When budgets tighten, compliance is often among the first functions to feel the squeeze. The pitch is familiar: it produces no revenue, the enforcement environment has eased, and a leaner team can do the same work with better tools. Some of those points have a grain of truth. Technology can make compliance more efficient. But the underlying premise, that compliance is overhead to be minimized, is wrong, and the recent record shows how expensive it can be to act on it.

The Arithmetic of Underinvestment

Start with the most vivid example. FinCEN’s order against Bank of America found that the bank’s remediation was expected to double investigative case volume and require roughly 750 additional staff, plus 800 consultants for a one-time lookback, and concluded that the bank had likely saved hundreds of millions of dollars in compliance spending while the problems persisted. The bank has announced a $1.2 billion charge for the resulting penalties. That figure does not count the cost of the lookback, the independent reviews, the ongoing regulatory orders, management time, the reputational damage, or whatever else may follow. Saving money on compliance in this way was not saving. It was borrowing, at a punishing rate of interest, from the future.

A parallel lesson appears at the other end of the scale. A twelve-person freight forwarder paid $175,000 over a $5,950 machine because its screening was late and looked only at a name. The cost of a better screening process would have been a fraction of the penalty, the remediation program, and the continuing reporting obligations imposed on the company. The proportions differ, but the logic is identical.

The Costs You Do Not See on the Penalty Line

Penalties are the visible cost. The less visible costs often exceed them: investigation expense, monitorships and lookbacks, lost business with customers and government agencies, exclusion or debarment risk, higher cost of capital, executive turnover, litigation and shareholder claims, and the diversion of management attention. And there is the cost of lost trust. Customers, partners, regulators, and employees all make decisions based on whether they believe a company does what it says. That belief takes years to build and can disappear in a single announcement.

What the Best Leaders Understand

The strongest business leaders have always understood that ethics and compliance are part of how value is created. A company known for integrity attracts and keeps talented people, earns the benefit of the doubt from regulators, wins and keeps customers, and finds it easier to enter markets and partnerships. Reputation, trust, and the quality of internal controls are intangible assets, and in most modern companies intangible assets are a large and growing share of enterprise value. Investments that protect and build them are not costs in any meaningful sense. They preserve the assets on which revenue depends.

Compliance also supports financial performance directly. Good controls prevent loss and fraud. Good data and monitoring reveal operational problems early. Effective third-party management reduces supply chain disruption. A reliable speak-up system surfaces issues when they are cheap to fix. The discipline that prevents a violation also tends to improve process quality.

Reading the Enforcement Environment Correctly

The temptation to retrench is strongest when headlines suggest a lighter touch. But as the companion posts in this series explain, the enforcement environment has not lightened; it has shifted toward national security, trade, sanctions, financial crime, health care, and the use of the False Claims Act. And the tools to find problems have improved. The Fraud Division has described data analytics, artificial intelligence, whistleblowers, and a new national fraud detection center as sources of leads, and it has instructed prosecutors to build incentives for people who come forward, including those who participated in the conduct. A company that cuts compliance may be reducing its ability to detect problems at precisely the moment that the government’s ability to detect them is increasing.

How to Make the Case Internally

If you are a compliance officer facing pressure to cut, make the argument in the language leadership uses.

Quantify exposure, not activity. Instead of presenting training completion rates, present the risks the budget protects, using concrete examples: what a customs misclassification, a sanctions miss, or a monitoring gap would cost at your scale.

Use the peer record. The Bank of America order is a well-documented case study of what saving on compliance costs, as the government itself characterized it. Others are available in every sector.

Show the efficiency story. Where technology can reduce cost without reducing coverage, say so. Modernizing, automating, and prioritizing by risk is a better answer than across-the-board cuts, as long as it is validated.

Tie compliance to commercial outcomes. Show how controls support customer requirements, procurement eligibility, insurance terms, financing conditions, and acquisitions.

Establish red lines. Be explicit about the functions that cannot be cut without increasing risk beyond tolerance, and ask leadership to accept that risk in writing if they decide to proceed.

Questions for the Board and CEO

Before approving cuts, directors should ask what the program covers today and what it will no longer cover. They should ask which risks will be accepted, who has accepted them, and whether the trade-off has been documented. They should ask how compliance’s ability to see across the organization and to stop a transaction will change. They should ask what the plan is if the enforcement priorities change again. And they should ask what the cost would be if the program had to be rebuilt after a failure, because rebuilding is always more expensive than maintaining.

The Bottom Line

Cutting compliance to save money in an environment of expanding risk is the definition of penny wise and pound foolish. The evidence is in the numbers companies are paying right now. The wiser course is to treat compliance as what it is: a requirement for protecting reputation, building lasting value, and operating with the confidence that comes from knowing the organization is doing what it says it does.