Compliance violations occur when a business or an individual fails to follow a binding rule, whether that rule comes from a federal statute, a state regulator, an industry authority, or the company’s own written policies. Penalties range from a few thousand dollars for a single workplace safety infraction to 25 years in federal prison for securities fraud, and a single act of misconduct can trigger overlapping investigations from more than one agency because healthcare, financial, workplace safety, and data privacy regulators each enforce their own penalty structures independently.
Regulatory Rules Versus Internal Policies
The first thing to sort out is whether the rule broken came from the government or from the company itself. Regulatory violations involve breaking rules set by federal or state agencies that carry the force of law. They apply regardless of company size or whether anyone at the business knew the rule existed. Internal violations involve breaching standards a company sets for itself through employee handbooks, codes of conduct, and standard operating procedures. Internal rules bind through the employment relationship, so breaking one usually leads to discipline rather than government enforcement.
The two categories often overlap. Many internal policies exist precisely to prevent regulatory violations. A hospital’s rule requiring encrypted email for patient data exists because HIPAA requires it, so an employee who ignores the internal rule creates both a disciplinary matter and potential federal liability for the hospital. Treating internal standards as optional is how companies discover the regulatory consequences the hard way.
The Most Common Violation Types and What They Cost
HIPAA and Patient Data
Healthcare organizations face some of the most closely watched requirements in the country. HIPAA, codified starting at 42 U.S.C. § 1320d, governs how covered entities handle individually identifiable health information. The most common violations are unauthorized disclosure of patient records, failure to encrypt electronic health data, and failure to notify affected individuals within 60 calendar days of discovering a breach. That 60-day deadline is a hard line.
Civil penalties use four tiers based on culpability. At the lowest tier, where the entity genuinely didn’t know and couldn’t reasonably have prevented the violation, penalties start at $145 per violation. At the highest tier, where the violation stems from willful neglect and the entity made no effort to fix it within 30 days, the penalty can reach $2,190,294 per violation in a single calendar year. Criminal penalties apply separately when someone knowingly obtains or discloses protected health information: up to one year in prison for a basic offense, up to five years when done under false pretenses, and up to ten years when the purpose is commercial gain or malicious harm.
OSHA and Workplace Safety
The Occupational Safety and Health Act, starting at 29 U.S.C. § 651, requires employers to provide working conditions free of recognized hazards. Typical violations include failing to provide fall protection on construction sites, ignoring hazardous chemical labeling requirements, and skipping equipment training.
As of 2026, OSHA penalties stand at $16,550 per violation for serious and other-than-serious violations, and $165,514 per violation for willful or repeat offenses. Failure-to-abate violations add another $16,550 per day beyond the abatement deadline. Inspections happen on both scheduled and surprise bases, and the agency specifically prohibits advance notice of a visit.
Bank Secrecy Act and Anti-Money Laundering
Financial institutions operate under the Bank Secrecy Act, which requires them to file reports for cash transactions exceeding $10,000 in a single day, maintain records of negotiable instrument purchases, and report suspicious activity. A person who willfully violates BSA requirements faces up to $250,000 in fines and five years in prison. If the violation occurs alongside another federal crime, that jumps to $500,000 and ten years. Banks themselves face criminal penalties up to the greater of $1 million or twice the transaction value.
Sarbanes-Oxley and Financial Reporting
Publicly traded companies must comply with the Sarbanes-Oxley Act at 15 U.S.C. chapter 98, which set strict rules on financial reporting, internal controls, and auditor independence after the corporate scandals of the early 2000s. Corporate officers must personally certify the accuracy of financial statements filed with the SEC. A CEO or CFO who knowingly certifies a misleading report faces up to $1 million in fines and ten years in prison. If the certification is willful, the maximum climbs to $5 million and 20 years.
The broader securities fraud statute at 18 U.S.C. § 1348 carries penalties of up to 25 years for anyone who executes a scheme to defraud investors in connection with publicly traded securities. It applies to any person involved in the fraud, not just company officers.
Data Privacy and FTC Enforcement
The United States has no single comprehensive federal privacy law covering all sectors. The Federal Trade Commission uses Section 5 of the FTC Act to pursue companies that engage in unfair or deceptive practices involving consumer data, which in practice means the FTC steps in when companies fail to honor their own privacy promises, collect data without proper consent, or neglect basic security measures. Recent FTC enforcement actions have produced penalties ranging from $5.7 million to $100 million.
False Claims Act
The False Claims Act at 31 U.S.C. § 3729 shows how quickly penalties compound. Anyone who submits a false claim to the federal government faces a civil penalty of $5,000 to $10,000 per claim (adjusted annually for inflation) plus three times the government’s actual damages. Self-reporting before the government discovers the fraud can reduce damages to double rather than triple the loss. Government contractors, healthcare providers billing Medicare, and defense suppliers are the most frequent targets.
How Intent Scales the Penalty
The penalty for any given violation turns on three things: the type of violation, the violator’s intent, and whether the violation caused actual harm. Civil penalties are monetary fines the regulating agency imposes, often without any criminal case. Criminal penalties involve the Department of Justice and can mean prison time for individuals. Many regulatory schemes allow both to apply at once.
Across compliance areas, criminal penalties follow a rough pattern. Basic violations carry modest fines and short prison terms; violations committed knowingly, under false pretenses, or for personal gain carry dramatically higher consequences. The jump from a one-year maximum to a 20- or 25-year maximum often hinges entirely on whether prosecutors can prove the person acted willfully.
