Tag: Bank of America

Categories
Blog

BOA Part 4: 20 Lessons Every Corporate Compliance Professional Should Learn from BOA

A manufacturer, technology company, retailer, or energy business doesn’t need to operate a bank to recognize the management problems this series examines. A commercially important relationship presents unresolved concerns. A monitoring tool produces reassuring statistics but does not provide adequate coverage. A vendor fails to deliver a critical update. Employees identify weaknesses, but corrective action remains incomplete.

Bank of America’s documents provide specific examples of these issues. FinCEN emphasizes management decisions, monitoring deficiencies, and customer due diligence failures. OFAC adds findings involving vendors, technology changes, operational mistakes, and remediation.

A non-banking compliance professional’s task is to translate those findings, not copy the bank’s obligations into a different industry. Bank-specific suspicious activity reporting and correspondent-account requirements should not be treated as universal corporate obligations. OFAC’s compliance framework, by contrast, expressly addresses organizations beyond financial institutions, including entities subject to U.S. jurisdiction and certain foreign entities with relevant U.S. connections. Applicability still depends on the organization’s activities and circumstances.

In this concluding Part 4, I offer 20 lessons learned as practical applications of the record from the FinCEN Consent Order and OFAC’s Enforcement Release.

Governance, Culture, and Management Accountability

FinCEN found that management focused on resource implications and revenue while identified risks persisted without commensurate controls. That is the factual foundation for the first four lessons.

1. Revenue is not a risk mitigation measure.

When a sales team argues that a distributor is indispensable, acknowledge the commercial importance and return to the unresolved risk. Require the business to identify the controls supporting continued engagement. The decision should explain why those controls are adequate, not merely why termination would be expensive. Commercial value belongs in the discussion, but it should not substitute for evidence of risk mitigation.

2. Escalation must produce a decision and follow-through.

Assign a decision-maker, a response deadline, and an accountable owner for every material compliance escalation. Record the reasoning behind the decision and the actions that follow. Where management retains a relationship subject to conditions, specify what happens when those conditions are not met. A recommendation should not disappear into repeated meetings without a documented disposition.

3. Resources should follow the risk.

Prepare resource requests around the work needed to address identified exposure: investigative volume, overdue reviews, data gaps, geographic expansion, and testing requirements. Where funding is declined, document the resulting limitations and proposed alternatives. Do not make a control appear more effective by excluding work merely because the organization lacks the capacity to perform it.

4. Board reporting should show unresolved exposure.

Report significant exceptions, recurring deficiencies, overdue corrective actions, and failed effectiveness tests alongside completed activities. Identify the executive responsible for the response and the decisions requiring board attention. Directors do not need every case file. They need a clear picture of material risks that remain uncontrolled and the evidence supporting management’s assessment.

Due Diligence and Understanding Business Relationships

FinCEN describes customer profiles that did not adequately incorporate third-party payments, geographic exposure, and information developed during the relationship. It also found deficient due diligence involving the bank’s own foreign branches and affiliates. FINCEN consent order 

5. Due diligence is a continuing process.

Set triggers to reassess when ownership, products, payment practices, geography, or transaction volumes change. A distributor’s original approval does not answer questions raised by materially different activity three years later. Updating a risk rating should also lead to an assessment of whether monitoring, contractual protections, payment controls, or other safeguards need to change.

6. Understand who is paying, for whom, and why.

For a non-banking business, relevant questions may arise when an unrelated entity pays a customer invoice, commissions are redirected, or refunds are requested to a different account. These circumstances do not automatically prove misconduct. They are reasons to obtain a supportable business explanation and apply appropriate controls before proceeding.

7. Familiarity and affiliation are not substitutes for assessment.

Apply risk-based review to longstanding partners, subsidiaries, and affiliated entities as well as unfamiliar third parties. The question is not simply whether the organization knows the entity. It is whether the organization understands its current activity, relevant counterparties, and exposure. Corporate affiliation may affect the information available, but it should not end the inquiry.

8. Evaluate connected relationships.

When an investigation identifies a problematic intermediary, assess whether the same person, beneficial owner, address, payment account, or commercial arrangement appears elsewhere. FinCEN describes the bank failing to reassess continuing customers after exiting a connected customer. The corporate application is to avoid treating each third-party file as an isolated record when the relevant risk involves a network of relationships. FINCEN consent order

Technology, Data, and Control Design

The Event Processor findings address unsupported design choices, inadequate responses to testing, poorly governed suppression rules, and incomplete monitoring coverage. These findings form the foundation for the next four applications. FINCEN consent order

9. Require evidence that automated decisions are supportable.

For each material automated compliance control, document its purpose, inputs, decision rules, limitations, and owner. Determine who can change it and who independently evaluates its performance. Ask the same questions whether the tool uses fixed rules, statistical models, or AI. The technology’s sophistication should not determine the rigor of its governance.

10. Measure what the system misses.

Test selected activity that falls below thresholds, bypasses automated review, or comes from products and business units with limited coverage. Examine delays and missed issues. A lower alert count may represent improvement, deterioration, or a change in the population being monitored. Do not treat reduced workload as proof of reduced risk.

11. Make data governance part of compliance governance.

Identify the information each control needs and trace it from its source through the control and into any resulting investigation. Assign responsibility for missing, inconsistent, or inaccessible data. FinCEN’s required review explicitly addresses data accuracy, completeness, responsibilities, information flows, and error detection. The corporate application is to treat those matters as control dependencies, not solely information technology concerns. FINCEN consent order

12. Put controls around exceptions.

Whitelists, overrides, automatic dismissals, and other exclusions should have a documented rationale, approval authority, review date, and testing requirements. Ensure that an exemption granted for one purpose does not disable an unrelated control. Revisit exceptions when the underlying facts change. An exception should remain a controlled decision, not become an undocumented permanent feature.

Vendors, Operational Execution, and Independent Challenge

OFAC’s compliance considerations emphasize organizational responsibility despite third-party reliance, controlled technology changes, and training supported by testing and accessible guidance. OFAC

13. Outsourcing does not transfer performance responsibility.

For a critical screening, monitoring, or due diligence provider, verify that the service actually operates within the company’s process. Test updates, escalation procedures, outages, and known limitations. A contract and a vendor assurance are useful starting points. They don’t prove required information reaches the right system or that employees act on it appropriately.

14. Treat technology changes as compliance events.

Before a migration, assess data transfer, control continuity, expected alert volume, staffing, and fallback procedures. After launch, test the real process rather than rely entirely on preproduction results. Define who can pause implementation or impose temporary safeguards if performance is inadequate. Completing the migration should not be the only measure of success.

15. Test whether employees can perform the required task.

Use realistic scenarios for sales, procurement, finance, logistics, and other relevant functions. Ask employees to demonstrate when they would stop a transaction, seek advice, or escalate an exception. Provide usable instructions and accessible expertise. Training completion is an administrative measure. Correct execution is the outcome the organization needs to establish.

