Compliance frameworks, security audits, and quality certifications this company maintains.
Bank of America maintains PCI DSS Level 1 certification, protecting payment card data across its credit card, debit card, and merchant processing operations serving over 69 million consumer accounts.
Bank of America's digital banking, cloud, and data platforms undergo annual SOC 2 Type II audits, ensuring security and availability controls for CashPro, Merrill Edge, and mobile banking services.
Bank of America holds ISO 27001 information security certification, underpinning its enterprise cybersecurity program protecting $3.4T in assets and the data of 69 million clients.
Bank of America fully complies with Sarbanes-Oxley Act requirements, maintaining rigorous internal financial controls and audit processes across its publicly traded holding company structure.
Bank of America meets Basel III and U.S. enhanced prudential standards, maintaining a CET1 capital ratio above 11.5% and satisfying Fed stress testing requirements as a G-SIB institution.
Bank of America complies with GDPR for its European client data, applying data minimization, consent management, and breach notification procedures across all EU-facing banking and capital markets operations.
Bank of America complies with the California Consumer Privacy Act, providing California residents with data access, deletion, and opt-out rights for personal financial and marketing data.
Bank of America operates a comprehensive Bank Secrecy Act and Anti-Money Laundering program, monitoring billions of transactions for suspicious activity and filing SARs with FinCEN as required.
Accessibility
WCAG 2.1 Level AA
CompliantBank of America designs its online banking portal, mobile app, and ATM interfaces to WCAG 2.1 Level AA, ensuring accessible financial services for clients with visual, motor, and cognitive disabilities.
Security
NIST Cybersecurity Framework
CompliantBank of America implements the NIST Cybersecurity Framework across its enterprise IT and cybersecurity programs, providing a structured approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity risks across one of the largest US financial institutions.