Penalty

Penalties come in three broad families. Administrative penalties are imposed by regulators, civil penalties by courts in non-criminal cases, and criminal penalties after conviction. Most legal systems use a penalty framework: a statute sets the range, and guidance sets out how to place a case within it. Common factors include the harm caused, how long the breach lasted, intent or recklessness, gain made, the firm's size and means, and cooperation. Repeat offending, or recidivism, usually raises the penalty, since an earlier sanction has plainly failed to change behaviour. Penalties also aim to deter others, not only to punish. Non-financial penalties such as bans or restrictions often bite harder than fines. Compliance teams read the penalty framework to estimate what a failure would really cost, beyond the headline fine.

For a breach of customer-money rules, a regulator starts from a base amount tied to the customer funds affected. It increases the figure because the firm had been warned before, then cuts it by 30% because the firm reported the issue itself. The final figure is published with the reasoning.