Your Bank Is Not Your Sanctions Compliance Program
What the October 13, 2026 Treasury actions against Bank of America show about relying on third parties to catch a prohibited payment.
By Ruta Riley, Founding Partner, One Lex Partners LLC. October 16, 2026.
A payment that clears a sanctions screening is not a transaction that complies. The bank’s screening tells you the bank did not stop the wire. It tells you nothing about whether you were permitted to send it.
On October 13, 2026, Treasury announced $1.2 billion in Financial Crimes Enforcement Network (FinCEN) penalties, a $750 million Office of the Comptroller of the Currency (OCC) penalty, and an $11.66 million Office of Foreign Assets Control (OFAC) settlement against Bank of America. One finding should get the attention of every company that pays foreign suppliers or collects from foreign customers.
FinCEN found that for several years more than a third of the bank’s suspicious activity investigations began with subpoenas, law enforcement referrals, inquiries from other banks, or employee referrals, not its own monitoring. Treasury described the bank as having “effectively outsourced to third parties” a substantial portion of its detection obligations. OFAC separately found the bank identified a lapse in its sanctions watchlist about a month after another U.S. bank blocked one of its payments downstream.
Those are the findings in the record for the second-largest bank in the country. Exporters and importers do the same thing when they treat a cleared wire as a cleared transaction, or when they assume the bank will stop a payment that should not go out. The bank’s screening is the bank’s control, built to protect the bank. Every U.S. person in a payment chain is responsible for its own compliance, and OFAC applies that liability without regard to fault. Four reasons relying on the bank fails.
First, your bank screens the names in a payment message against a list. It does not know who owns your counterparty under the 50 percent rule, what your product is, or where it goes after delivery. A payment to an unlisted intermediary in a third country clears every time. Liability for the underlying transaction belongs to the company that sent the payment.
Second, when a bank does block or reject a payment, it must report to OFAC within 10 business days, identify the originator and beneficiary, and attach the payment instructions and invoices (31 CFR 501.603 and 501.604). The bank has no discretion, and the report names you.
The same obligation applies to any U.S. person holding blocked property, not only banks. A company that blocks a payment owed to its own blocked customer files the same report.
Third, once a bank has reported a blocked or rejected payment, nothing you later tell OFAC about that payment, or about the related series, counts as a voluntary self-disclosure under the Enforcement Guidelines. Whether you knew the bank reported is irrelevant. In a non-egregious case the base penalty moves from half the transaction value to the schedule amount for each transaction (a fixed figure set by the payment’s dollar bracket). A $150,000 wire carries a $200,000 base. Twelve of them carry $2.4 million before adjustment for aggravating or mitigating factors.
Fourth, each payment is counted separately. Bank of America’s 475 apparent violations covered about $14.8 million in transactions and settled for $11.66 million with no reduction from the base penalty. OFAC cited incomplete cooperation and prior cautionary letters on similar conduct.
The result is the same either way. If the bank catches the payment, you are reported and lose self-disclosure credit. If it does not, the violation is complete and it is yours.
OFAC’s enforcement release states that each organization remains “responsible for its own compliance regardless of whether it relies upon third-party providers.” Your bank is a third-party provider.
Screen your own counterparties and run ownership diligence. Know where the goods or services end up.
