Bank of America’s Remediation Clock Runs Beyond the Fine

Original analysis | October 14, 2026. Source status checked against the October 13 releases and published orders.

The fact base

Treasury announced coordinated anti-money-laundering and sanctions actions against Bank of America on October 13. FinCEN's $1.2 billion assessment credits the OCC's $750 million penalty; the separate OFAC settlement is $11,662,930. The combined amount is therefore $1,211,662,930, rather than the sum of all three headline assessments. These are assessed or agreed amounts, not confirmation of payment. Treasury announcement, OCC announcement, OFAC release

The continuing obligations have a longer timetable. FinCEN requires a historical suspicious-activity review and independent effectiveness testing, with specified reporting milestones extending into 2028. The existing OCC order requires corrective actions to work over time and undergo OCC verification and validation; its provisions remain effective until changed or terminated in writing. The OCC order also requires prior written supervisory no-objection for new products, services or markets with high risks under the Bank Secrecy Act or sanctions rules. FinCEN order, sections VI and IX, OCC order, Articles XVI and XX

Our analysis: the scarce resource is change capacity

The fine establishes a monetary obligation. Remediation creates a different planning problem: how much organizational capacity must remain committed until improvements can withstand independent examination? That capacity includes experienced investigators, data owners, engineering release slots and management attention. Our operating-capacity argument concerns those opportunity costs. It does not infer a new growth cap from the penalty announcements or estimate future earnings.

Hiring more people can expand throughput, but it cannot automatically remove every dependency. Investigators need reliable data; engineers need agreed definitions; reviewers need stable versions of controls to test. If the same specialists must repair a data feed, explain its history and support current operations, three funded projects may still share one bottleneck. The useful budget question becomes which dependency prevents a completed repair from becoming usable evidence.

This makes sequencing an economic choice. Completing a foundational data repair may unlock several reviews, whereas completing several visible but peripheral tasks may leave the critical path unchanged. Management should be able to explain that distinction without equating money spent with risk retired.

Keep the historical and current workloads separate

A lookback addresses the consequences of earlier control failures. Ongoing monitoring must handle activity arriving today. Treating both as one queue can hide a trade-off: moving skilled staff to historical cases may improve reported lookback progress while leaving less capacity for current investigations. This is a general resource-allocation risk, not a finding about the bank's present staffing.

A sensible internal review would therefore distinguish historical cases completed, newly arriving work, the age of unresolved cases and the risk profile of each group. Totals alone can flatter progress when the easiest cases close first. The hard question is whether the remaining work is becoming less risky and more manageable without transferring delay elsewhere.

Evidence can expire while systems improve

Verification adds a sequencing problem. Suppose a control passes a test and its underlying data pipeline subsequently changes. The earlier result may no longer describe the live system. Conversely, freezing every change to preserve evidence could slow necessary improvements. A remediation program needs an explicit boundary around what was tested, when, against which data and under which configuration.

Our proposed discipline is to pair each significant repair with an evidence record and a retesting trigger. That makes the impact of a later change visible before deployment. It also gives independent reviewers a way to distinguish an enduring correction from a successful demonstration under conditions that no longer apply. This is an analytical recommendation, not a claim that the orders prescribe this exact workflow.

Read the next milestone for what it establishes

More suspicious-activity reports could reflect improved detection, a historical catch-up or a changing customer mix. Fewer alerts could reflect cleaner data or a weaker filter. Neither direction alone establishes better control. A meaningful assessment needs context about coverage, timeliness, investigation quality and the stability of results across relevant risks.

For outside observers, a delivered plan, an implemented system, an independent review and a formal supervisory change establish different things. The reporting dates in an order should not be treated as promised termination dates. Nor does limited public detail prove that private remediation work has stalled.

The constructive possibility is that durable, independently supported improvements progressively free specialist capacity for ordinary operations and future development. The downside is repeated rework that keeps those resources committed longer. Which path emerges depends on the quality and persistence of evidence. That is why the next useful question is what a completed milestone proves, and what remains to be demonstrated before supervisory obligations change.

Open Market Notes' framework is original analysis of the published requirements. It is not a forecast of regulatory decisions or investment advice.