Bank compliance is the ongoing work a financial institution does to follow every federal law, regulation, and ethical standard that governs banking, from how it opens accounts and issues loans to how it monitors transactions and protects customer data. A bank that falls short can face fines reaching $1,000,000 per day, public enforcement orders, and restrictions on its ability to grow or operate. For customers, a working compliance program is what keeps deposits safe, personal data private, and the financial system stable enough to trust.
What follows is what compliance actually covers, who enforces it, how banks build programs to meet the rules, and what happens when they don’t.
The Core Regulatory Areas
Compliance is not one rule but a stack of them, each with its own statute, regulator, and set of procedures a bank has to build into daily operations.
Anti-Money Laundering and the Bank Secrecy Act
The Bank Secrecy Act is the foundation of anti-money laundering regulation in the United States. It gives the Treasury Department authority to require financial institutions to keep records and file reports that help detect money laundering, tax evasion, and other financial crimes.1FinCEN.gov. The Bank Secrecy Act Every bank must build a formal AML program around five required components: internal controls, independent testing, a designated compliance officer, ongoing employee training, and risk-based customer due diligence procedures.2eCFR. 31 CFR 1020.210 – Anti-Money Laundering Program Requirements for Banks
Before opening any account, a bank runs through its Customer Identification Program. At minimum, it must collect the customer’s name, date of birth, address, and an identification number, which is a taxpayer identification number for U.S. persons or a passport or government ID number for non-U.S. persons. The point is to form a reasonable belief that the bank knows who the customer really is.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks For business accounts, banks must also identify the beneficial owners of legal entity customers, generally any individual owning 25 percent or more of the entity plus the person who controls it.4FinCEN.gov. Information on Complying with the Customer Due Diligence Final Rule
Two reporting obligations sit at the heart of the AML function. A Currency Transaction Report is required for any cash transaction over $10,000 in a single business day, with multiple transactions by the same person aggregated.1FinCEN.gov. The Bank Secrecy Act A Suspicious Activity Report has a lower dollar threshold and a more subjective trigger: a bank must file a SAR for any transaction involving $5,000 or more when it knows, suspects, or has reason to suspect the funds are illegal, the transaction is structured to evade reporting, or there’s no apparent lawful purpose. Filing is due 30 calendar days after the bank first detects reportable facts. If no suspect has been identified by then, the bank gets another 30 days, but filing can never be delayed beyond 60 days from initial detection.5eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
Sanctions Screening
Every bank must screen its customers and transactions against sanctions lists maintained by the Treasury Department’s Office of Foreign Assets Control. The most important is the Specially Designated Nationals list, which identifies individuals, entities, and organizations subject to U.S. economic sanctions. Banks cannot process transactions with anyone on the list and must block any property in which an SDN has an interest.6Office of Foreign Assets Control. Specially Designated Nationals and the SDN List
The list is updated frequently on no set schedule, so banks rely on automated screening to catch new designations. When a potential match surfaces, staff investigate whether it’s real by comparing names, locations, and other identifying details. Close matches that can’t be resolved internally are reported to OFAC’s hotline for verification. Sanctions violations can trigger severe penalties even without intent to process a prohibited transaction.
Fair Lending and Consumer Credit
The Equal Credit Opportunity Act makes it illegal for a creditor to discriminate against any applicant in any aspect of a credit transaction based on race, color, religion, national origin, sex, marital status, or age. Discrimination based on receipt of public assistance income or good-faith exercise of consumer protection rights is also prohibited.7Office of the Law Revision Counsel. 15 USC 1691 – Scope of Prohibition When a bank denies an application or takes other adverse action, it must notify the applicant within 30 days and include the specific reasons or inform the applicant of the right to request them.8eCFR. 12 CFR 1002.9 – Notification of Action Taken
The Truth in Lending Act and its implementing Regulation Z require lenders to clearly disclose the cost of credit before a borrower commits. The annual percentage rate and total finance charge are the key figures, so consumers can compare offers on equal footing.9Consumer Financial Protection Bureau. 12 CFR Part 1026 – Truth in Lending (Regulation Z) For credit secured by a consumer’s principal home, such as a home equity loan or refinance, borrowers have a right of rescission and can cancel until midnight of the third business day after closing, receiving disclosures, or receiving the rescission notice, whichever comes last. If the lender never delivers the required notice or disclosures, the right extends up to three years.10Office of the Law Revision Counsel. 15 USC 1635 – Right of Rescission as to Certain Transactions Purchase-money mortgages, the loan used to buy the home in the first place, are excluded from this rescission right.
Data Privacy Under the Gramm-Leach-Bliley Act
The Gramm-Leach-Bliley Act requires banks to protect the personal financial information of their customers through two main mechanisms. First, banks must give customers clear notice of their privacy practices and an opportunity to opt out before sharing personal financial information with unaffiliated third parties. Second, banks must develop and maintain a comprehensive information security program that safeguards data from unauthorized access.11Federal Trade Commission. Gramm-Leach-Bliley Act The law also prohibits obtaining customer information through deception, such as impersonating a customer to extract account details.12Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act
Community Reinvestment Act
The Community Reinvestment Act requires banks to meet the credit needs of the entire communities they serve, including low- and moderate-income neighborhoods. Federal regulators evaluate each bank’s CRA performance and assign a public rating. Banks with poor CRA records can face obstacles when seeking regulatory approval for mergers, acquisitions, or new branches. The evaluation method depends on the bank’s size, with large banks assessed on lending, investment, and service tests and intermediate small banks evaluated on lending and community development.13Federal Reserve Board. Evaluating a Banks CRA Performance
Who Regulates Banks
No single agency oversees every U.S. bank. Authority is split among several federal regulators based on a bank’s charter type, size, and organizational structure.
