Bank of America had a regulator's order spelling out what to fix and still ended up with a $1.2 billion fine. The gap wasn't knowledge. It was culture, ownership and execution.
Last week, U.S. regulators fined Bank of America $1.2 billion over failures in its anti-money-laundering controls. That includes $750 million from the Office of the Comptroller of the Currency, the largest penalty that regulator has ever issued. The bank's monitoring left trillions of dollars in transactions without proper review, and more than $5 billion in suspicious activity went unreported or was reported late. Bank of America admitted it willfully broke the Bank Secrecy Act.
The detail that matters most is the timeline. In December 2024, the same regulator ordered the bank to fix its program. The order spelled out what had to happen. Almost two years later, the OCC found that the bank hadn't finished many of the important steps, still wasn't sending potentially suspicious activity to investigators, and that management kept downplaying the problems. Bank of America says it has put billions of dollars and thousands of employees into fighting financial crime and that the work is far along.
So this wasn't a bank that didn't know what to do. It had the instructions in writing.
Culture decides what wins when priorities collide
At its root, this is a culture problem, and the culture rewarded revenue. Regulators said the bank put revenue ahead of compliance resources and relied on law enforcement inquiries and requests from other banks to flag problems it should have caught itself. That saved money for years, then ended in a record fine.
Culture isn't what a company says it values. It's what people do when two priorities collide and nobody is watching. If growth targets get protected every time and control work gets deferred, people learn quickly which one counts. No compliance policy survives incentives pointing the other way.
Why "fix it" programs look busy but don't land
Most remediation programs stall for the same reasons.
Too many layers. Every handoff between the team that spots a problem and the people who can fix it is a place for urgency to leak out. The OCC found the bank knew for years that suspicious activity wasn't reaching investigators. Somewhere between knowing and acting, it stalled.
Change is hard to adopt. New systems and procedures only matter if people actually work differently. A program can install tools and train staff and still leave daily habits untouched.
Broken processes with no clear owner. When a process runs across five teams, each one can point to the others. Nobody owns the outcome, so nobody is accountable when it doesn't happen.
The result is a program that reports progress through activity: people hired, money spent, training completed. Regulators judged it on a different question. Is suspicious activity reaching investigators on time? It wasn't.
Compliance is a capability, not a cost to minimize
The usual instinct is to treat compliance as overhead to keep as small as possible. Compliance works best as a capability you build and a partner to the business.
How much to invest depends on your risk appetite, your industry and how heavily you're regulated. A bank, a hospital and a software company won't spend the same amount. But risk appetite only applies above the legal floor. Below it, you aren't making a risk decision. You're taking a bet regulators will eventually call in.
Compliance also shouldn't be the one making business decisions. When it becomes the department of "no," people route around it. It belongs inside the decision, at the table early, shaping how the business does something rather than whether it's allowed to. Brought in late, it can only approve or block. Brought in early, it can design a safer path to the same goal.
What leaders should do now
This isn't only a banking lesson. Any organization working through an audit finding, a regulatory order or a ministerial directive faces the same risk.
1. Give every must-do fix one owner. Not a steering committee. One person accountable for the result, with the authority to cut across teams to get it done.
2. Measure outcomes, not activity, and have someone independent check them. Pick two or three measures that show the problem is actually fixed, like how long it takes for a flagged issue to reach someone who can act on it. Headcount and spend are inputs, not proof. The bank's own audit team missed problems examiners later found.
3. Cut the layers between seeing and acting. Map how a problem travels from the person who spots it to the person who can fix it. Every unnecessary step is a place for it to stall.
4. Check the incentives. If targets reward revenue and nothing rewards control, the culture will follow the targets. Make sure the scorecard reflects both.
Bank of America knew what it had to fix. The hard part was getting it done.
Culture isn't what a company says it values. It's what people do when two priorities collide and nobody is watching.