Bank of America (NYSE: BAC) Securities Class Action: AML Compliance, $1.2 Billion Penalty and December 15, 2026 Lead Plaintiff Deadline

The lawsuit alleges Bank of America misled investors about the scope of deficiencies in its Bank Secrecy Act, anti-money-laundering (AML), and economic-sanctions compliance programs. Importantly, plaintiff does not allege that the bank concealed regulatory scrutiny — Bank of America had already disclosed a December 2024 OCC cease-and-desist order and warned investors about compliance costs and possible additional penalties.

Instead, this is best understood as a BSA/AML remediation and regulatory-disclosure case. The complaint alleges that Bank of America understated how serious and widespread the problems were, overstated its remediation progress, and understated the likelihood and magnitude of additional remediation expense and regulatory penalties. These allegations have not been proven.

This distinction runs through the whole case. Bank of America Corporation is the publicly traded Delaware parent company — ticker BAC — and it is the defendant in this investor securities case. Bank of America, N.A. (often called 'BANA') is the national-bank subsidiary that conducts most of the company's banking operations.

The October 2026 federal enforcement actions — the OCC order, the FinCEN action, and the OFAC settlement — were directed principally at Bank of America, N.A. The securities lawsuit is different: it alleges that the publicly traded parent and its executives misled BAC investors about those regulatory issues. So the $1.2 billion FinCEN penalty was assessed against the bank subsidiary, not imposed directly on the publicly traded parent.

The Bank Secrecy Act (BSA) requires financial institutions to maintain systems designed to detect and report potential financial crime. A bank's BSA/AML program generally includes transaction monitoring, customer due diligence, suspicious-activity investigation and reporting, governance, internal controls, independent testing, and training. The purpose is to keep banks from being used for money laundering, terrorist financing, sanctions evasion, and other illicit finance.

A Suspicious Activity Report, or SAR, is a confidential report that a financial institution may be required to file with FinCEN when transactions raise potential money-laundering, fraud, terrorism-financing, or other illicit-finance concerns. The October 2026 enforcement actions focused heavily on BANA's alleged failure to escalate, investigate, and timely or accurately file SARs.

On December 23, 2024 — before the proposed class period — the Office of the Comptroller of the Currency (OCC) issued a cease-and-desist order against Bank of America, N.A. The OCC identified deficiencies involving suspicious-activity reporting, customer due diligence, internal controls, governance, independent testing, training, and BSA/AML and sanctions compliance.

The order required comprehensive corrective action and an independent consultant, and the complaint describes requirements for a board compliance committee, corrective-action plans, progress reporting, and historical transaction reviews.

Yes. Bank of America publicly disclosed the order and warned investors that failing to satisfy regulatory requirements could result in additional fines, additional regulatory orders, compliance expense, and business restrictions — its 2024 annual report said as much. So it would be inaccurate to say the bank hid the regulatory problem.

Plaintiff's narrower allegation is that investors were misled about the existing severity of the deficiencies, the true state of remediation, and the likely financial impact — not that the existence of regulatory scrutiny was concealed.

The class period begins August 1, 2025 — the day after Bank of America's July 31, 2025 Q2 Form 10-Q, which the complaint says stated the company had 'already completed significant steps' to satisfy the OCC order and did not believe the issues would have a material adverse financial impact on the corporation. Bank of America repeated substantially similar loss-contingency and BSA/AML disclosures in its October 2025 (Q3), February 2026 (annual report), and May 2026 (Q1) filings.

The complaint alleges those assurances lacked a reasonable basis — that BANA allegedly remained materially out of compliance while additional penalties were presented as more contingent than they actually were.

Yes — and this is an important point of balance. By its July 31, 2026 Q2 Form 10-Q, Bank of America expressly disclosed that resolution of the OCC consent order and related regulatory inquiries could include 'monetary penalties and other remedial actions.' So October 13 was not the first time investors learned a monetary penalty was possible, and this is not a claim that investors were told fines were impossible.

The stronger theory is that investors allegedly did not know the scale of the continuing failures, the admissions Bank of America would ultimately make, the magnitude of the penalty, or how incomplete the remediation allegedly remained.

After the market closed on October 13, 2026, federal regulators announced coordinated enforcement actions against Bank of America, N.A.:

FinCEN — $1.2 billion

FinCEN assessed a $1.2 billion penalty, and Bank of America admitted, as part of that resolution, that it willfully violated the Bank Secrecy Act. FinCEN found the bank failed to maintain a compliant AML program, conduct required correspondent-bank due diligence, and properly file SARs.