16. Protect independent challenges.

FinCEN describes repeating an unfavorable test, with the second result supporting the existing threshold. For other organizations, the application is to preserve original findings, document methodological changes, and subject material disagreements to independent review. A test may legitimately need correction. The process should explain why the correction is valid, not just produce a more comfortable answer. FINCEN consent order

Detection, Investigations, and Sustainable Remediation

17. Use external warnings to assess internal detection.

FinCEN distinguished useful cooperation and information sharing from excessive dependence on external and manual sources to identify relevant risks. Apply that distinction carefully. A whistleblower report does not, by itself, prove that a program failed. The question is whether controls designed to detect the issue should have identified it earlier and what the external information reveals about their limitations. FINCEN consent order

18. Investigate the underlying problem, not only the first incident.

When a control fails, determine whether the same weakness affects other transactions, employees, systems, business units, or jurisdictions. Document the rationale for the investigation’s scope and revisit it as evidence develops. OFAC’s criticism of the bank’s initially narrow lookback illustrates why resolving the first identified transaction may leave the broader problem undiscovered. OFAC

19. Require immediate protection and proof of lasting effectiveness.

Use appropriate interim safeguards while developing longer-term remediation. Then distinguish completion of the change from verification of its effectiveness. FinCEN’s undertakings separately address interim controls and subsequent testing of enhancements. For a corporate program, issue closure should identify the evidence reviewed, the remaining limitations, and who independently validated the result. FINCEN consent order

20. Organize disclosure and cooperation before the response becomes fragmented.

Establish decision rights, preserve evidence, develop the facts, and assess disclosure with counsel under the applicable regime. Track requests and verify that responses are complete and consistent. OFAC’s treatment also demonstrates the importance of precision: voluntary disclosure affected the base calculation for some violations, but the settlement received no additional reduction from that base. Different forms of credit should not be treated as interchangeable. OFAC

Turn the Lessons into an Action Plan

This case study’s value is not the number of lessons a compliance team can recite. It is whether the organization uses them to examine decisions and controls that matter to its own business. Start with three lessons that present the greatest exposure in your organization.

For each, identify the responsible executive, the control being relied upon, the latest evidence that it works, and the corrective action needed where that evidence is missing. Record what must happen immediately and what can reasonably be addressed through a longer-term plan.

Then take the results to the appropriate management or board committee. Do not report only that the review was completed. Report what the organization learned, what remains unresolved, and how effectiveness will be verified. The four-part series began by distinguishing between identifying a risk and addressing it. It ends by applying the same discipline to your own program.

The final board and CCO question: Where has our organization identified a material compliance risk, accepted a plan to address it, and failed to verify that the plan actually worked? This is the same basic question that concludes the last major section of the 2024 Evaluation of Corporate Compliance Program: Does the corporation’s compliance program work in practice?

Conclusion

Part 4 translates the Bank of America enforcement record into 20 practical lessons for compliance professionals outside banking, without treating bank-specific obligations as universal corporate requirements. The article organizes those lessons around governance and accountability, continuing due diligence, technology and data, operational execution, and sustainable remediation. Its central message is that commercial importance cannot substitute for risk mitigation; an escalation is not resolved merely because it has been discussed. Automation does not establish that a control works.

For CCOs, the practical response is to connect material concerns to accountable decisions, test what systems miss, verify vendor performance, and confirm that employees can execute required procedures. Remediation should include interim protection and independent evidence that corrective measures are effective. The concluding assignment turns these lessons into action: select three areas of greatest exposure, identify responsible executives, examine the evidence supporting existing controls, and address the gaps. The objective is not to adopt another company’s compliance program, but to use its documented failures to test and improve your own.

What it all Means for Compliance

The Bank of America enforcement actions illustrate the difference between maintaining compliance processes and achieving compliance effectiveness. Part 1 examined management’s response to known concerns, including decisions that prioritized revenue and resources while risks persisted without commensurate controls. Part 2 examined how unsupported design choices, monitoring gaps, and inadequate responses to testing undermined automated detection. Part 3 connected sanctions failures to broader questions of vendor oversight, operational execution, investigation scope, and durable remediation. Part 4 translated those findings into an action agenda for non-banking compliance professionals.

All of this makes the case for treating compliance as a business discipline grounded in governance, reliable information, accountable decisions, and verified results. CCOs should be able to demonstrate what happens after a concern is raised, while boards should ask what remains unresolved and whether management’s response has reduced the exposure. The ultimate test is not whether an organization can describe its compliance program. It is whether it can demonstrate that its controls work, management acts on adverse information, and corrective action addresses the underlying risk.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Bank of America’s $1.2B AML Breakdown: Too Big to Remediate?

The award-winning Compliance into the Weeds is the only weekly podcast that dives deep into compliance-related topics, going into the weeds to uncover hard-hitting compliance insights. Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the recent OCC and Federal Reserve enforcement actions against BAO for $1.2bn.

The enforcement action against Bank of America (with OCC, FinCEN, OFAC, and others) was for BOA’s failure to maintain an effective Bank Secrecy Act/AML program, including flawed transaction monitoring that led to inadequate suspicious activity reporting, weak customer due diligence, and deficient sanctions screening, sometimes with law enforcement flagging issues to the bank rather than the reverse.

They place this alongside recent actions against UBS, American Express, and a New York DFS fine of SEB, arguing recurring failures stem from poor transaction analysis. Kelly ties Bank of America’s problems to its homegrown “Event Processor” system, launched in 2010, which critics say uses arbitrary risk-scoring thresholds and lacks recalibration, compounded by insufficient staffing and management support. They highlight governance and accountability concerns, including unresolved findings from a 2024 OCC order, questions about board oversight of compliance, and doubts that fines alone will drive lasting remediation.

Key highlights:

  • BofA Fine Breakdown
  • What Went Wrong in AML
  • How the Tech Failed
  • Leadership and Culture Accountability
  • Fixing It People and Oversight
  • Risk Assessments and Too Big to Remediate

Resources:

Matt in Radical Compliance

Tom in the FCPA Compliance Report

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, the Top 10 Business Law Podcasts, and the Top 12 Risk Management Podcasts. Compliance into the Weeds has been awarded a Davey, Communicator, and W3 Award, all for podcast excellence.

Categories
Blog

BOA Part 3: The Failure to Connect the Dots: Sanctions, AML, and Effective Remediation

A payment-routing problem, a stale watchlist, an incorrectly prioritized alert, and an employee processing error may initially seem like separate operational incidents. OFAC’s Enforcement Release asks compliance leaders to examine the broader pattern. Its compliance considerations emphasize management oversight that identifies potentially systemic problems, implements durable solutions, and prevents errors from recurring across the enterprise.

Today, in Part 3, we focus on that connection. Fixing the first visible error is necessary. Establishing whether the same weakness exists elsewhere is the next responsibility.

A Separate Action with Familiar Governance Problems

According to the Enforcement Release, Bank of America agreed to pay $11,662,930 to resolve potential civil liability for 475 apparent violations involving approximately $14.8 million in transactions. The conduct involved sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. OFAC classified the matter as non-egregious but largely not voluntarily self-disclosed. These are separate findings from FinCEN’s anti-money laundering case. Do not treat them as findings about identical transactions merely because they reveal related governance concerns. Those concerns include control design, alert handling, staffing, technical changes, investigation scope, and the response to known weaknesses.

Payment Routing: A Control Must Work Across the Process

Bank of America used a third-party routing directory to help determine intermediary banks for certain cross-border payments. Some routing was automated; some could be entered manually. Once payment details were generated, the bank screened them for sanctions compliance.

In March 2022, the bank became aware that the directory included blocked banks and that some payments were still being processed to or through them. OFAC identified several causes: screening updates had not yet reflected new designations, analysts incorrectly dismissed alerts, or suppression rules automatically released payments based on earlier false-positive decisions.

OFAC ultimately identified 403 transactions totaling approximately $14.34 million routed through 35 blocked banks between February 2022 and March 2025. The bank implemented an automated directory solution in January 2023, but the release describes broader payment-processing failures beyond that implementation.

