Financial regulatory compliance is the body of federal rules that governs how banks, broker-dealers, investment advisers, and public companies handle money, customers, and information. The requirements come from several different laws and are enforced by several different agencies, and the penalties for getting them wrong range from civil fines into the tens of thousands of dollars per violation to criminal prison terms up to 20 years.1Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations In fiscal year 2025 alone, the SEC obtained orders totaling billions in penalties and disgorgement.2U.S. Securities and Exchange Commission. SEC Announces Enforcement Results for Fiscal Year 2025 The sections below walk through who regulates what, which laws create the obligations, what firms actually have to do, and how a program that will hold up to an examination fits together.
Which Agency Regulates You
No single federal body oversees all of U.S. finance. Which rulebook applies, and which examiners show up, depends on what the institution does.
The Securities and Exchange Commission oversees public company disclosures, investment advisers, mutual funds, and the securities exchanges.3Securities and Exchange Commission. U.S. Securities and Exchange Commission It can impose civil penalties, force the return of profits earned through misconduct, and bar individuals from serving as officers or directors of public companies; in fiscal year 2025 it issued 119 such bars.2U.S. Securities and Exchange Commission. SEC Announces Enforcement Results for Fiscal Year 2025
FINRA is the self-regulatory organization that licenses broker-dealers and their registered representatives, sets conduct rules, and examines member firms.4Financial Industry Regulatory Authority. What It Means to Be Regulated by FINRA Member firms must maintain supervisory systems reasonably designed to catch violations of securities laws and FINRA’s own rules.5FINRA.org. FINRA Rule 3110 – Supervision FINRA does not regulate banks, insurance companies, or investment advisers that are not also registered as broker-dealers.
Banks answer to a different set of regulators. The FDIC insures deposits at member banks up to $250,000 per depositor, per insured institution, and examines banks for financial soundness and consumer protection.6Federal Deposit Insurance Corporation. Deposit Insurance The Office of the Comptroller of the Currency charters and supervises national banks and federal savings associations, and can take enforcement action for violations of law, unsafe practices, or breaches of fiduciary duty.7Office of the Comptroller of the Currency. Laws and Regulations The Federal Reserve supervises bank holding companies, state-chartered banks that are Fed members, savings and loan holding companies, foreign bank offices operating in the United States, and nonbank entities designated as systemically important.8Board of Governors of the Federal Reserve System. The Fed Explained – Supervision and Regulation
A single institution often answers to several of these at once. A national bank with a broker-dealer subsidiary and publicly traded parent is examined by the OCC for its banking operations, by FINRA and the SEC for its securities activity, and by the SEC again for its public reporting.
The Federal Laws That Create the Obligations
Sarbanes-Oxley Act
Sarbanes-Oxley, enacted in 2002 after the Enron and WorldCom collapses, tightened accounting standards for public companies and created the Public Company Accounting Oversight Board to police the auditing profession.9U.S. Department of Labor. Sarbanes-Oxley Act of 2002 CEOs and CFOs must personally certify the accuracy of their company’s financial statements, so a misleading earnings report is a personal legal exposure for the people who signed it. The criminal provisions are severe: anyone who knowingly destroys, alters, or falsifies records to obstruct a federal investigation faces up to 20 years in prison, and that penalty applies even if no underlying fraud is ever proven.1Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations
Dodd-Frank Act
Dodd-Frank, passed in 2010 in response to the 2008 financial crisis, created the Consumer Financial Protection Bureau to oversee mortgage lending, credit cards, and other consumer financial products.10The White House. Wall Street Reform: The Dodd-Frank Act It also introduced the Volcker Rule, which prohibits banking entities from engaging in proprietary trading or from sponsoring hedge funds and private equity funds for their own profit.11Office of the Law Revision Counsel. 12 USC 1851 – Prohibitions on Proprietary Trading and Certain Relationships With Hedge Funds and Private Equity Funds The law’s whistleblower provisions, covered further below, reshape the internal calculus of every compliance program.
Bank Secrecy Act
The Bank Secrecy Act is the backbone of U.S. anti-money laundering law. It authorizes the Treasury Department to require financial institutions to keep records of cash purchases and file reports on transactions that could signal money laundering or other crimes.12FinCEN.gov. The Bank Secrecy Act Civil penalties for recordkeeping violations are adjusted annually for inflation and currently exceed $25,000 per violation.13Federal Register. Inflation Adjustment of Civil Monetary Penalties
Gramm-Leach-Bliley Act
Gramm-Leach-Bliley governs how financial institutions handle customers’ personal information. Under the FTC’s Safeguards Rule, covered institutions must maintain an information security program with administrative, technical, and physical protections for customer data, must tell customers how their information will be shared, and must give customers the right to opt out of certain sharing with third parties.14Federal Trade Commission. Gramm-Leach-Bliley Act The definition of “financial institution” is broad and reaches auto dealers that arrange financing, tax preparers, and payday lenders, not just banks.
