Tag: ECCP

Categories
Blog

BOA Part 4: 20 Lessons Every Corporate Compliance Professional Should Learn from BOA

A manufacturer, technology company, retailer, or energy business doesn’t need to operate a bank to recognize the management problems this series examines. A commercially important relationship presents unresolved concerns. A monitoring tool produces reassuring statistics but does not provide adequate coverage. A vendor fails to deliver a critical update. Employees identify weaknesses, but corrective action remains incomplete.

Bank of America’s documents provide specific examples of these issues. FinCEN emphasizes management decisions, monitoring deficiencies, and customer due diligence failures. OFAC adds findings involving vendors, technology changes, operational mistakes, and remediation.

A non-banking compliance professional’s task is to translate those findings, not copy the bank’s obligations into a different industry. Bank-specific suspicious activity reporting and correspondent-account requirements should not be treated as universal corporate obligations. OFAC’s compliance framework, by contrast, expressly addresses organizations beyond financial institutions, including entities subject to U.S. jurisdiction and certain foreign entities with relevant U.S. connections. Applicability still depends on the organization’s activities and circumstances.

In this concluding Part 4, I offer 20 lessons learned as practical applications of the record from the FinCEN Consent Order and OFAC’s Enforcement Release.

Governance, Culture, and Management Accountability

FinCEN found that management focused on resource implications and revenue while identified risks persisted without commensurate controls. That is the factual foundation for the first four lessons.

1. Revenue is not a risk mitigation measure.

When a sales team argues that a distributor is indispensable, acknowledge the commercial importance and return to the unresolved risk. Require the business to identify the controls supporting continued engagement. The decision should explain why those controls are adequate, not merely why termination would be expensive. Commercial value belongs in the discussion, but it should not substitute for evidence of risk mitigation.

2. Escalation must produce a decision and follow-through.

Assign a decision-maker, a response deadline, and an accountable owner for every material compliance escalation. Record the reasoning behind the decision and the actions that follow. Where management retains a relationship subject to conditions, specify what happens when those conditions are not met. A recommendation should not disappear into repeated meetings without a documented disposition.

3. Resources should follow the risk.

Prepare resource requests around the work needed to address identified exposure: investigative volume, overdue reviews, data gaps, geographic expansion, and testing requirements. Where funding is declined, document the resulting limitations and proposed alternatives. Do not make a control appear more effective by excluding work merely because the organization lacks the capacity to perform it.

4. Board reporting should show unresolved exposure.

Report significant exceptions, recurring deficiencies, overdue corrective actions, and failed effectiveness tests alongside completed activities. Identify the executive responsible for the response and the decisions requiring board attention. Directors do not need every case file. They need a clear picture of material risks that remain uncontrolled and the evidence supporting management’s assessment.

Due Diligence and Understanding Business Relationships

FinCEN describes customer profiles that did not adequately incorporate third-party payments, geographic exposure, and information developed during the relationship. It also found deficient due diligence involving the bank’s own foreign branches and affiliates. FINCEN consent order 

5. Due diligence is a continuing process.

Set triggers to reassess when ownership, products, payment practices, geography, or transaction volumes change. A distributor’s original approval does not answer questions raised by materially different activity three years later. Updating a risk rating should also lead to an assessment of whether monitoring, contractual protections, payment controls, or other safeguards need to change.

6. Understand who is paying, for whom, and why.

For a non-banking business, relevant questions may arise when an unrelated entity pays a customer invoice, commissions are redirected, or refunds are requested to a different account. These circumstances do not automatically prove misconduct. They are reasons to obtain a supportable business explanation and apply appropriate controls before proceeding.

7. Familiarity and affiliation are not substitutes for assessment.

Apply risk-based review to longstanding partners, subsidiaries, and affiliated entities as well as unfamiliar third parties. The question is not simply whether the organization knows the entity. It is whether the organization understands its current activity, relevant counterparties, and exposure. Corporate affiliation may affect the information available, but it should not end the inquiry.

