CMR is the leading provider of funding and management support for small to medium-sized businesses and entrepreneurs 

Most banks spend the night before their earnings call polishing the NII slide and fudging the reserve release calculations. Bank of America will be spending it reading a Treasury press release about itself.

Just after the close on Tuesday, Treasury announced more than $1.21 billion in penalties against BofA for violating anti-money-laundering and sanctions laws. Treasury calls it the third-largest penalty in its history, and the OCC calls its piece the largest it has ever handed out. The bank admitted it willfully violated the Bank Secrecy Act. It did not report more than $5 billion in suspicious transactions on time, and more than $1 billion of that was tied to what Treasury calls "priority" national-security risks, including Chinese money-laundering networks and illicit finance along the southwest border.

Here is how the money breaks down, per Treasury's press release:

The Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion penalty for the Bank's failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.

The OCC assessed a $750 million civil money penalty for the Bank's deficient and ineffective BSA/AML (anti-money laundering) compliance program.

The Office of Foreign Assets Control (OFAC) announced an $11.6 million settlement agreement with the Bank over apparent violations of numerous sanctions programs, including on Iran, Russia, narcotics, and global terrorism.

The penalties don't simply add up. Per CNBC, the OCC's $750 million is credited toward FinCEN's $1.2 billion, which gets you to about $1.21 billion once OFAC's change is added. In other words, it is a $1.2 billion fine with a record attached.

"Prioritized Its Revenues"

The details are where it gets awkward. Treasury did not say BofA was simply overwhelmed. It said this:

As these issues arose, Bank of America prioritized its revenues and minimized the impact on its required compliance resources. The nature and extent of the Bank's resulting reliance on law enforcement inquiries, requests by other financial institutions, and similar interventions over its own internal, automated controls... meant that the Bank effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.

Translation: BofA's money-laundering detection system often amounted to waiting for a subpoena.

Treasury also says the bank "allowed suspicious activity to accumulate uninvestigated for extended periods." That meant SARs arrived too late to help law enforcement much. Its customer due diligence also "failed to account for customers' extensive reliance on payments from unknown third parties," and the bank didn't act on red flags that included "potential ties to narcotics trafficking proceeds," even after its own compliance staff raised concerns about trade-based money laundering and fraud.

The OCC's language was harsher. Its release says the bank's transaction monitoring "resulted in the Bank failing to properly monitor trillions of dollars in transactions," that "the Bank knew for years" it was failing to escalate potentially suspicious activity, and that its BSA Officer and staff "lacked sufficient skills and expertise." Comptroller Jonathan Gould said:

"The second largest bank's egregious and continued BSA violations warrant the OCC imposing its largest [civil money penalty] ever assessed against a bank."

https://t.co/f5Z7atptce

— Comptroller Jonathan Gould (@USComptroller) October 13, 2026

OFAC, for its part, found 475 apparent sanctions violations. They included payments routed through blocked banks and designated individuals who were allowed to withdraw funds "due to poor sanctions alert calibration." OFAC called the violations "non-egregious," which is the regulatory version of "could have been worse."

About That 2024 Order

None of this came out of nowhere. On December 23, 2024, the OCC issued a cease-and-desist order against BofA for BSA and sanctions deficiencies, "including a failure to timely file suspicious activity reports and failure to correct a previously identified deficiency related to its Customer Due Diligence processes." The order itself described a "systemic failure" to set proper transaction-monitoring thresholds. That order came with no fine, a point American Banker noted at the time. As we reported back in October 2024 (Oct 30, 2024), barely two weeks after TD's guilty plea, BofA disclosed in a filing that it was in talks with several federal regulators over its

Bank Secrecy Act/anti-money laundering and sanctions compliance programs... including transaction monitoring, training, governance, and customer due diligence... resolution of these discussions may include one or more public orders by the regulators.

At the time we wondered which of the big US banks would be "named next" after TD. It took two years and an extra cease-and-desist, but we can now cross that question off the list.

(The same filing also disclosed a separate CFPB inquiry into payments on the Zelle network, which BofA said it might fight in court. Nothing in today's Treasury, OCC or OFAC releases mentions Zelle. That was a different matter with a different regulator.)

This time there is a fine, and the reason is what happened afterward. Per Treasury:

After agreeing to the 2024 Order, the Bank still failed to prioritize BSA/AML compliance... For example, more than a year after the 2024 Order, the Bank still failed to escalate potentially suspicious activities to investigators for review.

