The penalties for violating federal banking regulations run along a wide ladder: confidential supervisory warnings at the bottom, then formal cease-and-desist orders, civil money penalties that can reach roughly $2.5 million per day, permanent bans from the banking industry for individual officers, and, at the top, criminal prosecution with prison time and multibillion-dollar fines. Which rung a violation lands on depends on the statute involved, whether the conduct was willful, whether it caused loss, and whether the bank or individual has been warned before.
Who Enforces the Rules
No single agency polices banking. The Office of the Comptroller of the Currency supervises national banks and federal savings associations. The FDIC supervises state-chartered banks that aren’t Federal Reserve members and administers deposit insurance. The Federal Reserve supervises state-chartered member banks and bank holding companies. FinCEN, a Treasury bureau, enforces the Bank Secrecy Act’s reporting and recordkeeping rules. The Consumer Financial Protection Bureau enforces consumer financial protection laws and directly supervises banks with more than $10 billion in assets. The Department of Justice brings criminal prosecutions, and the SEC handles securities-law issues at bank holding companies and broker-dealer affiliates.1Federal Reserve. Enforcement Actions
These agencies coordinate but issue their enforcement actions independently, which is why a single episode of misconduct can produce parallel penalties from several regulators at once.
The Graduated Response
Regulators pick from a graduated set of tools based on how serious the problem is and whether the bank is fixing it voluntarily.
For less severe deficiencies, regulators use informal actions: board resolutions, memoranda of understanding, and commitment letters. These are nonpublic, voluntary, and not enforceable in court, but they signal that regulators expect the bank to correct the issue.2OCC. PPM 5310-3: Bank Enforcement Actions
When problems are severe, systemic, or uncorrected, regulators move to formal enforcement actions, which are typically public and legally enforceable. The OCC presumes a formal action is necessary when a bank has significant risk management deficiencies, systemic legal violations, evidence of insider abuse, or a composite examination rating of 3 or worse.2OCC. PPM 5310-3: Bank Enforcement Actions The main tools include:
- Cease-and-desist orders under 12 U.S.C. § 1818(b), which require the bank to stop a harmful practice and take specific corrective steps such as restitution to harmed consumers, growth restrictions, asset disposal, or contract rescission. When the bank agrees without contesting, the order is usually called a “consent order,” though the legal effect is identical.3FDIC. FDIC Updates Its Enforcement Actions Manual
- Formal written agreements between the regulator and the bank’s board. An FDIC written agreement “has the same effect as an order to cease and desist.”4FDIC. Types of Action
- Civil money penalties, described in detail below.
- Removal and prohibition orders under 12 U.S.C. § 1818(e), which can permanently bar an individual from working at any insured depository institution.5OCC. Enforcement Action Types
- Prompt corrective action directives, which impose escalating capital-based restrictions. If tangible equity drops to 2% or less, the bank may be placed into conservatorship or receivership.2OCC. PPM 5310-3: Bank Enforcement Actions
- Termination of deposit insurance, the most drastic action, which effectively forces a bank to close.6FDIC. Risk Management Manual of Examination Policies
Bank Secrecy Act violations have their own escalation rule. Under a 2020 interagency statement, regulators must issue a cease-and-desist order when a bank fails to establish or maintain a reasonably designed anti-money-laundering compliance program, or fails to correct a BSA problem that was previously flagged to its board or management in a supervisory communication. Isolated or technical violations generally don’t trigger mandatory enforcement.7OCC. Interagency Statement on Enforcement of BSA/AML Requirements
Civil Money Penalties and How They’re Calculated
Federal banking law uses a three-tier civil money penalty structure that escalates with the culpability of the violator. The base amounts are adjusted for inflation annually. As of January 2025, the FDIC’s inflation-adjusted maximums are:8Federal Register. Notice of Inflation Adjustments for Civil Money Penalties – FDIC
- Tier 1: up to $5,026 per day for any violation of a law, regulation, final order, or written agreement.
- Tier 2: up to $50,265 per day for violations that form a pattern of misconduct, cause or risk more than minimal loss to the bank, or produce financial gain to the violator.
- Tier 3: up to $2,513,215 per day for knowing violations that recklessly cause substantial loss to the bank or substantial gain to the violator.
