OMB Cancels 2026 Civil Penalty Inflation Adjustment: What M-26-11 Means for Compliance

TL;DR

• OMB Memorandum M-26-11 (April 17, 2026) cancels the 2026 inflation adjustment to all federal civil monetary penalties — the first cancellation since the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 took effect.
• Cause: BLS did not publish October 2025 CPI-U data due to the federal government shutdown, and the statute provides no alternative calculation method.
• Effect: maximum civil monetary penalties stay at 2025 levels across every federal agency — OFAC, FinCEN, SEC, OCC, Fed, FDIC, CFPB, BIS, State/DDTC.
• Practitioner work: refresh max-penalty references in policies, RCSA inherent risk, training, and board materials. Enforcement intensity does not change — only the per-violation cap.

For the first time in the decade since the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (FCPIAA) took effect, federal civil monetary penalties will not be adjusted for inflation. OMB Memorandum M-26-11, issued April 17, 2026, directs every federal agency to keep their civil monetary penalty (CMP) amounts at 2025 levels and to publish a Federal Register notice reflecting the no-adjustment outcome. The Federal Reserve Board’s revised notice (Doc. 2026-08747) — published May 5 — was one of the first agency notices to land under the new guidance.

This is not a policy change about how aggressively the government enforces. It is a one-year arithmetic glitch with implications for every compliance program that benchmarks risk against statutory maxima.

What the Memo Actually Says

FCPIAA requires every executive agency to adjust each civil monetary penalty annually, no later than January 15, using a cost-of-living multiplier calculated from the percentage change between the prior October’s CPI-U and the most recent October’s CPI-U as published by the Bureau of Labor Statistics. The 2026 multiplier would have been 1.02735 — a roughly 2.7% bump — based on November CPI-U comparisons that some agencies had projected before final October numbers became unavailable.

The catch: due to the federal government shutdown, BLS never published October 2025 CPI-U. The statute gives OMB no fallback. Per Baker McKenzie’s analysis, OMB concluded that any agency attempt to substitute a different index (September CPI-U, PCE deflator, etc.) would not meet the statutory standard and would likely be vacated on litigation. Better to skip a year than invite a wave of penalty challenges.

The memo’s operative direction is short:

1. Continue using 2025 CMP levels for any 2026 enforcement action.
2. Still publish a Federal Register notice — with zero adjustment — to comply with the procedural requirement.
3. Continue maintaining and reporting penalty updates in Agency Financial Reports under OMB Circular A-136.

That is it. No statutory amendment. No policy realignment. A clean pause.

What Stays the Same — and What Doesn’t

Compliance practitioners need to separate the headline from the actual operational impact.

The maximum CMPs that practitioners actually reference in compliance programs — OFAC’s per-violation IEEPA penalty cap, FinCEN’s BSA willful-violation cap, SEC’s tier-three penalties for fraud, the OCC’s Tier 3 penalties under 12 U.S.C. § 1818(i)(2)(C) — all stay at their 2025 numbers. None of those caps are routinely the binding constraint in actual enforcement actions, which usually multiply per-violation caps by transaction counts that dwarf the per-unit dollar.

Two examples that show why:

• FinCEN/SEC/FINRA coordinated Canaccord Genuity action in March 2026 — $80 million civil penalty for an AML program failure spanning more than six years. The settlement amount is driven by the duration and scale of the violations, not by any single per-violation cap.
• OFAC sanctions actions routinely involve thousands of transactions; the per-violation IEEPA cap rarely binds because agencies negotiate global settlements, not per-unit math.

The real impact of the freeze is administrative — references and benchmarks need a footnote, not a rebuild.

Practitioner Action Items

1. Update Penalty References Across Compliance Artifacts

Every place your program cites a “maximum civil money penalty” needs a one-line check this week. Common spots:

• AML and sanctions policies — BSA Tier 1/2/3 penalties; IEEPA per-violation caps; OFAC reckless-disregard caps.
• SEC compliance manuals — Tier 1/2/3 civil penalties under Section 21B and analogous provisions.
• Bank policies — 12 U.S.C. § 1818(i)(2) Tier 1/2/3 penalty schedules.
• Privacy and data protection — FTC Act Section 5(m), GLBA, and child privacy (COPPA) cap references.
• Training decks and onboarding — slides quoting maximum exposure.
• Board reporting — quarterly compliance dashboards that reference statutory maxima for inherent risk bracketing.

