Banking compliance regulations are the federal laws and agency rules that govern how U.S. deposit-taking institutions handle money, verify customers, disclose costs, protect data, lend fairly, and hold enough capital to stay solvent. They run across several statutes and multiple regulators, and the consequences for breaking them range from statutory damages paid to individual customers to criminal penalties for officers and receivership for the institution itself.
Anti-Money Laundering and Customer Identification
The Bank Secrecy Act sits at the center of anti-money laundering compliance. Banks must file a Currency Transaction Report for any cash transaction above $10,000 in a single business day, including multiple smaller transactions by the same person that add up past that threshold.1Internal Revenue Service. Bank Secrecy Act – Section: Currency Transaction Report (CTR)
When a transaction of $5,000 or more looks suspicious or has no clear lawful purpose, the bank must file a Suspicious Activity Report with the Financial Crimes Enforcement Network.2eCFR. 12 CFR 208.62 – Suspicious Activity Reports SAR filings are confidential. Banks must also file reports for transactions of $25,000 or more that raise red flags even when no specific suspect has been identified.
The USA PATRIOT Act layered on a written Customer Identification Program requirement. Before opening any account, a bank must collect the customer’s name, date of birth, address, and an identification number, and then verify that information.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks Customers are also screened against government sanctions lists.
Penalties reach both the institution and its people. A willful BSA violation carries a civil penalty of the greater of $25,000 or the amount involved, capped at $100,000.4Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Willful criminal violations can bring up to five years in prison and a $250,000 fine. If the violation is part of a broader pattern of illegal activity involving more than $100,000 in a year, those caps rise to ten years and $500,000.5Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
Beneficial Ownership on Business Accounts
When a business entity opens an account, verification does not stop at the entity. The Customer Due Diligence Rule requires covered financial institutions to identify and verify the beneficial owners of any legal entity customer. A beneficial owner is any individual who owns 25 percent or more of the entity’s equity, plus at least one person with significant management responsibility, such as a CEO, CFO, or managing member.6FinCEN.gov. CDD Rule FAQs
This bank-level obligation is separate from direct beneficial ownership reporting under the Corporate Transparency Act. As of March 2025, entities created in the United States and their U.S. beneficial owners are exempt from filing beneficial ownership reports with FinCEN; only foreign entities registered to do business in the United States must file.7FinCEN.gov. Beneficial Ownership Information Reporting The CDD Rule itself is unchanged. Banks still collect beneficial ownership information from business customers at account opening.6FinCEN.gov. CDD Rule FAQs
Lending and Deposit Disclosures
The Truth in Lending Act, implemented through Regulation Z, requires lenders to provide a written disclosure that spells out the Annual Percentage Rate and total finance charge in a standardized format.8Consumer Financial Protection Bureau. 12 CFR Part 1026 – Truth in Lending (Regulation Z) Standardization is the point: a borrower can line up competing offers and compare real costs without decoding proprietary fee language.
Deposit accounts get parallel treatment under the Truth in Savings Act and Regulation DD. Banks must disclose the Annual Percentage Yield, along with maintenance fees, minimum balance requirements, and early withdrawal penalties.9Consumer Financial Protection Bureau. 12 CFR Part 1030 – Truth in Savings (Regulation DD)
Advance notice for changing account terms depends on the product. Credit card issuers and other open-end lenders must give at least 45 days’ written notice before a significant change to terms such as rates or fees.10Consumer Financial Protection Bureau. 12 CFR 1026.9 – Subsequent Disclosure Requirements For electronic fund transfer accounts, the notice window is at least 21 days before fee increases or service reductions take effect.11Consumer Financial Protection Bureau. 12 CFR 1005.8 – Change in Terms Notice
A consumer who proves a TILA violation can recover statutory damages. The amounts depend on the credit product:
- Closed-end loans secured by real property: between $400 and $4,000 per violation.
- Open-end credit not secured by real property: between $500 and $5,000 per violation, calculated as twice the finance charge.
- Class actions: total recovery capped at the lesser of $1,000,000 or one percent of the creditor’s net worth.12Office of the Law Revision Counsel. 15 USC 1640 – Civil Liability
Electronic Fund Transfer Protections
Regulation E covers debit cards, ATM transactions, direct deposits, and other electronic fund transfers. It uses a tiered liability system for unauthorized transactions that rewards quick reporting. Notify the bank within two business days of discovering a lost or stolen debit card, and maximum liability is $50. Wait longer than two business days, and exposure rises to $500. If a fraudulent charge sits on the statement for more than 60 days without being reported, the customer can be liable for the full amount of any unauthorized transfers that occur after that 60-day window.13Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Once an error is reported, the bank has 10 business days to investigate and reach a conclusion. It can extend the investigation to 45 days, but only if it provisionally credits the account within the first 10 business days and gives the customer full use of those funds while the investigation continues.14eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors For new accounts or international transfers, those windows stretch to 20 business days and 90 days. The regulation states that a consumer’s own negligence cannot be used to push liability past these caps.
Data Privacy and Cybersecurity
The Gramm-Leach-Bliley Act requires banks to maintain a comprehensive information security program that protects customer data from unauthorized access.15Federal Trade Commission. Gramm-Leach-Bliley Act Banks must deliver a privacy notice when the relationship begins and annually after that, explaining what data is collected, how it is shared, and how customers can opt out of certain sharing. A change that expands data sharing triggers a revised notice with a fresh opt-out.
