Many boards have read this administration’s FCPA pullback as proof that enforcement risk has eased and compliance spending can ease with it. Michael Volkov, a compliance expert and attorney, calls that a dangerous misread: the Justice Department has reallocated its enforcement energy, not retreated, toward healthcare, procurement, tax and trade fraud — areas that touch far more companies than the FCPA ever did. Cut compliance now, he argues, and you see less just as the government sees more.
Every few years, a familiar narrative unfolds within corporate America: the perception that compliance is a discretionary overhead expense, ripe for trimming. This cycle, often driven by perceived shifts in the regulatory landscape, is currently playing out across numerous organizations. Compliance budgets are being flattened or reduced, headcount is being "optimized," chief compliance officers are being moved further from the executive suite, and programs meticulously built over years are being re-characterized as expendable costs to be right-sized.
The prevailing argument often goes something like this: Compliance, by its nature, does not directly generate revenue. The enforcement environment is perceived to have eased, and the belief is that a leaner team, augmented by advanced technology, can achieve the same level of risk mitigation. While technology can indeed enhance efficiency, the underlying premise that compliance is solely an overhead to be minimized is fundamentally flawed and potentially catastrophic.
Recent high-profile penalties, such as those levied against Bank of America, serve as a stark and sobering reminder of the consequences when compliance is present on the organizational chart but absent from the crucial decision-making processes. These cases underscore that a mere functional presence is insufficient; true compliance requires integration, authority, and the willingness to act on its findings, even when inconvenient.
Six Billion Reasons to Reconsider Compliance Cuts: The Bank of America Case Study
On October 13th, a consortium of regulatory bodies announced coordinated enforcement actions against Bank of America, resulting in substantial penalties. The Financial Crimes Enforcement Network (FinCEN) imposed a $1.2 billion civil penalty via a consent order, in which the bank acknowledged willful violations of the Bank Secrecy Act (BSA). The order detailed failures in maintaining an adequate Anti-Money Laundering (AML) program, a lack of timely suspicious activity report (SAR) filings, and an inability to effectively address national security risks associated with Chinese money laundering networks and illicit finance activities along the U.S.-Mexico border.
Complementing FinCEN’s action, the Office of the Comptroller of the Currency (OCC) levied a $750 million penalty for the same deficient AML program, which was credited against the FinCEN penalty. Additionally, the Office of Foreign Assets Control (OFAC) settled for $11.6 million, addressing apparent violations of sanctions programs related to Iran, Russia, narcotics trafficking, and terrorism. These violations, alarmingly, spanned from 2018 through mid-2025, indicating a persistent and systemic breakdown in controls.
This is not a narrative of a financial institution devoid of a compliance function. Bank of America possessed a compliance department, and by FinCEN’s own account, this function performed many of its intended duties. As early as July 2022, compliance personnel flagged a customer relationship – an online auto auction business – as carrying an unacceptably high risk with no discernible control measures. Their recommendation was to terminate the relationship. Investigations later revealed that this single customer was linked to well over a hundred suspicious transactions. Furthermore, internal testing repeatedly demonstrated that the bank’s primary transaction monitoring system was failing to detect illicit activities.
The critical failure was not in compliance’s ability to identify risks, but in its inability to effect change. The relationship management team reportedly argued that the client was commercially significant, generating approximately $6 million in annual revenue, and that terminating the relationship would be detrimental to business. Consequently, a "mitigation plan" was implemented instead of account closure. This customer continued to process payments until June 2025. In a particularly telling episode, when an internal system test yielded results unfavorable to senior leadership’s desired outcome, the head of financial crimes allegedly ordered the test to be repeated. The second iteration conveniently declared the system "working as intended," a conclusion FinCEN clearly did not share.
The financial implications are staggering. FinCEN estimated that the bank had likely saved hundreds of millions of dollars in compliance expenditures by allowing these systemic issues to persist. The subsequent remediation efforts are projected to require approximately 750 additional staff members, along with 800 consultants for a one-time lookback initiative. This lookback alone uncovered nearly 8,900 SARs that should have been filed. The bank has already recorded a $1.2 billion charge for the penalties. This figure does not encompass the extensive costs associated with the lookback, independent reviews, ongoing regulatory oversight, management time diverted from core business activities, significant reputational damage, or potential future consequences. The pursuit of short-term savings in compliance, in this instance, proved to be a Faustian bargain, deferring inevitable costs with exorbitant interest.
While the Bank of America case has garnered significant media attention, similar lessons, albeit on a different scale, are emerging. Pegasus Worldwide Logistics, a freight forwarding company with just 12 employees, was fined $175,015 by OFAC for a $5,950 machine transaction due to a delayed screening process that relied solely on name matching. A more robust screening process would have incurred a fraction of the penalty, along with the costs of remediation and ongoing reporting obligations now imposed on the company. The scale differs, but the underlying principle of underinvesting in compliance and technology remains identical.
Beyond the direct financial penalties, the less visible costs are often far more substantial. These include extensive investigation expenses, the imposition of independent monitors, lost business opportunities, the risk of debarment from government contracts, an increased cost of capital, executive turnover, shareholder litigation, and a profound erosion of public trust.
The Unquestionable Value of Compliance: A Function That Can Say "No"
The unique and indispensable value of a robust compliance function lies in its cross-functional perspective. Unlike individual business units focused on their specific objectives, compliance operates with a holistic view across all business lines, products, geographies, and customer segments. This vantage point enables the identification of systemic patterns that might otherwise go unnoticed, such as recurring issues in hotline reports, correlations between customer alerts and sales revenue, or the consistent appearance of the same control weakness across multiple divisions. This comprehensive insight is crucial for identifying and addressing problems when they are still nascent and manageable.