The compliance lesson is to test the complete process. A current directory does not establish that manual entry works correctly. A screening alert does not establish that the alert is properly resolved. A prior false-positive decision does not establish that the same disposition remains appropriate after a sanctions designation.

Alert Prioritization: Strong Information Must Produce an Appropriate Response

OFAC describes a design flaw that assigned low or medium priority to customers whose names and dates of birth both exactly matched those of blocked persons.

Because those alerts were not classified as high priority, review was delayed. Three designated individuals conducted 31 transactions using bank or credit card accounts. The bank fully implemented the relevant correction in February 2024, six months after initially identifying the issue. This is a control-design issue with an operational consequence.

The existence of a queue does not establish effective prioritization. Compliance leaders should be able to explain which information triggers immediate attention, which activity may continue while an alert awaits review, and what interim protection applies when the prioritization logic is known to be deficient.

Watchlist Updates: Vendor Performance and Internal Processing Both Matter

Between May 24 and June 28, 2023, a third-party vendor error prevented the watchlist file Bank of America used from reflecting changes to OFAC’s sanctions list. The bank did not identify the error until July, approximately a month after another U.S. bank blocked one of the affected payments downstream.

A separate failure in February 2025 involved technical problems in the bank’s own systems. The bank failed to implement a vendor update reflecting the previous day’s designations and processed transactions for a designated ship management company. The bank fully activated the relevant updates several days later; it then conducted a lookback and self-disclosed those transactions.

The two events should not be collapsed into a single vendor failure. One originated with the vendor. The other involved the bank’s processing of an update. Together, they illustrate why oversight should verify the entire update process: issuance, receipt, loading, activation, and operation. A delivery confirmation is not proof that screening uses the new information.

Employee Errors and Technology Changes Need a Control Response

The Enforcement Release also describes a business account that remained unrestricted after an analyst dismissed an alert involving its blocked beneficial owner. A subsequent rescreening during a platform migration generated another alert, but the bank did not review it promptly. OFAC attributed the delay to the volume of migration-generated alerts and inadequate preparation for that workload.

In another incident, personnel moved $189,869 from restricted business accounts into a new unrestricted account after misunderstanding how to handle accounts with a blocked authorized signer. Sanctions personnel identified the error and blocked the new accounts before the customer conducted further transactions involving the funds.

The second intervention mattered. It prevented further activity. It did not eliminate the need to examine why the transfer had been authorized. Calling an event human error should begin the root-cause inquiry, not end it. Was the instruction clear? Did the employee have access to appropriate guidance? Were approval rights properly defined? Should another control have prevented the action?

What the Penalty Says About Disclosure and Cooperation

OFAC determined that 413 apparent violations were not voluntarily self-disclosed and 62 were. Its base penalty calculation already reflected that distinction: the applicable scheduled amounts for the former and one-half of transaction value for the latter. The settlement equaled the resulting base penalty. Consequently, saying that the bank received no recognition whatsoever for voluntary disclosure would be inaccurate.

The more precise lesson is that OFAC granted no additional reduction from the base penalty. The release expressly states that OFAC did not mitigate the penalty for remedial measures or cooperation. OFAC also identified a tolling agreement as a mitigating factor but concluded that the circumstances did not justify a net reduction.

OFAC described piecemeal or incomplete submissions and delayed responses that slowed its investigation. It also criticized the bank’s initially narrow lookback into blocked-bank payments, with the full scope identified only after further OFAC direction. For compliance leaders, the lesson is to organize the response early. Coordinate investigation scope, document preservation, factual development, disclosure decisions, remediation, and regulatory responses rather than handling them as disconnected tasks.

FinCEN’s Undertakings Show What Verification Requires

The FinCEN Consent Order requires independent work to address historical suspicious activity, the effectiveness of transaction monitoring, customer and foreign correspondent due diligence, and data governance. Its lookback begins in January 2022 and extends through completion of relevant monitoring remediation, subject to the Consent Order’s scope provisions.

Two aspects are particularly instructive. First, the Consent Order addresses interim controls while remediation remains underway. A future system improvement is not treated as an answer to present exposure. Recommended interim measures may include manual processes, periodic reviews, and product-focused analyses. Second, the end-state review includes subsequent testing to validate whether enhancements meaningfully mitigate the relevant risks. Implementation and effectiveness are separate questions.

That distinction should shape remediation reporting. The board needs to know both whether the change was completed and whether testing demonstrates that it works.

Three Key Takeaways

First, investigate recurring themes across incidents. Similar errors may reveal shared weaknesses in data, approvals, staffing, training, or change management.

Second, treat disclosure and cooperation as disciplined processes. Determine the scope, preserve the record, develop the facts, and respond completely and promptly.

Third, distinguish implementation from effectiveness. Maintain interim safeguards and require independent evidence before declaring a material issue resolved.

The board question: Are we receiving evidence that remediation has reduced the risk, or only reports that remediation activities have been completed?

Summary

In Part 3, we examined how BOA’s sanctions failures exposed weaknesses across payment routing, alert prioritization, watchlist updates, and employee execution. The central lesson is that seemingly separate incidents should prompt an examination of shared weaknesses in oversight, resources, and operational processes, rather than a series of isolated fixes. We also considered vendor accountability, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation.

FinCEN’s requirements for interim safeguards and subsequent effectiveness testing illustrate why implementing corrective measures and proving that they work are separate responsibilities. For CCOs, this means identifying root causes, preventing ongoing exposure, and independently validating the response. For boards, it means demanding evidence of reduced risk rather than accepting reports of completed activities. The measure of remediation is whether the underlying control weakness has been effectively addressed.

Join Us Tomorrow

Tomorrow in Part 4, we shift from Bank of America’s enforcement record to the decisions compliance professionals outside banking face. We translate BOA’s documented failures into 20 practical lessons covering governance, ongoing due diligence, technology and data, vendor oversight, employee execution, investigations, and remediation. The objective is not to apply bank-specific obligations to every company, but to examine how comparable weaknesses could arise in customer relationships, distributor networks, procurement processes, payment controls, and automated compliance systems.

Each lesson links a finding to a practical action, giving CCOs a framework to review their own programs. The series concludes with an assignment: select three areas of greatest exposure, identify accountable owners, examine the evidence that existing controls work, and address what remains unresolved. The final question is whether your organization has accepted a plan to address a material risk without verifying that it worked.

Categories
Blog

BOA Part 2: The $5 Billion Blind Spot About Compliance Technology

An automated compliance system can operate exactly as configured and still fail to perform the function the organization needs.

That distinction is central to FinCEN’s findings concerning Bank of America’s proprietary transaction monitoring system, Event Processor. The FinCEN Consent Order attributes missed and delayed reporting of more than $5 billion in suspicious activity to deficiencies in internal controls and other parts of the bank’s anti-money laundering program. That figure reflects suspicious activity that was not reported on time, not a determination that every dollar represented criminal proceeds.

In Part 1, we examined management decisions about known risks. This installment examines how those decisions were embedded in technology, testing, and investigative processes. In Part 2, we review the natural follow-up to that statement: the lesson is not that automation is inherently unreliable. Automating a decision does not remove the obligation to establish that the decision is supportable.

Inside Event Processor

Bank of America developed Event Processor to manage transaction monitoring alerts. The bank’s records describe an interconnected model system intended to support identifying, investigating, and reporting suspicious activity. Its development also addressed a practical problem: there were not enough investigators to review all the alerts being generated.

The diagram on page 10 of the Consent Order illustrates the basic process. Individual alerts received weighted risk scores and were generally consolidated into customer-level Event Groups. Unless an automatic promotion applied, the group ordinarily did not become an investigative case until its combined score reached 20 points. Stakeholders initially set that threshold, and it remained in place until December 2023.