OCC — $750 million (credited, not additional)

The OCC separately assessed a $750 million civil money penalty — but that $750 million is credited against the $1.2 billion FinCEN penalty. It should not be added on top to create a '$1.95 billion' fine. The coordinated BSA/AML penalty is effectively $1.2 billion total, with the OCC amount included through that credit.

OFAC — about $11.66 million (separate)

The Office of Foreign Assets Control (OFAC) separately announced an $11,662,930 settlement concerning apparent sanctions violations, which does bring the coordinated total to roughly $1.212 billion.

The enforcement materials stated that Bank of America failed to report accurately or timely more than $5 billion of suspicious activity, approximately $1 billion of which allegedly implicated national-security or other priority illicit-finance risks. FinCEN specifically highlighted Chinese money-laundering networks and illicit finance along the southwest border. The complaint also alleges management received written reports identifying significant SAR-reporting failures from 2019 through 2023 that allegedly remained inadequately remedied even after the December 2024 OCC order — facts potentially relevant to scienter and to board-oversight analysis.

The OCC described Bank of America's BSA/AML program as 'deficient and ineffective.' Among its findings were a failure to properly monitor trillions of dollars in transactions, large numbers of late SARs involving billions of dollars, inadequate training and insufficient BSA expertise, deficient audit functions, systemic transaction-monitoring gaps, continuing failures after the 2024 order, and management minimization of the deficiencies.

OFAC's settlement concerned 475 apparent violations involving sanctions programs covering, among other areas, Russia, Belarus, Iran, Burma/Myanmar, Somalia, narcotics, and global terrorism — including processing payments involving blocked banks, failing to prioritize exact-match alerts, delayed watchlist updates, and human error involving blocked persons' accounts. Importantly, OFAC characterized these as 'apparent violations' that were non-egregious but largely not voluntarily self-disclosed — so they should not be described as criminal sanctions violations.

Here precision matters, because the legal posture differs across the three actions. In connection with the FinCEN resolution, Bank of America admitted the specified facts and violations, including willful BSA violations. The OCC imposed a civil money penalty and made supervisory and enforcement findings. The OFAC matter was resolved as a civil settlement regarding apparent sanctions violations. It would be inaccurate to say Bank of America 'admitted every allegation made by all three regulators.'

Bank of America recorded a $1.2 billion regulatory settlement charge in its Q3 2026 results, reported the next morning (October 14). The charge reduced diluted EPS by $0.17. Reported net income was about $6.9 billion, or $0.91 per share; excluding the regulatory settlement charge, adjusted net income was about $8.1 billion, or $1.08 per share.

No. Bank of America reported roughly $30 billion of Q3 revenue (up about 3% year over year, with net interest income up about 8%) and remained highly profitable despite the charge. The securities lawsuit concerns the regulatory-risk disclosures and the resulting settlement charge, not a collapse of the bank's underlying operating businesses. Analysts (including at J.P. Morgan and UBS) raised questions about whether the charge was a one-time item or signaled broader reputational and remediation-cost concerns — but those are analyst observations, not proof of securities fraud.

Management has emphasized that the company recognizes the seriousness of compliance, has invested billions of dollars in technology, has dedicated thousands of employees to financial-crime compliance, has completed substantial work, and has already incorporated ongoing remediation expense into its operating-cost base. The fair summary is that remediation did occur, but the regulators' position is that it was inadequate and incomplete — the OCC said the bank had begun implementing changes but had not completed many significant steps required for an effective program.

Unlike some major bank enforcement cases, the October 2026 order did not impose an asset-growth cap. CFO Alastair Borthwick stated that the consent order imposes no asset cap and does not constrain ordinary business operations — so this is not a Wells Fargo-style restriction, even though remediation remains ongoing.

According to the complaint, BAC closed at $53.96 on October 13 and $51.39 on October 14 — a close-to-close decline of about 4.8% (with a larger intraday move to a low of $49.26). The complaint uses that 4.8% figure for its loss-causation allegations.

Section 10(b) and Rule 10b-5

The complaint asserts federal securities-fraud claims under Section 10(b) and Rule 10b-5 against all defendants, based on the allegedly misleading BSA/AML and remediation disclosures.

Section 20(a)

It also asserts controlling-person claims against Brian Moynihan and Alastair Borthwick. Importantly, the government's regulatory findings and Bank of America's FinCEN admissions do not automatically establish a private Rule 10b-5 claim — plaintiff must still prove a material misrepresentation or omission, scienter, reliance, loss causation, and damages.

The alleged class period is August 1, 2025 through October 13, 2026. The complaint limits the proposed class to investors in Bank of America common stock — not preferred shares, bonds, or options — so investors should preserve all brokerage statements and transaction records showing BAC common-stock purchases and sales during that period.

The current published PSLRA lead plaintiff deadline is December 15, 2026.

Do I Have to Become Lead Plaintiff?

Generally, no. A lead plaintiff is the investor or investor group the court appoints to actively supervise the proposed class and proposed lead counsel. Most investors remain passive class members.

Lead Plaintiff Deadline ≠ Settlement Claim Deadline

These are different dates. An eligible investor ordinarily does not need to seek lead-plaintiff appointment merely to remain a potential passive class member.

Generally, no, for the securities class action. Selling BAC does not automatically eliminate a potential securities claim; eligibility, recognized loss, and damages turn on matters including purchase and sale timing and corrective-disclosure timing. Continued ownership matters separately for potential derivative claims.

The complaint does not plead an insider-selling theory, and the currently reviewed Forms 4 do not support one. Alastair Borthwick's reviewed dispositions principally involve share withholding for tax obligations (and, in one later filing, a charitable gift), and Brian Moynihan's reviewed transactions principally involve the settlement of cash-settled restricted stock units rather than open-market selling. Julie & Holleman therefore does not presently characterize this as an insider-trading case; the stronger governance theory here is regulatory compliance and board/risk oversight.

Potentially. Bank of America Corporation is incorporated in Delaware, so any shareholder derivative or internal-affairs analysis generally begins with Delaware law. Because the complaint alleges years-long internal reporting of AML deficiencies and continuing failures after a formal regulatory order, this presents a more concrete current-holder issue than a generic stock decline.

Julie & Holleman LLP is interested in speaking with current BAC shareholders who owned Bank of America shares at the time of potentially actionable conduct — which spans the pre-class remediation period, the 2025 and 2026 disclosures, and board oversight after the OCC order — and have continued to hold their shares. Potential areas of investigation include:

• BSA/AML oversight — what information reached the board, transaction-monitoring deficiencies, SAR backlogs (the complaint alleges an investigative backlog that peaked near 200,000 cases), resource allocation, regulator communications, and the independent consultant's findings;
• the board compliance committee the 2024 OCC order required — what reports it received, what deficiencies remained open, and remediation milestones;
• compliance staffing and budget — when resource shortages were identified and what approvals occurred; and
• sanctions controls — watchlist updates, blocked-party screening, and governance surrounding OFAC compliance.

Any oversight claim would require separate analysis of board-level information, good faith, monitoring systems, response to red flags, standing, and demand requirements. And because Suspicious Activity Reports and many AML records carry strict statutory confidentiality, shareholder litigation does not automatically provide public access to SARs, regulator communications, or AML investigative files; counsel may nonetheless evaluate whether a Delaware books-and-records investigation or other steps are appropriate for a current BAC shareholder. No determination has been made that viable derivative claims exist.

No to both. Bank of America is routinely involved in unrelated matters, so it is worth separating these:

• This is not the Bank of America Zelle lawsuit, a mortgage or foreclosure case, or a consumer bank-fee case.
• This is not the OCC enforcement action itself. The OCC, FinCEN, and OFAC actions are government enforcement matters; they are the factual basis for this separate, private investor securities lawsuit.

No earlier overlapping securities action based on these specific BSA/AML disclosure allegations was identified in the public sources reviewed.

Julie & Holleman LLP is investigating allegations involving Bank of America Corporation, BAC, Bank of America, N.A., Brian Moynihan, Alastair Borthwick, FinCEN, the OCC, OFAC, the Bank Secrecy Act, anti-money-laundering and suspicious-activity reporting, sanctions compliance, regulatory remediation, and board oversight. We are interested in hearing from:

Investors With Securities Losses

Investors who purchased or otherwise acquired Bank of America common stock between August 1, 2025 and October 13, 2026 and suffered losses, including investors evaluating lead-plaintiff appointment before December 15, 2026.

Current BAC Shareholders

Current shareholders who owned BAC during potentially actionable conduct and have continued to hold their shares and wish to evaluate possible Delaware corporate-governance rights.