- The Office of the Comptroller of the Currency charters, regulates, and supervises all national banks and federal savings associations.14Office of the Comptroller of the Currency. About the Office of the Comptroller of the Currency
- The Federal Reserve is the primary supervisor for all bank holding companies and regulates state-chartered banks that have joined the Federal Reserve System.15Federal Reserve Bank of St. Louis. Holding Company Supervision
- The Federal Deposit Insurance Corporation insures deposits up to $250,000 per depositor, per bank, per ownership category, and serves as the primary federal regulator for state-chartered banks that are not Federal Reserve members.16Federal Deposit Insurance Corporation. Understanding Deposit Insurance17Federal Deposit Insurance Corporation. Federal Deposit Insurance Act Section 3 – Definitions
- The Consumer Financial Protection Bureau has exclusive supervisory authority for consumer financial law compliance at banks with more than $10 billion in assets. For smaller banks, the institution’s primary prudential regulator handles consumer compliance.18Consumer Financial Protection Bureau. Institutions Subject to CFPB Supervisory Authority
Federal regulators conduct on-site safety-and-soundness examinations on a regular cycle, generally every 12 months. Well-run smaller institutions with strong ratings, adequate capital, no recent change in control, and no formal enforcement action can qualify for an 18-month cycle, though regulators reserve the right to examine sooner if conditions warrant.19Federal Deposit Insurance Corporation. Interim Final Rules on Expanded Examination Cycle for Certain Small Insured Depository Institutions
What a Compliance Program Looks Like Inside a Bank
Meeting these demands requires a formal, written compliance program approved by the bank’s board of directors. The program has to cover every area the bank is subject to, from AML and fair lending to data privacy, sanctions, and CRA, and translate each requirement into day-to-day procedures employees can actually follow.
The Chief Compliance Officer sits at the center of that framework. The CCO typically reports directly to the board or a dedicated compliance committee rather than through business-line management, and that independence matters. A compliance officer answering to the same executives whose revenue targets create compliance pressure is a compliance officer in name only. The role covers risk assessments to identify where the bank is most vulnerable, keeping policies current as regulations shift, and running monitoring systems that flag problems before regulators do.
Training connects policy to practice. Every employee who handles customer information, processes transactions, or makes lending decisions needs regular training on the rules governing their work. A teller needs to know CTR thresholds and structuring red flags. A loan officer needs to understand fair lending rules and adverse action notice requirements. Generic annual training that covers everything at a surface level is one of the most common weaknesses examiners flag.
Independent testing rounds out the program. Whether performed by internal audit staff or an outside firm, testing evaluates whether the bank’s controls actually work as designed. Regulators expect it to be genuinely independent; the compliance department should not be grading its own homework.
Penalties for Compliance Failures
When regulators find serious failures, they have a graduated set of enforcement tools that scale with the severity and intent of the violation. The most significant actions become part of the public record.
Cease and Desist and Consent Orders
A cease and desist order is the workhorse of bank enforcement. The appropriate federal banking agency can issue one whenever it finds that a bank or affiliated party has violated a law, breached a written agreement, or engaged in unsafe or unsound practices. The order requires the bank to stop the conduct and take specific corrective action.20Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution When the bank agrees to the terms without contesting, the document is called a consent order. Both are legally enforceable, publicly disclosed, and often include detailed corrective plans with deadlines.
Prohibition Orders
In the most serious individual cases, a regulator can permanently bar a bank officer, director, or other affiliated party from participating in the affairs of any insured financial institution. This requires a showing that the individual violated a law or engaged in unsafe practices, that the violation caused harm or financial gain, and that the conduct involved personal dishonesty or willful disregard for the institution’s safety. A prohibition order effectively ends a person’s career in banking.
Civil Money Penalties
Financial penalties follow a three-tier structure that reflects increasing culpability:
- Tier One covers general violations of any law, regulation, or written condition, with a statutory base of up to $5,000 per day the violation continues.
- Tier Two applies when a violation is part of a pattern, causes more than minimal loss, results in financial gain, or involves reckless unsafe or unsound practices. The base is up to $25,000 per day.
- Tier Three is reserved for knowing violations that cause substantial loss to the institution or substantial gain to the individual. The base is up to $1,000,000 per day for individuals; for institutions, the cap is the lesser of $1,000,000 or one percent of total assets per day.
These statutory bases are adjusted upward for inflation, so actual maximums in any given year run higher. The per-day structure means penalties compound rapidly: a bank that takes months to fix a known problem can face an enormous cumulative fine.
Beyond the direct financial hit, major enforcement actions damage a bank’s reputation in ways that ripple through the business. Stock prices drop, customers leave, and recruiting becomes harder when a bank is publicly operating under a consent order for AML or fair lending failures. Regulators can also restrict a bank’s ability to grow, pay dividends, or pursue acquisitions until the underlying problems are fully resolved.