What Firms Have to Do Day to Day
Identify the Customer, Then Keep Watching
Before opening an account, a bank must collect the customer’s name, date of birth, address, and Social Security or taxpayer identification number, then verify those details against government-issued identification.15Federal Financial Institutions Examination Council. FFIEC BSA/AML – Customer Identification Program For business accounts, FinCEN’s Customer Due Diligence rule requires covered institutions to identify the beneficial owners of legal entity customers and verify those individuals using the same procedures applied to any other customer, so shell companies cannot be used to move money anonymously.16Federal Register. Customer Due Diligence Requirements for Financial Institutions
The obligation does not end at account opening. Institutions must conduct ongoing monitoring and update customer records when new information surfaces, such as a change in business ownership, a shift in transaction patterns, or a move into a high-risk jurisdiction.16Federal Register. Customer Due Diligence Requirements for Financial Institutions
Suspicious Activity Reports
When a bank detects a transaction of $5,000 or more that could involve money laundering, fraud, or another crime, it must file a Suspicious Activity Report with FinCEN.17FFIEC BSA/AML InfoBase. FFIEC BSA/AML – Suspicious Activity Reporting The filing deadline is 30 calendar days from initial detection; if no suspect has been identified at that point, the deadline extends to 60 days, but no longer.18eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions All SARs are filed electronically through FinCEN’s BSA E-Filing System, and the bank is prohibited from telling the customer that a report has been filed.19Financial Crimes Enforcement Network. Suspicious Activity Reports (SARs)
Currency Transaction Reports
Any cash transaction over $10,000 in a single business day triggers a Currency Transaction Report. Multiple smaller cash transactions that aggregate to more than $10,000 in a day must be treated as a single reportable transaction if the bank knows they were conducted by or on behalf of the same person.20Federal Financial Institutions Examination Council. FFIEC BSA/AML – Currency Transaction Reporting The bank must record and verify the name, address, and Social Security or taxpayer identification number of the person conducting the transaction.21Financial Crimes Enforcement Network. Notice to Customers: A CTR Reference Guide Structuring transactions to stay below the $10,000 threshold is itself a federal crime.
Recordkeeping
The BSA generally requires banks to retain records related to SARs, CTRs, and other reported transactions for at least five years, and records used to verify a customer’s identity must be kept for five years after the account is closed.22FFIEC BSA/AML InfoBase. FFIEC BSA/AML Appendices – Appendix P: BSA Record Retention Requirements Examiners routinely request historical transaction data, and failing to produce it triggers civil penalties that can exceed $25,000 per violation.13Federal Register. Inflation Adjustment of Civil Monetary Penalties
Cybersecurity Disclosure
Since December 2023, public companies have been required to disclose material cybersecurity incidents on Form 8-K within four business days of determining that the incident is material.23U.S. Securities and Exchange Commission. SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure The disclosure must describe the nature, scope, and timing of the incident and its material impact on operations or financial condition. In their annual filings, public companies must also describe their processes for identifying and managing cybersecurity risks, the board’s oversight role, and management’s responsibilities. The four-day clock starts at the materiality determination, not at the breach itself, so delays on that call attract scrutiny. Financial institutions carry the additional Safeguards Rule obligations under Gramm-Leach-Bliley on top of SEC disclosure.14Federal Trade Commission. Gramm-Leach-Bliley Act
Whistleblowers Change the Internal Math
Under the SEC’s whistleblower program, individuals who voluntarily provide original information leading to a successful enforcement action can receive between 10% and 30% of the monetary sanctions collected, when the total exceeds $1 million.24U.S. Securities and Exchange Commission. Whistleblower Program Employers cannot fire, demote, suspend, or otherwise retaliate against an employee for reporting potential violations to the SEC; an employee who suffers retaliation can sue for reinstatement, double back pay with interest, and attorney fees.25Office of the Law Revision Counsel. 15 USC 78u-6 – Securities Whistleblower Incentives and Protection The practical consequence inside a firm is that employees whose internal reports are ignored have a direct pipeline to the SEC and a financial incentive to use it, which puts a premium on internal reporting systems that actually investigate what they receive.
Building a Program That Holds Up
A compliance program that exists only on paper is worse than no program at all, because it provides evidence that the firm knew its obligations and failed to meet them. Regulators and courts treat paper-only programs harshly. The pieces that make a program credible under examination are consistent across institutions.
Start with a risk assessment that maps every product, service, and customer type against the regulations that apply to it. A retail bank that also offers wealth management and commercial lending faces different risks in each line, and the compliance infrastructure needs to reflect that. Refresh the assessment when the institution enters new markets, launches new products, or when the rules change.
Designate a compliance officer with real authority: direct access to the board and the ability to halt activities that pose legal risk. This is the person who faces examiners and escalates internal breaches. Burying the function several levels below the C-suite signals to regulators, accurately, that the firm does not take it seriously.
Translate the rules into written policies tailored to each department. The anti-money laundering team needs different day-to-day instructions than the trading desk, and both need clear written guidance. Policies tell employees what to do and demonstrate to examiners that the institution has thought through its obligations.
Train everyone who touches customer accounts, processes transactions, or handles sensitive data, and document who was trained on what. When an examiner asks whether staff were trained on a new rule, a sign-in sheet and training materials answer the question in a way “we told them in a meeting” does not.
Test the program through independent audits and self-assessments. The goal is not a perfect score every time; it is a system that identifies gaps and fixes them. A firm that self-reports a problem and shows corrective action stands in a different position from one caught during an examination.