The OCC’s 2025 maximums for national banks are slightly higher at the lower tiers: $12,567 per day for Tier 1, $62,829 per day for Tier 2, and the same $2,513,215 per day for Tier 3.9Federal Register. Notification of Inflation Adjustments for Civil Money Penalties – OCC
Where a particular penalty lands within those ranges depends on 13 factors that regulators weigh, including the violator’s intent, how long and how often the misconduct occurred, whether it was concealed, whether the violator disclosed it voluntarily, the amount of financial gain or loss, and whether the institution had a functioning compliance program.10FDIC. Examination Policies Manual – Section 14.1
FIRREA Penalties
The Financial Institutions Reform, Recovery, and Enforcement Act of 1989 gives the Department of Justice a separate civil penalty tool that has become one of the government’s favored ways to punish banking misconduct. Under 12 U.S.C. § 1833a, the Attorney General can seek penalties of up to $1,000,000 per violation, or up to $5,000,000 for a continuing violation, when conduct violates any of 14 enumerated criminal statutes affecting a federally insured financial institution. If the violation produced pecuniary gain or caused pecuniary loss, the penalty can be increased to the full amount of that gain or loss.11Cornell Law Institute. 12 U.S. Code § 1833a – Civil Penalties
Two features make FIRREA powerful. The burden of proof is preponderance of the evidence rather than the criminal standard of beyond a reasonable doubt, and the statute of limitations runs for 10 years. DOJ recovered over $8 billion under FIRREA in 2018 alone.
When Violations Become Crimes
Banking violations cross into criminal territory when they involve willful misconduct. The key criminal statutes include:
- Bank Secrecy Act criminal provisions at 31 U.S.C. 5322, covering willful failure to maintain an AML program or file required reports.
- False bank entries under 18 U.S.C. § 1005: making false entries in a bank’s books, reports, or statements with intent to defraud, punishable by up to $1,000,000 in fines and 30 years’ imprisonment.12GovInfo. 18 U.S.C. § 1005
- Bank fraud under 18 U.S.C. § 1344: executing or attempting to execute a scheme to defraud a financial institution.
- False statements under 18 U.S.C. § 1014: knowingly making false statements on loan or credit applications.
- Bank bribery under 18 U.S.C. § 215: offering or accepting something of value to influence a bank transaction.
Prosecutors have broad discretion to bring charges, negotiate a deferred prosecution agreement, or accept a non-prosecution agreement. DOJ guidelines direct them to weigh the seriousness of the offense, whether the wrongdoing was pervasive or isolated, the corporation’s history of misconduct, and the quality of its compliance programs.13DOJ. Principles of Federal Prosecution of Business Organizations
Criminal prosecutions of banks themselves were rare before 2008. That has changed: banks paid roughly $7 billion of the $9 billion in total corporate criminal penalties assessed in 2015 alone.14Yale Law Journal. The Rise of Bank Prosecutions Individual prosecutions of bank officers, though, remain uncommon relative to institutional penalties.
Personal Consequences for Directors, Officers, and Employees
Bank directors and officers carry personal exposure that is separate from anything the bank itself pays. Under 12 U.S.C. § 93(a), directors of a national bank who knowingly violate banking laws, or knowingly permit others to do so, can be held personally liable for all resulting damages, and in extreme cases such violations can lead to forfeiture of the bank’s charter.15GovInfo. 12 U.S.C. § 93(a)
The FDIC can sue former directors and officers of failed banks for losses caused by breaches of the duties of loyalty and care, and has historically done so or reached settlements in roughly a quarter of bank failures. Liability tends to attach in cases involving dishonest conduct, approval of insider transactions, failure to establish proper underwriting policies, and failure to heed warnings from regulators or auditors.16FDIC. Duties and Responsibilities of Directors and Officers
A prohibition order under Section 1818(e) is often the most severe personal consequence short of criminal charges: a permanent bar from working at any insured depository institution, imposed for violations, unsafe practices, or breaches of fiduciary duty that caused financial loss or harmed depositors.5OCC. Enforcement Action Types
Banks cannot cushion those blows. They are prohibited from indemnifying directors and officers for civil money penalties or the legal costs of defending against them when the action results in a final assessment. Buying directors’ and officers’ insurance with a rider covering civil money penalties is itself a regulatory violation.17Luse Gorman. Responsibilities of Bank Directors and Officers
What Big Cases Look Like in Practice
Three recent cases show what happens when the full enforcement machinery turns on a large bank.
