Many boards have read this administration’s FCPA pullback as proof that enforcement risk has eased and compliance spending can ease with it. Michael Volkov, a compliance expert and attorney, calls that a dangerous misread: the Justice Department has reallocated its enforcement energy, not retreated, toward healthcare, procurement, tax and trade fraud — areas that touch far more companies than the FCPA ever did. Cut compliance now, he argues, and you see less just as the government sees more.
Every few years, someone in the C-suite stumbles over the fact that compliance is overhead. I have watched this movie before, and I know how it ends. Right now, the sequel is playing across corporate America. Compliance budgets are being flattened or trimmed, headcount is being “optimized,” chief compliance officers are being moved further from the executive suite, and programs built over a decade are being described as overhead to be right-sized.
The pitch goes like this: Compliance produces no revenue, the enforcement environment has eased, and a leaner team can do the same work with better tools. Some of those points have a grain of truth. Technology can make compliance more efficient. But the underlying premise, that compliance is overhead to be minimized, is wrong.
Let’s face it: If anyone still needs convincing, the Bank of America penalties announced Oct. 13 should end the conversation, as they show with unusual clarity what happens when compliance is present on the org chart but absent from the decisions that matter.
6 million reasons to overrule compliance
On Oct. 13, three regulators announced coordinated actions against Bank of America. FinCEN assessed a $1.2 billion civil penalty in a consent order in which the bank admitted to willfully violating the Bank Secrecy Act. The order found that the bank failed to maintain an adequate AML program, failed to file suspicious activity reports and failed to address national security risks tied to Chinese money laundering networks and illicit finance along the southwest border. The OCC imposed a $750 million penalty for the same deficient program, credited against FinCEN’s, and OFAC added an $11.6 million settlement for apparent violations of sanctions programs covering Iran, Russia, narcotics trafficking and terrorism. The violations stretched from 2018 into 2025.
This is not a story of a bank with no compliance function. Bank of America had one, and by FinCEN’s account that function did much of its job. In July 2022, compliance personnel identified that a customer relationship, an online auto auction business, carried too much risk and no evident way to control it, and they recommended closing the accounts. Investigators documented well over a hundred cases tied to that single customer. Internal testing repeatedly showed that the bank’s primary monitoring system was missing suspicious activity.
What failed was not the ability of compliance to see but the ability of compliance to act. The relationship team argued that the client was important, citing about $6 million in annual revenue and that a closure would be detrimental. A mitigation plan replaced the closure, and the customer kept processing payments until June 2025. When a test of the monitoring system produced a result senior leadership did not like, the head of financial crimes had the test repeated. The second test declared the system was “working as intended.” FinCEN disagreed.
Now do the arithmetic. FinCEN concluded that the bank had likely saved hundreds of millions of dollars in compliance spending while the problems persisted. Fixing them is expected to require roughly 750 additional staff, plus 800 consultants for a one-time lookback, and that lookback alone turned up nearly 8,900 suspicious activity reports that should have been filed. The bank has announced a $1.2 billion charge for the resulting penalties. That figure does not count the cost of the lookback, the independent reviews, the ongoing regulatory orders, management time, the reputational damage or whatever else may follow. Saving money on compliance in this way was not saving. It was borrowing, at a punishing rate of interest, from the future.
The BoA affair has drawn headlines, understandably, but the same lesson appears at the other end of the scale. A 12-person freight forwarder, Pegasus Worldwide Logistics, paid $175,015 to OFAC over a $5,950 machine because its screening was late and looked only at a name. A better screening process would have cost a fraction of the penalty, the remediation program and the continuing reporting obligations now imposed on the company. The proportions differ, but the logic is identical.
And penalties are only the visible cost. The less-visible costs often exceed them: investigation expense, monitorships, lost business, debarment risk, higher cost of capital, executive turnover, shareholder claims and lost trust.
No US Person, No Dollars, Still Sanctioned: Exploring Treasury’s Evolving Approach on Iran
Waves of OFAC actions have redrawn Iran-related exposure for aviation, shipping, digital assets, gold & tech
Read moreDetailsWhat good is a compliance function that can’t say no?
