Supervision & Ratings

Civil Money Penalty

Also known as CMP

A Civil Money Penalty (CMP) is a monetary fine imposed by a bank regulator for violations of law, regulation, or supervisory agreement. CMPs can range from thousands to billions of dollars depending on the violation.

Formula

Maximum statutory CMP per day: Tier 1 ~$11K, Tier 2 ~$57K, Tier 3 ~$2.3M (per 12 USC §1818(i), inflation-adjusted annually).

The three statutory tiers escalate by severity. Tier 1 covers minor violations; Tier 2 covers reckless or pattern violations; Tier 3 covers knowing violations with substantial benefit or loss. Daily maximums multiplied by violation duration can produce penalties in the hundreds of millions or billions in egregious cases.

Why it matters

CMPs are the visible cost of enforcement. Large banks have paid record CMPs in recent years: $3B to Wells Fargo (2018, fake accounts), $1.5B to JPMorgan Chase (2020, spoofing), $1B to Bank of America (2023, BSA failures). CMPs go to the Treasury (and in some cases to harmed customers via restitution), not to the regulator.

How to interpret

CMP size is the regulator's signal of severity. Penalties under $1M reflect minor violations; $1M-$100M reflects significant control failures; over $100M signals systemic misconduct or material customer harm. CMPs are typically issued in conjunction with consent orders that require corrective actions.

Thresholds

Range	Label	Interpretation
< $1M	Minor	Routine violations or first-time issues.
$1M–$100M	Significant	Material control or compliance failures.
$100M–$1B	Severe	Systemic misconduct or extensive customer harm.
> $1B	Headline	Major bank-wide misconduct case.

Worked example

Wells Fargo Bank, N.A. paid a $3B Department of Justice civil/criminal penalty in 2020 in resolution of the fake-account scandal — separate from the consumer-restitution amounts already paid. The penalty was the largest in US banking history at the time and reflected the multi-year, bank-wide scope of the misconduct.

Frequently asked

Where does CMP money go?

To the US Treasury, except where the regulator orders specific consumer restitution. CMPs do not directly fund the regulator's operations. Some banks have also paid voluntary 'remediation' amounts directly to harmed customers in addition to formal CMPs.

Can multiple agencies impose CMPs for the same conduct?

Yes. A single bank misconduct can produce CMPs from multiple agencies (DOJ, OCC, FRB, FDIC, CFPB, SEC, state regulators) addressing different statutory violations. Total agency settlements in major cases often exceed $1B across all agencies.

How are individual employees affected?

CMPs against individuals (officers, directors, employees) are also authorized under §1818(i) and can include personal fines and prohibition orders. Individual prohibition orders bar named individuals from working in the banking industry.

Direction: Lower is betterUnits: $Call report: Public enforcement databasesBrowse banks

Sources

12 USC §1818(i) — Federal banking agency CMP authority
DOJ, OCC, FRB, FDIC, CFPB enforcement action databases

See CMP across 4,335 US banks

BankRegReports ranks every FDIC-insured institution by CMP, refreshed quarterly within 48 hours of FFIEC release.

Browse the directory →Browse by state Browse by asset tier