However, this critical "line of sight" is entirely dependent on two fundamental elements: access and authority. Compliance must have unfettered access to transactions, data, and key decision-making meetings. It must possess the ability to ask probing questions and receive timely, truthful answers. Crucially, it needs the authority to halt or suspend a transaction or relationship when inherent risks cannot be adequately controlled. Every one of these vital capabilities erodes significantly when an organization treats compliance as a cost center to be minimized. Budgetary reductions that shrink monitoring teams directly impair the function’s capacity for oversight. Reporting structures that bury the Chief Compliance Officer (CCO) several layers down diminish the audience for critical warnings. And a corporate culture that permits business leaders to routinely overrule or circumvent compliance recommendations without consequence renders those warnings effectively worthless.
The most pervasive failure observed is not the absence of a compliance function, but rather the absence of its stature and authority. Examining the pronouncements from FinCEN, the OCC, and OFAC in the Bank of America case reveals a clear focus: the penalties were not for the mere absence of policies, but for the critical gap between what the bank knew and what it did. Regulators highlighted internal reports that identified systemic misalignments years before any external intervention, and employees who had raised concerns that went unheeded.
Forward-thinking business leaders have long recognized that reputation, trust, and the quality of internal controls are invaluable intangible assets, often constituting a substantial and growing portion of a modern company’s overall enterprise value. Effective controls prevent losses and mitigate fraud. A reliable speak-up system ensures that issues are surfaced when they are still inexpensive to rectify. Investments made to protect these critical assets should not be viewed as costs, but rather as strategic investments in long-term sustainability and value preservation.
Beyond FCPA: Reallocating Enforcement Energy and Expanding Corporate Risk
A common and dangerous misconception that has taken root in many corporate boardrooms is the belief that a perceived reduction in Foreign Corrupt Practices Act (FCPA) enforcement signals an overall decline in regulatory risk. This reasoning fundamentally misunderstands the current enforcement landscape. The current administration’s approach to FCPA enforcement, while refined and narrowed in focus, does not represent an abandonment of the statute or a general retreat from corporate accountability. Instead, it signifies a strategic reallocation of enforcement resources and energy.
In June, the Department of Justice issued guidance directing prosecutors to concentrate foreign bribery cases on matters involving payments connected to cartels and transnational criminal organizations, as well as conduct that poses a direct threat to national security. This is a more targeted FCPA, not a weakened one. The enforcement zeal has not dissipated; it has been strategically redirected.
In April, the Justice Department established a new National Fraud Enforcement Division (NFED). By October 1st, this division issued a directive identifying four priority categories for corporate investigations: healthcare fraud, government procurement and contract fraud, tax and revenue evasion, and trade fraud, encompassing tariff evasion and forced labor. The False Claims Act has become a particularly potent tool for customs-related cases. Concurrently, OFAC, the Bureau of Industry and Security (BIS), and the Justice Department continue to vigorously pursue sanctions and export control enforcement actions. FinCEN’s Bank of America order, with its focus on Chinese money laundering networks and illicit finance along the southwest border, further exemplifies this shift.
Taken together, this pattern does not suggest a retreat from enforcement but rather a strategic reallocation of resources toward areas where the political, economic, and national security rationale is most compelling. Critically, these newly prioritized areas of enforcement touch a significantly broader spectrum of companies than the FCPA traditionally did. From healthcare providers and defense contractors to international trade firms and businesses involved in complex supply chains, the potential for regulatory scrutiny has demonstrably expanded.
Furthermore, the tools available for detecting misconduct have undergone significant advancements. The NFED directive explicitly highlights the use of data analytics through a national fraud detection center. It also instructs prosecutors to enhance whistleblower incentives, aiming to encourage reporting even from insiders who participated in the wrongdoing. Consequently, companies that choose to cut back on compliance may inadvertently be diminishing their own capacity to detect emerging problems precisely at a moment when governmental capabilities for detection are being significantly amplified.
For compliance officers facing pressure to reduce budgets, the imperative is to articulate the value proposition of compliance in terms that resonate with executive leadership and the board. This involves framing compliance not as a cost, but as a strategic imperative that protects shareholder value, enhances reputation, and ensures long-term business viability. Quantifying the potential costs of non-compliance, drawing upon real-world examples like the Bank of America case, can be a powerful persuasive tool.
Boards of directors, in turn, must adopt a more proactive and inquisitive stance. A fundamental question they should pose is: "In the past two years, how many times has compliance recommended against a course of action, and what was the outcome?" If the answer is "never," this should not be interpreted as a sign of smooth sailing but rather as a stark warning that compliance is either not being empowered to voice its concerns or its warnings are not being heeded. If the answer is "often, and the business overrode the recommendation," the board should demand a thorough review of each such instance to understand the rationale for overriding compliance and the subsequent business impact.
Bank of America’s own internal personnel identified and documented the systemic issues in writing for years. Any organization contemplating trimming its compliance resources should first rigorously assess whether its compliance officers possess the genuine authority to intervene and halt problematic activities. A critical lesson from recent enforcement actions is that rebuilding a compromised compliance program after a significant failure is invariably far more costly and complex than maintaining a robust and well-resourced program from the outset. The illusion of eased enforcement is a dangerous mirage, and those who mistake it for permission to disinvest in compliance do so at their own peril.
