Compliance Failures in 2025 and 2026: Major Penalties, Common Causes, and How Organizations Can Fix Them

By the time a regulator becomes involved, the problem may have continued for months or years.

Enforcement actions announced in 2025 and 2026 show that compliance failures can affect organizations in almost every industry. Financial institutions were penalized for weak policies and consumer-data processes. Healthcare organizations faced settlements after cybersecurity and privacy failures. Manufacturers paid substantial amounts over environmental reporting and emissions. Government contractors faced False Claims Act allegations. Employers received safety citations after serious injuries and fatalities. Companies also faced sanctions, anti-corruption, privacy, and procurement-related enforcement.

The consequences go far beyond the initial fine. A compliance failure may lead to customer refunds, remediation projects, independent monitoring, reporting obligations, legal expenses, operational restrictions, management distraction, reputational damage, and lost business.

This article examines notable compliance failures from 2025 and 2026, the recurring reasons behind them, and the practical steps organizations can take to prevent similar problems.

What Is a Compliance Failure?

A compliance failure occurs when an organization does not meet a legal, regulatory, contractual, ethical, or internal policy requirement.

The failure may involve an action the organization took, such as submitting inaccurate information, making an improper payment, or discharging pollutants without authorization.

It may also involve something the organization failed to do, such as:

• Conducting a required risk assessment
• Implementing an adequate control
• Investigating a complaint
• Reporting an incident
• Protecting personal information
• Maintaining accurate records
• Training employees
• Monitoring a third party
• Correcting a known hazard
• Updating a policy after a regulatory change

Not every compliance failure leads to a financial penalty. Some are identified internally and corrected before they cause harm. Others result in warning letters, findings, remediation plans, license restrictions, civil penalties, criminal resolutions, or litigation.

The seriousness of the outcome can depend on the duration of the conduct, the number of people affected, the harm caused, whether management knew, whether records were falsified, and how the organization responded after discovering the issue.

Compliance Enforcement Remained Significant in 2025

The scale of U.S. enforcement activity demonstrates why companies cannot treat compliance as a documentation exercise.

The Department of Justice reported more than $6.8 billion in False Claims Act settlements and judgments for fiscal year 2025, the highest annual amount in the statute’s history. More than $5.7 billion related to healthcare matters. Whistleblowers filed 1,297 qui tam lawsuits during the year, also a record.

The Securities and Exchange Commission reported 456 enforcement actions for fiscal year 2025. The SEC stated that orders for monetary relief totaled $17.9 billion, although that figure included amounts treated as satisfied through other proceedings and large judgments from older litigation. After excluding those items, the SEC reported $1.4 billion in disgorgement and interest and $1.3 billion in civil penalties. It also received a record 53,753 tips, complaints, and referrals.

These figures show two important trends.

First, organizations face scrutiny from regulators, employees, consumers, investors, business partners, and whistleblowers. Second, a problem that remains hidden from management may still be visible to someone else.

Notable Compliance Failures and Penalties in 2025 and 2026

The following cases illustrate common compliance weaknesses. Settlement allegations do not always represent a judicial finding of liability, and proposed OSHA penalties may be contested or adjusted.

Organization or matter	Announced outcome	Compliance problem
Hino Motors	Global criminal and civil resolutions valued above $1.6 billion	False and fabricated emissions-testing data
Wells Fargo advisory firms and Merrill Lynch	$60 million in combined SEC civil penalties	Inadequate policies for cash sweep programs
Equifax	$15 million CFPB civil penalty	Weak consumer dispute investigations and flawed software
Lockheed Martin	$29.74 million False Claims Act settlement	Allegedly incomplete cost and pricing disclosures
PIH Health	$600,000 HIPAA settlement	Risk-analysis and breach-notification failures
Progressive Converting	$280,110 in proposed OSHA penalties	Machine guarding, energy control, and training failures
Chemours	More than $450 million estimated penalty and compliance obligations	Alleged PFAS releases and environmental violations
Four healthcare entities	$1.165 million in combined HIPAA settlements	Ransomware, risk-analysis, and notification failures
FleetPride	$264,380 in proposed OSHA penalties	Confined-space, respiratory, and electrical hazards
USAID bribery matter	Corporate resolutions and individual guilty pleas	Bribery, procurement manipulation, and concealed payments

1. Hino Motors: False Regulatory Data

In January 2025, regulators announced criminal and civil resolutions valued at more than $1.6 billion involving Hino Motors and related entities.

EPA stated that Hino submitted misleading, incomplete, altered, or fabricated emissions-testing data over several years. The conduct affected more than 110,000 diesel engines imported or sold in the United States.

The resolution included a $525 million civil penalty, a criminal fine, recall and mitigation obligations, and requirements to establish a compliance and ethics program.

What failed: The central problem was not a missed deadline or isolated paperwork mistake. Regulatory data itself was manipulated.

Lesson: Organizations should independently verify high-risk regulatory submissions. Employees who create performance data should not have unchecked authority to approve and submit the same information.

Controls should include data lineage, approval separation, exception reporting, audit trails, testing protocols, and channels for technical employees to raise concerns.

2. Wells Fargo Advisory Firms and Merrill Lynch: Policies That Did Not Address the Risk

In January 2025, the SEC announced $60 million in combined civil penalties against two Wells Fargo advisory firms and Merrill Lynch.

The SEC found that the firms failed to adopt and implement reasonably designed policies addressing client interests and adviser responsibilities relating to cash sweep programs.

What failed: The firms had compliance responsibilities, but their policies and processes did not adequately address how client cash was managed and how conflicts should be evaluated.

Lesson: A general conflict-of-interest policy is not enough. Policies must address the organization’s actual products, compensation structures, operating processes, and customer risks.

Organizations should test whether a policy answers the decisions employees face in real situations.

3. Equifax: Ineffective Processes and Flawed Software

The Consumer Financial Protection Bureau ordered Equifax to pay a $15 million civil penalty in January 2025 over failures in its handling of consumer disputes.

According to the CFPB, Equifax did not adequately consider documents submitted by consumers, allowed previously deleted inaccuracies to reappear, issued confusing communications, and used flawed software that contributed to inaccurate credit scores and duplicated accounts.

What failed: The problem crossed policy, technology, data quality, customer communication, and control monitoring.

Lesson: Automated processes can scale compliance failures as easily as they scale good controls.

Organizations should validate compliance-sensitive software before release, monitor outputs after deployment, test unusual cases, control code changes, and ensure that human reviewers can challenge automated decisions.

4. Lockheed Martin: Incomplete Government Contract Pricing Information

In February 2025, Lockheed Martin agreed to pay $29.74 million to resolve False Claims Act allegations involving pricing on certain F-35 contracts. This amount was in addition to $11.3 million previously paid to the Department of Defense relating to some of the same data.

The government alleged that the company did not provide accurate, complete, and current supplier cost or pricing information during contract negotiations. The settlement resolved allegations without a determination of liability.

What failed: Critical information allegedly did not reach the government during a regulated pricing process.

Lesson: Government contractors need clear controls over representations, certifications, estimates, costs, and disclosures.

Before a submission is certified, the organization should identify every data owner, reconcile source records, document assumptions, record exceptions, and require approval from someone independent of the commercial outcome.

5. PIH Health: Cybersecurity and Breach Response Failures

HHS’s Office for Civil Rights announced a $600,000 settlement with PIH Health in April 2025 after a phishing attack compromised 45 employee email accounts and affected nearly 190,000 individuals.

OCR identified potential failures involving a thorough risk analysis and timely breach notifications. The corrective action plan required risk analysis, risk management, revised policies, and employee training.

What failed: The cyberattack triggered the investigation, but the compliance concerns focused on the governance around the incident.

Lesson: A breach does not automatically prove compliance failure. However, the absence of a current risk assessment, appropriate controls, and timely notification can turn a security incident into a regulatory enforcement matter.

6. Progressive Converting: Safety Controls Not Implemented

In July 2025, OSHA cited Progressive Converting after investigations involving machine and hazardous-energy risks. The agency proposed $280,110 in penalties for repeat, serious, and other violations.

OSHA alleged failures involving machine guarding, energy-control procedures, and training for employees performing service and maintenance.

What failed: Required physical safeguards and operational procedures were allegedly absent or ineffective.

Lesson: Safety compliance cannot be managed through annual training alone. Critical controls must be visible at the worksite and verified through inspections, supervisor observations, maintenance procedures, and employee feedback.

7. Chemours: Long-Running Environmental Compliance Failures

In June 2026, the Justice Department and EPA announced a settlement with Chemours concerning PFAS releases from facilities in West Virginia, North Carolina, and New Jersey.

The agreement included a $22.5 million civil penalty, a $90 million mitigation program, pollution controls, and clean-water commitments. The combined cost of the penalty and required relief was estimated to exceed $450 million. The complaint alleged violations continuing for more than a decade.

What failed: The alleged failures involved environmental releases, permits, hazardous-waste requirements, and long-running control weaknesses.

Lesson: The eventual compliance cost can be much larger than the civil penalty. Organizations may need to fund remediation, monitoring, engineering controls, alternative water, testing, and long-term reporting.

Environmental compliance should therefore be connected to operational data, maintenance, capital planning, and executive risk decisions.

8. Four HIPAA Ransomware Settlements: Missing Risk Analysis

In April 2026, HHS OCR announced four ransomware settlements totaling $1.165 million. The incidents collectively affected more than 427,000 individuals.

OCR repeatedly identified inadequate or missing risk analyses. In one case, the agency also identified delayed breach notification. Each organization entered a corrective action plan subject to two years of monitoring.

What failed: The common theme was not simply that attackers gained access. It was that regulated entities had not adequately assessed and managed foreseeable risks to protected health information.

Lesson: A risk assessment must be accurate, current, organization-specific, and connected to remediation.

A generic security checklist completed once and stored for several years is unlikely to provide meaningful protection.

9. FleetPride: Confined-Space and Respiratory Protection Failures

OSHA cited FleetPride in July 2026 after an employee died while inspecting a tanker trailer.

The agency alleged 16 serious and three other-than-serious violations, including failure to implement a confined-space program, incomplete respiratory-protection controls, and electrical hazards. OSHA proposed penalties of $264,380.

What failed: The activity involved a known high-risk working environment, but the required program and safeguards were allegedly inadequate.

Lesson: Organizations must identify high-risk tasks before work begins. Permit-required activities should not rely on informal experience or employee judgment alone.

10 USAID Bribery Scheme: Procurement and Third-Party Controls

In June 2025, the Justice Department announced guilty pleas involving a USAID contracting official and three corporate executives in a bribery scheme connected to more than $550 million in contracts.

The government described concealed payments, false invoices, shell companies, payroll arrangements, gifts, and manipulated procurement decisions. Two companies admitted criminal liability and entered deferred prosecution agreements requiring compliance and ethics improvements.

What failed: The scheme exploited procurement authority, subcontractor relationships, payment systems, performance reviews, and weak detection of conflicts and unusual benefits.

Lesson: Anti-bribery compliance must include financial controls, procurement oversight, third-party monitoring, conflict disclosures, gift controls, and investigation of unusual payments.

Start your 21-day free trial and experience how VComply helps you with your policy management and compliance maturity.

Why Compliance Programs Fail

Although regulations differ, the root causes of compliance failure are remarkably consistent.

1. Compliance Exists Only on Paper

The organization may have a code of conduct, policies, annual training, and a hotline, but these elements are not integrated into daily operations.

A written policy is ineffective when:

• Employees cannot understand it
• Procedures do not support it
• Systems allow prohibited actions
• Managers do not enforce it
• No one monitors compliance
• Violations have no consequences

DOJ guidance asks whether a compliance program is well designed, implemented in good faith, adequately resourced, and working in practice.

2. Risk Assessments Are Generic or Outdated

Organizations sometimes repeat the same risk assessment every year without considering new products, markets, technology, regulations, acquisitions, vendors, incidents, or enforcement trends.

An effective risk assessment should identify:

• The requirement
• The affected activity
• The possible failure
• The likelihood
• The potential consequence
• Existing controls
• Control weaknesses
• Required improvement
• Responsible owner

3. Ownership Is Unclear

A compliance team may coordinate the program, but it cannot operate every control.

Each obligation should have a named business owner. Assigning responsibility to “operations,” “finance,” or “IT” is usually insufficient.

4. Policies Are Not Converted Into Controls

A policy may say the organization protects customer data. That statement must be supported by access controls, authentication, encryption, monitoring, backups, incident response, testing, and review.

Every important policy requirement should be connected to an observable activity or control.

5. Red Flags Are Ignored

Warning signs may include:

• Repeated complaints
• Unusual payments
• missing documents
• inconsistent test results
• frequent control overrides
• unresolved audit findings
• high employee turnover
• vendor resistance to due diligence
• rapidly changed data
• late or incomplete reports

Red flags should trigger review, not simply be stored in a report.

6. Data Governance Is Weak

Regulatory decisions depend on accurate information.

Organizations need to know:

• Where data originated
• Who changed it
• Which version is current
• How it was validated
• Which calculation was used
• Who approved it
• Where it was submitted

7. Third Parties Are Not Monitored

Due diligence completed at onboarding is not enough.

Vendors, distributors, agents, contractors, consultants, laboratories, and intermediaries should be monitored according to their risk.

8. Training Is Too General

Annual training may raise awareness, but it does not necessarily prepare employees for decisions in their roles.

High-risk employees need scenario-based training tied to their work.

9. Employees Do Not Trust Reporting Channels

A hotline has limited value when employees fear retaliation or believe reports will be ignored.

Organizations should monitor whether concerns are acknowledged, investigated, resolved, and used to improve controls.

10. Findings Remain Open

Repeatedly extending corrective-action dates can normalize noncompliance.

Extensions should require a reason, risk review, interim controls, and management approval.

How to Fix Compliance Failures

Step 1: Contain the Immediate Risk

When a serious failure is identified:

• Stop the activity when safe and legally appropriate
• preserve relevant records
• protect affected people
• notify legal and compliance leadership
• prevent further inaccurate submissions
• restrict access where needed
• assess reporting obligations
• establish interim controls

Do not destroy, rewrite, or backdate records.

Step 2: Establish the Facts

Determine:

• What happened
• when it began
• how long it continued
• who knew
• which systems were affected
• which records are reliable
• who may have been harmed
• which regulators, contracts, or policies are involved
• whether similar issues exist elsewhere

Serious matters may require investigation under legal privilege, depending on counsel’s advice.

Step 3: Identify the Root Cause

Do not stop at “employee error.”

Ask why the error was possible.

The root cause may involve:

• Poorly designed systems
• unclear procedures
• conflicting incentives
• inadequate staffing
• missing supervision
• weak training
• uncontrolled spreadsheets
• poor third-party oversight
• management pressure
• ignored audit findings

Step 4: Build a Corrective Action Plan

Each action should include:

• A named owner
• due date
• priority
• expected result
• interim control
• required evidence
• reviewer
• approval process
• effectiveness test

Step 5: Update the Risk Assessment

The failure should change how the organization understands its risks.

Review related departments, products, locations, systems, and third parties to determine whether the same weakness exists elsewhere.

Step 6: Redesign the Control

A control should specify:

• Who performs it
• what they review
• how often it occurs
• what evidence is retained
• what counts as an exception
• where the exception goes
• who approves completion

Step 7: Strengthen Monitoring

Useful monitoring may include:

• Exception reports
• data analytics
• trend reviews
• access reviews
• sample testing
• transaction monitoring
• site inspections
• vendor audits
• complaint analysis
• overdue-action reports

Step 8: Test Effectiveness

Do not close remediation because a new policy was published.

Test whether the new process prevents or detects the original problem.

DOJ guidance specifically considers whether remedial improvements and controls have been tested to determine whether they would prevent or detect similar misconduct.

Step 9: Improve Reporting and Escalation

Executives and boards should receive information about:

• Material compliance risks
• serious incidents
• repeated findings
• overdue corrective actions
• regulator contact
• whistleblower allegations
• control failures
• remediation progress

Step 10: Consider Self-Disclosure Carefully

Voluntary disclosure may affect the outcome of certain enforcement matters, but the decision is legal and fact-specific.

DOJ and other regulators may consider voluntary self-disclosure, cooperation, remediation, compensation, and discipline when resolving a matter. DOJ reported that some fiscal year 2025 False Claims Act settlements reflected reduced penalties or damage multiples for cooperation and remediation.

Organizations should consult qualified counsel before making a disclosure.

A Practical 90-Day Compliance Recovery Plan

Days 1–15: Stabilize

• Preserve records
• stop ongoing violations
• identify affected people and systems
• establish the investigation team
• make required notifications
• implement interim controls

Days 16–30: Diagnose

• Complete root-cause analysis
• map affected requirements
• identify control failures
• review similar operations
• assess third parties
• create the corrective action plan

Days 31–60: Remediate

• Update systems and procedures
• clarify ownership
• train affected employees
• correct inaccurate records
• strengthen escalation
• address disciplinary issues
• begin testing

Days 61–90: Verify

• Test redesigned controls
• review remaining exposure
• confirm evidence
• validate regulatory submissions
• report progress to leadership
• create long-term monitoring
• obtain independent review where appropriate

Questions Leadership Should Ask

Senior leaders and boards should ask:

1. What are our highest compliance risks?
2. Who owns each critical obligation?
3. Which controls have failed recently?
4. Which corrective actions are overdue?
5. Are employees reporting concerns?
6. Which third parties create the greatest exposure?
7. Can we trace regulatory data to its source?
8. Are compliance teams adequately resourced?
9. Do incentives encourage risky behavior?
10. Have remediation measures been tested?

Final Thoughts

The compliance failures announced in 2025 and 2026 were not confined to one industry or one type of regulation.

They involved environmental data, customer interests, credit reporting, government pricing, protected health information, workplace safety, international sanctions, pollution, and public procurement.

Despite these differences, the underlying lessons are consistent.

Compliance fails when responsibilities are unclear, data cannot be trusted, warning signs are ignored, controls exist only on paper, and corrective actions are repeatedly delayed.

An effective compliance program must connect requirements with people, processes, systems, monitoring, evidence, and leadership decisions.

The goal is not to create more policies. It is to make compliant behavior part of the way work is assigned, performed, reviewed, and improved.

Ready to strengthen policy management and compliance across your organization, Book a personalized demo with VComply and take the first step toward smarter compliance management.

Frequently Asked Questions (FAQs)

1. What is a compliance failure?

A compliance failure occurs when an organization does not meet a legal, regulatory, contractual, or internal policy requirement. It may involve missed deadlines, inaccurate reporting, weak controls, privacy breaches, safety violations, improper payments, or failure to correct a known issue.

2. What are the most common reasons compliance programs fail?

Common causes include unclear ownership, outdated risk assessments, weak implementation of policies, poor data quality, inadequate employee training, ignored warning signs, limited third-party oversight, and overdue corrective actions.

3. What are the consequences of a compliance violation?

Consequences can include civil penalties, criminal fines, customer refunds, regulatory monitoring, corrective action plans, legal costs, operational restrictions, reputational damage, loss of contracts, and increased scrutiny from regulators.

4. How can an organization fix a compliance failure?

The organization should contain the immediate risk, preserve records, investigate what happened, identify the root cause, assign corrective actions, update relevant controls and policies, train affected employees, and test whether the remediation is effective.

5. How can companies prevent future compliance failures?

Companies can reduce future failures by maintaining an up-to-date obligation register, assigning clear owners, automating deadlines and escalations, monitoring high-risk activities, reviewing third parties, encouraging employee reporting, and regularly testing whether controls work in practice.