Corporate Compliance Failures Brought Billion-Dollar Bills in 2025. Here’s Where the Costs Fell.

Federal fraud settlements and judgments reached a record $6.9 billion, led by health care. Major cases in retail, banking, manufacturing and technology show why the financial exposure extends beyond fines.

Federal False Claims Act settlements and judgments reached $6.89 billion in fiscal 2025, the highest annual total in the program’s history. Health care accounted for $5.72 billion, or 83.1%, according to a Captain Compliance analysis of Justice Department enforcement statistics. That was about nine times the amount attributed to Defense Department matters.

The costs were substantial elsewhere, too. Amazon’s Prime subscription case produced a $2.5 billion settlement. Discover faced at least $1.475 billion in merchant restitution and federal penalties. Google agreed to a $1.375 billion Texas privacy settlement. Those cases involved different laws, different remedies and different kinds of conduct, but each attached a substantial financial obligation to how a business operated.

Those figures measure different parts of the cost. Some annual totals overlap with individual cases. Some judgments include money credited against another obligation. Settlements can fund refunds over several years. Read together, the records show where several of 2025’s most consequential compliance costs arose, and why a company’s exposure can extend well beyond a regulatory fine.

Health care accounted for 83% of federal fraud recoveries

The Justice Department’s annual announcement identified health care as the main source of False Claims Act settlements and judgments. The law addresses knowing false claims for government money and can impose treble damages and penalties. Its health care cases span insurers, drugmakers, pharmacies and providers.

The department’s statistical tables divide recoveries by the government agency primarily involved. They provide a consistent comparison within this enforcement program, rather than a ranking of every industry under every U.S. law.

Source: Justice Department, FY2025 Fraud Statistics. Fiscal 2025 ran from October 1, 2024, through September 30, 2025. Percentages calculated from the published totals.

The mechanisms behind the cases matter as much as their size. In April 2025, Gilead Sciences agreed to pay $202 million to resolve allegations that its speaker programs paid kickbacks to induce prescriptions of HIV drugs. About $176.9 million went to the federal government; the remainder was allocated to states. Gilead made factual admissions as part of the settlement.

Prosecutors described repeat attendance at programs on the same subject, expensive meals and payments to high prescribers. They said Gilead’s own data should have alerted it to abuses. For businesses that pay professionals to educate customers or promote products, that creates a concrete review question: does the spending support a legitimate service, and can the company substantiate that purpose from attendance, payment and sales records?

Where major 2025 cases landed

The following cases illustrate exposure across six industries. These are selected examples, not industry-wide totals or an exhaustive ranking. Amounts describe announced settlements or orders, rather than cash necessarily paid during 2025.

Refund obligations can exceed the fine

A company that budgets only for civil penalties can miss a larger part of its exposure. In Amazon’s case, 60% of the announced $2.5 billion amount was assigned to consumer redress. The court-entered September 25 order required a $1.5 billion consumer fund alongside the $1 billion civil penalty. The amount ultimately distributed depends on the settlement’s terms; funding a redress program and completing payments to consumers are different events.

The FTC alleged that Amazon enrolled consumers in Prime without their consent and made cancellation difficult. The settlement also required changes to enrollment disclosures and cancellation flows. The operational issue was the customer journey itself: what people saw, which choices they were offered and what happened when they tried to leave.

Discover’s restitution obligation was larger still relative to its penalties. The FDIC required a plan to distribute at least $1.225 billion to affected merchants and intermediaries after finding that consumer credit cards had been misclassified as commercial cards for approximately 17 years, producing higher interchange charges. Its $150 million penalty was accompanied by a separate $100 million Federal Reserve penalty.

Using the announced amounts, consumer redress and merchant restitution represented about 69% of the combined $3.975 billion minimum in these two cases. That calculation describes the allocation of the obligations, not completed customer payments. It also explains why a penalty-only comparison would understate the financial consequences.

