When I first heard the news last week that the U.S. Department of Treasury and other federal agencies had imposed penalties and settlements against Bank of America totaling more than $1.2 billion for anti-money laundering and trade sanctions violations, I told colleagues that we would not have to wait long for a follow-on D&O lawsuit. Sure enough, just days after the Treasury Department announcement, a plaintiff shareholder filed a securities class action lawsuit against the Bank and certain of its executives based on the defendants’ alleged misrepresentations concerning the bank’s compliance and internal controls. This type of lawsuit following in the wake of regulatory enforcement actions raises important and interesting issues, as discussed further below.

The Treasury Department’s October 13, 2026, announcement of the penalties and settlements imposed against Bank of America can be found here. The Wall Street Journal’s October 13, 2026, article about the Bank of America penalties and settlement can be found here. A copy of the October 16, 2026, securities lawsuit complaint can be found here.

Background

Bank of America is a multinational bank holding company. The company conducts banking operations through its wholly owned subsidiary, Bank of America, N.A. (BANA). As part of its regulatory compliance, Bank of America must, as the subsequent securities lawsuit complaint puts it, “maintain effective controls to identify, investigate, and report suspicious activity and comply with Bank Secrecy Act (BSA), anti-money laundering (AML) requirements, and applicable economic sanctions laws.”

On December 23, 2024, the Office of the Comptroller of the Currency (OCC, an agency within the Treasury Department) issued a cease-and-desist order against BANA (the “Consent Order”), which required the bank to take corrective actions to address alleged deficiencies in its BSA/AML and sanctions compliance program. The securities complaint alleges that following the entry of the Consent Order, the company represented to investors that it had “already completed significant steps to satisfy the requirements of the Consent Order” and did not believe the compliance issues would have a “material adverse impact on the Corporation.

On October 13, 2026, the Treasury Department announced coordinated enforcement actions against BANA resulting in more than $1.21 billion in penalties and assessments. The Financial Crimes Enforcement Network (FCN or FinCEN) announced the entry of a $1.2 billion penalty against BANA (inclusive of a $750 million OCC penalty). The FCN penalty was imposed for the bank’s failure to “mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.” The penalties imposed are among the largest in Treasury Department history.

The Office of Foreign Assets Control (OFAC) separately announced an $11.6 million settlement over what the Treasury Department called “apparent violations of numerous sanctions programs, including on Iran, Russia, narcotics, and global terrorism.”  

Of particular significance, the Treasury Department’s announcement of the penalties specifically recites that “as part of its resolution with FinCen, Bank of America admits that it willfully violated the BSA and failed to (1) implement and maintain an AML program that met the minimum requirements of the BSA…, (2) conduct due diligence for correspondent accounts for foreign financial institutions, and (3) file suspicious activity reports.”

The Treasury Department specifically asserts that Bank of America failed to timely report to FinCEN over $5 billion in suspicious transactions, with over $1 billion of this activity implicating national security-related risks, including suspicious transactions indicative of Chinese Money Laundering Networks.

The Lawsuit

On October 16, 2026, the New England Teamsters Pension Fund, a Bank of America shareholder, filed a securities class action lawsuit in the Southern District of New York against the company and certain of its executives. The complaint purports to be filed on behalf of a class of investors who purchased the company’s securities between August 1, 2025 and October 13, 2026.

The complaint alleges that the lawsuit is “about how Defendants misled Bank of America investors by touting the company’s progress” in carrying out the “corrective actions” required by the Consent Order, “while downplaying the scope and financial consequences of its compliance failures.” While the company represented to investors that it had completed significant steps to comply with the Consent Order, the reality, the complaint alleges that the company’s compliance failures were “systemic, affected multiple core compliance functions across the Company’s business lines, and remained inadequately remediated despite years of internal warnings and regulatory intervention.”

The complaint alleges that as a result of these systemic compliance failures, BANA failed to “properly monitor trillions of dollars in transactions and timely and accurately report billions of dollars in suspicious activity.” Management, the complaint alleges, had “received written reports identifying substantial reporting failures,” yet the Company “failed to devote sufficient resources to investigating suspicious transactions and correcting its deficient controls.”