8. Evaluate connected relationships.

When an investigation identifies a problematic intermediary, assess whether the same person, beneficial owner, address, payment account, or commercial arrangement appears elsewhere. FinCEN describes the bank failing to reassess continuing customers after exiting a connected customer. The corporate application is to avoid treating each third-party file as an isolated record when the relevant risk involves a network of relationships. FINCEN consent order

Technology, Data, and Control Design

The Event Processor findings address unsupported design choices, inadequate responses to testing, poorly governed suppression rules, and incomplete monitoring coverage. These findings form the foundation for the next four applications. FINCEN consent order

9. Require evidence that automated decisions are supportable.

For each material automated compliance control, document its purpose, inputs, decision rules, limitations, and owner. Determine who can change it and who independently evaluates its performance. Ask the same questions whether the tool uses fixed rules, statistical models, or AI. The technology’s sophistication should not determine the rigor of its governance.

10. Measure what the system misses.

Test selected activity that falls below thresholds, bypasses automated review, or comes from products and business units with limited coverage. Examine delays and missed issues. A lower alert count may represent improvement, deterioration, or a change in the population being monitored. Do not treat reduced workload as proof of reduced risk.

11. Make data governance part of compliance governance.

Identify the information each control needs and trace it from its source through the control and into any resulting investigation. Assign responsibility for missing, inconsistent, or inaccessible data. FinCEN’s required review explicitly addresses data accuracy, completeness, responsibilities, information flows, and error detection. The corporate application is to treat those matters as control dependencies, not solely information technology concerns. FINCEN consent order

12. Put controls around exceptions.

Whitelists, overrides, automatic dismissals, and other exclusions should have a documented rationale, approval authority, review date, and testing requirements. Ensure that an exemption granted for one purpose does not disable an unrelated control. Revisit exceptions when the underlying facts change. An exception should remain a controlled decision, not become an undocumented permanent feature.

Vendors, Operational Execution, and Independent Challenge

OFAC’s compliance considerations emphasize organizational responsibility despite third-party reliance, controlled technology changes, and training supported by testing and accessible guidance. OFAC

13. Outsourcing does not transfer performance responsibility.

For a critical screening, monitoring, or due diligence provider, verify that the service actually operates within the company’s process. Test updates, escalation procedures, outages, and known limitations. A contract and a vendor assurance are useful starting points. They don’t prove required information reaches the right system or that employees act on it appropriately.

14. Treat technology changes as compliance events.

Before a migration, assess data transfer, control continuity, expected alert volume, staffing, and fallback procedures. After launch, test the real process rather than rely entirely on preproduction results. Define who can pause implementation or impose temporary safeguards if performance is inadequate. Completing the migration should not be the only measure of success.

15. Test whether employees can perform the required task.

Use realistic scenarios for sales, procurement, finance, logistics, and other relevant functions. Ask employees to demonstrate when they would stop a transaction, seek advice, or escalate an exception. Provide usable instructions and accessible expertise. Training completion is an administrative measure. Correct execution is the outcome the organization needs to establish.

16. Protect independent challenges.

FinCEN describes repeating an unfavorable test, with the second result supporting the existing threshold. For other organizations, the application is to preserve original findings, document methodological changes, and subject material disagreements to independent review. A test may legitimately need correction. The process should explain why the correction is valid, not just produce a more comfortable answer. FINCEN consent order

Detection, Investigations, and Sustainable Remediation

17. Use external warnings to assess internal detection.

FinCEN distinguished useful cooperation and information sharing from excessive dependence on external and manual sources to identify relevant risks. Apply that distinction carefully. A whistleblower report does not, by itself, prove that a program failed. The question is whether controls designed to detect the issue should have identified it earlier and what the external information reveals about their limitations. FINCEN consent order