Administrative Consequences Beyond the Fine
License Revocation and Debarment
Regulators can shut down a company’s ability to operate. License revocation removes an entity’s legal authority to do business in its field. Under federal healthcare regulations, the Office of Inspector General can exclude any provider whose state license has been revoked for reasons related to professional competence, performance, or financial integrity, and that exclusion lasts at least as long as the underlying license suspension.
For companies dependent on government contracts, debarment does similar damage. Under the Federal Acquisition Regulation, the government can debar a contractor for fraud in obtaining or performing a public contract, antitrust violations, embezzlement, bribery, false statements, or tax evasion. Debarment typically lasts up to three years and bars the company from bidding on any federal contract during that period. The triggers are broad enough that even delinquent federal taxes exceeding $10,000 can lead to debarment.
Corporate Integrity Agreements
In healthcare, companies that settle fraud allegations with the federal government often enter Corporate Integrity Agreements with the HHS Office of Inspector General. These agreements run for five years and require the company to hire a dedicated compliance officer, retain an independent review organization, screen employees against exclusion lists, and submit annual reports on compliance activities. In exchange, the OIG agrees not to exclude the company from Medicare, Medicaid, and other federal healthcare programs. Breach the agreement, and both monetary penalties and the exclusion the company was trying to avoid come back on the table.
Remediation Costs
The fine is rarely the biggest number. Companies routinely spend millions on legal defense, internal investigations, system overhauls, and independent monitors. Data breach notification costs alone can run into the hundreds of thousands. Courts and regulators sometimes require independent monitors for years after a violation, adding ongoing overhead that dwarfs the original penalty. The total cost of a serious compliance failure frequently exceeds the statutory fine by a factor of five or more.
How Violations Get Detected
Audits and Automated Monitoring
Most violations surface through audits, not dramatic investigations. Internal audits, run by the company’s own staff, catch errors before they become public. External audits bring in independent third parties to verify that financial records and operational processes meet legal standards. These reviews usually happen annually, though unusual patterns in financial data or employee complaints can prompt off-cycle reviews.
Compliance monitoring increasingly relies on automated tools that plug into a company’s existing IT infrastructure, providing real-time dashboards across multiple regulatory frameworks, flagging gaps as they emerge, and collecting evidence for audits automatically. Companies that skip this investment are at a growing disadvantage when regulators arrive.
Whistleblowers
Whistleblowers uncover some of the largest compliance failures on record, and federal law provides both protection and financial incentive. Federal employees are protected under the Whistleblower Protection Act at 5 U.S.C. § 2302, which makes it illegal for a supervisor to take any adverse personnel action, including termination, demotion, or reassignment, because the employee disclosed evidence of fraud, waste, or abuse. Employees of publicly traded companies have separate protections under Sarbanes-Oxley. Under 18 U.S.C. § 1514A, public company employees who report conduct they reasonably believe constitutes securities fraud, mail fraud, wire fraud, or bank fraud are entitled to reinstatement, back pay, and litigation costs if they suffer retaliation.
The strongest financial incentive is the SEC’s whistleblower program under the Dodd-Frank Act. Anyone who provides original information leading to an SEC enforcement action of more than $1 million in sanctions can receive between 10% and 30% of the money collected. Through the end of fiscal year 2023, the SEC had awarded nearly $2 billion to roughly 400 whistleblowers. Dodd-Frank also gives whistleblowers who are fired or otherwise penalized the right to sue for reinstatement, double back pay with interest, and attorney’s fees.
What to Do When You Find a Violation Internally
A company that discovers misconduct in its own operations has to decide fast: report it to the government or hope no one else finds out. The Department of Justice has made the arithmetic on that decision increasingly clear. Under the DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy, companies that voluntarily self-report criminal misconduct, cooperate fully, and take appropriate remedial steps are eligible for a presumption that the government will decline to prosecute, absent aggravating circumstances.
To qualify, the disclosure must happen before the government learns of the misconduct through other means and before any imminent threat of exposure. The company must turn over all relevant facts, including information about the individuals involved, preserve and produce documents without waiting to be asked, and put in place real remediation: a functioning compliance program, discipline for responsible employees, and steps to address the harm. As of March 2026, the DOJ also allows companies that receive an internal whistleblower report to qualify for a declination if they self-report within 120 days, even if the whistleblower has already contacted the government.
Preventing Violations in the First Place
A compliance program on paper accomplishes nothing if it doesn’t work in practice. The U.S. Sentencing Guidelines at §8B2.1 define what counts as an effective compliance and ethics program for federal sentencing, and both the DOJ and federal agencies look at the same factors when deciding how to handle violations. An organization with a genuinely effective program can receive a lower culpability score at sentencing, which directly reduces financial penalties.
The core elements are straightforward:
- Written policies and procedures designed to prevent and detect the misconduct most likely in the company’s industry.
- Board-level oversight in which the governing authority actually understands the program’s content and effectiveness rather than rubber-stamping annual reports.
- Dedicated compliance leadership with day-to-day operational responsibility, adequate resources, real authority, and direct access to the board.
- Reasonable efforts to screen out anyone with a history of illegal activity from positions of substantial authority.
- Regular, role-specific training tracked for completion.
- Confidential, anonymous reporting channels that employees trust.
- Consistent discipline that applies equally regardless of seniority. Nothing destroys a compliance culture faster than executives getting passes that line employees would never receive.
- Prompt investigation and corrective action when problems surface, including updates to the program itself to prevent recurrence.
The companies that avoid the worst outcomes are the ones that treat compliance as an operational function with real authority and real funding, not a department that produces binders no one reads.