The timing rules were equally important. An Event Group generally needed to reach the threshold within 13 months of its oldest active alert. Older alerts could remain in the group but no longer contribute to its score. Consequently, retirement of an alert did not establish that the underlying concern had been investigated or resolved. For compliance leaders, the distinction is consequential. A system that generates an alert does not necessarily ensure meaningful review.

The Testing Challenged the Design

The Consent Order describes repeated evidence that the system’s risk weights did not adequately reflect the risks being identified. One internal report found that an ATM large-cash-deposit risk factor carried only one point in Event Processor even though the bank’s testing associated it with a SAR yield of 56.75%. FinCEN also notes that SAR yield can be useful but is not the only metric for evaluating a control. The issue was the bank’s failure to respond appropriately to evidence that its design was not addressing its risks.

The chart on page 21 makes the threshold problem particularly clear. In tested samples, Event Groups scoring 19 points, just below the investigative threshold, had SAR yields of 45.49% in the first quarter of 2022 and 45.03% in the second quarter. Earlier testing of groups scoring 20 to 24 points, which qualified for investigation, had produced yields of approximately 34%. FINCEN consent order

These results did not establish the precise performance of every unreviewed transaction. However, they challenged the justification for leaving the threshold unchanged. Management should have asked, “What does this evidence tell us about the activity we are not investigating?”

When Efficiency Becomes the Wrong Objective

FinCEN found that the bank’s testing often focused on whether yields above and below the threshold differed statistically, without adequately considering the implications of missed suspicious activity. The bank also lacked an objective benchmark to assess whether the threshold was appropriate.

In another example, a calibration model reduced the number of cases requiring investigation by more than 8,200. An accompanying report described the associated loss of SARs as permissible without explaining how that conclusion had been reached.

This distinction matters for any automated compliance process. Reducing unnecessary reviews can legitimately improve a process. Reducing reviews is not, by itself, evidence of improvement. Consider an expense-monitoring tool. Eliminating repetitive, demonstrably irrelevant alerts may improve performance. Raising thresholds until the review team can handle the remaining volume does not establish that the excluded transactions present acceptable risk.

That is an application of the case, not a finding about an expense system at Bank of America. The transferable principle is that the performance objective must remain tied to the compliance purpose.

Exceptions Can Defeat the Primary Control

The Event Processor also used rules that rescored certain risk factors to zero. The Consent Order describes those rules as developed through an ad hoc and subjective process without adequate testing. When the bank discontinued the logic in December 2023, approximately 150,000 active Event Groups had triggered one or more aspects of it.

One particularly useful example involved customers exempted from certain currency transaction reporting requirements. Event Processor used that status to suppress some alerts, even though the applicable exemption did not remove the obligation to report suspicious activity. The broader control lesson is to examine the legal and factual basis for every exception.

An exception for one purpose should not silently become an exemption from a different control. A previously approved customer should not automatically become exempt from future review. A false-positive determination based on yesterday’s information should not permanently determine tomorrow’s result.

Data Gaps Limit What Technology Can Detect

FinCEN found that the bank’s systems did not adequately distinguish among types of negotiable instruments, such as checks and money orders, which limited targeted monitoring. The Consent Order also describes insufficient monitoring and data quality issues involving credit card activity. The lesson for compliance technology governance begins before model selection.

What information does the control need? Is that information captured consistently? Does it reach the monitoring system? Can investigators retrieve and use it? Who is responsible when a required field is incomplete or a relevant product lacks coverage? A sophisticated analytical tool cannot compensate for an unidentified gap in the information supplied to it.

Recalibration Revealed the Scale of the Problem

Following regulatory engagement, Bank of America lowered the investigative threshold in December 2023 to 10 or 12 points, depending on the Event Group. A limited lookback identified nearly 8,900 SARs involving approximately $4 billion in activity that the bank had failed to identify and report under the prior parameters.

The bank estimated that the revised thresholds would double ongoing monthly investigative volume and require about 750 additional personnel, plus another 800 consultants for the one-time lookback. These were the bank’s staffing estimates, not evidence that every position had already been filled. For a CCO, those numbers make the resource question concrete. Technology configuration and staffing cannot be governed as unrelated decisions when one determines the other’s workload.

The Application to AI Governance

The Consent Order describes Event Processor as a proprietary interconnected model system. It does not establish that it was a generative AI system. Nevertheless, its governance failures provide useful comparison points for organizations deploying AI in compliance. FINCEN consent order

NIST’s AI Risk Management Framework organizes risk management around Govern, Map, Measure, and Manage. Applied here as an analytical framework, those functions suggest a practical sequence: assign accountable ownership, define the intended use and relevant risks, test actual performance, and act when the evidence identifies deficiencies.

ISO/IEC 42001 provides a complementary management-system approach for establishing, maintaining, and continually improving AI governance. Neither framework is presented here as a standard that FinCEN found Bank of America had violated. The objective is not to prohibit innovation. It is to ensure that innovation remains explainable, testable, and subject to effective challenge.

Three Key Takeaways

First, validate the decision rules, not merely system availability. Establish why thresholds, weights, prioritization rules, and exceptions address the intended risk.

Second, test what the control misses. Include below-threshold activity, incomplete product coverage, data gaps, and delayed escalation.

Third, connect technology governance to resources and remediation. A finding that requires additional review must lead to a supportable operational response.

The CCO question: Can you demonstrate that your compliance technology addresses the intended risk, or only that it operates according to its configuration?

In Part 2, we examined how BOA’s Event Processor transaction monitoring system failed to translate automated alerts into effective detection and investigation. FinCEN identified unsupported design choices, inadequately calibrated risk weights, poorly governed suppression rules, and monitoring gaps that persisted despite testing that challenged the system’s effectiveness.

After the bank lowered its investigative thresholds, a limited lookback identified nearly $4 billion in suspicious activity that it had failed to identify and report under the previous parameters. The central lesson for CCOs is that reducing alert volumes or investigative workloads does not, by itself, demonstrate improved compliance. Effective technology governance requires reliable data, supportable decision rules, independent testing, attention to missed activity, and resources sufficient to address the findings. These principles also provide practical guidance for AI oversight. An automated control is measured by whether it addresses the intended risk, not simply whether it operates as configured.

Join us Tomorrow

Tomorrow, Part 3 broadens the analysis from transaction monitoring to sanctions compliance, examining OFAC’s findings on blocked-bank payment routing, improperly prioritized alerts, delayed watchlist updates, and mishandled accounts associated with blocked persons. These incidents raise a broader management question: when several controls fail in different ways, does the organization investigate each error separately, or does it examine whether they reveal shared weaknesses in oversight, resources, and operational execution?

We will explore the importance of vendor oversight, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation. We will also examine the difference between completing a corrective action and proving it works, including the role of interim safeguards and independent validation. Boards and compliance leaders must ask whether management has corrected individual incidents or verified that the underlying controls work across the enterprise.

Categories
Blog

BOA Part 1: $1.2 Billion Compliance Failure: When Red Flags Meet Revenue

A compliance program is tested when someone identifies a risk that the business would prefer not to address. The question is not whether compliance can produce a memorandum. The question is whether the organization makes a timely, supportable decision and implements controls that address the concern.

The Bank of America enforcement record provides a detailed examination of that problem. FinCEN (Consent Order) describes repeated internal warnings, testing that identified weaknesses, and customer relationships that continued without controls commensurate with the risks. Its findings place management decisions about revenue and resources at the center of the compliance failure.

