Fewer new regulations and a lack of new EHS requirements being issued at a Federal level have led some compliance teams to read the current regulatory environment as lower risk. Enforcement data from fiscal year 2025 tells a different story. The risk did not shrink. It redistributed, and it landed somewhere many programs are not currently looking.
What the headline numbers say, and what they leave out
The U.S. Environmental Protection Agency reported 2,127 civil enforcement cases concluded in fiscal year 2025, the highest count in nine years. Criminal charges reached 156 defendants, the most since fiscal year 2016. Combined civil penalties, criminal fines, restitution, and court-ordered relief totaled more than $1.2 billion.
Those figures are accurate, and they are also concentrated. A small number of unusually large, outlier cases account for a disproportionate share of the total penalty amount. When those outliers are set aside, the enforcement picture looks meaningfully different, and reading the aggregate figures without accounting for them can lead a compliance team to the wrong conclusion about where its actual exposure sits. Independent reporting from Environment+Energy Leader reached a similar read of the underlying case data, which is a useful outside check on the pattern Dakota has been watching.
Where risk actually went: administrative enforcement got more lenient
The clearest shift is in administrative civil enforcement, the routine mechanism used to address permit violations, recordkeeping failures, and day-to-day operational gaps that make up most facility-level exposure. Analysis from the Environmental Data and Governance Initiative found that, comparing the first year of the current administration to the comparable period the year before, the share of administrative cases concluding with zero penalty rose sharply, and total federal penalties in administrative cases fell even as case volume increased.
More cases closed. The dollar yield per case dropped. That combination can look, from a distance, like enforcement easing off. It is closer to enforcement being redistributed toward volume and away from per-case severity, which is a different risk profile for a compliance program to plan around, not a smaller one.
Where risk didn’t move at all: criminal enforcement
While administrative civil cases were resolving more leniently, EPA’s criminal enforcement program moved in the opposite direction. The current fiscal year produced the highest defendant count since fiscal year 2016 and forfeiture exceeding $1 billion in illegal proceeds, with 187 new criminal cases opened and 65 years of incarceration handed down.
The cases driving those numbers share a common thread: deliberate falsification of compliance data, concealment of violations from regulators, or conduct that crosses from negligence into intentional fraud. That distinction matters more than the size of any individual case. The relevant line for a compliance program is not how large a given violation is. It is whether a gap was missed or whether it was known and left unaddressed. A documented, functioning compliance program that catches and corrects gaps sits in a fundamentally different risk category than one that allows known issues to persist.
Where risk moved somewhere else entirely: the states
Federal administrative leniency has not been mirrored at the state level, and for organizations operating across multiple states, that gap is the more operationally significant finding. While Federal regulations are being scaled back, compliance deadlines are being pushed out sometimes indefinitely, and parts of regulations are being completely repealed, states are creating new regulations to fill the void at the Federal level. Producer responsibility programs, greenhouse gas regulations, recycling and waste reduction initiatives, and heat illness programs, are popping up across the country, adding new complexities to operating across state lines. California’s air and water regulators, New York’s environmental agency, and several state attorneys general have maintained or increased enforcement activity in areas where federal enforcement has pulled back.
For a program that calibrates its risk posture against federal enforcement trends alone, state-level activity is the unpriced exposure. Federal and state enforcement are no longer moving together, and treating them as a single signal is no longer a reliable way to assess where the real risk sits.
Dakota has been tracking this shape of complexity
As part of our unified regulatory risk management solution, Dakota’s regulatory team monitors rulemaking activity, deregulatory actions, congressional disapprovals, and state-level divergence continuously. In our 2025 EHS Regulatory Roundup webinars series, we highlighted how the growing gap between federal and state regulatory activity is creating additional complexity for multi-jurisdiction operators and tracked federal deregulation alongside growing enforcement discretion. The enforcement data summarized here reflects that same pattern showing up on the enforcement side rather than only the rulemaking side, which is consistent with what continuous regulatory monitoring is built to surface.
Dakota’s Regulatory Team continues to track the evolving state regulatory landscape, alongside Federal activity, painting the full picture of regulatory requirements from state-to-state, even when the Federal activity is in a pattern of deregulation.
What this means for a compliance program
Three things matter more right now than they have in several years.
- Documentation depth. Cases resolving with zero penalty are not going to facilities with weak records. They are going to facilities that can demonstrate a functioning compliance program when a case is opened. An up-to-date EHS legal register, user activity logs, completed inspections, and closed corrective actions are the evidence that supports that outcome.
- Disclosure readiness. EPA’s voluntary disclosure programs received 538 disclosures covering violations at 957 facilities in fiscal year 2025. That pathway is only available to programs with enough visibility into their own operations to know what needs disclosing before a regulator finds it first. That visibility is what we mean when we describe regulatory preparedness as a leading indicator of compliance performance.
- State-level mapping. Federal enforcement trends are not a reliable proxy for state enforcement trends, and have not been for some time. Programs operating across multiple states need visibility into state-specific enforcement posture, not just federal activity.
The risk changed shape. It’s still there.
The outlier cases driving fiscal year 2025’s aggregate numbers will eventually fall out of the headline figures. What remains underneath them is a compliance and enforcement structure that rewards documented, proactive programs and is considerably less forgiving of undocumented ones. That gap is wider than it has been in years, and it is not visible if a compliance program is only watching the rulemaking side of the equation.
As mentioned earlier, Dakota’s Regulatory Team tracks regulatory activity year-round, and provides real-time alerts for recent and proposed Federal changes to help EHS teams understand changes in rulemaking and enforcement before they become a compliance gap.
Subscribe to our EHS Regulatory Alerts or request a demo to see how Dakota supports compliance programs through a shifting regulatory and enforcement landscape.
