Skip to main content
FinCrime Institute
Category: Enforcement and Penalties

Supervisory Action

Also known as: Common Supervisory Action (CSA), Supervisory Activity
Simply put

A supervisory action is a step taken by a financial regulator to check whether a firm is following the rules and to address problems it identifies. This can include activities such as examinations, requesting reports, and requiring a firm to fix weaknesses. Depending on the situation, supervisory actions may range from routine reviews to more formal measures that escalate when concerns are not resolved.

Formal definition

Supervisory action refers to the exercise of a supervisory authority's powers over a regulated financial institution to assess and enforce compliance with applicable laws, rules, and regulations. Such authority may include, but is not limited to, conducting examinations, requiring reports and disclosures, and enforcing compliance (see 12 CFR § 1235.7). In practice, the term covers a spectrum of measures: at one end, routine supervisory activities such as examinations conducted by a state agency over an institution within its regulatory authority; and at the other, the communication and escalation of supervisory concerns, which may culminate in formal enforcement action where concerns are not adequately remediated. The specific form, scope, and legal basis of a supervisory action vary by jurisdiction and by supervisory body, for example, coordinated exercises such as the European Securities and Markets Authority's Common Supervisory Actions (CSAs), run with national competent authorities to assess compliance with particular provisions under frameworks such as UCITS and AIFMD, are structured differently from US federal or state bank supervisory processes. Exact powers, procedures, and escalation thresholds should be confirmed against the applicable regulatory regime.

Why it matters

Supervisory action is the mechanism through which regulators translate written rules into observed practice. For an obliged entity, the difference between a program that exists on paper and one that functions in reality is frequently surfaced through supervisory activity, examinations, requests for reports and disclosures, and the communication of supervisory concerns. Because these measures sit on a spectrum, understanding where a given interaction falls, from routine review to escalated concern, helps firms calibrate their response and allocate governance attention appropriately.

The stakes are meaningful because supervisory action is often the stage at which weaknesses can still be remediated before matters escalate to formal enforcement. A US Government Accountability Office report published in 2024 examined how regulators communicated supervisory concerns to two banks and reviewed the procedures for escalating those concerns, illustrating that the manner and timeliness of supervisory communication, and a firm's responsiveness to it, can be consequential. That said, the specific powers, escalation thresholds, and consequences vary considerably by jurisdiction and supervisory body, so firms should not assume a uniform process applies across regimes.

Supervisory action also carries a coordination dimension. Exercises such as the European Securities and Markets Authority's Common Supervisory Actions, run together with national competent authorities to assess compliance with particular provisions under frameworks such as UCITS and AIFMD, allow supervisors to examine a defined issue consistently across multiple firms and jurisdictions. For compliance teams, this means a single thematic focus may be examined at many institutions simultaneously, and expectations identified in one such exercise can inform supervisory attention more broadly.

Who it's relevant to

Compliance officers and heads of compliance
These professionals are typically the primary point of contact for supervisory activity, from responding to examinations and information requests to managing the remediation of identified concerns. Understanding where an interaction sits on the spectrum, routine review versus escalated concern, helps them prioritize governance attention and resources appropriately and demonstrate responsiveness before matters escalate further.
Fund and asset managers under UCITS and AIFMD
Firms operating under the UCITS and AIFMD frameworks may be selected for coordinated exercises such as ESMA's Common Supervisory Actions, run with national competent authorities to assess compliance with defined risk-related provisions. Because these exercises examine a specific theme consistently across many participants, affected managers should track the focus areas identified and prepare to evidence compliance with the provisions under review.
Board members and senior governance functions
Because supervisory concerns can escalate toward formal enforcement where they are not adequately remediated, boards and senior management have a stake in ensuring the firm has procedures to receive, assess, and act on supervisory communications. Governance oversight of remediation timeliness and adequacy is often central to how a supervisor perceives a firm's responsiveness.
Legal and regulatory affairs teams
These teams advise on the legal basis, scope, and procedural rights attached to supervisory action, which vary by jurisdiction and supervisory body. They help firms confirm the specific powers and escalation thresholds under the applicable regime, such as those referenced in US regulations like 12 CFR § 1235.7 or under EU supervisory frameworks, rather than relying on assumptions of uniformity.

Inside Supervisory Action

Supervisory Authority
The competent body empowered to oversee an obliged entity's compliance with AML/CFT obligations. The identity of the supervisor varies by jurisdiction and sector, for example, FinCEN and the federal banking agencies in the US, the FCA in the UK, and national competent authorities designated under the EU AML framework. Some sectors are supervised by self-regulatory organisations where permitted.
Legal Basis
The source instrument authorising the action. Supervisory powers typically derive from statute and implementing rules rather than from the FATF Recommendations, which are standards rather than binding law. Examples include the US Bank Secrecy Act and FinCEN rules, the UK Money Laundering Regulations and the Proceeds of Crime Act, and the EU AML Directives or AML Regulation as transposed or applied nationally.
Triggering Conditions
The circumstances that prompt action, such as identified deficiencies in an AML programme, control failures, inadequate customer due diligence, reporting shortcomings, or breaches detected through examinations, thematic reviews, or off-site monitoring. Triggers are generally defined by the applicable regime and the supervisor's risk-based approach.
Range of Measures
The graduated tools available to a supervisor, which may include informal feedback, remediation requirements, formal directions, undertakings, restrictions on business, licence conditions or revocation, and monetary penalties. The specific measures available and their thresholds vary by jurisdiction and are set out in the relevant statutes and rules.
Administrative vs. Criminal Nature
Supervisory action is generally administrative or regulatory in character and is distinct from criminal prosecution for money laundering or terrorist financing offences. A supervisory finding or penalty addresses compliance failures and does not, by itself, establish that a criminal offence has been committed.
Procedural Safeguards
The due-process elements that typically accompany action, such as notice, the opportunity to respond, and rights of appeal or review. The precise procedures depend on the governing framework and administrative law of the jurisdiction.

