Seven years and $260 billion later, big banks are nearing the end of their long legal nightmare. From dodgy mortgages to duff insurance, rigged rates to skirted sanctions, lenders have been paying the price for a wide range of misdeeds, as regulators dig deeper into their activities both before and after the financial crisis.

Analysts at Morgan Stanley estimate that the 25 largest banks in the US and Europe have taken some $260 billion in litigation-related charges since 2009. Over the next two years, they face around $65 billion in additional penalties, the analysts reckon in a recent research note.

Mortgage malpractice is the biggest source of legal trouble for the banks, both in the past ($94 billion in fines and provisions) and the future ($13 billion more to come). British banks have paid more than $40 billion for peddling a misleading form of personal insurance, the second-largest source of fines. The rest of the charges come from a mix of interest-rate manipulation, sanctions violations, tax evasion, and other transgressions.

Although Bank of America and JPMorgan are far ahead of the pack in terms of costs already incurred, the UK’s Royal Bank of Scotland faces the biggest bill to come—nearly $11 billion between now and 2017, the bulk related to US mortgage misdeeds. The charges are worth more than RBS’s estimated operating profit in 2017; a dividend won’t likely be paid until 2018, a decade after long-suffering shareholders last received one from the bailed-out bank.

Given banks’ seemingly endless capacity for bad behavior, putting a price tag on future legal trouble is guesswork, the analysts admit, as some of their forecasts include “general provisions for issues not yet identified, given the ongoing focus of regulators on a broad spectrum of historic issues.”

Things seem to be moving in the right direction, the analysts note. Across the industry, executive pay has fallen by around 30% since 2006, with more emphasis on long-term incentives and non-financial targets. Banks are also hiring compliance and risk-management staff like crazy—compliance headcount has more than doubled at banks like JPMorgan and HSBC over the past few years.

But changing dysfunctional corporate cultures doesn’t happen overnight: dealing with past transgressions is one thing, but are banks better prepared to stamp out wrongdoing in the future?