For chief compliance officers, the central lesson is straightforward: Identifying a material risk is the beginning of compliance work, not its completion. Over this four-part blog series, we will review the FinCEN Consent Order, OFAC’s Enforcement Release, and the Department of the Treasury’s Press Release to mine each for how this was allowed to occur, how it continued, the governance failures, the marginalization of compliance, and the penalties assessed. Today in Part 1, we examine the governance failure at the heart of the Bank of America enforcement actions: compliance personnel identified significant risks, but management did not ensure those concerns led to timely, effective corrective action.

Understanding the Enforcement Actions

On October 13, 2026, the Department of the Treasury announced enforcement actions involving FinCEN, the Office of the Comptroller of the Currency, and the Office of Foreign Assets Control. Treasury described combined penalties exceeding $1.21 billion for anti-money laundering and sanctions failures.

The penalty structure matters. FinCEN assessed $1.2 billion but credited the bank’s $750 million OCC payment, leaving $450 million payable under the FinCEN Consent Order. OFAC’s separate Enforcement Release states a settlement of $11,662,930. Adding the full FinCEN and OCC assessments together would therefore overstate the combined financial penalty.

The legal posture also matters. Bank of America admitted the facts and violations in the FinCEN Consent Order. It expressly limited its admission of willfulness to the civil Bank Secrecy Act enforcement standard. By contrast, OFAC resolved potential civil liability for apparent violations. These documents should not be characterized as a criminal guilty plea.

The Warnings Were Already Inside the Organization

Consider the relationship identified in the FinCEN Consent Order as Customer A, an online marketplace connecting sellers of salvaged vehicles with domestic and international buyers. The bank had maintained accounts for this customer since 1995. By 2022, compliance personnel had identified concerns involving third-party payments, limited visibility into the source of funds, and repeated fraud-related investigations. In July, compliance recommended that the customer’s accounts be considered for closure. Subsequent internal analysis identified more than 100 customer-related cases between 2020 and August 2022.

This was not simply a disagreement about a customer’s reputation. Compliance was identifying a weakness in the bank’s ability to understand the funds moving through the relationship. An important distinction must remain clear. The Consent Order records that no evidence shows Customer A orchestrated the underlying fraud. The concern was that its accounts appeared to have received and moved fraud proceeds, creating risks the bank needed to address. Suspicion concerning transactions is not proof that the customer knowingly participated in the underlying misconduct.

That distinction makes the compliance lesson more useful. An organization does not need to prove a business partner is a criminal before deciding the relationship requires stronger controls.

When Commercial Importance Becomes the Answer to a Different Question

Following an internal meeting in September 2022, the relationship manager prepared a memorandum describing Customer A as a “large and valued client” generating approximately $6 million in annual revenue. The memorandum emphasized the broader commercial relationship and the business line’s support for retaining it. Compliance personnel continued asking how the underlying risks were being mitigated. FINCEN consent order

Here is the governance problem: commercial value and risk mitigation answer different questions. Revenue explains why the business wants to retain a relationship. It does not establish that the relationship can be maintained within an effective control environment.

Nor does compliance independence require that every recommendation to terminate a relationship prevail. FinCEN expressly states that account closure is not the only appropriate response to heightened financial crime risk. Enhanced monitoring, restrictions on products or services, and other risk-based controls may be appropriate. The real question is whether the alternative works.

A defensible decision to retain a high-risk customer should explain what will change, who will implement it, what evidence will show it works, and what happens if the customer does not meet the agreed conditions. Without those elements, an alternative mitigation plan can become a way to defer the original decision.

A Mitigation Plan Is Not the Same as Mitigation

In March 2023, more than six months after compliance recommended closure, the relationship manager summarized proposed measures, including limiting payments to registered buyers or dealers. Compliance withdrew its closure recommendation based on the communication and implementation of those measures, while reserving the possibility of revisiting the decision.

However, Customer A continued processing third-party payments through its Bank of America account until June 2025. The bank did not adequately update the customer’s risk profile, ongoing monitoring, or other due diligence measures to address the continuing practice. Some other changes were implemented, but the central payment risk persisted.

This is where compliance activity and compliance effectiveness separate. A meeting is an activity. A mitigation plan is an activity. A customer assurance is information. None, standing alone, establishes that the risk has been reduced. For the CCO, the missing discipline is verification. When the organization decides to continue a relationship subject to conditions, those conditions need an owner, an implementation date, evidence requirements, and consequences for nonperformance.

Resources Are Also a Governance Decision

FinCEN found that management’s approach to transaction monitoring was influenced by the resources required to investigate additional cases. When remediation began, the bank estimated that investigative volumes would double and that approximately 750 additional personnel would be needed. FinCEN concluded that the bank had likely avoided hundreds of millions of dollars in compliance-related expenditures during the relevant period. That was FinCEN’s assessment, not a separately calculated figure of realized profit.

The business lesson is not that every compliance function should receive every requested dollar. Resource decisions need to address the actual risk. Management should not resolve a capacity problem by treating the activity that exceeds capacity as less important without a supportable risk basis.

What the CCO and Board Should Ask

As a comparison framework, the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) examines whether a program is well designed, adequately resourced and empowered, and effective in practice. It also asks whether managers tolerate greater compliance risks to pursue revenue and how the company responds when compliance raises concerns. These are useful analytical questions here, not the legal standards under which FinCEN resolved this case.

Board oversight provides another comparison. In Marchand v. Barnhill, the Delaware Supreme Court emphasized the need for a good-faith effort to establish board-level monitoring of a critical compliance risk. Caremark liability involves a demanding bad-faith standard, not automatic liability whenever a control fails. The Bank of America documents discussed here are not Caremark judgments against its directors.

The practical board questions nevertheless follow naturally. Which material compliance recommendations remain unresolved? Which business decisions depend on mitigation that has not been verified? Which deficiencies have appeared repeatedly without an effective response? Those questions move oversight beyond receiving presentations to examining whether management is controlling the risk.

Three Key Takeaways

First, require decisions, not indefinite escalation. Material concerns need accountable decision-makers, documented reasoning, deadlines, and follow-through.

Second, separate commercial justification from control effectiveness. A valuable relationship may be retained, but its revenue does not demonstrate that its risks are mitigated.

Third, verify the conditions supporting the decision. Keep an approved remediation plan open until the organization has evidence that the relevant controls work.

The CCO question: When the business rejects or modifies a compliance recommendation, can you demonstrate that the alternative actually reduced the risk?

Today we examined the governance failure at the heart of the Bank of America enforcement actions: compliance personnel identified significant risks, but management did not ensure that those concerns produced timely, effective corrective action. FinCEN’s findings describe an organization that prioritized customer revenue and resource considerations while known risks persisted without commensurate controls.

The central lesson is not that compliance must prevail in every disagreement or that every high-risk relationship must be terminated. Decisions to retain those relationships must rest on demonstrable risk mitigation, not commercial importance alone. For CCOs, this means establishing accountable decision-makers, deadlines, documented reasoning, and verification that agreed measures work. For boards, it means examining unresolved exposure rather than merely receiving reports of completed activities. A mitigation plan does not establish that a risk has been mitigated. The organization must verify the result.

Join us Tomorrow

Management decisions about compliance don’t stay confined to committee meetings and customer relationship discussions. They also shape the technology that determines which risks receive attention and which remain uninvestigated. In Part 2, we turn to Bank of America’s Event Processor transaction monitoring system and FinCEN’s findings concerning unsupported design choices, investigative thresholds, alert suppression, gaps in monitoring coverage, and inadequate responses to testing.