18. Investigate the underlying problem, not only the first incident.

When a control fails, determine whether the same weakness affects other transactions, employees, systems, business units, or jurisdictions. Document the rationale for the investigation’s scope and revisit it as evidence develops. OFAC’s criticism of the bank’s initially narrow lookback illustrates why resolving the first identified transaction may leave the broader problem undiscovered. OFAC

19. Require immediate protection and proof of lasting effectiveness.

Use appropriate interim safeguards while developing longer-term remediation. Then distinguish completion of the change from verification of its effectiveness. FinCEN’s undertakings separately address interim controls and subsequent testing of enhancements. For a corporate program, issue closure should identify the evidence reviewed, the remaining limitations, and who independently validated the result. FINCEN consent order

20. Organize disclosure and cooperation before the response becomes fragmented.

Establish decision rights, preserve evidence, develop the facts, and assess disclosure with counsel under the applicable regime. Track requests and verify that responses are complete and consistent. OFAC’s treatment also demonstrates the importance of precision: voluntary disclosure affected the base calculation for some violations, but the settlement received no additional reduction from that base. Different forms of credit should not be treated as interchangeable. OFAC

Turn the Lessons into an Action Plan

This case study’s value is not the number of lessons a compliance team can recite. It is whether the organization uses them to examine decisions and controls that matter to its own business. Start with three lessons that present the greatest exposure in your organization.

For each, identify the responsible executive, the control being relied upon, the latest evidence that it works, and the corrective action needed where that evidence is missing. Record what must happen immediately and what can reasonably be addressed through a longer-term plan.

Then take the results to the appropriate management or board committee. Do not report only that the review was completed. Report what the organization learned, what remains unresolved, and how effectiveness will be verified. The four-part series began by distinguishing between identifying a risk and addressing it. It ends by applying the same discipline to your own program.

The final board and CCO question: Where has our organization identified a material compliance risk, accepted a plan to address it, and failed to verify that the plan actually worked? This is the same basic question that concludes the last major section of the 2024 Evaluation of Corporate Compliance Program: Does the corporation’s compliance program work in practice?

Conclusion

Part 4 translates the Bank of America enforcement record into 20 practical lessons for compliance professionals outside banking, without treating bank-specific obligations as universal corporate requirements. The article organizes those lessons around governance and accountability, continuing due diligence, technology and data, operational execution, and sustainable remediation. Its central message is that commercial importance cannot substitute for risk mitigation; an escalation is not resolved merely because it has been discussed. Automation does not establish that a control works.

For CCOs, the practical response is to connect material concerns to accountable decisions, test what systems miss, verify vendor performance, and confirm that employees can execute required procedures. Remediation should include interim protection and independent evidence that corrective measures are effective. The concluding assignment turns these lessons into action: select three areas of greatest exposure, identify responsible executives, examine the evidence supporting existing controls, and address the gaps. The objective is not to adopt another company’s compliance program, but to use its documented failures to test and improve your own.

What it all Means for Compliance

The Bank of America enforcement actions illustrate the difference between maintaining compliance processes and achieving compliance effectiveness. Part 1 examined management’s response to known concerns, including decisions that prioritized revenue and resources while risks persisted without commensurate controls. Part 2 examined how unsupported design choices, monitoring gaps, and inadequate responses to testing undermined automated detection. Part 3 connected sanctions failures to broader questions of vendor oversight, operational execution, investigation scope, and durable remediation. Part 4 translated those findings into an action agenda for non-banking compliance professionals.

All of this makes the case for treating compliance as a business discipline grounded in governance, reliable information, accountable decisions, and verified results. CCOs should be able to demonstrate what happens after a concern is raised, while boards should ask what remains unresolved and whether management’s response has reduced the exposure. The ultimate test is not whether an organization can describe its compliance program. It is whether it can demonstrate that its controls work, management acts on adverse information, and corrective action addresses the underlying risk.

