Biggest AML fines of all time, ranked with their sources

On 13 October 2026 the US Treasury announced more than $1.21 billion in penalties against Bank of America. According to Treasury, the bank reported over $5 billion in suspicious transactions to FinCEN late, after relying on law enforcement inquiries and requests from other banks instead of its own automated controls (Treasury). Its $750 million OCC penalty is the largest in OCC history.

What are AML fines?

An AML fine, or anti money laundering fine, is a money penalty for breaking anti money laundering law: a weak program, skipped customer checks, unmonitored transactions or late reports. It comes as a regulator's civil money penalty, a court's forfeiture order, a criminal fine, or a settlement, as with ING and ABN AMRO in the Netherlands.

Large cases stack several of them. TD Bank's total of about $3.09 billion combined a DOJ plea of $1.89 billion, which credited the Federal Reserve's $123.5 million fine, FinCEN's $1.3 billion less a $543 million credit, and the OCC's $450 million.

A sanctions penalty punishes dealings with listed countries or people, a prohibition the guide to high risk countries and FATF lists separates from the FATF's risk lists. Several large cases mix the two, so each row below carries a type.

Why are firms fined? The main reasons for AML penalties

Five failures trigger the fines ranked below.

• A program on paper only. TD Bank held its AML budget to a "flat cost paradigm" while known gaps stayed open.
• Customer checks skipped. Binance let users trade with only an email address.
• Monitoring that never changes. TD Bank added no new monitoring scenarios from at least 2014 to late 2022.
• Reports filed late or never. Binance never filed a suspicious activity report with FinCEN, and Bank of America filed billions of dollars of them late.
• Screening against part of the list. From 2017 to January 2023, Starling Bank checked customers against only a fraction of the sanctions list.

What are the biggest AML fines in history?

How the ranking works. Every penalty of $300 million or more in this page's scope (AML, money laundering and sanctions cases, plus the related types the Type column names) that an authority's own release or judgment records is in Table 1, 36 rows in all; the 13 rows below $300 million are a selection. BNP Paribas (sanctions) and Goldman Sachs (bribery) keep their labels at the top because most fines lists put them first.

Table 1. The most expensive AML fines in history, ranked by USD at the decision date. Sources: each authority's release or judgment, linked in the last column; exchange rates from the Federal Reserve H.10 series.

Rates (Federal Reserve H.10): AUD 0.7120 (21 October 2020), 0.7387 (20 June 2018), 0.6664 (11 July 2023); EUR 1.1566 (4 September 2018), 1.2028 (19 April 2021); GBP 1.2585 (31 January 2017), 1.3233 (13 December 2021), 1.2311 (9 December 2022); SEK 10.3827 per dollar (19 March 2020), 9.3234 (25 June 2020); EUR 1.1764 (14 November 2017), 1.1800 (23 September 2025).

BitMEX's row is the civil penalty in the CFTC's case. A separate $100 million criminal fine imposed on its operator, HDR Global Trading, on 15 January 2025 was among the pardons of 27 March 2025 (DOJ clemency grants).

BNP Paribas: $8.97 billion (2014)

BNP Paribas pleaded guilty to conspiring to violate US sanctions law by moving more than $8.8 billion for Sudanese, Iranian and Cuban entities (SDNY). A senior compliance officer had warned in 2005 that the scheme evaded US sanctions.

Binance: $4.32 billion (2023)

Binance agreed to pay $4,316,126,163. Its FinCEN and OFAC settlements were each agency's largest (Treasury).

TD Bank: $3.09 billion (2024)

No US bank had pleaded guilty to a money laundering conspiracy before TD Bank did (DOJ, District of New Jersey). It left 92 percent of its transaction volume unmonitored from 2018 to April 2024, and with no new scenarios for eight years it skipped the feedback stage of AML transaction monitoring.

Goldman Sachs: $2.9 billion (2020)

Goldman Sachs admitted an FCPA conspiracy. Over $1 billion in bribes to Malaysian and Abu Dhabi officials won it a role in about $6.5 billion of 1MDB bond deals.