Put differently, the first notice was free. The follow-up came with a bill.

The TD Comparison

The obvious benchmark is TD Bank. In October 2024 TD pleaded guilty to BSA and money-laundering conspiracy charges and agreed to roughly $3 billion in total penalties across agencies, according to the DOJ. That included a $1.8 billion criminal resolution, a $450 million OCC penalty, and an asset cap on its US operations. We flagged back in May 2024 that the AML mess risked sending TD into a "lost decade."

BofA's settlement differs in a few important ways:

• About 40% of TD's total: $1.2 billion versus about $3 billion.
• Admission, not a plea: BofA admitted willful BSA violations to FinCEN. No source we've seen mentions criminal charges or a DOJ resolution. 
• No asset cap: Instead of a growth restriction, BofA gets a third-party lookback and independent reviews of its monitoring, CDD and correspondent-banking due diligence. Those reviews focus on the southwest border and cartels, Iran and Russia.
• OCC records: BofA's $750 million beats TD's $450 million OCC penalty by a wide margin.

In other words, a record fine, but nothing like TD's sentence.

Some Napkin Math

BofA told CNBC the penalties mean a $1.2 billion non-tax-deductible charge in Q3 results (perfect timing for tomorrow's Adjusted EPS to miss net of "one time almost criminal items", cutting net income by about 17 cents per share. Against the roughly $1.11 consensus EPS, that is about 15% of the quarter's expected earnings gone before the call starts.

Another way to measure it: $1.2 billion against "over $5 billion" in suspicious transactions not reported on time works out to about 24 cents per unreported dollar. As compliance budgets go, the cheaper option was always going to be the compliance budget.

The bank says remediation costs are "already reflected in its current expense base," so the hit should be one-time, at least on paper.

The Stock

The timing was unusual. BAC closed Tuesday at $53.94, down 1.2% in concert with a broader bank selloff (after what were good, if not great earnings by JPM, Citi and Goldman) but the news came out around 4:09pm ET, right after the bell. In other words, regular-session weakness came alongside a soft tape for financials and can't be pinned on the fine, and sure enough BofA sold off another 2% after hours once the news hit. That leaves BAC down about 3.6% YTD, and well below its 52-week high of $65.22.

TL/DR: the $1.2 billion is not the story. BofA can cover it with about a week of NII (6 days when the 10Y hits 6%); the story is that Treasury, the OCC and Bessent all used the same phrase about the second-largest US bank: it "prioritized its revenues" over compliance. And BofA kept doing so for more than a year after signing a cease-and-desist. For a CEO who has built his tenure on "responsible growth," that phrase will be hard to escape. The independent reviews and lookback will likely produce more late SARs, and possibly more findings, over the coming quarters.

Next catalysts:

1. Q3 results, Wednesday before the open; call at 8:30am ET. Consensus is about $1.11 EPS on about $30.6–30.7 billion revenue, with FTE NII of about $16.55 billion (Zacks). BofA guided 2026 NII growth to the upper end of 6–8% in July. A Q3 NII print of $16.3 billion or more keeps that credible, per one preview.
2. On the call, listen for whether management reports results excluding the 17-cent charge (it will). Also listen for any change to remediation spending or the expense outlook, whether more regulatory or DOJ exposure remains (a "no comment" will say a lot), whether buybacks are affected, and NII guidance after the September Fed move.
3. Moynihan on CNBC at 10:20am ET, where "responsible growth" is likely to come up more than he'd like.

Going into the quarter, Goldman's desk said it wanted BofA to show "any NII upside updated for the rate curve and can this flow into operating leverage?" Operating leverage is easier to show without a $1.2 billion penalty line item.

Still, the main lesson for anyone thinking of skimping on AML: it costs about 24 cents on the dollar to make your (allegedly criminal) clients extra happy, and the bill eventually arrives.

Much more in the full Goldman Desk Bank/Fins EPS Preview note, available to pro subs.

'Tis the season to riot?

Mauritius, the island nation in the Indian Ocean east of Madagascar and off Africa's southeastern coast, is experiencing what Bloomberg describes as the worst riots in three decades amid an affordability crisis.

"This time again, as in 1999, the police are the main target," Jocelyn Chan Low, a political analyst, told the outlet. "The scale of the violence has multiplied, with police stations and vehicles set ablaze."