Compliance deficiencies persisted after the 2024 Consent Order “exposing the Company to substantial regulatory penalties and requiring significant further investment in remediation.” Consequently, Defendants’ repeated assurances “about the limited scope of the Company’s compliance issues, its remediation efforts, and the expected financial impact lacked a reasonable basis and omitted material adverse facts.”

The complaint alleges that the defendants violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 thereunder. The complaint seeks to recover damages on behalf of the class.

Discussion

While, as I noted at the outset of this post, I anticipated the filing of a D&O lawsuit following along in the wake of the imposition of massive regulatory penalties and settlements, this securities case is not necessarily the lawsuit I anticipated. My expectation was more along the lines of a derivative lawsuit alleging breach of fiduciary duty or breach of the duty to monitor. To be sure, in many of the key allegations in the lawsuit read more like a mismanagement case than a misrepresentation case.

But even though this lawsuit is in the form of a securities suit rather than a derivative lawsuit, it still illustrates how the follow-on lawsuit can translate financial losses of a type that would not typically be covered under a D&O insurance policy into losses (alleged investor damages) that, all else equal, could be covered under a typical D&O insurance policy.

This follow-on lawsuit phenomenon is one that we have noted in numerous recent posts, including, as discussed for example here, where a follow on derivative lawsuit against the board of Uber translated underlying allegations of sexual harassment and misconduct into a D&O claim; and a follow on derivative lawsuit against Microsoft’s board translated underlying alleged intellectual property violations into a D&O lawsuit.

Other examples of this follow on litigation phenomenon involve D&O lawsuits following in the wake of alleged antitrust violations (discussed, for example, here), or alleged FCPA violations (here) or even alleged trade sanctions violations (discussed here).

There are other aspects of this new lawsuit that adhere to developing securities litigation themes and patterns, including, for example, the way in which underlying AML violations can translate into D&O claims. For example, we discussed here the July 2026 lawsuit that was filed against British money transfer firm Wise after its share price declined on news that the firm’s application for a U.S. banking charter had been denied due to AML concerns. Along the same lines, in January 2025, the money transfer company Block was hit with a securities suit based on allegations that the company’s failure to maintain AML protocols had created a “haven for criminal and illicit activities.” In our blog post (here) about the Block lawsuit, we linked to numerous prior securities suits filed based on underlying AML, export controls, or trade sanctions violations.

We have also noted in recent posts that geopolitical issues and concerns increasingly are have given rise to D&O claims, and in that regard it is noteworthy that Bank of America’s $11.6 million settlement agreement with OFAC involved apparent violations of numerous sanctions programs, including sanctions imposed on Iran and Russia. The D&O Diary has previously noted that in the current fraught geopolitical environment, various governmental sanctions regimes can not only create operational risk, but can lead to securities class action lawsuits, as discussed, for example, here.

With respect to the geopolitical risk, I think it is also noteworthy that the allegations against Bank of America include allegations that the bank’s failure to report priority national security risks included transactions allegedly involving Chinese Money Laundering Networks. This China angle is noteworthy to me because it seems that alleged geopolitical risks increasingly seem to involve some China connection, as noted, for example, here, where Bloom Energy was hit with a securities suit for allegedly misrepresenting the company’s dependence on Chinese Rare Earth mineral supplies. From reading the complaints over the last few months with any type of geopolitical spin, it sure seems like any type of China connection is increasingly fraught in a way that arguably should be of keen interest to D&O insurance underwriters.

One Final Note: It is interesting to me that on the same day as the new securities lawsuit was filed against Bank of America, a separate new securities suit was filed against the Canadian clothing company Gildan. A copy of the Gildan complaint can be found here. The difference between the allegations in the two lawsuits is quite interesting to me.

In the Gildan lawsuit, the plaintiffs essentially allege that the company misrepresented its revenues and financial condition as a result of the company engaging in “channel stuffing.” In other words, the Gildan lawsuit is an old-fashioned financial misrepresentation suit. I am old enough to remember when there was a time, not that long ago really, when what  securities litigation routinely was about was financial misrepresentation.

However, these days, securities lawsuits increasingly involve setbacks companies have encountered as part of the business operations. This is a phenomenon I have called “event-driven litigation,” where the lawsuits involve allegations not specifically that the company misrepresented its financial condition, but rather that the company failed to disclose that the bad thing that has happened to the company might happen.

The Gildan lawsuit is to me a reminder of what securities lawsuits used to be about, and, it could be argued, still should be.