Add a footnote: “Civil monetary penalties remain at 2025 levels for calendar year 2026 per OMB Memorandum M-26-11.”

2. Recalibrate RCSA Inherent Risk

If your annual compliance risk assessment or RCSA scoring uses statutory maximum penalties as one of the inputs to inherent impact, you do not need to change scoring — but document the input as “2025 levels per M-26-11” so the next examiner who flips your work papers does not assume you forgot to update.

3. Track the Cycle for 2027

Plan a calendar reminder for January 2027. If BLS data normalizes by then, the January 2027 adjustment will incorporate the cumulative effect of the missed 2026 adjustment (or the agencies will have to interpret the statute to determine whether to compound or skip). That uncertainty is itself a risk-management item — the right response is a tracked open issue rather than waiting to be surprised.

4. Update Vendor and TPRM Penalty Disclosures

If your standard contract language references “applicable civil monetary penalties as adjusted annually,” confirm with legal that the language still works under a freeze. Most well-drafted clauses do — they reference whatever the current published maximum is, not a specific dollar amount.

5. Be Ready for the Question

Boards, audit committees, and senior leaders will ask one of two questions:

• “Does this reduce our regulatory exposure?” — No. Settlement amounts are not driven by per-violation caps, and enforcement intensity is unchanged.
• “Should we relax investment in compliance controls?” — No. The OCC’s Spring 2026 Semiannual Risk Perspective flagged elevated fraud, sanctions, and AML compliance risk, with no indication that supervisory expectations are softening.

The right answer is “this is a procedural pause with no operational effect on our risk profile.”

Control Failure Pattern: When the Adjustment Is the Risk

The historical reason inflation adjustment exists is to prevent statutory maxima from eroding under cumulative inflation — a $100,000 cap from 1990 would have lost roughly half its real value by 2025. The freeze creates a one-year erosion of about 2.7% in real terms across every CMP.

For programs whose risk frameworks use statutory caps as a calibration anchor, this is the kind of small drift that should be logged in a regulatory change tracker and revisited in next year’s cycle. The CRO and CCO should make sure this is captured in the regulatory change inventory rather than absorbed silently.

This is exactly the workflow the Issues Management Tracker is built for — log the regulatory change, assign an owner for the policy refresh, due-date the validation, and link to the M-26-11 source so the next person to ask can find the answer in three seconds.

What to Watch Next

Three downstream questions practitioners should track:

1. Will agencies that already published 2026 adjustment notices revise them? The Fed’s May 5 notice was one of the first revisions to conform. Expect similar revisions from agencies that beat OMB’s memo to publication.
2. Does the 2027 adjustment compound or skip? The statute is silent on this scenario. Compliance counsel should track OMB’s 2027 memo carefully.
3. Does Congress amend FCPIAA? The shutdown exposed a gap in the statute. A technical fix is plausible but not urgent — legislative action is unlikely in 2026.

Bottom Line

OMB M-26-11 is a small story with broad reach. Every federal civil monetary penalty stays at 2025 levels for 2026 because BLS did not publish October 2025 CPI-U during the shutdown. Compliance programs should refresh references, document the freeze in regulatory change logs, and avoid drawing any conclusion about enforcement intensity from a procedural pause. The penalties did not change. The risk did not change. The footnote did.

Sources

• OMB Memorandum M-26-11: Cancellation of Penalty Inflation Adjustments for 2026 (April 17, 2026)
• Federal Register, Civil Monetary Penalties—2026 Adjustment, Doc. 2026-08747 (May 5, 2026)
• Baker McKenzie Sanctions Blog, Inflation Adjustment for Federal Civil Monetary Penalties Nixed for 2026
• Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (Sec. 701, P.L. 114-74)