???? Mauritius closes schools and urges companies to adopt flexible arrangements as protests escalate: Media What reportedly sparked the unrest: ?? Protests erupted over water shortages, supply disruptions, and rising living costs; ?? Tensions flared after police shot and injured a 27-year-old woman on Friday; ?? On Monday night, demonstrators burned a police station in Rose Hill, torched tires, and blocked roads. ?? Social media footage shows scenes of unrest.

— Sputnik Africa (@sputnik_africa) October 13, 2026

The social unrest has forced education centers to close and prompted the country's top business lobby to urge companies to let employees work from home amid the chaos.

Mauritius closed schools in some parts of the country following a night of unrest that began when a police officer shot a young woman https://t.co/2Xq17NYhRW https://t.co/6qBwDrMMei

— TRT Afrika (@trtafrika) October 13, 2026

#Mauritius???? Prime Minister, Dr. #NavinRamgoolam has scheduled an EMERGENCY?? Cabinet Meeting for today at 14:30pm to address latest #law and #order challenges following overnight unrest sparked by a Police Officer shooting a young #woman in Camp-Levieux. https://t.co/Qt2snF1znX

— TwistOliver (@Oliver_Mhuriro) October 13, 2026

Protesters have burned police stations and vehicles and blocked roads across the tiny island nation, which relies heavily on tourism and financial services.

???? Massive protests erupt across Mauritius, with large crowds taking to the streets. LOCKDOWN IN MAURITIUS: Authorities are being urged to impose an immediate curfew amid escalating protests. https://t.co/13PfZ5ajlU

— TheGlobalDecoder (@TGD_06) October 13, 2026

Bloomberg pointed out, "Still, the war in the Middle East has driven up fuel prices and a crippling drought has emptied reservoirs, resulting in water-use restrictions in some areas."

In other words, Gulf-related fuel disruptions appear to be colliding with El Niño weather effects, culminating in a perfect storm.

#Smoke is currently being observed from a #sugarcane plantation near Mont-Roches as public #unrest continues in some parts of #Mauritius???? today! #Mauritius???? exports #sugar to around 60 countries around the world. *Video: Radio One (Facebook)???? https://t.co/hhJAQgN9OY

— TwistOliver (@Oliver_Mhuriro) October 13, 2026

How did the riots start?

Bloomberg explains:

Street protests began on Oct. 7 in the central region of the main island, known as Mauritius, with roads blocked with broken furniture and mattresses. The shooting of the woman further fueled anger, with Indian surgeons who had been flown in to treat her operating on Monday to remove a bullet.

"The root cause for the unrest is almost similar to the riots three decades ago, said Chan Low. "n February 1999, a popular singer died in police custody, triggering riots."

The Mauritius Police Force released a statement earlier today saying, "The situation is under control."

The riots in Mauritius overlap with far-left and migrant riots in France that have spread to Belgium and may spread to other European countries.

As 2027 approaches, the convergence of elevated energy prices, El Niño-linked adverse weather, conflicts across Eurasia, and a strong dollar could raise the risk of social unrest in vulnerable emerging and developing economies.

Countries that depend on imported fuel and food, with limited fiscal capacity to cushion households, would be especially exposed. The key risk is that simultaneous shocks could turn economic frustration into broader political and social instability.

Update(1715ET): Zelensky has taken to X to announce a second night of heavy Russian airstrikes, but without the early warning from Western allies that his government had previously been afforded.

Ballistic missiles are rocking the capital overnight. At around or shortly before midnight Zelensky announced a new "Russian ballistic missile attack on Kyiv" as "Once again, no early warning from our partners. The main target was energy infrastructure, specifically CHPP-4. Unfortunately, it was hit." 

The English-language message is chiefly aimed at Washington and Europe, and after Zelensky days ago expressed outrage at Trump's diesel release deal with Russia's Putin. The Ukrainian leader addressed the US directly: "And it is important that the United States really see what is happening and who is responsible for this war continuing," Zelensky wrote. However, it's not yet definitively confirmed that Washington has cut off intelligence. The accusations that "early warnings" have been withheld have remained vague, and have not directly accused the Trump administration of halting all intel-sharing. But the messaging, born of frustration, does hint strongly at some level of a change.

