A manufacturer, technology company, retailer, or energy business doesn’t need to operate a bank to recognize the management problems this series examines. A commercially important relationship presents unresolved concerns. A monitoring tool produces reassuring statistics but does not provide adequate coverage. A vendor fails to deliver a critical update. Employees identify weaknesses, but corrective action remains incomplete.
Bank of America’s documents provide specific examples of these issues. FinCEN emphasizes management decisions, monitoring deficiencies, and customer due diligence failures. OFAC adds findings involving vendors, technology changes, operational mistakes, and remediation.
A non-banking compliance professional’s task is to translate those findings, not copy the bank’s obligations into a different industry. Bank-specific suspicious activity reporting and correspondent-account requirements should not be treated as universal corporate obligations. OFAC’s compliance framework, by contrast, expressly addresses organizations beyond financial institutions, including entities subject to U.S. jurisdiction and certain foreign entities with relevant U.S. connections. Applicability still depends on the organization’s activities and circumstances.
In this concluding Part 4, I offer 20 lessons learned as practical applications of the record from the FinCEN Consent Order and OFAC’s Enforcement Release.
Governance, Culture, and Management Accountability
FinCEN found that management focused on resource implications and revenue while identified risks persisted without commensurate controls. That is the factual foundation for the first four lessons.
1. Revenue is not a risk mitigation measure.
When a sales team argues that a distributor is indispensable, acknowledge the commercial importance and return to the unresolved risk. Require the business to identify the controls supporting continued engagement. The decision should explain why those controls are adequate, not merely why termination would be expensive. Commercial value belongs in the discussion, but it should not substitute for evidence of risk mitigation.
2. Escalation must produce a decision and follow-through.
Assign a decision-maker, a response deadline, and an accountable owner for every material compliance escalation. Record the reasoning behind the decision and the actions that follow. Where management retains a relationship subject to conditions, specify what happens when those conditions are not met. A recommendation should not disappear into repeated meetings without a documented disposition.
3. Resources should follow the risk.
Prepare resource requests around the work needed to address identified exposure: investigative volume, overdue reviews, data gaps, geographic expansion, and testing requirements. Where funding is declined, document the resulting limitations and proposed alternatives. Do not make a control appear more effective by excluding work merely because the organization lacks the capacity to perform it.
4. Board reporting should show unresolved exposure.
Report significant exceptions, recurring deficiencies, overdue corrective actions, and failed effectiveness tests alongside completed activities. Identify the executive responsible for the response and the decisions requiring board attention. Directors do not need every case file. They need a clear picture of material risks that remain uncontrolled and the evidence supporting management’s assessment.
Due Diligence and Understanding Business Relationships
FinCEN describes customer profiles that did not adequately incorporate third-party payments, geographic exposure, and information developed during the relationship. It also found deficient due diligence involving the bank’s own foreign branches and affiliates. FINCEN consent order
5. Due diligence is a continuing process.
Set triggers to reassess when ownership, products, payment practices, geography, or transaction volumes change. A distributor’s original approval does not answer questions raised by materially different activity three years later. Updating a risk rating should also lead to an assessment of whether monitoring, contractual protections, payment controls, or other safeguards need to change.
6. Understand who is paying, for whom, and why.
For a non-banking business, relevant questions may arise when an unrelated entity pays a customer invoice, commissions are redirected, or refunds are requested to a different account. These circumstances do not automatically prove misconduct. They are reasons to obtain a supportable business explanation and apply appropriate controls before proceeding.
7. Familiarity and affiliation are not substitutes for assessment.
Apply risk-based review to longstanding partners, subsidiaries, and affiliated entities as well as unfamiliar third parties. The question is not simply whether the organization knows the entity. It is whether the organization understands its current activity, relevant counterparties, and exposure. Corporate affiliation may affect the information available, but it should not end the inquiry.
8. Evaluate connected relationships.
When an investigation identifies a problematic intermediary, assess whether the same person, beneficial owner, address, payment account, or commercial arrangement appears elsewhere. FinCEN describes the bank failing to reassess continuing customers after exiting a connected customer. The corporate application is to avoid treating each third-party file as an isolated record when the relevant risk involves a network of relationships. FINCEN consent order
Technology, Data, and Control Design
The Event Processor findings address unsupported design choices, inadequate responses to testing, poorly governed suppression rules, and incomplete monitoring coverage. These findings form the foundation for the next four applications. FINCEN consent order
9. Require evidence that automated decisions are supportable.
For each material automated compliance control, document its purpose, inputs, decision rules, limitations, and owner. Determine who can change it and who independently evaluates its performance. Ask the same questions whether the tool uses fixed rules, statistical models, or AI. The technology’s sophistication should not determine the rigor of its governance.
10. Measure what the system misses.
Test selected activity that falls below thresholds, bypasses automated review, or comes from products and business units with limited coverage. Examine delays and missed issues. A lower alert count may represent improvement, deterioration, or a change in the population being monitored. Do not treat reduced workload as proof of reduced risk.
11. Make data governance part of compliance governance.
Identify the information each control needs and trace it from its source through the control and into any resulting investigation. Assign responsibility for missing, inconsistent, or inaccessible data. FinCEN’s required review explicitly addresses data accuracy, completeness, responsibilities, information flows, and error detection. The corporate application is to treat those matters as control dependencies, not solely information technology concerns. FINCEN consent order
12. Put controls around exceptions.
Whitelists, overrides, automatic dismissals, and other exclusions should have a documented rationale, approval authority, review date, and testing requirements. Ensure that an exemption granted for one purpose does not disable an unrelated control. Revisit exceptions when the underlying facts change. An exception should remain a controlled decision, not become an undocumented permanent feature.
