OFAC Hits Bank of America With $11.6M Penalty for Sanctions Screening Failures

OFAC has reached a settlement with Bank of America for $11,662,930 resolving 475 apparent violations of U.S. sanctions regulations. The case centers on deficiencies in the bank's payment screening operations, including failures in match prioritization, watchlist updates, and the handling of accounts connected to blocked persons. Notably, OFAC provided no penalty reduction for the bank's remediation efforts or cooperation, a detail that carries significant implications for the broader compliance community, including government contractors and organizations engaged in cross-border transactions.

The settlement underscores the critical importance of robust sanctions-screening controls for any organization handling payments or third-party transactions. For government contractors, who frequently operate in complex supply chains and international markets, the risk is particularly acute. Payments routed through financial institutions, subcontractor relationships, and vendor onboarding processes can all become vectors for sanctions exposure if screening controls are weak or inconsistently applied. OFAC's findings suggest that even large, sophisticated financial institutions with dedicated compliance programs can fall short when match prioritization and watchlist maintenance are not treated as dynamic, high-priority functions.

One of the most striking aspects of this enforcement action is the absence of any penalty mitigation for remediation or cooperation. Under OFAC's enforcement guidelines, companies typically expect that voluntary self-disclosure, prompt remediation, and substantial cooperation will result in reduced penalties. In this case, however, OFAC determined that the bank's efforts did not warrant a discount. This outcome signals that regulators may be raising the bar for what constitutes meaningful cooperation and effective remediation. For contractors, the message is clear: simply having a compliance program is not enough. Controls must be tested, documented, and demonstrably effective, and lookbacks must be appropriately scoped and thorough.

The procurement implications extend beyond the financial institution itself. Government procurement teams should use this case as a reference point when assessing sanctions-related controls in payment workflows and third-party relationships. When evaluating contractors for award, agencies may increasingly scrutinize whether bidders have adequate screening mechanisms in place for their own payments, subcontractors, and supply chain partners. A weak sanctions compliance posture can become a source of performance risk, potentially leading to delayed payments, contract modifications, or even suspension or debarment if violations are severe.

Moreover, the case highlights the operational exposure created by ineffective lookbacks and disclosures. Organizations that discover potential violations must act quickly to investigate exact matches, update watchlists in real time, and ensure that third-party data feeds are reliable and current. The 475 apparent violations in this case were not isolated incidents; they reflect systemic failures that persisted over time. Contractors should therefore consider conducting periodic internal audits of their screening systems, simulating sanctions scenarios, and maintaining detailed records of any remediation actions taken. This documentation can be invaluable if regulators later question whether the organization took its compliance obligations seriously.

Finally, the settlement serves as a reminder that sanctions enforcement is not limited to banks. Any organization that touches the U.S. financial system or handles U.S.-origin goods, technology, or services can be subject to OFAC jurisdiction. Government contractors, especially those in defense, aerospace, and technology sectors, often deal with sensitive end-users and destinations. A single lapse in screening can result in substantial civil penalties, reputational damage, and loss of eligibility for federal contracts. As OFAC continues to prioritize enforcement, contractors should treat sanctions compliance as a core procurement risk management function, not a back-office formality.

• OFAC settled with Bank of America for $11,662,930 over 475 apparent sanctions violations.
• Violations involved failures in payment screening, match prioritization, watchlist updates, and handling accounts connected to blocked persons.
• No penalty reduction was provided for the bank's remediation or cooperation, signaling stricter enforcement expectations.
• Government contractors should test screening controls and third-party data feeds to ensure potential exact matches are investigated promptly.
• Contractors should maintain documented, appropriately scoped lookbacks and self-disclosure processes.
• Procurement teams can use this case to assess sanctions-related controls in payment workflows and third-party relationships.
• OFAC is part of the U.S. Department of the Treasury, which enforces U.S. economic sanctions.
• The case demonstrates that systemic screening failures can lead to significant financial penalties, even for large institutions.
• Organizations should consider internal audits and simulated sanctions scenarios to validate compliance effectiveness.
• Sanctions compliance should be treated as a core procurement risk management function, especially for contractors in defense, aerospace, and technology sectors.