BoA would have a legal requirement to verify the identity of their customers and in some cases the source of their funds, and if they failed to meet those oblig

BoA would have a legal requirement to verify the identity of their customers and in some cases the source of their funds, and if they failed to meet those obligations they would indeed be held liable. This action also has the side effect of making it illegal for a victim organization to pay a ransom that would run through this exchange, which may be desirable outcome from the government's POV.