The second-largest U.S. bank said in an August securities filing that it had been in discussions with regulators to address concerns over the sale and marketing of credit card debt cancellation products and identity theft protection services that it offered alongside its credit cards.

It added that it may be required to repay or provide other relief to consumers and also pay penalties to one or more regulators.

News of the potential settlement with the Consumer Financial Protection Bureau was first reported by the Wall Street Journal, which also said Bank of America could pay more than $800 million to settle the allegations against it.

Spokesmen for Bank of America and the CFPB declined to comment.

In recent years, the CFPB has been cracking down on credit-card companies offering payment protection, credit score tracking and other add-on products. Since 2012, Capital One Financial Corp., American Express Co., Discover Financial Services and JPMorgan Chase & Co. all have paid fines to resolve allegations of unfair practices related to such products.

The CFPB is continuing to look at add-on products at other firms as well, one of the sources told Reuters.