Across corporate America, a quiet retrenchment is under way. Compliance budgets are being flattened or trimmed, headcount is being “optimized,” chief compliance officers are being moved further from the executive suite, and programs built over a decade are being described as overhead to be right-sized. The justification is usually the same: the enforcement climate has changed, so the risk has changed. The Bank of America penalties announced on October 13 should end that conversation. They show with unusual clarity what happens when compliance is present on the org chart but absent from the decisions that matter.

The Pattern in the Bank of America Record

FinCEN’s consent order is not a story of a bank with no compliance function. Bank of America had one, and by FinCEN’s account that function did much of its job. Compliance personnel identified that a major customer relationship carried too much risk and no evident way to control it, and they recommended closing the accounts. Investigators documented well over a hundred cases tied to a single customer, most of them fraud related. Internal testing repeatedly showed that the bank’s primary monitoring system was missing suspicious activity.

What failed was not the ability of compliance to see. It was the ability of compliance to act. The recommendation to exit the customer was met with the relationship team’s argument that the client was important and a closure would be detrimental. A mitigation plan replaced the closure, the risk it was supposed to address persisted for years, and the customer remained. When a test of the monitoring system produced a result senior leadership did not like, the order says the head of financial crimes had the test repeated. And FinCEN concluded that the bank had likely saved hundreds of millions of dollars in compliance expenditure while the problems went unaddressed.

That is the retrenchment problem in miniature. A compliance function can be staffed, trained, and technically competent, and still be unable to change what the organization does.

Line of Sight Is the Source of Compliance’s Value

The unique value of compliance is perspective. A compliance function sees across business lines, products, geographies, and customers in a way no single business unit can. It sees the pattern in the hotline reports, the correlation between a customer’s alerts and a sales team’s revenue, and the same control weakness showing up in three divisions. That cross-organizational line of sight is what lets a company catch a problem while it is still small.

Line of sight, though, depends on access and on authority. Compliance needs access to transactions, data, and decision meetings. It needs the ability to ask questions and get answers. And it needs the authority to hold or stop a transaction or relationship when the risk is not controlled. Every one of those capabilities erodes when a company treats compliance as a cost to minimize. Budgets that shrink the monitoring team reduce what the function can see. Reporting lines that bury the chief compliance officer several layers down reduce who hears the warning. And a culture in which business leaders can overrule or route around compliance without consequence reduces what the warning is worth.

The Stature Problem

The most common failure I see is not an absence of compliance but an absence of stature. In too many organizations, when compliance raises a concern the business can ignore it, delay it, or circumvent it, and often does so successfully. Some of the signs are familiar:

• The chief compliance officer does not have direct, regular access to the board or its audit or risk committee, or reports through a function whose priorities conflict with compliance.
• The business can close a deal, onboard a customer, or retain a relationship over compliance’s objection with no formal escalation, documented rationale, or senior approval.
• Compliance is consulted after decisions are made, not before.
• Compensation and promotion for business leaders do not reflect compliance outcomes.
• When compliance says no, the response is to ask who else can say yes.

The government has been explicit that it examines exactly these questions. In evaluating a program, prosecutors ask whether compliance has sufficient autonomy, seniority, and resources, and whether it has access to the data it needs. A function that cannot stop a transaction is not a control; it is a record of warnings.

What Regulators Penalize Is the Gap

Look at what FinCEN, the OCC, and OFAC actually emphasized. They did not penalize the bank for the absence of policies. They penalized the gap between what the bank knew and what it did. They cited internal reports that identified miscalibration years before any regulator did. They cited employees who raised concerns. They cited management that, in FinCEN’s words, focused on the effect on resourcing rather than on remediation. That framing is exactly what a prosecutor or regulator will see in any company that lets compliance warnings go unanswered.

What Real Stature Looks Like

Companies serious about compliance do several concrete things.

They give the chief compliance officer a seat at the table. Direct reporting access to the CEO and the board, with regular executive sessions and the ability to escalate without permission, signals that compliance matters.

They build a formal override process. If the business wants to proceed over compliance’s objection, the decision should require a documented rationale, senior approval above the business line, specific mitigating controls, a review date, and visibility to the board.

They embed compliance in the front end of decisions, such as new customers, new markets, third-party engagements, acquisitions, and new products, not after the fact.

They protect independence in testing and monitoring. Nobody should be able to ask for a test to be rerun until the result is acceptable, and the metrics used to evaluate controls should be set before results are known.

They tie incentives to behavior. Leaders who retain high-risk relationships over compliance’s objection should answer for the outcome.

They fund the function to the risk, not to history. When case volumes are expected to double after tuning a system correctly, the right response is to hire investigators, not to avoid tuning.

The Question for Boards

Boards should ask a blunt question: in the last two years, how many times has compliance recommended against something, and what happened? If the answer is “never,” that is not reassurance; it is a warning that compliance is not being asked or not being heard. If the answer is “often, and the business overrode it,” the board should want to see every instance. The Bank of America record is what that second answer can become.

The Bottom Line A weak compliance function is not a saving. It is a transfer of risk from a budget line you can see to a liability you cannot. Bank of America’s own people told it what was wrong, in writing, for years. The penalty arrived when the organization finally had to answer why nothing changed. Any company tempted to trim compliance should first ask whether its compliance officers could stop something if they needed to. If they could not, the problem is not the budget. It is stature, and the cost of ignoring it is rising.