People underestimate the cost of getting compliance wrong because they look at the fine and stop there. The fines alone are enormous. In 2023 the Irish regulator hit Meta with a record 1.2 billion euro GDPR penalty over data transfers.1 In 2024 TD Bank agreed to pay around 3 billion dollars over anti-money-laundering failures.2 Volkswagen's diesel scandal has cost the company something in the order of 30 billion dollars once fines, settlements and buybacks are added up.3 And in every one of these, the headline number is only the beginning.
The bill has six lines, not one
The fine is the visible line. Under it sit five more that rarely make the headline and often dwarf it. Remediation: the cost of actually fixing what was broken, usually far more than the penalty. Legal and investigation costs, which run for years. Lost business, as customers and partners walk. Management time, as the leadership spends a year on the problem instead of the business. And reputation, the hardest to price and the slowest to recover. Volkswagen paid the fines quickly. It is still paying for the story.
The solution, as a cost-of-failure ledger
Price the whole bill before you decide compliance is too expensive
| Line | What it is | Usually... |
|---|---|---|
| The fine | The regulator's penalty | The visible headline |
| Remediation | Fixing what was actually broken | Often bigger than the fine |
| Legal and investigation | Lawyers, forensics, years of it | Runs long after the news |
| Lost business | Customers and partners who leave | Quiet and cumulative |
| Management time | Leadership consumed by the crisis | The hidden opportunity cost |
| Reputation | Trust, and the price of rebuilding it | The longest tail of all |
Put a rough number on each line for a plausible failure in your business. The total is what compliance is actually protecting.
Why this reframes the whole spending decision
When compliance is a cost to be minimised, every pound spent on it feels like waste, because you are comparing it against zero. The comparison is wrong. The right comparison is against the full six-line bill of the failure it prevents, weighted by how likely that failure is. Seen that way, a competent compliance programme is not overhead. It is cheap insurance against a cost that can, as Wells Fargo, TD Bank and Volkswagen all found, run into the billions and outlast the people who caused it.
This is not fear-selling. Most businesses will never face a billion-euro fine, and pretending otherwise is its own kind of dishonesty. But the shape of the bill is the same at every scale. For a small firm, the fine might be modest and the lost customer, the legal bill and the reputational hit might be what actually hurts. The lesson from the giants is not the size of the number. It is the number of lines.
Questions to ask before you cut a compliance cost
- What is the plausible failure this control prevents, and how likely is it?
- What would the full six-line bill of that failure be for us?
- Are we comparing the cost of compliance against zero, or against the failure?
- Which line would hurt us most, the fine, or the lost trust?
- Is this spend overhead, or insurance we have mispriced?
Getting compliance wrong is expensive in a way that a single number never captures. The fine is the part that makes the news and, very often, the part that costs the least. Count all six lines, weight them by likelihood, and the case for doing compliance properly stops being a moral argument and becomes a financial one. That is the argument that actually moves budgets, and it is the honest one.
Notes and sources
- Meta fined a record 1.2 billion euros under GDPR by the Irish Data Protection Commission in 2023. Overview of the biggest GDPR fines. Link. ↩
- TD Bank agreed to pay around 3 billion dollars over anti-money-laundering failures in 2024. GARP. Link. ↩
- Volkswagen's dieselgate bill reached around 30 billion dollars in total costs. Reporting summary. Link. ↩
From the book
Compliance Beyond Ticking the BoxTurn compliance from a cost you endure into a system that protects the business and drives its growth.