A consent order is a formal agreement between a firm and a regulator that settles an enforcement action. It usually sets a penalty and the changes the firm must make, and the firm agrees to it rather than fight the case in court.
Key takeaways
- A consent order settles an enforcement action by agreement with a regulator.
- It usually sets a penalty and the fixes the firm must make.
- The firm agrees to it instead of contesting the case.
- It is a common outcome of AML enforcement by bank regulators.
- It differs from a deferred prosecution agreement, which is criminal.
- Ignoring the terms of a consent order brings further, harsher action.
On this page
What it isHow it worksWhat it containsVs deferred prosecutionVs debarmentIn AMLWhy firms accept themHow firms respondFAQsRead more
$3.09B
TD Bank penalty, resolved partly through regulatory consent orders, 2024
Source: US Department of Justice
What is a consent order?
A consent order is a settlement. When a regulator finds a firm has broken the rules, the two often agree on how to resolve it, and that agreement is set out in a consent order.
The word consent is the key. The firm consents to the terms, usually a penalty and a list of required changes, rather than fighting the regulator in a lengthy legal battle. Both sides get certainty, and the matter is closed on agreed terms.
It is one of the most common ways AML cases end. Read more: the failures behind them often involve a weak AML compliance program.
How a consent order works
A consent order follows a fairly standard path, from finding to agreement. The steps are broadly the same across regulators.
- The regulator investigates. It examines the firm and identifies failures.
- Terms are negotiated. The regulator and firm agree on a penalty and required fixes.
- The order is issued. The consent order sets out the terms in a binding document.
- The firm complies. It pays any penalty and makes the required changes.
Because the firm agrees, a consent order avoids a contested hearing. It is faster and more certain than litigation for both sides.
What a consent order contains
A consent order typically sets out both the punishment and the path forward. Several elements are common.
- Findings. A description of the failures the regulator identified.
- A penalty. A financial amount the firm must pay, in many cases.
- Required actions. The specific changes the firm must make to fix the problem.
- Oversight. Sometimes a requirement to report progress or accept a monitor.
Often the required actions matter more than the penalty. Fixing the underlying failure is usually the regulator’s real goal.
Consent order vs deferred prosecution agreement
A consent order and a deferred prosecution agreement both resolve a matter by agreement, but they sit in different worlds. The difference is civil versus criminal.
A consent order is usually a civil or regulatory tool, agreed with a regulator to settle an enforcement action. A deferred prosecution agreement is a criminal tool, agreed with a prosecutor to hold criminal charges in abeyance. One resolves a regulatory failing; the other resolves potential criminal liability.
| Consent order | Deferred prosecution agreement | |
|---|---|---|
| Nature | Civil or regulatory | Criminal |
| Agreed with | A regulator | A prosecutor |
| Resolves | A regulatory failing | Potential criminal charges |
A single large case can involve both at once, a consent order with regulators and a separate agreement with prosecutors.
Consent order vs debarment
It also helps to separate a consent order from debarment, which people sometimes confuse. They do very different things.
A consent order settles an enforcement action, usually with a penalty and required fixes. Debarment excludes a firm or person from contracts or programs, such as government or development-bank work. One is a settlement; the other is an exclusion. A firm can face both, but they are separate consequences.
Get an indicative AML risk rating
See where your money laundering risk is concentrated so you can fix gaps before a regulator does.
Consent orders in AML
In anti-money laundering, consent orders are a familiar tool of the bank regulators. They are how many AML failures are formally resolved.
When a bank regulator finds AML failings, such as weak monitoring or poor controls, it often issues a consent order requiring the firm to fix them, frequently alongside a penalty. In its 2024 case, TD Bank resolved matters through a combination of a criminal plea and regulatory consent orders, part of a roughly $3.09 billion resolution. These orders, enforced under the Bank Secrecy Act framework, are a routine part of the AML enforcement landscape.
Why firms accept consent orders
Firms usually accept a consent order because the alternative is worse. Fighting a regulator is costly, slow, and uncertain.
A contested case can drag on for years, cost a fortune in legal fees, and still end in a loss, with the added glare of a public fight. A consent order brings certainty: known terms, a defined penalty, and a chance to move on. For most firms, agreeing is the pragmatic choice, even where they might dispute some of the findings.
How firms respond to a consent order
Once a consent order is in place, the firm’s job is to deliver on it fully. A few priorities shape a good response.
- Understand the terms. Be clear on exactly what is required.
