What Is Bank Compliance? Rules, Regulators, and Penalties

Bank compliance is the ongoing work a financial institution does to follow every federal law, regulation, and ethical standard that governs banking in the United States. It covers how a bank opens accounts, screens customers, issues loans, monitors transactions, protects data, and serves its community. The stakes are concrete: regulators can impose fines reaching $1,000,000 per day for the most serious violations, issue public enforcement orders, and restrict a bank’s ability to grow, pay dividends, or acquire other institutions.

What Bank Compliance Covers

A bank’s compliance obligations run across several distinct bodies of law, each with its own rules, reports, and regulators. A compliant bank has to meet all of them simultaneously.

Anti-Money Laundering and the Bank Secrecy Act

The Bank Secrecy Act is the foundation of anti-money laundering regulation. It gives the Treasury Department authority to require financial institutions to keep records and file reports that help detect money laundering, tax evasion, and other financial crimes.¹ Every bank must build a formal AML program around five required components: a system of internal controls, independent testing, a designated compliance officer, ongoing employee training, and risk-based procedures for customer due diligence.²

Two reports do most of the day-to-day work. A Currency Transaction Report must be filed for any cash transaction exceeding $10,000 in a single day, with multiple same-day transactions by the same customer aggregated together.¹ A Suspicious Activity Report is triggered at $5,000 or more when the bank knows, suspects, or has reason to suspect the transaction involves illegal funds, is designed to evade reporting requirements, or has no apparent lawful purpose. SARs are due within 30 calendar days of initial detection, extendable by another 30 days if no suspect has been identified, but never beyond 60 days total.³

Before any of this, the bank has to know who its customer actually is. The Customer Identification Program requires collecting the customer’s name, date of birth, address, and an identification number — a taxpayer identification number for U.S. persons, or a passport or government-issued ID number for non-U.S. persons.⁴ For business accounts, banks must identify the beneficial owners of legal entity customers, generally meaning any individual who owns 25 percent or more of the entity and the person who controls it.⁵ In February 2026, FinCEN eased how often banks must reverify this information: banks now identify beneficial owners when a legal entity first opens an account, when previously collected information is called into question, or when risk-based procedures require it, rather than repeating the full process at every subsequent account opening.⁶

Sanctions Screening

Separate from AML, every bank must screen customers and transactions against the sanctions lists maintained by the Treasury Department’s Office of Foreign Assets Control. The Specially Designated Nationals list identifies individuals, entities, and organizations under U.S. economic sanctions. Banks are prohibited from processing transactions with anyone on the list and must block any property they hold in which an SDN has an interest.⁷ The list updates frequently and on no fixed schedule, so automated screening and timely review of potential matches are essential. Sanctions violations can bring severe penalties even without intent.

Fair Lending and Credit Disclosures

The Equal Credit Opportunity Act makes it illegal for a creditor to discriminate against any applicant in any aspect of a credit transaction based on race, color, religion, national origin, sex, marital status, age, receipt of public assistance income, or good-faith exercise of consumer protection rights.⁸ When a bank takes adverse action on a credit application, it must notify the applicant within 30 days and either provide the specific reasons or inform the applicant of their right to request them.⁹

The Truth in Lending Act and Regulation Z require lenders to disclose the cost of credit clearly before a borrower commits, most importantly the annual percentage rate and the total finance charge.¹⁰ Loans secured by a consumer’s principal home, such as home equity loans or refinances, carry a three-business-day right of rescission; purchase-money mortgages do not.¹¹

Data Privacy

The Gramm-Leach-Bliley Act requires banks to protect customers’ personal financial information. Banks must give customers clear notice of their privacy practices and an opportunity to opt out before sharing personal financial information with unaffiliated third parties, and must maintain a comprehensive information security program to safeguard that data.¹² The law also prohibits obtaining customer information through deception, such as impersonating a customer to extract account details.¹³

Community Reinvestment

The Community Reinvestment Act requires banks to meet the credit needs of the entire communities they serve, including low- and moderate-income neighborhoods. Regulators evaluate each bank’s performance and assign a public rating, and a poor record can block regulatory approval for mergers, acquisitions, or new branches. Large banks are assessed on lending, investment, and service tests, while intermediate small banks face lending and community development evaluations.¹⁴

Who Regulates Banks

No single agency oversees all U.S. banks. Authority is split based on a bank’s charter type, size, and organizational structure.

The Office of the Comptroller of the Currency charters, regulates, and supervises all national banks and federal savings associations.¹⁵
The Federal Reserve is the primary supervisor for all bank holding companies and regulates state-chartered banks that have joined the Federal Reserve System.¹⁶
The Federal Deposit Insurance Corporation insures deposits up to $250,000 per depositor, per bank, per ownership category, and serves as the primary federal regulator for state-chartered banks that are not Federal Reserve members.¹⁷¹⁸
The Consumer Financial Protection Bureau has exclusive supervisory authority for consumer financial law compliance at banks with more than $10 billion in assets. For smaller banks, the primary prudential regulator handles consumer compliance.¹⁹

Safety-and-soundness examinations run on a 12-month cycle by default. Well-run smaller institutions with top ratings, strong capital, no change in control in the previous year, and no formal enforcement action can qualify for an 18-month cycle, though regulators retain the right to examine sooner.²⁰

How a Bank Runs Its Compliance Program

Meeting these obligations requires a formal, written compliance program approved by the bank’s board of directors. The program must cover every regulatory area the bank is subject to and translate the rules into procedures employees actually follow.

