“Plans are only good intentions unless they immediately degenerate into hard work.” Peter Drucker
Bank of America signed its own warning in December 2024, then spent 659 days proving nobody owned it.
THE SIGNAL On October 13, Treasury hit Bank of America with $1.2 billion in penalties, the third-largest in the department’s history.
The OCC’s $750 million share, credited inside that total, is the biggest penalty that regulator has ever issued. The bank admitted it willfully violated the Bank Secrecy Act and failed to report more than $5 billion in suspicious transactions on time.
About $1 billion of it touched national security risks, including Chinese laundering networks and illicit finance along the southwest border.
The coverage says money laundering.
The record says something else.
On December 23, 2024, the OCC issued a cease-and-desist order for late suspicious activity reports and a due diligence gap the bank had already been told to fix once.
No fine came with it.
The bank didn’t admit or deny anything and said its prior work left it well positioned to comply.
THE FAILURE POINT
The break didn’t happen this month.
It happened in the weeks after December 23, 2024, when the bank had the problem in writing, signed, with a regulator watching, and nobody turned that order into one owned fix with a test and a date.
The OCC now says the bank didn’t treat compliance as a priority after signing, left many of the major remediation steps unfinished, and kept downplaying how deficient the program was.
More than a year after the order, suspicious transactions were still not reaching the investigators who decide whether to file.
SIGNAL WITHIN THE SIGNAL
Norman Decision Time.
The signal was as clear as a signal gets: a signed federal order, preceded by deficiencies examiners first flagged in 2023.
The clock started on December 23, 2024.
An owned decision that actually closed the gap never showed up. On October 13, 2026, the clock read 659 days and the decision was still pending. The regulator stopped waiting.
Bank of America’s checker graded its own work. Don’t do that. Run SignalWalk on your next Tier 2 or take the MOS Assessment at mosei.org. If the problem is the person holding the pen, start with Regulate.
Audit a meeting: SignalWalk → https://moseiorg.gumroad.com/l/signalwalk
Score your system: MOS Assessment → https://mosei.org
BEHAVIOR UNDER PRESSURE
Regulators found the bank leaned on law enforcement inquiries and other outside referrals to spot suspicious activity, instead of its own monitoring.
Compliance staffing and training fell short. Its BSA audit function missed problems outside examiners later found. The BSA officer and staff lacked the expertise to run the program.
That’s what remediation looks like when activity stands in for a decision. A consultant gets hired. Reviews kick off. The status report stays green. Everyone is busy. Nobody asks the one question that matters: did the system catch a bad transaction today?
SYSTEM DRIVER (MOS)
This system produced task completion and called it correction.
The structural fix is one rule.
No corrective action closes on tasks done. It closes when someone who didn’t build the fix runs a live test and the problem fails to reappear, on a date, with a name on the result.
The audit miss is the tell here.
The bank’s own checker graded the work and passed it. Outside examiners failed it. If the person verifying the fix reports to the person who owns it, you don’t have verification.
LEADER DRIVER (IOS)
A no-penalty order is easy to file as handled. The record suggests that’s what happened here. The order drew no fine, and the remediation stalled inside it.
The override threshold was sitting in the order itself. It cited a deficiency the bank had already been told to correct.
Once a regulator repeats a finding, the next green status report should be treated as suspect by default. The leader’s move is to stop asking whether the program is on plan and ask to watch it catch one real case.
IF YOU DO ONE THING TODAY
Pull your open corrective actions: audit findings, customer escapes, safety findings, anything an outside party flagged.
Sort by age.
For every item older than 90 days, write one name and one test that would prove the problem is gone, with a date.
Any item that can’t get both before you leave the room comes to your desk by Friday with the owner attached.
FINAL SIGNAL
A corrective action without an owner is a confession on a delay.
CTA Forward this to the person who owns your oldest open corrective action. If you can’t name them, that’s the edition.
Pick one meeting you think runs clean. Send this to its owner, then score it with SignalWalk and see if you were right. → https://moseiorg.gumroad.com/l/signalwalk
SOURCESU.S. Treasury and FinCEN release, Oct. 13, 2026 · OCC News Releases 2024-140 and 2026-89 · Associated Press · Reuters · Axios · Fox Business