- Fix the root cause. Address the failure, not just its symptoms.
- Show progress. Report on the changes the order requires.
- Meet every deadline. Deliver the required actions on time.
Document your controls in a policy
Generate a tailored AML policy draft that records the controls a regulator expects to see.
Screen a customer against watchlists
Run one search across sanctions, PEP, and adverse media data as part of stronger controls.
Frequently asked questions
What is a consent order?
A consent order is a formal agreement between a firm and a regulator that settles an enforcement action. It usually sets a penalty and the changes the firm must make, and the firm agrees to it rather than fight the case in court. In AML, it is one of the most common ways bank regulators resolve failings such as weak controls or poor monitoring.
How does a consent order work?
A consent order follows a standard path: the regulator investigates and identifies failures, the regulator and firm negotiate terms, the order is issued as a binding document setting out a penalty and required fixes, and the firm complies. Because the firm agrees, a consent order avoids a contested hearing, making it faster and more certain than litigation for both sides.
What does a consent order contain?
A consent order typically contains findings describing the failures the regulator identified, a financial penalty in many cases, required actions specifying the changes the firm must make, and sometimes oversight such as reporting or a monitor. Often the required actions matter more than the penalty, since fixing the underlying failure is usually the regulator’s real goal.
What is the difference between a consent order and a deferred prosecution agreement?
A consent order is usually a civil or regulatory tool, agreed with a regulator to settle an enforcement action. A deferred prosecution agreement is a criminal tool, agreed with a prosecutor to hold criminal charges in abeyance. One resolves a regulatory failing, while the other resolves potential criminal liability. A large case can involve both at once.
What is the difference between a consent order and debarment?
A consent order settles an enforcement action, usually with a penalty and required fixes. Debarment excludes a firm or person from contracts or programs, such as government or development-bank work. One is a settlement, and the other is an exclusion. A firm can face both, but they are separate consequences that do different things.
Are consent orders used in AML?
Yes. Consent orders are a familiar tool of bank regulators in anti-money laundering. When a regulator finds AML failings such as weak monitoring or poor controls, it often issues a consent order requiring the firm to fix them, frequently alongside a penalty. They are enforced under frameworks such as the Bank Secrecy Act and are a routine part of AML enforcement.
Why do firms accept consent orders?
Firms usually accept a consent order because fighting a regulator is costly, slow, and uncertain. A contested case can drag on for years, cost a fortune in legal fees, and still end in a loss, with the glare of a public fight. A consent order brings certainty: known terms, a defined penalty, and a chance to move on, making it the pragmatic choice.
Does a consent order mean admitting guilt?
Not always. In many consent orders, a firm agrees to the terms and required actions without formally admitting or denying the findings, though this varies by regulator and case. The focus is often on resolving the matter and fixing the failure rather than on a formal admission. The exact wording on admission depends on the specific order and the regulator involved.
What happens if a firm breaches a consent order?
Breaching a consent order is a serious matter, sometimes treated more harshly than the original failure. A consent order sets out a roadmap the regulator expects the firm to follow, and failing to deliver on the required actions signals the firm did not take the agreement seriously. This can bring further enforcement, additional penalties, or tighter oversight.
Who issues consent orders?
Consent orders are issued by regulators. In AML, this typically means bank regulators and financial supervisors, such as those overseeing banks and financial institutions in a given country. In the US, regulators including the bodies that supervise banks and enforce the Bank Secrecy Act issue consent orders to resolve AML and other regulatory failings by the firms they oversee.
How should a firm respond to a consent order?
A firm should understand exactly what the order requires, fix the root cause of the failure rather than just its symptoms, report on the changes it is making, and meet every deadline the order sets. Delivering fully and on time is essential, since failing to meet the required actions can bring harsher consequences than the original failing did.
Is a consent order public?
Consent orders are often made public by the regulator, which is part of their deterrent effect. Publishing an order tells the wider industry what failure occurred and what the consequences were, encouraging other firms to avoid the same mistakes. The public nature also adds a reputational cost for the firm, on top of any penalty and required remediation.
Read more: our ultimate guides, whitepapers and templates
Related guides and resources to help you act on what you just read.
Last reviewed July 12, 2026 · 11 min read · Written for compliance and risk professionals · By the WhoWiki editorial team
Key takeaway: a consent order is a formal agreement to settle an enforcement action with a regulator, usually setting a penalty and required fixes without a court fight.