Common questions

Answers to the questions practitioners most commonly ask about Supervisory Action.

Does receiving supervisory action mean the firm has committed a criminal offence?
No. Supervisory action is an administrative or regulatory response taken by a supervisory authority, and it is distinct from a criminal prosecution. A supervisor may impose remediation requirements, administrative penalties, or other measures where it identifies weaknesses in an AML/CFT program or non-compliance with applicable obligations, without any finding of criminal wrongdoing. Criminal liability for money laundering or related offences is generally established through separate criminal proceedings under the relevant criminal law, applying a different standard of proof. The existence of supervisory action does not by itself establish that any individual or entity has committed a crime.
Is supervisory action the same everywhere, applying a single global standard?
No. While the FATF Recommendations set out standards expecting countries to provide supervisors with adequate powers, including the ability to apply a range of proportionate and dissuasive sanctions, these are standards rather than binding law. The specific form, scope, and severity of supervisory action depend on the applicable domestic regime, for example the powers of supervisors under the UK Money Laundering Regulations, the frameworks reflected in the EU AML instruments, or the enforcement authorities available to US federal functional regulators and FinCEN under the Bank Secrecy Act. The types of measures, thresholds, and procedures vary by jurisdiction and by supervisor, and exact powers should be confirmed against the relevant regulation.
What forms can supervisory action take?
Depending on the regime and the supervisor's powers, supervisory action can range across a spectrum. It may include informal engagement such as guidance or requests for information, formal measures such as directions, remediation plans, or requirements to enhance controls, and more serious responses such as administrative fines, restrictions on business activities, conditions on authorisation, or in some cases withdrawal of authorisation. The specific measures available depend on the applicable framework and the powers granted to the supervisor, so obliged entities should identify which authority supervises them and what enforcement toolkit that authority holds.
How should a firm respond when it receives a supervisory finding or action?
As an operational matter, firms typically engage constructively with the supervisor, seek to understand the precise nature of the finding and the source obligation it relates to, and where remediation is required, develop a documented and time-bound remediation plan with clear ownership. Firms generally involve senior management and the board or equivalent governance body, given accountability for the AML/CFT program, and consider whether legal advice is appropriate. Because procedures and rights of representation vary by jurisdiction, firms should confirm the applicable process, including any right to make representations or appeal, against the relevant regulation.
How does supervisory action relate to a firm's risk-based approach?
Supervisors commonly assess whether a firm's AML/CFT controls are commensurate with the money laundering and terrorist financing risks it faces, so supervisory action often points to gaps between assessed risk and the measures in place. It is important to treat controls as measures to detect, deter, and mitigate risk rather than as guarantees, and supervisory action typically focuses on whether the firm's risk assessment, policies, and procedures are adequate, applied, and evidenced. Remediation is generally framed around strengthening the risk-based framework rather than achieving an assumption of zero risk.
How should firms document and evidence remediation following supervisory action?
As an operational practice, firms generally maintain records demonstrating what the supervisor identified, what actions were taken in response, who was responsible, and when steps were completed. Supporting evidence may include updated policies and procedures, revised risk assessments, training records, testing or assurance results, and management information reported to governance bodies. Clear documentation helps demonstrate that the firm has addressed the findings and supports any subsequent supervisory review. The specific evidentiary expectations depend on the supervisor and applicable regime and should be confirmed accordingly.

Common misconceptions

Supervisory action means the entity or its staff have committed a money laundering offence.
Supervisory action is generally administrative in nature and typically addresses failures in AML/CFT controls, reporting, or due diligence. It does not, by itself, establish criminal wrongdoing, which would be a separate matter determined under the applicable criminal law such as the Proceeds of Crime Act in the UK.
A single global standard governs when and how supervisors must act.
There is no single binding global rule. The FATF Recommendations are standards, not law, and supervisory powers and triggers are set out in divergent national instruments, for example the US Bank Secrecy Act and FinCEN rules, the UK Money Laundering Regulations, and the EU AML Directives or Regulation. Requirements and available measures vary by jurisdiction and sector.
Supervisory action is always a large monetary penalty.
Supervisors typically have a graduated range of measures, from informal feedback and remediation requirements to formal directions, business restrictions, and licence actions. Monetary penalties are one option among several and are applied according to the supervisor's risk-based approach and the governing rules.

Best practices

Confirm which supervisory authority has jurisdiction over your entity and sector, and identify the specific statutory instrument that grounds its powers rather than relying on FATF standards as if they were binding law.
Maintain documented, risk-based AML/CFT controls and clear audit trails so that any supervisory examination can demonstrate the design and operation of your programme.
Treat identified deficiencies as remediation triggers: track findings, assign ownership, and evidence timely corrective action before informal issues escalate to formal measures.
Distinguish clearly in internal communications between administrative supervisory findings and any potential criminal exposure, avoiding assumptions that a supervisory action implies an offence has occurred.
Understand the full graduated range of measures available to your supervisor so the organisation can prepare proportionate responses and preserve procedural rights such as notice and appeal.
Confirm exact thresholds, penalty parameters, and procedural steps against the applicable regulation for your jurisdiction, since these vary and should not be assumed to be uniform across regimes.