it all depends on what you did wrong, if you can prove you had a policy and procedure in place and what it is. If you can show that you had software in place to catch a "hit", but somehow the software failed, why it failed, etc. I'm sure I've missed something. The fines are based on, what you did or didn't do, sometimes they'll fine you the same amount you were sending (in the case of a wire)but the fines are pretty much whatever the govt wants. Not only are there fines but there is possible jail time for the people involved (especially if it was on purpose)all the way up to the CEO and I believe the Board of Directors.