OCC payment against its own penalty, leaving $450 million payable to Treasury.

A routing directory with blocked banks in it

From May 2021 the bank routed some cross-border payments automatically using a vendor-supplied routing directory, the release says. After the sanctions imposed over Russia's invasion of Ukraine in 2022, that directory still listed blocked banks. Payments got through when filters lagged new designations, when analysts cleared alerts as false positives and when an "alert suppression rule" released them automatically. Between February 2022 and March 2025 the bank processed 403 transactions worth $14,340,100 via 35 blocked banks, 32 of them designated under the Russia programme, two under Belarus sanctions and one under an Iran-related order. That is about 97 per cent of the $14.8 million total value of the apparent violations.

The bank knew from March 2022 that the directory contained blocked banks but implemented a longer-term fix only in January 2023, and initially ran "a single, narrowly tailored lookback". The full scope emerged only after an OFAC administrative subpoena in January 2025, according to the release. The other failures were smaller:

• A design flaw ranked exact name and date-of-birth matches to blocked persons as low or medium priority, letting three designated individuals complete 31 transactions worth $56,258 between September 2021 and February 2024, OFAC found.
• A vendor's error kept new designations off the screening list from 24 May to 28 June 2023, letting six transactions worth $100,828 through, and a failure of the bank's own systems on 7 February 2025 let through 26 payments worth $146,543 for a ship management company designated under the terrorism programme, the release says.
• A wrongly dismissed alert left a blocked business account unrestricted for 14 months, and in April 2025 branch staff moved $189,869 from restricted accounts to a new unrestricted one at the request of a designated person's adult child, according to OFAC.

How the bill was set

OFAC deemed the case non-egregious. Of the 475 apparent violations, 413 were not voluntarily self-disclosed and 62 were; the base penalty is a schedule amount for each of the former plus half the transaction value of each of the latter, the release shows. The result, $11,662,930, is about 79 per cent of the value of the payments involved. Aggravating factors included recklessness, harm to sanctions policy, notably the Russia programme, and earlier cautionary letters over "substantially similar conduct". Some payments were stopped by other banks, but "the majority were not, conferring a benefit to the blocked banks involved", OFAC said. It also criticised "piecemeal or incomplete disclosures or responses to OFAC".

What it means for emerging-market banks

For lenders in Eurasia, Türkiye and the Gulf that clear dollars through US correspondents, three points stand out. The first is vendor risk. The routing directory and one of the watchlist failures came from vendors, and OFAC was explicit: "Each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers." The release cites OFAC's 2019 compliance framework, which it says is addressed to organisations subject to US jurisdiction and to foreign entities that do business in or with the United States or US persons.

The second is configuration. Decisions on alert parameters and rules "should be risk-based, adequately supervised, and subject to audit and testing in order to prevent errors from compounding", OFAC said, adding that moves to new screening tools should be implemented in a controlled manner. The 14-month delay on the blocked business account came from an alert backlog during such a move, the release shows.

The third is geography. FinCEN found that the bank failed to report in time nearly $1 billion of suspicious wires that "primarily involved Georgia, Belarus, and other Commonwealth of Independent States (CIS) nations", about 98 per cent of them by value linked to auto-related customers. It also found that until late 2024 the bank had a policy permitting simplified due diligence on correspondent accounts of its own foreign branches and affiliates, the consent order shows. The order requires a third-party lookback and independent reviews, including of foreign correspondent due diligence, with Iran and Russia among the priority risks, Treasury said.

Within the Treasury package, the OFAC bill is less than 1 per cent of the total. Measured against the payments, it is nearly four-fifths of their value. OFAC urged institutions to investigate promptly, self-disclose and cooperate fully, and noted that FinCEN's whistleblower programme can reward people in the United States or abroad whose information leads to penalties above $1 million, the release says.