The unique value of compliance is perspective. A compliance function sees across business lines, products, geographies and customers in a way no single business unit can. It sees the pattern in the hotline reports, the correlation between a customer’s alerts and a sales team’s revenue and the same control weakness showing up in three divisions. That line of sight is what lets a company catch a problem while it is still small.
Line of sight, though, depends on access and on authority. Compliance needs access to transactions, data and decision meetings. It needs the ability to ask questions and get answers. And it needs the authority to hold or stop a transaction or relationship when the risk is not controlled. Every one of those capabilities erodes when a company treats compliance as a cost to minimize. Budgets that shrink the monitoring team reduce what the function can see. Reporting lines that bury the CCO several layers down reduce who hears the warning. And a culture in which business leaders can overrule or route around compliance without consequence reduces what the warning is worth.
The most common failure I see is not an absence of compliance but an absence of stature. Look at what FinCEN, the OCC and OFAC actually emphasized. They did not penalize the bank for the absence of policies. They penalized the gap between what the bank knew and what it did. They cited internal reports that identified miscalibration years before any regulator did and employees who raised concerns.
The strongest business leaders have always understood that the opposite is also true. Reputation, trust and the quality of internal controls are intangible assets, and in most modern companies, intangible assets are a large and growing share of enterprise value. Good controls prevent loss and fraud. A reliable speak-up system surfaces issues when they are cheap to fix. Investments that protect those assets are not costs in any meaningful sense.
Don’t read the FCPA pause as a permission slip
Even leaders who accept all of this tend to fall back on one last argument: Fine, but the government has stepped back, so the risk has stepped back too. This dangerous misreading has taken hold in many boardrooms. Because the current administration paused and narrowed FCPA enforcement, the argument goes, enforcement risk in general has dropped, and compliance spending can drop with it. That reasoning confuses one statute with the whole landscape.
The June 2025 guidance from then-Deputy Attorney General Todd Blanche directed prosecutors to focus foreign bribery cases on matters like payments connected to cartels and transnational criminal organizations and conduct that threatens national security. That is a narrower FCPA, not an abandonment of the statute. And the enforcement energy has not disappeared; it has been reassigned.
In April, the Justice Department stood up a new National Fraud Enforcement Division (NFED), and Oct. 1 that division issued a directive naming four priority categories for corporate investigations: healthcare fraud, government procurement and contracts fraud, tax and revenue evasion, and trade fraud, including tariff evasion and forced labor. The False Claims Act has become a primary vehicle for customs cases. OFAC, BIS and the Justice Department continue to bring sanctions and export control cases. And FinCEN framed its Bank of America order around Chinese money laundering networks and illicit finance along the southwest border.
Put together, the pattern is not retreat. It is a reallocation toward areas where the political and security rationale is strongest, and those priorities touch a far wider range of companies than the FCPA traditionally did.
The tools to find problems have also improved. The NFED directive points to data analytics through a national fraud detection center and instructs prosecutors to build whistleblower incentives that reach even insiders who took part in the conduct. A company that cuts compliance may be reducing its ability to detect problems at precisely the moment the government’s ability to detect them is increasing.
If you are a compliance officer facing pressure to cut, make the argument in the language leadership uses:
- Quantify exposure, not activity. Instead of training completion rates, show what a customs misclassification, a sanctions miss or a monitoring gap would cost at your scale.
- Use the peer record. The Bank of America order is a well-documented case study of what saving on compliance costs, as the government itself characterized it.
- Show the efficiency story. Modernizing, automating and prioritizing by risk is a better answer than across-the-board cuts, as long as it is validated.
- Establish red lines. Be explicit about the functions that cannot be cut without increasing risk beyond tolerance, and ask leadership to accept that risk in writing if they proceed.
Boards, for their part, should ask a blunt question: In the past two years, how many times has compliance recommended against something, and what happened? If the answer is “never,” that is not reassurance; it is a warning that compliance is not being asked or not being heard. If the answer is “often, and the business overrode it,” the board should want to see every instance.
Bank of America’s own people told it what was wrong in writing for years. Any company tempted to trim compliance should first ask whether its compliance officers could stop something if they needed to. And it should remember that rebuilding a program after a failure is always more expensive than maintaining one.
Michael Volkov is the CEO of The Volkov Law Group LLC, where he provides compliance, internal investigation and white collar defense services. He can be reached at 
