Bank of America learned what a weak program costs on 13 October 2026: more than $1.21 billion in US penalties, according to the US Treasury. The OCC's share, $750 million, was for a "deficient and ineffective" BSA/AML compliance program.
The OCC found that the bank's BSA Officer, the role other firms call the AML compliance officer, and staff "lacked sufficient skills and expertise". Key personnel missed training on suspicious activity. The audit function failed to catch concerns that examiners later found.
What does compliance mean? Definition and history in business
Compliance means following the rules that apply to a business and being able to show it. To define it as a bank supervisor would, the Basel Committee's paper on compliance and the compliance function in banks (April 2005) describes compliance risk as "the risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules", industry standards and codes of conduct. The standards and codes in that list are "likely to go beyond what is legally binding" (para 5), reaching into integrity and ethical conduct.
The modern history is short. SOX, the US corporate reporting law signed on 30 July 2002, made public companies report each year on their internal controls. Three years later, Basel set out how a bank should run a compliance function.
What is the purpose of compliance?
Compliance protects a firm from the three losses in Basel's definition: sanctions, financial loss and reputational damage. Reputational damage, Basel adds, can follow "even if no law has been broken". Compliance also protects customers. It keeps the license a bank, insurer or payment firm needs to trade.
What are the types of compliance?
Table 1. Types of compliance, with one current rule each (as of October 2026).
| Type | What it covers | One dated rule | Who sets or enforces it |
|---|---|---|---|
| Financial crime (AML and sanctions) | Customer checks, transaction monitoring, suspicious activity reports | Bank Secrecy Act (US); the EU's AML Regulation applies from 10 July 2027 | FinCEN and the OCC for US banks; national supervisors in the EU |
| Data protection | Personal data of customers and staff | GDPR Article 33: breach notice "not later than 72 hours after having become aware of it"; CCPA regulations effective 1 January 2026 | Data protection authorities; the California Privacy Protection Agency |
| Corporate and financial reporting | Accurate accounts and internal controls | SOX section 404 (15 U.S.C. 7262): a yearly internal control report by management | SEC |
| Card data security | Cardholder data in payments | PCI DSS v4.0: new requirements effective after 31 March 2025 | PCI Security Standards Council, an industry body rather than a regulator |
Each type has its own compliance requirements, supervisor and evidence, and one firm can carry all four. A payment company, for example, screens customers under AML law, reports a data breach under GDPR and protects card data under PCI DSS.
Which sectors are most heavily regulated?
The heaviest rulebooks follow the license. Banking and payments, insurance, healthcare, energy and telecoms all need one to operate, and in each a supervisor can examine the controls, fine the firm and, at worst, withdraw the license.
Who is responsible for compliance in a company?
The OCC's findings also reached management, which "failed to ensure the bank had an effective BSA/AML compliance program".
Basel sorts the duty in layers. The board oversees compliance risk, approves the compliance policy and, at least once a year, assesses whether that risk is managed well. Senior management runs it and reports up. The compliance function advises, trains, assesses risk and tests, while internal audit reviews the function itself. In the EU, AMLR Article 11 adds a compliance manager in the management body and a compliance officer for AML controls day to day.
Ask who is responsible for compliance and a bank has more than one right answer. The board and senior management are accountable, the compliance function advises and tests, and the staff who sell each product carry its compliance risk in every sale, since Basel holds that compliance "concerns everyone within the bank".
Which regulations and regulatory bodies set the rules, and what is their role?
Regulatory bodies write or enforce rules, supervise firms, examine controls and fine breaches: in the US the SEC for public companies, FinCEN for the Bank Secrecy Act and the OCC for national banks; in the UK the FCA; in the EU the national supervisors and data protection authorities. Standard setters such as FATF, the Basel Committee and ISO publish standards that laws, supervisors or contracts then adopt; ISO 37301:2021 is ISO's standard for compliance management systems.
What changed in 2026:
- 1 January: California's CCPA regulations took effect.
- 3 August: ISO reviewed and confirmed ISO 37301:2021, so the 2021 text stays current.