Categories
Blog

BOA Part 3: The Failure to Connect the Dots: Sanctions, AML, and Effective Remediation

A payment-routing problem, a stale watchlist, an incorrectly prioritized alert, and an employee processing error may initially seem like separate operational incidents. OFAC’s Enforcement Release asks compliance leaders to examine the broader pattern. Its compliance considerations emphasize management oversight that identifies potentially systemic problems, implements durable solutions, and prevents errors from recurring across the enterprise.

Today, in Part 3, we focus on that connection. Fixing the first visible error is necessary. Establishing whether the same weakness exists elsewhere is the next responsibility.

A Separate Action with Familiar Governance Problems

According to the Enforcement Release, Bank of America agreed to pay $11,662,930 to resolve potential civil liability for 475 apparent violations involving approximately $14.8 million in transactions. The conduct involved sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. OFAC classified the matter as non-egregious but largely not voluntarily self-disclosed. These are separate findings from FinCEN’s anti-money laundering case. Do not treat them as findings about identical transactions merely because they reveal related governance concerns. Those concerns include control design, alert handling, staffing, technical changes, investigation scope, and the response to known weaknesses.

Payment Routing: A Control Must Work Across the Process

Bank of America used a third-party routing directory to help determine intermediary banks for certain cross-border payments. Some routing was automated; some could be entered manually. Once payment details were generated, the bank screened them for sanctions compliance.

In March 2022, the bank became aware that the directory included blocked banks and that some payments were still being processed to or through them. OFAC identified several causes: screening updates had not yet reflected new designations, analysts incorrectly dismissed alerts, or suppression rules automatically released payments based on earlier false-positive decisions.

OFAC ultimately identified 403 transactions totaling approximately $14.34 million routed through 35 blocked banks between February 2022 and March 2025. The bank implemented an automated directory solution in January 2023, but the release describes broader payment-processing failures beyond that implementation.

The compliance lesson is to test the complete process. A current directory does not establish that manual entry works correctly. A screening alert does not establish that the alert is properly resolved. A prior false-positive decision does not establish that the same disposition remains appropriate after a sanctions designation.

Alert Prioritization: Strong Information Must Produce an Appropriate Response

OFAC describes a design flaw that assigned low or medium priority to customers whose names and dates of birth both exactly matched those of blocked persons.

Because those alerts were not classified as high priority, review was delayed. Three designated individuals conducted 31 transactions using bank or credit card accounts. The bank fully implemented the relevant correction in February 2024, six months after initially identifying the issue. This is a control-design issue with an operational consequence.

The existence of a queue does not establish effective prioritization. Compliance leaders should be able to explain which information triggers immediate attention, which activity may continue while an alert awaits review, and what interim protection applies when the prioritization logic is known to be deficient.

Watchlist Updates: Vendor Performance and Internal Processing Both Matter

Between May 24 and June 28, 2023, a third-party vendor error prevented the watchlist file Bank of America used from reflecting changes to OFAC’s sanctions list. The bank did not identify the error until July, approximately a month after another U.S. bank blocked one of the affected payments downstream.

A separate failure in February 2025 involved technical problems in the bank’s own systems. The bank failed to implement a vendor update reflecting the previous day’s designations and processed transactions for a designated ship management company. The bank fully activated the relevant updates several days later; it then conducted a lookback and self-disclosed those transactions.

The two events should not be collapsed into a single vendor failure. One originated with the vendor. The other involved the bank’s processing of an update. Together, they illustrate why oversight should verify the entire update process: issuance, receipt, loading, activation, and operation. A delivery confirmation is not proof that screening uses the new information.

Employee Errors and Technology Changes Need a Control Response

The Enforcement Release also describes a business account that remained unrestricted after an analyst dismissed an alert involving its blocked beneficial owner. A subsequent rescreening during a platform migration generated another alert, but the bank did not review it promptly. OFAC attributed the delay to the volume of migration-generated alerts and inadequate preparation for that workload.