Our focus shifts from whether management acted on known concerns to whether its automated controls could identify and escalate the relevant activity. We will examine the difference between reducing investigative workload and improving compliance effectiveness, with practical applications for data governance, model validation, and AI oversight. Every CCO must ask whether your technology addresses the intended risk, not simply whether it operates according to its configuration.

Categories
Blog

Bank of America’s Corporate Culture Crisis: Part 5 – A Case Study for Compliance

Compliance professionals constantly seek to understand how systemic issues within corporate hierarchies can lead to severe consequences. The recent revelations about Bank of America’s (BoA) persistent workplace culture problems are a powerful reminder of compliance’s critical role in safeguarding employees and the organization.

This week, I have explored the BoA failure around workplace culture from various perspectives articulated by the Everything Compliance gang, including Karen Woody, Jonathan Armstrong, Matt Kelly, Karen Moore, and Jonathan Marks. This exploration included the failure of internal controls, failures by the Board and senior management, culture failures around highly driven, self-selecting employees, and the cultural miasma that is BoA from a perspective from across the pond. You can check out the full Everything Compliance episode here. We conclude our series with a summary of lessons learned for compliance and how compliance can use those lessons going forward.

The scandal at BoA involving the excessive hours worked by junior employees highlights a profound crisis in corporate culture that has significant implications for compliance professionals. Despite previous promises of reform following similar incidents, BoA’s failure to address these issues effectively reveals systemic problems that transcend mere policy implementation. The tragedy of junior banker Leo Lukenas, who died after working over 100 hours a week for multiple weeks in a row, underscores the urgent need for stronger internal controls, better communication between management levels, and a culture that genuinely prioritizes employee well-being.

This situation at BoA serves as a critical case study for compliance professionals, illustrating the dangers of a disconnect between senior management’s intentions and the actions of middle management. While senior executives may set policies to limit overwork, middle managers often circumvent these rules, perpetuating a toxic work environment. BoA’s manual control system’s failure, ineffective internal audits, and HR oversight further exacerbate the problem. Compliance professionals must ensure that internal controls are implemented, actively monitored, and enforced to prevent similar issues in their organizations.

A key lesson from the BoA crisis is the importance of addressing the role of incentive structures. In high-stakes environments like investment banking, where bonuses and career advancement are tied to deal closures, there is a significant risk of overwork becoming normalized. Compliance officers must advocate for realigning incentives to balance business goals with ethical standards and employee well-being. This involves addressing the symptoms of such crises and tackling the root causes, such as toxic corporate culture and misaligned incentives.

The BoA scandal highlights the critical role of internal controls in maintaining a healthy and sustainable corporate culture. Relying on self-reporting as a key control mechanism in this high-risk environment proved ineffective, as employees were pressured to underreport their hours. Compliance professionals must recognize that self-reporting should be supplemented with independent verification methods, such as automated time tracking and regular audits, to ensure accurate data collected and controls are effective.

A holistic approach to risk management and compliance must be considered. Internal controls must be integrated into a broader framework, including solid ethical leadership, ongoing employee education, and clear channels for reporting concerns. The failure of BoA’s control environment, monitoring, and remediation efforts allowed a culture of overwork to persist, ultimately leading to repeated tragedies. For compliance professionals, this underscores the need for continuous improvement and active management of internal controls.

The role of the board of directors in overseeing corporate culture is crucial. The BoA crisis demonstrates that board members must go beyond surface-level management reports and engage directly with employees to understand workplace challenges. A proactive approach, including regular reports on employee well-being metrics and internal audits focused on workplace culture, can help prevent such crises. Moreover, creating a culture where employees feel safe to voice concerns is essential for identifying and addressing risks before they escalate.

The Bank of America scandal is a stark reminder of the human cost of a toxic work culture and the vital role that compliance professionals play in safeguarding both employees and organizations. The lessons from this tragedy should guide efforts to create healthier, more sustainable work environments. Compliance is not just about preventing legal and regulatory risks but also about fostering a corporate culture that values integrity, transparency, and the well-being of all employees. By aligning business metrics with these values, companies can achieve sustainable success that benefits their bottom line and people.

Categories
Everything Compliance

Everything Compliance: Episode 139, The Bank of America Episode

In this episode, we take up the recent imbroglio surrounding the Bank of America and its toxic workplace culture of 100+ hour work weeks. We have the full quintet of Matt Kelly, Jonathan Armstrong, Karen Woody, Jonathan Marks, and Karen Moore; all hosted by Tom Fox.

  1. Matt Kelly mines the matter for compliance lessons learned. He shouts out the GOP speakers at the recently concluded Democratic National Convention who bucked their party for the good of the nation.
  2. Jonathan Marks explores how internal controls were in place but not completely disregarded. He shouts out to researchers at the University of Pennsylvania for its work in CAR T cell therapy to treat certain types of cancer.
  3. Karen Moore considers the matter from the perspective of the Board of Directors and what their role should be. She shouts out to her students in the new semester of her class at Fordham Law School.
  4. Karen Woody takes a deep dive into the district court’s recent dismissal of the SEC complaint against Solar Winds. She shouts out the persons who ran the Democratic National Convention for a great Convention.
  5. Jonathan Armstrong reviews the entire matter from his UK perspective. He rants about Elon Musk and hate speech on X.
  6. Tom Fox shouts out to Rick Springfield and his hit song Jessie’s Girl as one of the two most well-known and sung songs from the 1980’s.

The members of the Everything Compliance are:

  • Karen Woody – Is one of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu
  • Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com
  • Jonathan Armstrong –is our UK colleague and an experienced data privacy/data protection lawyer in London. He can be reached at his new law firm Jonathan.Armstrong@puntersouthall.law
  • Jonathan Marks can be reached at jtmarks@gmail.com
  • Karen Moore can be reached at Kmoore51@fordham.edu

The host and producer, rantor (and sometime panelist) of Everything Compliance is Tom Fox the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the award-winning Compliance Podcast Network.

Categories
Blog

Bank of America’s Corporate Culture Crisis: Part 4 – A Tale of Metrics and Misalignment: Lessons for Compliance Professionals

Compliance professionals constantly seek to understand how systemic issues within corporate hierarchies can lead to severe consequences. The recent revelations about Bank of America’s (BoA) persistent workplace culture problems are a powerful reminder of compliance’s critical role in safeguarding employees and the organization.

This week, I will explore the BoA failure around workplace culture from various perspectives articulated by the Everything Compliance gang, including Karen Woody, Jonathan Armstrong, Matt Kelly, Karen Moore, and Jonathan Marks. This exploration will include the failure of internal controls, failures by the Board and senior management, culture failures around highly driven, self-selecting employees, and the cultural miasma that is BoA from a perspective from across the pond. In Part 4, we consider a misconnection of metrics. This issue is not merely a question of productivity but a fundamental concern about corporate culture, ethics, and long-term sustainability.

In corporate governance and compliance, aligning business metrics and ethical obligations often defines a company’s culture’s success or failure. The recent Wall Street Journal (WSJ) article about BoA and its investment banking metrics sheds light on a crucial disconnect that compliance professionals must address: the disparity between business performance indicators and employee well-being.

At the heart of the issue is the nature of the metrics used to evaluate success in different industries. In investment banking, the primary focus is often on closing deals. The logic is straightforward: deals drive revenue, and revenue drives the bottom line. This singular focus on deal-making creates an environment where the end justifies the means, potentially overlooking the toll it takes on employees.

