Last week’s $1.2 billion fine imposed upon Bank of America for its failures involving money laundering and sanctions evasion should act as a wake-up call for the entire financial sector. This is not just because of the enormous size of the fine levied, but because of why the bank was fined, and the fundamental weaknesses in how financial institutions approach financial crimes to begin with.

Two key failures from Bank of America stand out: the failure to adequately identify and report more than a billion dollars of suspicious activity tied to national security and other priority illicit finance risks, and the fact that 76 percent of its risk factor weights in its transaction monitoring system remained unchanged for five years between 2018 and 2023. Of the weights that did change, approximately 80 percent were actually reduced.

These findings expose a fundamental disconnect between how financial institutions approach financial crime and the broader national security and geopolitical environment in which it occurs.

For much of the financial sector, money laundering and sanctions evasion are viewed primarily in the context of operational compliance: matching patterns, examining new behaviors and running names through sanctions lists. This is predominantly treated as operational, check-the-box compliance work. While these functions are certainly necessary to maintain an effective program to fight financial crime, focusing exclusively on compliance misses the actual reason individuals are sanctioned to begin with, and the national security risks associated with money laundering and financial crime.

Not all financial crimes are created equal. Your local drug dealer is not an equal national security risk to someone evading sanctions to support the North Korean nuclear program. But to understand this distinction, one must fundamentally alter how they approach financial crime to place it in the context of American national security, foreign policy and a rapidly shifting geopolitical environment. Take the Iran War, for example.

As it currently stands, the primary strategy through which the U.S. hopes to achieve victory is economic warfare. Stifling Iran’s ability to evade sanctions and launder funds is a core focus of the Trump administration’s strategy right now. From the perspective of American foreign policy objectives, the strategic consequences of missing Iranian sanctions evasion can be far greater than those of missing unrelated illicit transactions involving Australian tobacco.

But as we saw with Bank of America, when one of the world’s largest banks leaves most of its risk factor weights unchanged for five years, it raises serious questions about institutional complacency in a rapidly shifting global environment. During the years from 2018 to 2023, we saw a historic shift in illicit finance risk when Russia invaded Ukraine in 2022. Sanctions were imposed on a massive scale, Russian sanctions evasion networks adapted and yet 76 percent of the bank’s risk factor weights remained unchanged. Regulators also identified instances where inadequate risk factor weights were not appropriately recalibrated despite internal evidence of deficiencies.

An institution cannot continually update its understanding of financial crime risk if its professionals and leadership lack the geopolitical knowledge necessary to recognize how that risk is changing. What is needed is a fundamental restructuring of financial crime education in the private sector.

Year after year, the Association of Certified Anti-Money Laundering Specialists, the professional association for financial crime professionals, identifies insufficient expertise and ongoing training as significant risks facing the private sector.

In its Global Anti-Financial Crime Threats Reports, 43 percent of surveyed professionals in 2024, 50 percent in 2025 and 47 percent in 2026 considered insufficient skilled resources or ongoing training a high or very high risk to their financial crime functions. Meanwhile, 63 percent of respondents in the 2026 report identified geopolitical instability as high or very high risk.

The industry recognizes both the growing importance of geopolitically driven threats and persistent weaknesses in the expertise required to confront them. Professionals must be taught how American national security, foreign policy and geopolitics force adaptation in their anti-financial crime programs, and how these developments fundamentally shift the risks and suspicious activities institutions must prioritize.

Regulatory operational training is a necessity, but an institution cannot effectively meet its regulatory obligations without training its staff to a higher standard of education surrounding how the world of illicit finance exists beyond screening lists and transaction monitoring systems.

But to do this, companies must have leaders who understand these complex dynamics and approach them with the seriousness, resources and ongoing training necessary to turn a static system into the dynamic one needed in a rapidly shifting risk environment.

Are financial institutions training their employees to simply work, or are they training them to truly think?

The financial sector does not simply need better operational compliance training. It needs to fundamentally reexamine its approach to how financial crime education is taught and, perhaps even more importantly, maintained in the modern world.

Because at the core, financial crime is not merely a compliance hurdle, but a problem that affects the safety of Americans and others around the world. And companies cannot effectively counter threats that their staff is fundamentally untrained to combat.

Brett Erickson is managing principal at Obsidian Risk Advisors and an advisory board member at Seton Hall School of Diplomacy and International Relations and DePaul University Driehaus College of Business.