In October 2026, federal regulators announced civil money penalties totaling $1.2 billion against Bank of America and $350 million against American Express for significant BSA/AML compliance deficiencies. The enforcement actions generated headlines because of their size and the failure to report billions of dollars in suspicious activity. However, for community banks, fintechs, and sponsor banks, the dollar amounts are not the most important takeaway. The real lesson is that regulators continue to focus on the same fundamental BSA/AML and sanctions controls that institutions of all sizes are expected to maintain.
While Bank of America and American Express operate on a vastly different scale than most institutions, the deficiencies identified by regulators are remarkably familiar: ineffective transaction monitoring, delayed suspicious activity reporting, inadequate risk assessments, insufficient staffing and expertise, weak governance, and failure to remediate known issues in a timely manner.
The expectations gap is disappearing
Historically, many fintechs viewed regulatory expectations through the lens of their sponsor bank. Today, regulators increasingly evaluate the effectiveness of the entire program ecosystem, including the bank, fintech partner, third-party vendors, and supporting control framework.
As fintech-bank partnerships continue to grow, institutions should expect regulators to scrutinize customer onboarding processes, transaction monitoring programs, sanctions screening controls, customer due diligence, and escalation procedures with the same level of rigor applied to traditional banking activities. The underlying expectation is straightforward: if an institution is facilitating financial transactions, it must be able to identify, investigate, and report suspicious activity effectively.
Risk assessments must reflect reality
One of the more notable themes from the American Express enforcement action was the regulator's concern that risks associated with key products and services were not adequately reflected in the institution's AML program design. Regulators expect risk assessments to drive monitoring rules, staffing decisions, training programs, quality assurance reviews, and escalation thresholds. When those assessments become stale or fail to account for how customers actually use products, compliance gaps can emerge quickly.
When institutions lack a sufficient understanding of customer relationships, expected activity, or changes in risk over time, transaction monitoring and suspicious activity reporting processes become significantly less effective. For community banks and fintechs, this reinforces the importance of viewing risk assessments, CIP, CDD, and ongoing monitoring as interconnected components of a broader financial crimes compliance framework.
Monitoring effectiveness matters more than monitoring existence
Both enforcement actions highlight a reality that compliance professionals know well: having a monitoring system is not enough. Regulators increasingly focus on ensuring monitoring systems generate meaningful alerts, alerts are investigated appropriately, suspicious activity is escalated in a timely manner, and SAR decisions are properly documented. Many institutions invest significant resources in monitoring technology but spend less time validating whether those controls are working as intended. Alert backlogs, tuning deficiencies, ineffective scenarios, and resource constraints can gradually undermine even well-designed programs.
As financial institutions implement suppression rules, segmentation strategies, and risk-based prioritization models to manage increasing transaction volumes, regulators expect clear evidence that these controls remain appropriately calibrated and do not prevent potentially suspicious activity from being investigated. Strong monitoring programs are not measured by how many alerts they reduce, but by how effectively they identify and escalate meaningful financial crime risks.
For community banks and fintechs, periodic effectiveness testing may provide more value than simply adding additional monitoring rules or technology solutions. Independent testing and validation should also serve as a credible challenge to management to identify weaknesses before they become examination findings. In an increasingly complex financial crime risk environment, robust independent testing remains one of the most effective tools for ensuring compliance programs are operating as designed and capable of adapting to evolving regulatory expectations.
Staffing remains a regulatory focus
Another common theme across the recent actions is the importance of qualified personnel. Regulators cited concerns related to expertise, training, program execution, and overall compliance resources. These findings reinforce a long-standing principle: compliance programs must scale as risk and complexity increase.
This presents a challenge for growing fintech programs and smaller financial institutions. Growth in customers, transaction volume, and product offerings often outpaces growth in compliance staffing. While technology can improve efficiency, regulators continue to view experienced personnel, effective governance, and appropriate oversight as essential components of an effective BSA/AML program.
AML and OFAC can no longer operate in silos
The Bank of America action also reflects increasing regulatory emphasis on the relationship between AML and sanctions compliance. Treasury specifically highlighted the need for AML and sanctions programs to be integrated and mutually reinforcing. Effective sanctions compliance requires more than customer and transaction screening; it also depends on strong governance, sound change-management practices, independent validation of screening systems, and clear accountability for resolving identified control gaps. As financial institutions increasingly rely on third-party technology providers, regulators are placing greater emphasis on demonstrating that sanctions controls remain effective throughout the system lifecycle.
For many organizations, AML investigations, sanctions screening, fraud monitoring, and customer risk management are still managed through separate workflows and systems. Institutions should ensure these functions are connected and leverage information across programs to develop a more complete understanding of customer risk.
This trend is especially relevant for fintech programs, where operational teams often support multiple compliance disciplines simultaneously.
The biggest risk may be delayed remediation
Perhaps the most important lesson from these actions is that regulators have little patience for known issues that remain unresolved. Several findings involved longstanding deficiencies that had been previously identified but were not fully addressed.
Most compliance programs have open findings, enhancement opportunities, and remediation plans. Regulators generally understand that perfection is unrealistic. What receives greater scrutiny is whether management can demonstrate ownership, prioritization, adequate resources, and measurable progress toward resolution.
In many cases, the regulatory concern is not the original issue but the institution's response to it.
Conclusion
Community banks and fintechs should resist the temptation to view the Bank of America and American Express enforcement actions as problems unique to large financial institutions. The underlying themes are universal: understand your risks, ensure monitoring controls are effective, staff programs appropriately, integrate AML and OFAC functions, and address known deficiencies timely.
The size of the institutions may differ, but the expectations do not. Boards and senior management are expected to understand financial crime risks, receive meaningful reporting regarding program effectiveness, ensure adequate staffing and resources, and maintain oversight of remediation efforts. Organizations of all sizes would be well served to use these recent actions as an opportunity to reevaluate the strength and maturity of their own financial crimes compliance frameworks. Ultimately, the difference between an effective program and an enforcement action often comes down to how consistently an institution executes the fundamentals.