- 13 October: Treasury, FinCEN, the OCC and OFAC announced penalties of more than $1.21 billion against Bank of America.
- Next: the EU's AML Regulation applies from 10 July 2027.
Regulatory compliance vs corporate compliance: what is the difference?
Table 2. Regulatory compliance and corporate compliance side by side.
| Regulatory compliance | Corporate compliance | |
|---|---|---|
| Source of the rule | Laws, regulations and supervisors' rules | The firm's code of conduct, policies and board decisions |
| Who enforces it | Regulators and courts | The board, management and internal audit |
| What a breach brings | Fines, orders, action against the license | Discipline, a breach report, lost trust |
| Example | GDPR's 72 hour breach notice | Two approvers for every payment over a set amount |
Regulatory compliance answers to rules set outside the firm; corporate compliance answers to the firm's own. One control often serves both: a gifts register can meet a bribery law and the firm's own code at once.
How do companies stay compliant?
Companies stay compliant by repeating one cycle and keeping evidence of each step.
Table 3. The compliance cycle, stage by stage.
| Stage | Input | Output | Who decides |
|---|---|---|---|
| 1. Risk assessment | Products, customers, countries, applicable rules | Ranked compliance risks | Senior management; the board reviews yearly |
| 2. Policies and procedures | The risk assessment | Written policy and procedures | The board approves the policy |
| 3. Training | Policies, red flags, past breaches | Staff who know what to escalate | Head of compliance |
| 4. Monitoring and testing | Controls, samples of cases | Test results, breaches found | Compliance function |
| 5. Reporting | Test results, incidents | Reports to management and the board; filings to authorities | Head of compliance; the compliance officer for suspicious transactions |
| 6. Remediation and audit | Findings | Fixed controls, an independent review | Senior management; internal audit |
Prosecutors test the cycle with three questions from the DOJ's Evaluation of Corporate Compliance Programs (updated September 2024):
- Is the program "well designed?"
- Is it "adequately resourced" and given the authority to work?
- Does it "work in practice?"
The DOJ also asks whether a program is only a "paper program", and only records can answer that: who decided, when and why. In complead, formerly Sanction Scanner, regulatory compliance runs as workflows that record each decision, its owner and its approval as the work is done.
What are the penalties of non compliance?
Bank of America's penalties came with work attached: a third party lookback to find and report suspicious transactions the bank missed, and independent reviews of its monitoring and due diligence programs (Treasury). The bank also admits it "willfully violated the BSA" (FinCEN). FinCEN's $1.2 billion credits the OCC's $750 million, and OFAC settled 475 apparent sanctions violations for $11.6 million.
Here the penalties of non compliance went past the fine, into a consent order, a lookback and outside reviews.
This week, list five obligations your firm answers to and name one owner for each. Check when the board last assessed compliance risk. Then ask for evidence that one control ran last March, and time how long it takes to arrive.
Related terms
- AML compliance officer. The person who runs a firm's AML program and decides what goes to the FIU.
- Fraud vs money laundering. How the two crimes differ and which controls catch each.
- Regulation. A binding rule issued by a public authority under a law.
- DNFBP. Designated non financial businesses and professions, such as lawyers, accountants and casinos, that carry AML duties.
- MLRO. The money laundering reporting officer, who decides whether an internal suspicion becomes a report.
- Anti money laundering (AML). The laws, controls and reports that keep criminal money out of the financial system.
How this entry was checked. Checked on 26 October 2026 against the Basel Committee's paper on compliance and the compliance function in banks (April 2005), Regulation (EU) 2024/1624 Article 11, the Treasury, FinCEN and OCC releases of 13 October 2026, the DOJ's Evaluation of Corporate Compliance Programs (September 2024), GDPR Article 33, the CPPA regulations page, PCI SSC, SOX section 404 and ISO 37301. The definition follows the Basel Committee's wording on compliance risk. Onur Taner (Customer Success Manager, complead) wrote this entry and Dilara Diker, complead's Head of Compliance, reviewed it. Last reviewed: 26 October 2026.