TD Bank
On October 10, 2024, TD Bank N.A. and its parent holding company pleaded guilty to conspiring to fail to maintain a BSA-compliant AML program, failing to file accurate Currency Transaction Reports, and conspiring to launder money. It was the largest BSA penalty in U.S. history and the first time a national bank pleaded guilty to money laundering conspiracy.18DOJ. United States of America v. TD Bank, N.A.
The bank’s total financial penalty was approximately $1.887 billion, consisting of $1.435 billion in criminal fines and $452 million in forfeiture. FinCEN separately assessed a $1.3 billion civil penalty, the largest in Treasury and FinCEN history.19FinCEN. FinCEN Assesses Record $1.3 Billion Penalty Against TD Bank Investigators found that between January 2018 and April 2024, 92% of the bank’s total transaction volume, roughly $18.3 trillion, went unmonitored. Three money laundering networks moved more than $670 million through TD Bank accounts between 2019 and 2023, with help from five bank employees.20FDIC OIG. TD Bank Pleads Guilty to Bank Secrecy Act and Money Laundering The resolution required TD Bank to retain an independent compliance monitor and conduct a comprehensive review of its AML program.
Wells Fargo
Wells Fargo shows what sustained regulatory pressure looks like. After the fake-accounts scandal came to light in 2016, the CFPB and OCC issued consent orders over sales practices that included opening millions of unauthorized customer accounts. In February 2018, the Federal Reserve imposed an unprecedented asset cap, restricting the bank’s growth until it could demonstrate its governance and risk management had been fixed.21Democrats, House Financial Services Committee. Wells Fargo: A Timeline of Regulatory Actions Federal agencies collectively fined Wells Fargo $3 billion in 2018 alone.
Remediation took nearly a decade. A 2020 congressional report found that Wells Fargo had repeatedly submitted deficient plans and had “yet to fully satisfy any” of its outstanding consent orders at that time. The Federal Reserve terminated its 2018 enforcement action on March 5, 2026, after determining that the bank had completed all required conditions.22Federal Reserve. Federal Reserve Board Announces Termination of Enforcement Action Against Wells Fargo
U.S. Bancorp
In February 2018, DOJ filed two felony BSA charges against U.S. Bancorp after finding that the bank had deliberately capped transaction monitoring alerts based on staffing levels rather than risk, concealed the practice from regulators, and failed to report suspicious activity linked to a large payday-lending fraud scheme. The bank agreed to pay $528 million ($453 million in civil forfeiture and $75 million in OCC penalties), plus $70 million to resolve FinCEN civil violations. The case was resolved through a deferred prosecution agreement that required the bank to admit a detailed statement of facts and reform its compliance program.23DOJ. Criminal Charges Against U.S. Bancorp
What’s Changed Recently
In 2025, the CFPB narrowed its enforcement focus to cases involving actual consumer fraud with identifiable victims, threats to servicemembers and veterans, and intentional discrimination. It closed roughly 40% of its pending investigations and dropped cases built on novel legal theories, including disparate impact liability.24CFPB. 2025 Enforcement Lookback
A separate policy shift removed “reputation risk” as a supervisory factor. Following an August 2025 executive order directing regulators to prevent “politicized or unlawful debanking,” the OCC, FDIC, and Federal Reserve each pulled reputation risk from their examination programs.25The White House. Guaranteeing Fair Banking for All Americans A joint final rule adopted by the OCC and FDIC in 2026 codified the change, prohibiting agencies from taking adverse action against banks based on the political, social, or religious views of their customers or the lawfulness of their business activities. The agencies said they would continue to enforce laws prohibiting illegal, discriminatory, or predatory banking practices.26OCC. Joint Final Rule Eliminating Reputation Risk
FinCEN’s caseload has stayed active, with notable actions against TD Bank in 2024, Brink’s Global Services and Paxful in 2025, and Canaccord Genuity in 2026.27FinCEN. Enforcement Actions28OCC. OCC Announces Enforcement Actions for April 202629OCC. OCC Announces Enforcement Actions for May 2026 The floor moves with inflation each January, but the shape of the ladder, from a private supervisory letter to a criminal guilty plea, has been stable for decades.