A Russian ballistic missile attack on Kyiv. Once again, no early warning from our partners. The main target was energy infrastructure, specifically CHPP-4. Unfortunately, it was hit. A residential building was also damaged, and rescuers are currently putting out a fire there. Our systems detected these missiles only when they were already virtually on approach to Kyiv. CHPP-4 is one of Kyiv’s key energy facilities. According to our intelligence, the Russians are preparing further ballistic missile launches. The facts show that the Russians do not consider themselves bound by what the President of the United States said. Ukraine supported an energy ceasefire. Russia is targeting yet another power plant and the lives of our people. And this is absolutely unjust: when they are destroying our energy infrastructure, and Ukraine is not even receiving early warnings about ballistic missile launches. It is important that the world does not stay silent about this. And it is important that the United States really see what is happening and who is responsible for this war continuing. Please stay safe tonight and tomorrow. We are working to replenish our air defenses with anti-ballistic missiles.

— Volodymyr Zelenskyy / ????????? ?????????? (@ZelenskyyUa) October 13, 2026

*  *  *

Ukraine's President Volodymyr Zelensky has not only alleged that Russia has hit six energy sites since President Trump announced Putin signed on to an energy ceasefire, but he's also lashing out at Western allies, saying that for the first time in a long time no intelligence was shared by 'partners' warning of the latest overnight attack.

Zelensky said Tuesday in a post on X that an overnight Russian assault on the capital was "particularly vile" but that no intelligence was shared ahead of time, as has been typical previously.

Q: Has the U.S. stopped sharing intel with Ukraine? White House: I will have to get back to you on that. https://t.co/auu6jtFp27

— Clash Report (@clashreport) October 13, 2026

"There was also a particularly vile ballistic strike on Kyiv—five missiles that hit civilian infrastructure. Regarding this strike, unfortunately, there was no warning from partners," he wrote. "Intelligence data on the launch of Russian ballistic missiles helps save people's lives, and this is one of the most critical issues."

"This is precisely what helps prevent people from being killed — when there is an early warning about ballistic missiles," he wrote, without specifically apportioning blame. But the veiled message blaming the White House comes through loud and clear.

Given the timing and context, the clear suggestion is that Washington cut Zelensky and his officials out of the usual intel-sharing, and this has also broadly impacted allied sharing.

President Trump has lately threatened to precisely cut off intelligence as Ukraine has not complied with the US request for its forces to stop hitting Russian refineries, amid a global diesel supply and price crisis.

Zelensky further on Tuesday claimed that Ukraine is for now adhering to a pledge to not strike Russian oil refineries. He says this pause has been on for two days since Trump proclaimed a deal, which however Zelensky said was "news" to hm.

Of the latest Russian attacks, "These are absolutely clear signals that they have no intention of refraining from strikes on Ukraine," Zelensky said.

The Ukrainian leader has further lambasted the Trump deal with Putin for the release of Russian diesel. "We need American pressure on Russia, not sanctions relief, not concessions," Zelensky said earlier.

Trump is meanwhile ultimately blaming Ukraine for rising energy prices, and not the Iran war and Hormuz crisis.

Here's what Ukrainian media says is happening behind the scenes in the meantime:

Two Ukrainian officials said their U.S. counterparts had made clear that Washington would hold Kyiv responsible if Russian energy infrastructure were struck during the recently announced ceasefire.

"They called all the top military officials with threats," one Ukrainian official told the Kyiv Independent. "They're telling everyone that they're going to turn off both the intelligence sharing and PURL."

Zelensky has yet to specifically say that Washington itself has halted intelligence, but if the situation lingers the blame-game is probably coming.

Zelenskyy says Ukraine received no advanced intelligence about the Russian ballistic missile attack against Kyiv last night. But he falls short of saying that this was linked to Trump's threat passed via Kushner and Witkoff in Miami on Friday and via calls to Ukrainian officials over the weekend to pull US intelligence. Kyiv receives intelligence from numerous partners including European services. "There was also a particularly vile ballistic missile strike on Kyiv – five missiles that hit civilian infrastructure," he says. "Unfortunately, we received no early warning from our partners about this strike."

— Christopher Miller (@ChristopherJM) October 13, 2026

The Prioritised Ukraine Requirements List (PURL) is the procurement mechanism and program European allies use to purchase weapons from the US for Ukraine. The US administration has outright said it is ready to halt the program if Zelensky doesn't comply, and Trump has gone so far as to say that maybe Ukrainians should find a new leader.