Danske Bank: $2.06 billion (2022)

Danske Bank pleaded guilty to defrauding US banks about its AML controls. Its Estonian branch let non resident customers, including from Russia, move money with little if any oversight, $160 billion of it through US correspondent banking accounts. It forfeited $2.059 billion.

JPMorgan Chase: $2.05 billion (2014)

JPMorgan admitted two Bank Secrecy Act felonies over Bernard Madoff's account (SDNY). Its London staff reported Madoff to UK regulators in 2008, while US compliance officers with the same facts filed no SAR.

HSBC: $1.92 billion (2012)

From 2006 to 2009 HSBC's US bank rated Mexico "standard", its lowest risk category, and did not monitor over $670 billion in wires from HSBC Mexico (DOJ). At least $881 million in drug proceeds got through, some by the black market peso exchange.

Commerzbank: $1.45 billion (2015)

Commerzbank admitted hiding payments for Iranian and Sudanese businesses, and its New York branch admitted Bank Secrecy Act failures (DOJ). The Olympus securities fraud also ran through the bank. Its victims received $300 million.

Société Générale: $1.44 billion (2018)

Société Générale paid $1,340,165,000 to US prosecutors and regulators for sanctions violations, mostly dollar payments for Cuban credit facilities (SDNY). The same day NYDFS added $95 million for weak suspicious activity reporting and customer due diligence at the New York branch.

UniCredit: $1.3 billion (2019)

UniCredit Bank AG in Munich pleaded guilty to moving at least $393 million through the US financial system for sanctioned entities, most of it for the Islamic Republic of Iran Shipping Lines, a designated proliferator of weapons of mass destruction.

Bank of America: $1.21 billion (2026)

Suspicious activity sat uninvestigated for long stretches, and the bank had been under an OCC order to fix its program since December 2024 (OCC). OFAC added $11.6 million for 475 apparent sanctions violations.

Standard Chartered: $1.1 billion (2019)

Standard Chartered processed about 9,500 transactions worth about $240 million for Iranian entities from 2007 to 2011 (DOJ). The FCA's £102.2 million part was for AML failings. Among them was an account a UAE branch opened with 3 million UAE dirham in cash in a suitcase (FCA).

UBS AG (France): EUR 835 million (2025)

UBS AG accepted a EUR 730 million fine in a French guilty plea procedure for illegal solicitation and aggravated laundering of tax fraud proceeds, and paid EUR 105 million in damages to the French state.

Westpac: AUD 1.3 billion (2020)

Most of Westpac's admitted contraventions were 19,502,841 international funds transfer instructions reported late to AUSTRAC. Westpac also failed 48 times to assess correspondent banks properly.

ING: EUR 775 million (2018)

Client accounts in the Netherlands were used to launder hundreds of millions of euros from 2010 to 2016, and ING had known of its weaknesses since 2010. It paid a EUR 675 million fine plus EUR 100 million in disgorgement.

Crédit Agricole CIB: $787.3 million (2015)

From August 2003 to September 2008, subsidiaries in Geneva moved about $312 million through the US for sanctioned entities, nearly all of them Sudanese. Compliance staff there knew the sanctions applied and authorized the payments anyway.

Standard Chartered: $667 million (2012)

NYDFS settled first, for $340 million, on conduct involving transactions of at least $250 billion, and required a monitor for the New York branch's money laundering controls (NYDFS). In December federal and Manhattan authorities added $327 million.

Deutsche Bank: about $630 million (2017)

DB Moscow ran more than 2,400 matching pairs of mirror trades that moved over $6 billion out of Russia (FCA). The FCA blamed an inadequate AML control framework from 2012 to 2015.

ING: $619 million (2012)

ING moved more than $2 billion through the US financial system for Cuban and Iranian entities, in more than 20,000 transactions. The DOJ called it the largest fine yet against a bank in a US sanctions investigation.

