Modern banking can be astonishingly attentive. Forget your password and suddenly you're proving your identity with the persistence of someone trying to enter a nuclear facility. Somewhere, a tiny automated system is ready to send you seven notifications about an account balance. Then a major compliance story arrives, and you start wishing the big problems had received the same enthusiasm as the small ones.

On October 13, FinCEN announced a $1.2 billion penalty against Bank of America over compliance failures. The OCC separately assessed $750 million, credited toward FinCEN's amount rather than added on top. Reuters reported the bank's response: it says it has invested billions in financial-crime technology and dedicated thousands of employees to the effort, and remains committed to addressing regulators' concerns. That's a substantial response. It also raises a fairly obvious question: how do we know the improvements are working?

Regulation is not an optional accessory

The familiar political script says regulation is a burden. Businesses are dynamic; inspectors are tedious; the economy would soar if everyone stopped asking for paperwork. It sounds terrific until the paperwork turns out to be one of the things standing between a financial system and an expensive mess.

Rules can be badly designed. Regulators can make mistakes. Nobody needs to worship a filing cabinet. But that is an argument for competent oversight, not for treating oversight itself as an embarrassing hobby pursued by people who don't understand capitalism.

A bank is not a lemonade stand with a better website. Financial institutions sit inside a system the public depends on. Their responsibilities should match their reach. The more complicated the operation, the less convincing it is to suggest that complexity excuses weak controls. Complexity is why the controls exist.

The fine is the beginning of the question

A large penalty makes a satisfying headline. It gives everyone a number to point at and allows the news cycle to pretend the story has a neat ending. But the important question is what follows: better monitoring, competent staffing, reliable reporting, and evidence that the same problems won't quietly return after the attention moves elsewhere.

I'm less interested in whether a press release sounds remorseful than whether an independent reviewer can verify the repair. Corporate language is very good at announcing journeys, commitments, and progress. A broken elevator also has a journey. We'd still prefer it to reach the floor.

There is room for fairness here. Employees working on compliance are not interchangeable with executives setting priorities. A regulatory failure isn't proof that every customer transaction was illicit. And acknowledging the bank's stated remedial efforts is part of describing the story honestly. Accuracy makes criticism more useful; it doesn't make it less pointed.

The market doesn't inspect itself

The liberal case for regulation is that the public shouldn't have to rely exclusively on a company's assurance that it has everything under control. Institutions have incentives. Oversight exists partly because those incentives don't always align with the interests of everyone exposed to the consequences.

That is neither an attack on commerce nor a demand to replace every banker with a government employee carrying a whistle. It is an insistence that trust be supported by verification. If ordinary customers can be asked for documentation, institutions can be asked to demonstrate that their systems meet the rules.

And credit where it belongs: a regulator taking meaningful action deserves recognition even when the administration isn't your preferred political team. The point of supporting oversight is to support it when it happens, not to reserve applause for the right campaign merchandise.

The next useful headline will be about whether the repairs hold. Until then, let's retire the idea that compliance is dead weight.

Apparently, the paperwork was carrying more than we thought.