Conversely, in law firms, the metric of success is often billable hours. Lawyers are compensated and promoted based on the number of hours they bill, which can lead to a different, yet equally problematic, set of behaviors. Over-inflating hours or working excessive hours becomes the norm because that is the path to career advancement.

Both systems create perverse incentives: investment bankers might underreport hours to avoid raising HR flags, while lawyers might overreport hours to enhance their career prospects. These behaviors highlight a crucial point for compliance professionals: the metrics set at the top of an organization inevitably shape the behavior throughout the company.

One of the first steps in addressing these issues is understanding the available data and how it is used. Compliance professionals must ask themselves, “What data do we have, and how can it be used to monitor and manage risks effectively?” By focusing solely on deal closure, companies are potentially neglecting data related to employee well-being, such as hours worked or stress levels.

In contrast, law firms have systems that track the minutiae of an employee’s workday, from time spent on tasks to keystrokes made during document review. This data is invaluable for billing clients and identifying patterns that may indicate overwork or burnout. Compliance professionals in investment banking could learn from this approach, using technology to track hours worked or monitor workload distribution, ensuring that employees are kept within reasonable limits.

The core issue is more alignment between business metrics and corporate culture risks. Compliance professionals must ensure senior management acknowledges overwork as a significant risk and takes proactive steps to monitor and mitigate it. This involves tracking the traditional success metrics and implementing metrics that reflect the company’s values and culture.

For example, if overwork is recognized as a risk, metrics such as average hours worked, employee turnover rates, and employee satisfaction surveys should be regularly monitored and reported. This dual approach allows a company to pursue business success while ensuring its corporate culture remains healthy and sustainable.

The responsibility of aligning these metrics rests not solely with middle management, compliance officers, or senior management; it extends to the board of directors. The board’s oversight role is crucial in ensuring that the company’s culture is preserved in pursuing financial success. For boards everywhere, the recent scrutiny BoA received in the WSJ article serves as a lesson.

Board members must go beyond the surface level of management reports and delve into the realities of the workplace culture. This requires more than attending board meetings in luxurious settings and listening to pre-prepared presentations. It involves engaging directly with employees at all levels, understanding their challenges, and prioritizing their well-being.

A practical approach could involve the board requiring regular reports on employee well-being metrics, mandating internal audits focused on workplace culture, or even conducting anonymous employee surveys to get an unfiltered view of the corporate environment.

An effective compliance program also hinges on creating a culture where employees feel safe to voice their concerns. A speak-up culture is essential in identifying issues before they escalate into major risks. Management and the board should encourage employees to report inconsistencies between policy and practice and take these reports seriously.

For instance, if employees consistently report working beyond reasonable hours, this should trigger an investigation and subsequent action from the board. Such feedback mechanisms help identify risks and reinforce the company’s commitment to ethical practices.

Lastly, when issues do arise—such as the tragic death of a young employee in the Bank of America case—the board should conduct a root cause analysis. This analysis should not be limited to the immediate cause but should explore deeper systemic issues that may have contributed to the incident.

A comprehensive root cause analysis might reveal that the focus on deal closure at the expense of employee well-being is not an isolated issue but indicative of a broader cultural problem. The board could use this analysis to implement changes across the organization, ensuring that similar incidents do not occur in the future.

The lessons are clear: the metrics that companies use to measure success are powerful drivers of behavior. The challenge for compliance professionals is ensuring that these metrics align with business goals, ethical standards, and employee well-being. This requires a proactive approach, leveraging data to monitor business performance and corporate culture. It also requires a board that is engaged, informed, and committed to understanding the realities of the workplace.

In the end, compliance is not just about preventing legal and compliance risks but about fostering a corporate culture that values integrity, transparency, and the well-being of all employees. By aligning metrics with these values, companies can achieve sustainable success that benefits their bottom line and people.

Categories
Blog

Bank of America’s Corporate Culture Crisis: Part 3 – The Role of Internal Controls

Compliance professionals constantly seek to understand how systemic issues within corporate hierarchies can lead to severe consequences. The recent revelations about Bank of America’s (BoA) persistent workplace culture problems are a powerful reminder of compliance’s critical role in safeguarding employees and the organization.

This week, I will explore the BoA failure around workplace culture from various perspectives articulated by the Everything Compliance gang, including Karen Woody, Jonathan Armstrong, Matt Kelly, Karen Moore, and Jonathan Marks. This exploration will include the failure of internal controls, failures by the Board and senior management, culture failures around highly driven, self-selecting employees, and the cultural miasma that is BoA from a perspective from across the pond. In Part 3, we will consider the role of internal controls.

Internal controls are often seen as the backbone of an organization’s ability to operate efficiently, ethically, and within the bounds of the law. They serve as the safety net that catches errors deters fraud, and ensures that policies are not just theoretical but are put into practice. However, the recent revelations in the Wall Street Journal (WSJ) surrounding the culture of overwork at a major financial institution, where junior bankers were expected to work excessively long hours, shine a spotlight on a critical failure in internal controls—not in their design, but in their execution and monitoring. This blog post will explore the lessons compliance professionals can learn from this situation, focusing on implementing, actively managing, and enforcing internal controls.

Understanding the Control Environment

The control environment is at the heart of any robust internal control system. This includes the corporate culture, employee attitudes toward internal controls, and the tone set by senior management. It’s the foundation upon which all other aspects of internal control are built. When the control environment is weak or toxic, as in the situation under discussion, the entire control structure can crumble.

In this case, BoA had ostensibly implemented controls to prevent overwork—junior bankers were required to self-report their working hours. If they exceeded a certain threshold, this would trigger a review by HR. However, this control was ineffective because those responsible for enforcing it did not take it seriously. Managers instructed their subordinates not to report excessive hours, bypassing control entirely. Additionally, think about the basic conflict of interest (READ: Absurdity) in having the person the control was supposed to monitor input the information for the control to activate.

For the compliance professional, this emphasizes that your control environment is only as strong as the commitment of those enforcing it. Senior management must set the tone and ensure that it resonates throughout the organization. When internal controls are ignored or undermined, it’s often a sign that the control environment is flawed.

The Role of Monitoring and Remediation

Internal controls are not static; they require ongoing monitoring and, when necessary, fine-tuning or remediation. In the BoA situation, the institution needed to adequately monitor the effectiveness of its controls. Even after the tragic death of a junior banker, which should have been a clear signal that the controls in place were not working, there was no significant overhaul or improvement in the control environment.

Monitoring is a critical component of internal control, as it allows an organization to detect weaknesses and address them before they lead to significant issues. In this case, the failure to monitor and remediate allowed a toxic culture to persist for years, ultimately leading to repeated tragedies.

For the compliance professional, the lesson is clear: regular monitoring of internal controls is essential. When weaknesses are identified, they must be addressed promptly and effectively. A failure to remediate control weaknesses leaves an organization vulnerable to risks and can signal to employees that the controls—and the culture—are not taken seriously.

The Flaws of Self-Reporting as a Control

One of the most striking aspects of this case is the reliance on self-reporting as a key control mechanism. While self-reporting can be helpful, it is far from foolproof, especially in environments with significant pressure to conform to unrealistic expectations. In this instance, the control requiring junior bankers to self-report their hours was ineffective because the reporting was neither enforced nor monitored.

The problem with self-reporting as a control is that it places the onus on the individuals being controlled, which can create a conflict of interest. Employees may feel pressured to underreport or falsify their time to meet expectations or avoid repercussions. With independent verification and oversight, self-reporting is likely to be reliable.

