*This client alert was co-authored by Julianne K. Crowley and Damian Priamursky.

Background and Key Findings

On October 13, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), and the Office of Foreign Assets Control (OFAC) jointly imposed a $1.2 billion civil money penalty on Bank of America (BofA) for willful violations of the Bank Secrecy Act (BSA) and U.S. sanctions programs.1 Of that amount, $750 million will be paid to the OCC and $11.6 million will be paid to OFAC. This is the third-largest penalty in FinCEN history and the largest in OCC history.2

While each regulator relied on different legal grounds, a common theme was BofA’s investment in new technology without corresponding updates to its staffing, audit, ongoing monitoring, and training policies. As a result, the FinCEN Consent Order requires BofA to hire a Suspicious Activity Monitoring Consultant to assess whether its use of technology is effective, and it emphasizes that technology should remain “subject to appropriate [BofA] oversight.”3

Similarly, the OCC found that inadequate training, staffing, and escalation procedures continued to undermine BofA’s suspicious activity monitoring and suspicious activity report (SAR) filing despite its technology investment.4 From 2019 to 2023, 18% to 44% of the suspicious activity the system captured was never escalated to investigation.5 Even when suspicious activity was escalated, BofA did not provide enough staff, resulting in a backlog of 200,000 system-generated alerts with no assigned investigator in 2024.6

Where Automation Design Broke Down

While it is unclear whether BofA used AI specifically, it used automated systems that follow fixed rules programmed by investigators at the bank. If a rules-based tool with readable logic can fail for nearly seven years, AI tools whose reasoning is harder to validate carry even greater risks.

From the enforcement actions, we see two examples where BofA’s monitoring program went wrong, and how closer collaboration among the legal, compliance, technology, and operations teams could have produced a cohesive and defensible monitoring tool:

  • Alert suppression: BofA’s system automatically released payments whenever an alert matched criteria previously identified and was subsequently cleared as a false positive by an analyst. When a system can automatically reuse a clearance, any error can become a permanent rule without human intervention. Integrated teams can define which alerts trigger escalated review and which support automatic clearance.
  • Exemption scoring shortcut: BofA set structuring and ATM-related risk factors to “zero” for certain exempt customers despite the potential criminal conduct. An “exempt” status alone should not suppress suspicious activity monitoring. Developers should separate exempt-status handling from monitoring logic, and these risk factors should still be flagged.

BofA’s automated system failures demonstrate that (1) one analyst’s decision can become a standing instruction to the system with no written explanation, (2) any rule in the system, whether created internally or externally, still requires supervision and testing, and (3) teams must continuously test and adjust a system’s rules to meet the business’s specific risks. This oversight cannot be left to a single team; all relevant stakeholders must work together at the design and ongoing monitoring stages.

Practical Implications: Where This Hits Your Fund

Despite BofA’s status as a regulated financial institution, the takeaways apply directly to private fund managers adopting AI and automated tools, mainly establishing supervision protocols, testing procedures, and mapping clear accountability.

  • Understand each tool and assign responsibility for it. Managers should identify where AI or automation is used, including by service providers, and designate personnel to supervise and audit each tool in a documented process.
  • Establish meaningful human review. Internal policies should identify (1) who reviews AI-generated analyses, (2) how screening alerts are escalated, and (3) who approves related investor or transaction decisions. For example, qualified personnel should verify AI analysis of an ownership structure against underlying documents before relying on it for due diligence. Any errors should be assessed to catch any similar behavior in case a pattern emerges.
  • Test accuracy before and during deployment. For AI, testing should address unsupported conclusions, fabricated sources, and missed information; for automated screening, it should address missed matches, outdated lists, and improper alert clearance. Testing must be consistent and documented.
  • Oversee service providers. Managers should ask administrators and other providers when they use AI, how they validate results, and confirm that errors will be escalated to the Manager for review.
  • Review investor disclosures. Offering documents and investor communications should accurately describe material uses of AI and automation, associated risks, and the extent of human oversight, and should be reassessed as reliance on them grows. Claims about AI capabilities should be supported.

Governance Before Go-Live: How We Help Fund Managers

Managers should put governance in place before relying on AI or automated tools and reassess them as use changes. Counsel should be involved from the start, working with compliance, investment, technology, and operations personnel to translate legal requirements into decision criteria, review procedures, and escalation protocols. Lowenstein Sandler’s Investment Management and AML teams help managers evaluate these considerations and develop suitable procedures, including reviewing policies and service provider arrangements, assigning review responsibility, and assessing disclosures. Our teams also advise on potential compliance failures, corrective measures, and reporting obligations.

Contacts

Lowenstein Sandler’s Investment Management & Private Funds Group works alongside investment managers, private fund sponsors, and emerging managers as they adopt AI and automated tools. To discuss how this action affects your fund, please contact the Lowenstein Sandler Investment Management & Private Funds Group at investmentmanagementpracticegroup@lowenstein.com or your regular Lowenstein Sandler contact.

1 See In the Matter of Bank of America, N.A., FinCEN Consent Order No. 2026-03, Financial Crimes Enforcement Network (Oct. 13, 2026); see also In the Matter of Bank of America, N.A., OCC Consent Order No. AA-ENF-2026-41, Office of the Comptroller of the Currency (Oct. 13, 2026); “Bank of America, N.A. Settles with OFAC for $11,662,930 Related to Apparent Violations of Multiple Sanctions Programs,” Office of Foreign Assets Control (Oct. 13, 2026).
2 See News Release 2026-89, “OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance,” Office of the Comptroller of the Currency (Oct. 13, 2026, available here; see also “U.S. Treasury Announces Record Enforcement Actions Against Bank of America,” U.S. Dept. of the Treasury (Oct. 13, 2026), available here.
3 Id. at fn. 1, FinCEN Consent Order No. 2026-03 at p. 75.
4 BofA was already subject to a 2024 consent order for similar deficiencies and did not adequately resolve them. See Id. at fn. 1, OCC Consent Order No. AA-ENF-2026-41 at p. 1.
5 Id. at fn. 1, OCC Consent Order No. AA-ENF-2026-41 at p. 3.
6 Id. at p. 5.