Enforcement action
A formal step a regulator takes against a firm or person for breaking the rules, such as a fine, an order, a ban or a court case.
An enforcement action is a formal step a regulator or prosecutor takes against a firm or an individual for breaching laws or rules. Outcomes include fines and other monetary penalties, disgorgement, cease-and-desist and remediation orders, restrictions on permissions, industry bans and court proceedings. The volumes are material: the SEC brought 456 enforcement actions in its 2025 fiscal year, including 303 standalone actions and 69 follow-on administrative proceedings, according to its annual results release.
The form depends on the regulator. The SEC files civil actions in federal court or brings administrative proceedings. The FCA publishes Final Notices that set out its findings, the rules breached and the penalty. FINRA resolves many disciplinary matters through settlements that it publishes. Regulators also act jointly: in December 2022 the FCA and the PRA fined TSB Bank a combined GBP 48.65 million for operational risk management and governance failures linked to its IT migration.
Compliance teams can use an enforcement action as a source: the published findings show how a regulator reads its own rules in a concrete case, often in more detail than any guidance. The TSB case turned on the management of outsourcing risk in a change program the bank started itself, which is why the FCA horizon scanning guide uses it to price the cost of weak change governance.
A useful discipline is to treat a peer's enforcement action as a change event:
- Log the action, the regulator, the date and the rules cited.
- Record whether the same facts could arise in your firm, and why or why not.
- If they could, test the relevant controls and keep the result as evidence.
Enforcement data also shows the direction of travel, which is why it belongs in regulatory intelligence alongside rules and guidance. See also Dear CEO letter.
This entry is general information, not legal advice.