For the compliance professional, the starkness of the lesson could not be more profound. Self-reporting should not be relied upon as the sole or primary control in a high-risk environment. It should be supplemented with independent verification methods, such as automated time tracking, regular audits, or cross-referencing with other data sources. This approach ensures that the data collected is accurate and that controls are truly effective.

Automation and Technology in Internal Controls

Given BoA’s size and sophistication, it is somewhat perplexing that more robust, automated controls were not implemented. In today’s technologically advanced world, numerous tools can automatically track employee hours, monitor for signs of overwork, and flag potential issues for review. These tools can remove the burden of self-reporting and provide more accurate, real-time data.

For example, many organizations use software that tracks employee computer activity, monitors login and logout times, and even tracks time spent on specific tasks. This data can then be used to identify patterns of overwork and take proactive measures to prevent burnout or health issues.

For the compliance professional, it is a direct lesson that leveraging technology can significantly enhance the effectiveness of internal controls. Automated systems can provide continuous monitoring, reduce the risk of human error, and offer objective data that can be used to identify and address potential issues before they escalate.

The Importance of a Holistic Approach

Finally, every compliance professional must recognize that internal controls cannot operate in a vacuum. Internal controls must be part of a broader, holistic approach to risk management and compliance. This includes fostering a strong ethical culture, regularly training employees at all levels, and ensuring transparent, accessible channels for reporting concerns.

With BoA, the failure was not just in the specific control related to work hours—it was a systemic failure across the organization. The culture of overwork was allowed to persist because the control environment was weak, monitoring was inadequate, and there was no serious commitment to remediation.

This final lesson learned for the compliance professional is that internal controls are just one piece of the puzzle. To be truly effective, they must be integrated into a comprehensive risk management framework that includes strong ethical leadership, ongoing education, and a commitment to continuous improvement. 

Internal Controls as a Reflection of Corporate Culture

The tragic situation at BoA is a stark reminder of the critical importance of internal controls in maintaining compliance and a healthy and sustainable corporate culture. Internal controls are more than checkboxes—they reflect an organization’s values and priorities. When controls are ignored or undermined, they send a message that compliance, and by extension, employee well-being, is not a priority.

For compliance professionals, the key takeaway is clear: internal controls must be actively managed, monitored, and enforced. They must be part of a broader effort to create a culture of integrity and accountability. Perhaps most importantly, they must be seen as a dynamic system that requires constant attention and adjustment to remain effective. In a world where pressure on employees is greater than ever, robust internal controls are not just a regulatory requirement but a moral imperative.

Categories
Blog

Bank of America’s Corporate Culture Crisis: Part 2 – Lessons Learned for Compliance

Compliance professionals constantly seek to understand how systemic issues within corporate hierarchies can lead to severe consequences. The recent revelations about Bank of America’s (BoA) persistent workplace culture problems are a powerful reminder of compliance’s critical role in safeguarding employees and the organization.

This week, I will explore the BoA failure around workplace culture from various perspectives articulated by the Everything Compliance gang, including Karen Woody, Jonathan Armstrong, Matt Kelly, Karen Moore, and Jonathan Marks. This exploration will include the failure of internal controls, failures by the Board and senior management, culture failures around highly driven, self-selecting employees, and the cultural miasma that is BoA from a perspective from across the pond. In Part 2, we journey through some key lessons learned for compliance professionals.

In the high-stakes world of investment banking, where deals are won or lost in hours, the pressure to perform can push individuals to the brink. Unfortunately, that brink has meant a premature end to some people’s lives. The recent tragedy at BoA, where a junior banker named Leo Lukenas died after working over 100 hours a week for weeks on end, has cast a harsh light on a decade-long problem. This is not the 2013 scandal revisited; it’s an ongoing crisis, a corporate culture problem that has festered for years. The lessons from this ongoing debacle are critical and chilling for compliance professionals.

Lukenas was not the first casualty of this toxic culture. In 2013, an intern in Bank of America’s London office, Moritz Erhardt, met a similar fate after enduring a grueling workload. Following that incident, the bank promised to implement policies to prevent such tragedies from recurring. Yet, a decade later, Lucas’s death is a stark reminder that those policies have either failed or were never truly enforced.

The investment banking division at Bank of America has been likened to a “white-collar sweatshop,” a description that, sadly, fits too many high-pressure work environments. While the term “sweatshop” might conjure images of factories in developing countries, overwork and exploitation can happen in plush office towers just as easily. Lucas’s death has brought into sharp relief the human cost of such environments, where the relentless pursuit of profit eclipses the well-being of employees.

What is particularly concerning is that this issue is separate from a single office or even a single country. The WSJ’s reporting has revealed that overwork at Bank of America is a pervasive issue, affecting employees in New York, London, Tokyo, and Latin America. Former employees have cited overwork as a primary reason for leaving the bank, underscoring that this is not a localized problem but an enterprise-wide failure of corporate culture.

This brings us to a crucial question: Where was compliance? Why have the policies and controls put in place to prevent overwork ineffective? The answer lies in a deep-seated cultural issue that transcends mere policy implementation. Middle management has tolerated if not outright encouraged, this culture, which senior management has failed to address with the necessary urgency.

Middle management is often described as the “meat grinder” of corporate culture, where good intentions from the top can get mangled into toxic behaviors at the bottom. In the case of Bank of America, middle managers were reportedly telling their subordinates not to report excessive working hours to HR, effectively bypassing the controls that were supposed to prevent overwork.

This is a classic example of what can happen when senior management fails to engage effectively with middle management. Senior executives may have genuinely wanted to prevent overwork, but their message could have been more focused and addressed by those in the middle tasked with enforcing it. This disconnect is where corporate culture often fails. Compliance professionals understand that policies are only as good as their enforcement, and enforcement is only as good as the people who are responsible for it. For the compliance professional, this means you must directly connect what senior management has laid out as policy and not simply put procedures in place to implement the policy but then monitor the implementation to ensure the policy is being followed. Sadly, that was not the case at BoA.

Another critical factor in this crisis is the role of incentive structures. It is no secret that high-stakes deals and intense pressure to produce results drive investment banking. But the stage is set for disaster when bonuses and career advancement are tied to closing deals, even at the cost of employee health.

This misalignment of incentives is a fundamental issue that any compliance officer must address. If the financial rewards for middle managers are tied to delivering results, irrespective of the human cost, then it should be no surprise that overwork becomes a pervasive problem. Incentive structures must be reexamined and realigned with the organization’s ethical and operational goals.

As compliance professionals, it is imperative not just to address the symptoms of such crises but to dig deeper and identify the root causes. This case’s root cause is clear: a toxic corporate culture prioritizes results over people. But beyond that, it is about senior management’s failure to enforce a healthy work culture and the misalignment of incentives that drives middle managers to push employees to the brink.

Organizations need to examine their culture, management practices, and incentive structures to prevent such tragedies in the future. This is not just a problem for Bank of America; it’s an industry-wide issue that requires a collective response. Compliance officers have a crucial role in advocating for stronger controls, better communication, and a culture that truly values employee well-being.

The ongoing crisis at BoA is a sobering reminder of the human cost of a toxic work culture. For compliance professionals, it serves as a call to action. A culture that values employees as people, not just as cogs in a machine, is necessary for enforcing and supporting policies; having them on paper is not sufficient.

As we progress, the lessons from this tragedy should guide our efforts to create healthier, more sustainable work environments. Compliance is not just about ticking boxes; it’s about ensuring our values are reflected in our organizations’ day-to-day operations. Ultimately, it’s about protecting the organization and the people who make it what it is.