The Chief Compliance Officer sits at the center. The CCO typically reports directly to the board or a dedicated compliance committee rather than through business-line management, and that independence matters. A compliance officer who answers to the executives whose revenue targets create compliance pressure is a compliance officer in name only. The CCO’s core work includes conducting risk assessments, maintaining and updating policies as regulations change, and ensuring monitoring systems catch problems before regulators do.

Training is the piece that connects policy to practice. Every employee who handles customer information, processes transactions, or makes lending decisions needs regular training on the specific rules governing their work. A teller needs to know CTR thresholds and structuring red flags. A loan officer needs fair lending rules and adverse action notice requirements. Generic annual compliance training that covers everything at a surface level is one of the most common weaknesses examiners flag.

Independent testing rounds out the program. Whether conducted by internal audit staff or an outside firm, testing evaluates whether the bank’s controls actually work as designed. Regulators expect the testing to be genuinely independent; the compliance department should not grade its own homework.

What Happens When a Bank Fails

Regulators have a graduated set of enforcement tools, and the most significant actions become part of the public record.

Cease and Desist and Consent Orders

A cease and desist order is the workhorse of bank enforcement. The appropriate federal banking agency can issue one whenever it finds that a bank or affiliated party has violated a law, breached a written agreement, or engaged in unsafe or unsound practices. The order requires the bank to stop the conduct and take specific corrective action.²¹ When the bank agrees to the terms without contesting, the resulting document is called a consent order. Both are legally enforceable, publicly disclosed, and typically include detailed corrective plans with deadlines.

Prohibition Orders

In the most serious individual cases, a regulator can permanently bar a bank officer, director, or other affiliated party from participating in the affairs of any insured financial institution. This requires a showing that the person violated a law or engaged in unsafe practices, that the violation caused harm or financial gain, and that the conduct involved personal dishonesty or willful disregard for the institution’s safety.²¹ A prohibition order effectively ends a career in banking.

Civil Money Penalties

Financial penalties follow a three-tier structure that reflects increasing culpability:

Tier One covers general violations of any law, regulation, or written condition. The statutory base is up to $5,000 per day the violation continues.
Tier Two applies when a violation is part of a pattern of misconduct, causes or is likely to cause more than minimal loss, or results in financial gain, and covers reckless unsafe or unsound practices. The statutory base is up to $25,000 per day.
Tier Three is reserved for knowing violations that cause substantial loss to the institution or substantial gain to the individual. The statutory base is up to $1,000,000 per day for individuals. For institutions, the cap is the lesser of $1,000,000 or one percent of total assets per day.²¹

These statutory base amounts are adjusted upward for inflation, so actual maximums in any given year are higher. The per-day structure means penalties compound rapidly during ongoing violations; a bank that takes months to fix a known problem can face a massive cumulative fine. Beyond the direct financial hit, major enforcement actions damage reputation in ways that ripple through the business. Stock prices drop, customers leave, recruiting becomes harder, and regulators can restrict a bank’s ability to grow, pay dividends, or pursue acquisitions until the underlying problems are fully resolved.

1
FinCEN.gov. The Bank Secrecy Act
2
eCFR. 31 CFR 1020.210 – Anti-Money Laundering Program Requirements for Banks
3
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
4
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
5
FinCEN.gov. Information on Complying with the Customer Due Diligence Final Rule
6
FinCEN.gov. FinCEN Exceptive Relief Order FIN-2026-R001
7
Office of Foreign Assets Control. Specially Designated Nationals and the SDN List
8
Office of the Law Revision Counsel. 15 USC 1691 – Scope of Prohibition
9
eCFR. 12 CFR 1002.9 – Notification of Action Taken
10
Consumer Financial Protection Bureau. 12 CFR Part 1026 – Truth in Lending (Regulation Z)
11
Office of the Law Revision Counsel. 15 USC 1635 – Right of Rescission as to Certain Transactions
12
Federal Trade Commission. Gramm-Leach-Bliley Act
13
Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act
14
Federal Reserve Board. Evaluating a Banks CRA Performance
15
Office of the Comptroller of the Currency. About the Office of the Comptroller of the Currency
16
Federal Reserve Bank of St. Louis. Holding Company Supervision
17
Federal Deposit Insurance Corporation. Understanding Deposit Insurance
18
Federal Deposit Insurance Corporation. Federal Deposit Insurance Act Section 3 – Definitions
19
Consumer Financial Protection Bureau. Institutions Subject to CFPB Supervisory Authority
20
Federal Deposit Insurance Corporation. Interim Final Rules on Expanded Examination Cycle for Certain Small Insured Depository Institutions
21
Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution