Regulators Are Rightsizing: Why the Enforcement Wave Just Peaked

The enforcement environment is normalizing. Not softening—normalizing.

From 2023 through early 2026, regulators (especially the Federal Reserve and OCC) pursued an aggressive enforcement strategy that felt personal. Failed audits triggered cease-and-desist orders. Compliance lapses triggered multi-million-dollar fines. Governance concerns triggered board restructuring demands. The message was unmistakable: We're in charge, and compliance is non-negotiable.

It worked. Sort of. Banks invested heavily in compliance infrastructure, hired experienced officers, and rebuilt board committees. But they also became bureaucratic, slow, and risk-averse. Customer-facing innovation stalled. Lending got more conservative. Smaller banks with limited resources got squeezed out.

Congress noticed. And they're pushing back—hard.

The Political Shift (And Why It Matters)

The Senate Banking Committee and House Financial Services Committee are now asking questions that were unthinkable 18 months ago:

• Why are bank compliance costs rising faster than banking profits?
• Are regulators overcorrecting for a few problem institutions?
• Are compliance requirements actually reducing risk, or just creating theater?
• Why are community banks exiting while JPMorgan's unresolved enforcement issues go unpunished?

The answer to that last question is particularly sharp: Large banks have enough scale and resources to absorb enforcement fines and comply with demanding orders. Community banks don't. Result: consolidation (which regulators say they want to slow) is accelerating (because of regulation).

Key recent moves:

• Senate Banking leadership called for a "compliance rationalization review" (code for: we think you're overdoing it)
• Three House members introduced the "Regulatory Restraint Act"—which would require cost-benefit analysis before issuing new enforcement actions
• Federal Reserve announced a "simplified compliance regime" for banks under $10B in assets (slower roll-out of certain regulations, extended transition periods)
• OCC backed off aggressive enforcement on governance issues—focusing instead on substantive risk, not board structure

This isn't Republican vs. Democratic. It's geographic and economic. Rural and suburban banking interests (both parties) are aligned: The big banks took all the risk. The small banks are paying all the penalties. Stop.

What the Rightsizing Actually Means

For banks currently in enforcement actions:

Your exit timeline is accelerating. Regulators are no longer looking for five-year remediation plans. They're asking: "Have you fixed the problem or not?" If you have, expect 6-9 months to resolution instead of 24-36. If you haven't, you'll feel pressure and political cover to either fix it fast or exit (via M&A).

The five banks that exited OCC enforcement recently (which we covered in article 2) were given political air cover they didn't have 18 months ago. Expect more.

For banks with marginal compliance issues (not yet in enforcement):

You have breathing room. Regulators are less likely to escalate minor exam findings to formal orders. This doesn't mean you ignore them—it means you can develop multi-year remediation plans and won't face sudden capital holds or board restructuring demands.

The risk: Don't misinterpret "breathing room" as permission to backslide. Regulators' patience has limits. Fix what's broken, but you can do it methodically rather than frantically.

For banks with robust compliance:

You just gained competitive advantage. While competitors navigate enforcement actions, you can: - Invest in customer experience and digital capabilities - Compete more aggressively on lending (less regulatory drag) - Attract risk officers and compliance officers from problem banks - Build market share in underserved segments (community lending, commercial real estate)

The banks with the cleanest operations and strongest controls will pull ahead. Compliance won't be a cost center anymore—it'll be a competitive weapon.

For banks with minimal oversight (under $5B):

The new "simplified compliance regime" is meaningful. You'll get: - Slower implementation timelines for new regulations (24-month extensions, not 6-month) - Simplified audit requirements (risk-based sampling instead of comprehensive testing) - Reduced reporting frequency on certain metrics - Relief from some post-2008 regulations that were meant for "systemically important" institutions

This opens room for margin expansion and strategic investment.

The Risks (Because There Are Always Risks)

Moral hazard: If banks believe enforcement is softening, they'll cut compliance corners. Regulators will then overcorrect again. This cycle has happened three times in the past 20 years.

Regulatory capture: Smaller banks now dominating the political conversation means their interests (easier rules, fewer requirements) override systemic risk concerns. This works until it doesn't.

Competitive distortion: Large banks face the same (or stricter) enforcement, so they don't benefit from rightsizing. They'll argue for "level playing field" and get political support. Expect new regs targeting large bank behaviors within 12-18 months.

False positivity: The enforcement wave peaked, but it didn't reverse. Regulators will still be aggressive—just more focused. Don't mistake "normalizing" for "friendly."

What This Means for Your Board

If you're in enforcement: - Accelerate your remediation timeline. You now have regulatory and political cover to exit. - Hire experienced officers for the final push. They're available because other banks are exiting enforcement. - Plan your post-enforcement strategy. What will compliance look like once you exit? Staff it up before you need it.

If you're managing marginal issues: - Develop a credible remediation plan (12-24 months, clear milestones). - Document your efforts quarterly with exam teams. Political pressure means regulators need to see progress. - Position compliance as enabling business strategy, not blocking it. This is the narrative shift that matters.

If you have clean operations: - This is your moment. While competitors manage enforcement, invest in customer acquisition and product development. - Rebuild your loan growth strategy. The fear that drove conservative underwriting is fading. - Compete for talent in underserved markets. Community lending, commercial real estate, and SME banking all have less regulatory drag now.

Universally: - Don't over-index on regulatory sentiment. The enforcement mood can shift again with a single high-profile failure. - Keep compliance investments strong. You're right-sizing expectations, not eliminating controls. - Stay engaged with your regulators. The political pressure is real, but your relationship with your exam team still matters more.

The enforcement wave peaked because it was unsustainable—both economically and politically. Banks that understood this 18 months ago already adjusted. The ones that bet everything on "we're so regulated now, compliance is set" are about to discover they misread the environment.

For most banks, rightsizing means opportunity. Use it.