U.S. Bancorp: $613 million (2018)

U.S. Bancorp set its alert numbers by staffing levels instead of risk and hid the caps from the OCC (SDNY). FinCEN also found over 5,000 inaccurate currency transaction reports.

Which were the largest AML fines of 2025 and 2026?

Table 2. The largest AML penalties of 2025 and 2026 so far. Sources: the releases linked in Table 1 and the FINTRAC and FinCEN pages linked below.

The most recent AML fines in the ranking are Bank of America and American Express, both from October 2026, and six of the 49 ranked cases date from 2025 or 2026. Cryptomus is left out of Table 1 because FINTRAC's CAD 176,960,190 penalty for 2,593 contraventions is under appeal to the Federal Court (FINTRAC).

The broker dealer record moved twice in five months. FinCEN called Canaccord's $80 million the largest such Bank Secrecy Act penalty in March 2026 (FinCEN), then said the same of UBS Financial Services in August.

Sector breakdown: who gets fined the most?

Bank fines for money laundering dominate: 41 of the 49 ranked cases are banks. Crypto exchanges come second with four, all since 2021 (BitMEX, Binance, KuCoin and OKX). Western Union and MoneyGram are the two money transmitters, Crown is the one casino group and UBS Financial Services the one broker dealer.

The sector specific AML risks follow the business model. Banks hold accounts, clear dollars and serve other banks, so one control failure can touch billions. The exchanges failed at the first step, onboarding customers with an email address or no KYC. Crown's risk was different. Junket operators deposited money for its customers.

Global regulatory authorities behind AML enforcement

On 27 June 2025 the Monetary Authority of Singapore imposed composition penalties totaling S$960,000 on five major payment institutions for AML/CFT breaches that ran as late as August 2023 (MAS).

FinCEN (United States)

FinCEN is a bureau of the US Treasury. It enforces the Bank Secrecy Act at the center of AML in the United States and took part in 11 of the 49 cases, from Wachovia in 2010 to Bank of America in 2026.

FCA (United Kingdom)

On 2 October 2024 the FCA fined Starling Bank £28,959,426 for failings in its financial crime systems and controls. Starling had opened over 54,000 accounts for 49,000 high risk customers despite a restriction agreed in 2021 (FCA).

MAS (Singapore)

After the money laundering case of August 2023, MAS fined nine financial institutions S$27.45 million (MAS). UBS AG Singapore's share was S$3 million. Eight of the nine had not reviewed transactions their own systems flagged.

BaFin (Germany)

BaFin, Germany's Federal Financial Supervisory Authority, fined N26 Bank EUR 9.2 million on 21 May 2024 because the bank had filed suspicious transaction reports systematically late in 2022 (BaFin, in German).

AUSTRAC (Australia)

AUSTRAC brings civil penalty cases to the Federal Court, which set all three Australian amounts in Table 1: Westpac, Commonwealth Bank of Australia and Crown.

How are AML fines calculated?

The maximum penalty for failing to comply with money laundering regulations depends on the country; below that cap, each regulator publishes its method.

United States. FinCEN weighs ten factors from its 2020 enforcement statement, such as the seriousness of the violations, management's knowledge, prior violations and cooperation. Its TD Bank order states the caps: up to $69,733 a day for a willful AML program violation, and for each willful SAR or CTR violation the greater of the transaction amount, capped at $278,937, or $69,733 (FinCEN consent order, TD Bank, p. 66 to 67).

United Kingdom. The FCA follows five steps in DEPP 6.5A: disgorgement, seriousness (0 to 20 percent of relevant revenue), aggravating and mitigating factors, deterrence, and a settlement discount. Standard Chartered's 2019 case shows the last step. Without the discount its penalty would have been £145,947,500; the bank accepted the findings, qualified for 30 percent off and paid £102,163,200. Criminal breaches of the 2017 regulations carry, on indictment, up to two years in prison, a fine, or both (regulation 86).