Vendors, Operational Execution, and Independent Challenge
OFAC’s compliance considerations emphasize organizational responsibility despite third-party reliance, controlled technology changes, and training supported by testing and accessible guidance. OFAC
13. Outsourcing does not transfer performance responsibility.
For a critical screening, monitoring, or due diligence provider, verify that the service actually operates within the company’s process. Test updates, escalation procedures, outages, and known limitations. A contract and a vendor assurance are useful starting points. They don’t prove required information reaches the right system or that employees act on it appropriately.
14. Treat technology changes as compliance events.
Before a migration, assess data transfer, control continuity, expected alert volume, staffing, and fallback procedures. After launch, test the real process rather than rely entirely on preproduction results. Define who can pause implementation or impose temporary safeguards if performance is inadequate. Completing the migration should not be the only measure of success.
15. Test whether employees can perform the required task.
Use realistic scenarios for sales, procurement, finance, logistics, and other relevant functions. Ask employees to demonstrate when they would stop a transaction, seek advice, or escalate an exception. Provide usable instructions and accessible expertise. Training completion is an administrative measure. Correct execution is the outcome the organization needs to establish.
16. Protect independent challenges.
FinCEN describes repeating an unfavorable test, with the second result supporting the existing threshold. For other organizations, the application is to preserve original findings, document methodological changes, and subject material disagreements to independent review. A test may legitimately need correction. The process should explain why the correction is valid, not just produce a more comfortable answer. FINCEN consent order
Detection, Investigations, and Sustainable Remediation
17. Use external warnings to assess internal detection.
FinCEN distinguished useful cooperation and information sharing from excessive dependence on external and manual sources to identify relevant risks. Apply that distinction carefully. A whistleblower report does not, by itself, prove that a program failed. The question is whether controls designed to detect the issue should have identified it earlier and what the external information reveals about their limitations. FINCEN consent order
18. Investigate the underlying problem, not only the first incident.
When a control fails, determine whether the same weakness affects other transactions, employees, systems, business units, or jurisdictions. Document the rationale for the investigation’s scope and revisit it as evidence develops. OFAC’s criticism of the bank’s initially narrow lookback illustrates why resolving the first identified transaction may leave the broader problem undiscovered. OFAC
19. Require immediate protection and proof of lasting effectiveness.
Use appropriate interim safeguards while developing longer-term remediation. Then distinguish completion of the change from verification of its effectiveness. FinCEN’s undertakings separately address interim controls and subsequent testing of enhancements. For a corporate program, issue closure should identify the evidence reviewed, the remaining limitations, and who independently validated the result. FINCEN consent order
20. Organize disclosure and cooperation before the response becomes fragmented.
Establish decision rights, preserve evidence, develop the facts, and assess disclosure with counsel under the applicable regime. Track requests and verify that responses are complete and consistent. OFAC’s treatment also demonstrates the importance of precision: voluntary disclosure affected the base calculation for some violations, but the settlement received no additional reduction from that base. Different forms of credit should not be treated as interchangeable. OFAC
Turn the Lessons into an Action Plan
This case study’s value is not the number of lessons a compliance team can recite. It is whether the organization uses them to examine decisions and controls that matter to its own business. Start with three lessons that present the greatest exposure in your organization.
For each, identify the responsible executive, the control being relied upon, the latest evidence that it works, and the corrective action needed where that evidence is missing. Record what must happen immediately and what can reasonably be addressed through a longer-term plan.
Then take the results to the appropriate management or board committee. Do not report only that the review was completed. Report what the organization learned, what remains unresolved, and how effectiveness will be verified. The four-part series began by distinguishing between identifying a risk and addressing it. It ends by applying the same discipline to your own program.
The final board and CCO question: Where has our organization identified a material compliance risk, accepted a plan to address it, and failed to verify that the plan actually worked? This is the same basic question that concludes the last major section of the 2024 Evaluation of Corporate Compliance Program: Does the corporation’s compliance program work in practice?
Conclusion
Part 4 translates the Bank of America enforcement record into 20 practical lessons for compliance professionals outside banking, without treating bank-specific obligations as universal corporate requirements. The article organizes those lessons around governance and accountability, continuing due diligence, technology and data, operational execution, and sustainable remediation. Its central message is that commercial importance cannot substitute for risk mitigation; an escalation is not resolved merely because it has been discussed. Automation does not establish that a control works.
For CCOs, the practical response is to connect material concerns to accountable decisions, test what systems miss, verify vendor performance, and confirm that employees can execute required procedures. Remediation should include interim protection and independent evidence that corrective measures are effective. The concluding assignment turns these lessons into action: select three areas of greatest exposure, identify responsible executives, examine the evidence supporting existing controls, and address the gaps. The objective is not to adopt another company’s compliance program, but to use its documented failures to test and improve your own.
What it all Means for Compliance
The Bank of America enforcement actions illustrate the difference between maintaining compliance processes and achieving compliance effectiveness. Part 1 examined management’s response to known concerns, including decisions that prioritized revenue and resources while risks persisted without commensurate controls. Part 2 examined how unsupported design choices, monitoring gaps, and inadequate responses to testing undermined automated detection. Part 3 connected sanctions failures to broader questions of vendor oversight, operational execution, investigation scope, and durable remediation. Part 4 translated those findings into an action agenda for non-banking compliance professionals.
All of this makes the case for treating compliance as a business discipline grounded in governance, reliable information, accountable decisions, and verified results. CCOs should be able to demonstrate what happens after a concern is raised, while boards should ask what remains unresolved and whether management’s response has reduced the exposure. The ultimate test is not whether an organization can describe its compliance program. It is whether it can demonstrate that its controls work, management acts on adverse information, and corrective action addresses the underlying risk.
