Noncompliance is the failure to follow a rule, regulation, policy, standard, or contract term that applies to you or your organization. In plain terms, it is the gap between what you were required to do and what you actually did or didn’t do. The requirement can come from a federal statute, a state law, an industry regulation, a government contract, or your own written policies, and the consequences range from a modest fine to criminal prosecution depending on which rule was broken and whether the violation was intentional.
You don’t always have to mean it. An employer who miscalculates overtime has committed wage noncompliance even if a spreadsheet formula was the only culprit. A hospital that misses a breach notification deadline is noncompliant even if the underlying data loss was someone else’s fault. The requirement is objective; your awareness of it usually isn’t a defense.
Why Intent Still Matters
Although noncompliance doesn’t require intent, intent decides what happens next. Regulators, courts, and sentencing guidelines draw sharp lines between “didn’t know,” “should have known,” and “knew and did it anyway.” A company that unknowingly mishandles patient data sits in a different penalty tier than one that skipped safeguards to cut costs. The IRS doubles down on this logic: once the agency shows any part of an underpayment was fraudulent, the entire underpayment is presumed fraudulent unless the taxpayer proves otherwise, and the fraud penalty is 75% of the fraudulent portion.1Office of the Law Revision Counsel. 26 U.S. Code 6663 – Imposition of Fraud Penalty
So when people ask what noncompliance “costs,” the honest answer depends less on the rule than on whether the person broke it by accident, by neglect, or on purpose.
Where Noncompliance Shows Up
Noncompliance exists in nearly every regulated sector. A few of the most common examples give a sense of the range.
Workplace Safety
Federal rules require employers to identify hazards and protect workers. Personal protective equipment is a frequent trouble spot: employers must provide it at no cost and train workers to use it.2eCFR. 29 CFR 1910.132 – General Requirements A single serious violation can cost up to $16,550, and the penalty applies per violation, not per inspection. If the same hazard affects 30 workers, that can mean 30 separate penalties. Failing to fix a cited hazard adds another $16,550 per day past the deadline, and willful or repeated violations run far higher. These figures adjust annually for inflation.3Occupational Safety and Health Administration. OSHA Penalties
Taxes
The IRS stacks penalties. Filing late costs 5% of the unpaid tax per month, capped at 25%, and a return more than 60 days late triggers a minimum penalty of $525 (for returns due after December 31, 2025) or 100% of the unpaid tax, whichever is less.4Internal Revenue Service. Failure to File Penalty A separate failure-to-pay penalty of 0.5% per month runs on top, and interest compounds on all of it.
There is one escape hatch for taxpayers who realize they’ve been willfully noncompliant. The IRS Voluntary Disclosure Practice lets people who intentionally hid income or evaded filing requirements come forward, cooperate, pay back taxes with interest and penalties, and generally avoid criminal prosecution. The disclosure has to reach the IRS before it opens a civil exam, receives a third-party tip, or starts a criminal investigation. Income from activities illegal under federal law doesn’t qualify.5Internal Revenue Service. IRS Criminal Investigation Voluntary Disclosure Practice
Healthcare and Patient Privacy
Healthcare is one of the most heavily regulated sectors. When a covered entity discovers a breach of protected health information affecting 500 or more people, it must notify the Department of Health and Human Services within 60 calendar days. Smaller breaches require notification within 60 days after the end of the calendar year in which they were discovered.6HHS.gov. Submitting Notice of a Breach to the Secretary Missing those deadlines is its own act of noncompliance on top of whatever caused the breach.
Civil penalties for privacy and security violations are tiered by culpability, starting at $145 per occurrence for a violation the entity couldn’t have known about and climbing to $2,190,294 per violation for willful neglect left uncorrected for 30 days.
The harshest tool in this area is exclusion from federal health programs. When a provider lands on the Office of Inspector General’s exclusion list, no federal program will pay for any item or service they furnish, prescribe, or direct, and the ban follows them across professions. Billing a federal program while excluded brings a civil monetary penalty of up to $10,000 per item or service plus treble damages, and employers who hire excluded individuals and bill federal programs face the same exposure.7Office of Inspector General. The Effect of Exclusion From Participation in Federal Health Care Programs Reinstatement after the exclusion period ends isn’t automatic; the individual has to apply.
Environmental Rules
Environmental penalties hit harder than most people expect. The EPA’s inflation-adjusted civil penalties for 2026 can reach six figures per day. Clean Air Act and hazardous waste violations each run up to $124,426 per day; Safe Drinking Water Act and toxic release violations reach $71,545; Clean Water Act violations reach $68,445.8eCFR. 40 CFR 19.4 – Statutory Civil Monetary Penalties, as Adjusted for Inflation, and Tables A violation that persists for months can generate penalties large enough to bankrupt a mid-sized company.
Criminal exposure is just as serious. Knowing violations of Clean Air Act emission standards carry up to five years in prison, doubled for a second conviction. Knowingly endangering another person through an air quality violation can bring up to 15 years. Even failing to report required information carries up to two years.9U.S. EPA. Criminal Provisions of the Clean Air Act
Wages and Hours
Wage noncompliance under federal law has a built-in multiplier. An employer who fails to pay the minimum wage or proper overtime owes the unpaid wages plus an equal amount in liquidated damages, which effectively doubles the liability.10Office of the Law Revision Counsel. 29 U.S. Code 216 – Penalties A court can reduce liquidated damages only if the employer proves the violation was in good faith and based on reasonable grounds to believe the conduct was lawful.11Office of the Law Revision Counsel. 29 U.S. Code 260 – Liquidated Damages Misclassifying employees as independent contractors, miscalculating the regular rate for overtime, and requiring off-the-clock work are the common culprits, and small per-pay-period amounts turn large after you multiply across workers, pay periods, and the doubling rule.