Australia. The AML/CTF Act caps each contravention by a company at 100,000 penalty units, between AUD 17 million and AUD 21 million in Westpac's period (judgment, paragraph 54). Westpac admitted over 23 million contraventions, so the AUD 1.3 billion the court set sits far below the arithmetic maximum.

Which countries issue the most AML fines?

US authorities took part in 38 of the 49 cases, from FinCEN and the OCC to federal prosecutors. New York's DFS joined 14 of them and acted on its own in six. UK authorities joined 6, acting alone for NatWest and Santander UK. Australia (3), the Netherlands (2), Sweden (2) and France (2) always acted alone, and Danish and Singapore authorities each joined one resolution.

Both Dutch cases ended in settlements the prosecutor offered and the bank accepted, with no court penalty. No regulator publishes a world total. Added up, the 49 cases here come to about $47.0 billion at decision date rates, with Credit Suisse's 2021 case counted at the $475 million it paid.

How can companies avoid AML fines?

Each control below failed in at least one ranked case.

Table 3. Ten controls and the fines that show why. Sources: the authority releases linked in Table 1 and H2 6.

Two rows recur in the largest bank cases: monitoring that stays frozen while the business changes, and alerts nobody works. They sit behind TD Bank, U.S. Bancorp and Bank of America. In complead, formerly Sanction Scanner, transaction monitoring opens each alert as a case that names the rule and the rule version that raised it, with the reason stated in language a reviewer can repeat.

Bank of America's OFAC case is a payments problem: correspondent payments went through blocked banks, and poorly calibrated alerts let designated people move money. Payment screening is the check that reads the sender and the receiver of a transfer while it is processed.

The records row has no case because records are how every other row gets proven. UK rules require firms to keep records for five years (MLR 2017 regulation 40), and record keeping is one of the preventive measures in the FATF Recommendations.

Monitorships follow the largest fines: FinCEN's TD Bank order imposed a four year monitorship and Treasury's Binance settlement a five year one.

Bank of America's order goes further. With a third party, the bank must run a lookback to find and report the suspicious transactions its old controls missed, and independent reviews will test its suspicious activity monitoring, customer and correspondent due diligence, and data governance. Each transaction the lookback turns up becomes a SAR filed long after the activity, on top of the $1.21 billion in penalties.

How this ranking was built

The ranking covers banks and the other firms that AML rules oblige: crypto exchanges, money transmitters, casinos and broker dealers. A case counts when an authority penalized AML or counter terrorist financing failures, money laundering or sanctions violations. Bribery, fraud and obstruction cases count only when the firm's own AML controls or a laundering scheme sit at their center, as with Goldman Sachs and 1MDB or Danske Bank's Estonian branch. That test leaves out Glencore's 2022 guilty pleas for bribery and market manipulation (DOJ) and UBS's 2023 mortgage case. Pending cases are left out.

Every row was checked on 24 October 2026 against the authority's own release, order or judgment: US federal and New York authorities, the FCA, the Federal Court of Australia, the Dutch and French prosecutors and courts, and Finansinspektionen. The same day those authorities' releases were searched for missing cases of $300 million or more, which added nine rows. At and above that line the table is complete for these authorities; Crown, at $299.9 million, falls just under it.

Each amount is the total of one resolution across every authority involved: fines, civil money penalties, forfeitures, disgorgement and damages to the state. A sum one authority credits against another's is counted once, and Credit Suisse's 2021 case is counted at what it paid after credits. Resolutions of the same conduct within one year are combined, as for Standard Chartered in 2012 and Deutsche Bank in 2017, while later cases against the same bank get their own row. Other currencies are converted at the Federal Reserve's H.10 rate for the decision date. The rates sit under Table 1.

The page first went up on 21 April 2025 and was rebuilt in October 2026. It is refreshed each January.

Melis Alparslan, Regional Sales Manager at complead, wrote this page. Ufuk Gürdaş reviewed it. He is a compliance specialist with more than 10 years in banking and fintech compliance, a MASAK certified compliance officer, and holds the ICA Certificate in Compliance and an MBA in Auditing.

Last reviewed: 24 October 2026.