Manufacturing penalties can restrict future business

Hino’s case attached costs to both past conduct and future operations. On March 19, 2025, a federal judge accepted the company’s guilty plea in an emissions fraud case and imposed a $521.76 million criminal fine, a $1.087 billion forfeiture judgment and five years of probation. During probation, Hino cannot import diesel engines it manufactures into the United States. That restriction concerns Hino-manufactured engines; it should not be described as a ban on all Hino truck sales.

The case also shows how easy it is to overstate a compliance bill. The Justice Department explained that payments toward civil settlement obligations and a private class action settlement would count toward the forfeiture judgment. Adding every announcement together would double-count overlapping obligations. In its own disclosure, Hino said it expected the forfeiture obligation to be fully met through credits. It also described governance and compliance reforms intended to prevent recurrence.

For manufacturers, the business risk therefore includes whether products can continue entering a market, what must be recalled or repaired, and which testing records support certification. A monetary penalty captures only one part of that exposure.

Privacy and cybersecurity create different routes to liability

Google’s Texas settlement shows that a single state can produce a billion-dollar privacy resolution. Texas announced an agreement in principle in May 2025 and announced the signed $1.375 billion agreement in October. The claims concerned location tracking, incognito browsing and biometric information. Google did not admit wrongdoing and said the settlement addressed older claims involving policies it had already changed, according to Reuters.

Privacy risk also extends beyond a security breach. A business can face questions about whether it collected information with the required permission, whether its disclosures accurately described collection, and whether a user’s settings changed what the product actually did. Those questions require an examination of data flows and product behavior.

Cybersecurity obligations can create another enforcement route when a company sells services to the government. In May 2025, Raytheon companies and Nightwing agreed to an $8.4 million False Claims Act settlement concerning allegations that required controls were missing from an internal development system used on 29 Defense Department contracts and subcontracts. The settlement resolved allegations without a determination of liability.

A separate $11.25 million settlement involving Health Net Federal Services and Centene addressed allegations of false cybersecurity certifications under a TRICARE contract. The government alleged failures to scan for vulnerabilities, correct flaws on schedule and respond to audit findings. There was no determination of liability. The case illustrates how the accuracy of a compliance certification can itself become a financial issue.

A record in one program does not establish a national record

The False Claims Act record should not be stretched into a claim that every measure of corporate enforcement reached an all-time high. The SEC reported 456 enforcement actions in fiscal 2025 and $17.9 billion in ordered monetary relief. It also disclosed that the total included judgments in the long-running Stanford Ponzi scheme litigation and amounts deemed satisfied by orders in separate proceedings.

After removing those items, the SEC reported $2.7 billion in monetary relief. Neither figure is a measure of cash collected from operating businesses during that year, and neither can simply be added to every other regulator’s headline total. Enforcement statistics record the outcomes of particular cases, sometimes involving conduct and litigation that began many years earlier.

What businesses should put in the compliance budget

These cases support a broader way to assess financial exposure. Alongside potential fines, businesses should identify amounts that might have to be refunded, revenue that could be subject to forfeiture, products or systems that would need repair, and activities that an order could restrict. Defense expenses, investigations and management time create additional costs, but the public records reviewed here do not support a reliable national estimate for them.

The practical work depends on the operation. Billing teams need tests that detect incorrect classifications before they spread across years of transactions. Subscription businesses need to examine actual enrollment and cancellation paths. Contractors need evidence that supports the controls they certify. Privacy teams need to know what information leaves a browser or app, which vendors receive it, and whether consent and opt-out choices change those transfers.

For digital privacy, that means testing collection before a choice, after acceptance, after rejection and after withdrawal where applicable; checking relevant opt-out signals; and retaining dated records of the configuration and results. Captain Compliance’s work centers on connecting those technical controls with monitoring and evidence. The useful management question is whether the company can show what its systems did when a customer exercised a right, and how quickly it detects and corrects a failure.