The FTC’s Safeguards Rule adds specific technical requirements. Banks must encrypt customer information both in storage and in transit. They must implement multi-factor authentication for anyone accessing systems containing customer records, using at least two factors such as a password combined with a physical token or biometric verification.16Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know Each institution must designate a qualified individual to oversee the program and conduct regular risk assessments.
36-Hour Incident Notification
A joint rule from the OCC, FDIC, and Federal Reserve requires banks to notify their primary federal regulator as soon as possible, and no later than 36 hours, after determining that a significant cybersecurity incident has occurred.17eCFR. 12 CFR Part 304 Subpart C – Computer-Security Incident Notification The 36-hour clock starts when the bank concludes the incident rises to the level of a “notification incident,” meaning it has materially disrupted banking operations, threatened a significant business line, or posed a risk to financial stability.18Federal Register. Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers Individual officers and directors can face personal liability for privacy violations they authorized or failed to prevent.
Fair Lending and Equal Credit Access
Lending decisions must rest on creditworthiness, not demographics. The Equal Credit Opportunity Act, implemented through Regulation B, prohibits discrimination based on race, color, religion, national origin, sex, marital status, age, or the fact that an applicant receives public assistance income.19Consumer Financial Protection Bureau. 12 CFR Part 1002 – Equal Credit Opportunity Act (Regulation B) When a bank denies a credit application, it must send a written notice explaining the specific reasons within 30 days.20Consumer Financial Protection Bureau. 12 CFR 1002.9 – Notifications
That adverse action requirement applies even when the underwriting decision is made by an algorithm. The CFPB has said creditors using automated models must still supply specific, accurate reasons for each denial. Vague explanations or boilerplate checklists do not satisfy the rule. If the algorithm flagged a particular factor, the notice has to name it in terms the applicant can understand.21Consumer Financial Protection Bureau. Adverse Action Notification Requirements and the Proper Use of the CFPB’s Sample Forms Provided in Regulation B
The Community Reinvestment Act takes a broader view, requiring banks to serve the credit needs of the entire communities where they operate, including low- and moderate-income neighborhoods.22Federal Reserve Board. Community Reinvestment Act (CRA) Regulators assign one of four ratings: Outstanding, Satisfactory, Needs to Improve, or Substantial Noncompliance.23Federal Reserve Board. Evaluating a Bank’s CRA Performance A poor rating can block branch expansion or a merger.24Federal Financial Institutions Examination Council. Community Reinvestment Act
Fair lending enforcement targets patterns, not just individual files. Examiners look at whether an institution has significantly fewer originations in minority neighborhoods than in comparable areas, and whether protected groups are charged higher rates than borrowers with similar credit profiles. The Department of Justice and the CFPB use statistical analysis to identify disparities that legitimate underwriting factors cannot explain. Individual punitive damages under ECOA can reach $10,000, and class-action recoveries are capped at the lesser of $500,000 or one percent of the creditor’s net worth.25Office of the Law Revision Counsel. 15 USC 1691e – Civil Liability Courts can also order banks to set up specialized lending programs to remedy past discrimination.
Capital, Stress Tests, and Prompt Corrective Action
Federal regulators require every bank to maintain a minimum Common Equity Tier 1 capital ratio of 4.5 percent, which measures core equity against risk-weighted assets.26Federal Reserve Board. Annual Large Bank Capital Requirements That is the floor. Large banks face additional surcharges and buffers that push their effective minimums higher.
The largest institutions also undergo annual stress tests run by the Federal Reserve. These simulations model severe scenarios such as a spike in unemployment or a housing market crash and project how the bank’s capital would hold up. If projected capital falls below the required threshold, regulators can restrict dividends or stock buybacks until the cushion is rebuilt. Large banking organizations also must hold enough high-quality liquid assets to cover 30 days of stressed cash outflows, with a Liquidity Coverage Ratio minimum of 100 percent.27Bank for International Settlements. Basel III: The Liquidity Coverage Ratio and Liquidity Risk Monitoring Tools
The Volcker Rule, part of the Dodd-Frank Act, prohibits banks from engaging in proprietary trading or acquiring ownership interests in hedge funds and private equity funds.28Office of the Law Revision Counsel. 12 USC 1851 Customer deposits are not supposed to fund speculative bets, and separating traditional banking from high-risk trading reduces the odds that a failure will require a public bailout.
When a bank’s capital drops into critically undercapitalized territory, regulators must act within 90 days by appointing a receiver or conservator, or by documenting why an alternative action better serves the public interest. If the bank remains critically undercapitalized on average over the following 270 days, a receiver must be appointed regardless.29FDIC. Section 38 – Prompt Corrective Action
Federal Deposit Insurance and Its Limits
The FDIC insures deposits up to $250,000 per depositor, per ownership category, at each insured bank, backed by the full faith and credit of the United States.30FDIC. Understanding Deposit Insurance Credit unions have parallel coverage through the National Credit Union Share Insurance Fund at the same $250,000 level per share owner, per insured credit union.31National Credit Union Administration. How Your Accounts Are Federally Insured
One boundary matters for anyone buying investments at a bank branch. Mutual funds, annuities, and similar products sold through a bank are not FDIC-insured, are not guaranteed by the bank, and can lose principal. Regulators require banks to disclose these distinctions clearly whenever they sell nondeposit investment products.32Federal Reserve. Retail Sales of Nondeposit Investment Products – Interagency Statement Because coverage is calculated per ownership category, a single person can hold more than $250,000 at one bank by spreading funds across categories such as individual accounts, joint accounts, and retirement accounts.