Securities and Public-Company Reporting
Public-company officers who knowingly certify financial reports that don’t meet disclosure requirements face up to $1 million in fines and 10 years in prison under Sarbanes-Oxley. Willful certification pushes the maximum to $5 million and 20 years. Destroying or falsifying records to obstruct a federal investigation can add another 20 years. These penalties fall on individual executives, not just the company.
Federal Contractors
Companies holding federal contracts have an affirmative duty to disclose. If a contractor finds credible evidence of criminal fraud, bribery, conflict-of-interest violations, or civil False Claims Act violations connected to the contract, it must report that evidence to the government, and the same goes for significant overpayments. Knowing failure to disclose on time is grounds for suspension or debarment, and the obligation runs until three years after final payment.12Acquisition.GOV. FAR 3.1003 Requirements
Debarment is the heaviest sanction in federal contracting. A debarred company can’t receive new contracts, work as a subcontractor, or act as an agent for other contractors. It usually lasts up to three years, extends to five for drug-free workplace violations, and the debarring official can go longer if needed to protect the government’s interests.13Acquisition.GOV. FAR Subpart 9.4 – Debarment, Suspension, and Ineligibility For a business that lives on government work, debarment ends the business.
Consequences Beyond the Fine
Dollar penalties are the headline, but they’re often not the worst part.
Personal Criminal Exposure
Corporate noncompliance doesn’t shield officers. Under the responsible corporate officer doctrine, prosecutors can charge executives with misdemeanor violations based on their position of authority, without proving they personally participated in or even knew about the misconduct. If a prohibited act happened within the company and the officer had the authority to prevent or correct it but didn’t, that can be enough. Courts have applied the theory to food and drug safety, environmental laws, and antitrust violations.
Losing the Business Itself
Agencies can halt operations until the organization comes back into compliance. In less dramatic cases, a company that fails to file required annual reports or pay state taxes can be administratively dissolved. A dissolved business can’t enter contracts, sue, defend itself in court, obtain permits, or complete mergers, and officers and owners may become personally liable for debts the business takes on afterward. Reinstating a dissolved business means filing paperwork, paying back fees, and often paying penalties and interest; the filing fee alone runs from $25 to $500 depending on the state, before you add the back taxes that caused the problem.
Interest That Doesn’t Stop
Noncompliance debts grow. The federal underpayment interest rate for the second quarter of 2026 is 6% for most taxpayers and 8% for large corporate underpayments, and it compounds daily.14Internal Revenue Service. Bulletin No. 2026-8 A liability that looks manageable in year one can grow substantially before the dispute is resolved.
Reputation
The hardest consequence to measure is often the most lasting. Customers leave, investors pull back, partners renegotiate or walk away, and public enforcement actions stay in search results indefinitely. For public companies, the stock-price hit from a major compliance failure can dwarf the fine. For smaller businesses, a single high-profile violation can change how the community sees them for years.
How Noncompliance Gets Found
Most noncompliance surfaces through one of three channels: internal monitoring, external inspection, or someone speaking up. Internal audits compare actual practice against documented procedures, test controls, and look for anomalies in the records. External inspections verify what the organization reports and catch what internal teams miss. Complaints and tips drive a surprising share of enforcement actions; agencies maintain intake systems specifically to capture them.15eCFR. 29 CFR 33.12 – Complaint Handling Procedures
Federal whistleblower programs make the third channel especially productive. The SEC pays eligible whistleblowers 10% to 30% of the monetary sanctions collected in actions where sanctions exceed $1 million, and the program has become one of the agency’s most productive sources of leads.16U.S. Securities and Exchange Commission. Whistleblower Program The IRS runs a parallel program: for cases involving more than $2 million in dispute (with individual taxpayers whose gross income exceeds $200,000), whistleblowers receive 15% to 30% of what the government collects. Awards are discretionary in smaller cases. A whistleblower who planned or initiated the noncompliance can see the award reduced by up to 100%, depending on their role.17Internal Revenue Service. Whistleblower Awards
How a Compliance Program Lowers the Risk
Having a real compliance program isn’t just good hygiene; it directly reduces penalties when something goes wrong. Under the federal sentencing guidelines for organizations, an effective compliance and ethics program in place at the time of the offense subtracts three points from the culpability score used to calculate fines, which can translate into millions in reductions. The credit disappears if the organization delayed reporting the offense or if senior leadership participated in, condoned, or ignored the misconduct.18United States Sentencing Commission. Chapter Eight – Sentencing of Organizations
The Department of Justice evaluates compliance programs with three questions: Is it well designed? Is it adequately resourced and empowered? Does it work in practice? A program that looks good on paper but lacks staff, training, or leadership support won’t earn credit. Prosecutors want concrete evidence that the program detects and prevents the kinds of misconduct most likely in the company’s industry, maintains confidential reporting channels, and applies real consequences when violations surface.19U.S. Department of Justice. Evaluation of Corporate Compliance Programs
What matters in practice is a risk assessment tailored to the actual business, accessible policies and procedures, training that goes beyond a yearly click-through, a reporting mechanism employees trust, and consistent enforcement when something is found. The point of all of it is to catch problems internally, fix them before an agency arrives, and have a documented record showing the organization took the rules seriously.