Regulators and fines
How regulatory fines are calculated
Short answer
- FCA seriousness levels
- 0%, 5%, 10%, 15% or 20% of relevant revenue 1
- FCA settlement discount
- 30% if agreed in stage 1, 0% in any other case 2
- EU antitrust basic amount
- Up to 30% of the value of sales, multiplied by years of participation 3
- EU antitrust cap
- 10% of total turnover in the preceding business year 3
- UK data protection higher maximum
- £17.5 million or 4% of total worldwide annual turnover, the greater for an undertaking 6
- US organizational fine table
- US$8,500 at offense level 6 or less to US$150,000,000 at level 38 or more 7
The common pattern
Published fining methods share a shape. The regulator measures how serious the breach was. It links that measure to a money figure, often a share of revenue or sales. It moves the figure up or down for the facts of the case. It then checks the result against a legal maximum. The four systems on this page follow that pattern 1,34,7.
A fine is different from disgorgement and from compensation. Disgorgement takes back the profit made from the breach. Compensation or redress goes to people who lost money. The FCA calculates disgorgement as a separate first step and does not apply its settlement discount to it 1,2.
UK Financial Conduct Authority: five steps
The FCA sets out its method for penalties on firms in chapter 6.5A of its Decision Procedure and Penalties manual 1.
- Step 1, disgorgement: the FCA seeks to deprive the firm of the financial benefit derived directly from the breach, where it can be quantified, and ordinarily adds interest 1.
- Step 2, seriousness: the FCA chooses a percentage of the firm's relevant revenue. Level 1 is 0%, level 2 is 5%, level 3 is 10%, level 4 is 15% and level 5 is 20% 1.
- Step 3, aggravating and mitigating factors: the Step 2 figure can be increased or decreased by a percentage. The Step 1 amount is not adjusted 1.
- Step 4, deterrence: the FCA may increase the penalty if the figure after Step 3 is insufficient to deter the firm or others 1.
- Step 5, settlement discount: the penalty is reduced when the firm agrees the amount and other terms. The reduction is 30% if the agreement is concluded during stage 1 and 0% in any other case 2.
European Commission: antitrust fines
For breaches of EU competition rules, the Commission's 2006 guidelines start with the value of the company's sales of goods or services to which the infringement directly or indirectly relates 3. The basic amount is a proportion of that value set by the gravity of the infringement, at up to 30% 3. That figure is multiplied by the number of years of participation in the infringement 3. The guidelines provide for adding a further sum of between 15% and 25% of the value of sales to the basic amount 3.
The basic amount can rise for aggravating circumstances. A company that continues or repeats a similar infringement after an earlier finding can see the basic amount increased by up to 100% for each such infringement 3. It can fall where mitigating circumstances exist 3. The Commission can apply a specific increase so the fine has a deterrent effect 3. The final amount cannot exceed 10% of the company's total turnover in the preceding business year 3.
UK data protection fines
The UK Information Commissioner's Office lists five steps in its fining guidance. They are seriousness, turnover, the starting point, aggravating and mitigating factors, and an adjustment so the fine is effective, proportionate and dissuasive 8.
At Step 1, a lower degree of seriousness gives a starting point of between 0% and 10% of the relevant legal maximum. Medium seriousness gives 10% to 20%. High seriousness gives 20% to 100% 4. At Step 2 the ICO can scale the figure for the size of the undertaking. For annual turnover up to £2 million the indicative range is 0.2% to 0.4% of the Step 1 starting point. Above £435 million for the standard maximum, or £437.5 million for the higher maximum, there is no turnover adjustment 5.
The standard maximum is £8.7 million or 2% of the undertaking's total worldwide annual turnover in the preceding financial year. The higher maximum is £17.5 million or 4%. For an undertaking the greater figure applies 6.
US federal courts: fines on organizations
When an organization is sentenced for a federal crime in the United States, the court applies Chapter 8 of the US Sentencing Commission Guidelines Manual. The base fine is the greatest of three figures. They are the amount in the Offense Level Fine Table, the pecuniary gain to the organization from the offense, and the pecuniary loss the organization caused intentionally, knowingly or recklessly 7.
The fine table runs from US$8,500 at offense level 6 or less to US$150,000,000 at offense level 38 or more 7. The court then calculates a culpability score. It starts with 5 points and applies the adjustments listed in the guideline 7.
Reading a fine in the news
A headline figure can combine several parts. An FCA total can include disgorgement plus a penalty reduced by a settlement discount 1,2. A reported EU antitrust fine is the figure after the 10% turnover cap 3. A UK data protection fine reflects both a seriousness band and a turnover adjustment 4,5. Two fines are only comparable when the method, the revenue base and any discount are known.
Common questions
What is the maximum EU fine for a competition breach?
Under the Commission's 2006 guidelines the final fine cannot exceed 10% of the company's total turnover in the preceding business year 3.
Does settling reduce an FCA fine?
Yes. Agreement during stage 1 brings a 30% reduction. Agreement later brings 0%. The discount does not apply to disgorgement 2.
What is the largest UK data protection fine allowed?
The higher maximum is £17.5 million or 4% of total worldwide annual turnover in the preceding financial year, the greater figure for an undertaking 6.
How does a US court set a fine for a company?
It finds a base fine, the greatest of a table amount, the gain to the organization or the loss caused, and then calculates a culpability score starting at 5 points 7.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@enforcementoutcomes.com.
Sources
- Financial Conduct Authority: FCA Handbook, DEPP 6.5A The five steps for penalties imposed on firms
- Financial Conduct Authority: FCA Handbook, DEPP 6.7 Discount for early settlement
- European Commission: Guidelines on the method of setting fines imposed pursuant to Article 23(2)(a) of Regulation No 1/2003 (1 September 2006)
- Information Commissioner's Office: Step 1: Assessment of the seriousness of the infringement
- Information Commissioner's Office: Step 2: Accounting for turnover
- Information Commissioner's Office: The maximum amount of a fine under UK GDPR and DPA 2018
- United States Sentencing Commission: Annotated 2025 Chapter 8
- Information Commissioner's Office: Data Protection Fining Guidance
Related
- What a regulatory investigation means
An investigation is not a finding. How the SEC, the UK FCA and the European Commission open, run and close investigations, with official figures.
- FCA enforcement outcomes
UK Financial Conduct Authority enforcement data for 2025/26 and 2024/25: outcomes, fines, convictions, operations closed, case durations and notices.
- EU competition and data protection fines explained
How EU antitrust, cartel, GDPR and Digital Markets Act fines work: legal caps, procedure, Commission cartel fine totals and a landmark GDPR decision.
- Settlements without admission explained
What neither admit nor deny settlements mean, the SEC's May 2026 change, and how the FCA, EU, ASIC and French prosecutors treat admissions.
- SEC enforcement outcomes
What the US SEC reported for fiscal years 2025 and 2024: enforcement actions, monetary relief, bars and investor distributions, and how an SEC case moves.