In another incident, personnel moved $189,869 from restricted business accounts into a new unrestricted account after misunderstanding how to handle accounts with a blocked authorized signer. Sanctions personnel identified the error and blocked the new accounts before the customer conducted further transactions involving the funds.

The second intervention mattered. It prevented further activity. It did not eliminate the need to examine why the transfer had been authorized. Calling an event human error should begin the root-cause inquiry, not end it. Was the instruction clear? Did the employee have access to appropriate guidance? Were approval rights properly defined? Should another control have prevented the action?

What the Penalty Says About Disclosure and Cooperation

OFAC determined that 413 apparent violations were not voluntarily self-disclosed and 62 were. Its base penalty calculation already reflected that distinction: the applicable scheduled amounts for the former and one-half of transaction value for the latter. The settlement equaled the resulting base penalty. Consequently, saying that the bank received no recognition whatsoever for voluntary disclosure would be inaccurate.

The more precise lesson is that OFAC granted no additional reduction from the base penalty. The release expressly states that OFAC did not mitigate the penalty for remedial measures or cooperation. OFAC also identified a tolling agreement as a mitigating factor but concluded that the circumstances did not justify a net reduction.

OFAC described piecemeal or incomplete submissions and delayed responses that slowed its investigation. It also criticized the bank’s initially narrow lookback into blocked-bank payments, with the full scope identified only after further OFAC direction. For compliance leaders, the lesson is to organize the response early. Coordinate investigation scope, document preservation, factual development, disclosure decisions, remediation, and regulatory responses rather than handling them as disconnected tasks.

FinCEN’s Undertakings Show What Verification Requires

The FinCEN Consent Order requires independent work to address historical suspicious activity, the effectiveness of transaction monitoring, customer and foreign correspondent due diligence, and data governance. Its lookback begins in January 2022 and extends through completion of relevant monitoring remediation, subject to the Consent Order’s scope provisions.

Two aspects are particularly instructive. First, the Consent Order addresses interim controls while remediation remains underway. A future system improvement is not treated as an answer to present exposure. Recommended interim measures may include manual processes, periodic reviews, and product-focused analyses. Second, the end-state review includes subsequent testing to validate whether enhancements meaningfully mitigate the relevant risks. Implementation and effectiveness are separate questions.

That distinction should shape remediation reporting. The board needs to know both whether the change was completed and whether testing demonstrates that it works.

Three Key Takeaways

First, investigate recurring themes across incidents. Similar errors may reveal shared weaknesses in data, approvals, staffing, training, or change management.

Second, treat disclosure and cooperation as disciplined processes. Determine the scope, preserve the record, develop the facts, and respond completely and promptly.

Third, distinguish implementation from effectiveness. Maintain interim safeguards and require independent evidence before declaring a material issue resolved.

The board question: Are we receiving evidence that remediation has reduced the risk, or only reports that remediation activities have been completed?

Summary

In Part 3, we examined how BOA’s sanctions failures exposed weaknesses across payment routing, alert prioritization, watchlist updates, and employee execution. The central lesson is that seemingly separate incidents should prompt an examination of shared weaknesses in oversight, resources, and operational processes, rather than a series of isolated fixes. We also considered vendor accountability, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation.

FinCEN’s requirements for interim safeguards and subsequent effectiveness testing illustrate why implementing corrective measures and proving that they work are separate responsibilities. For CCOs, this means identifying root causes, preventing ongoing exposure, and independently validating the response. For boards, it means demanding evidence of reduced risk rather than accepting reports of completed activities. The measure of remediation is whether the underlying control weakness has been effectively addressed.

Join Us Tomorrow

Tomorrow in Part 4, we shift from Bank of America’s enforcement record to the decisions compliance professionals outside banking face. We translate BOA’s documented failures into 20 practical lessons covering governance, ongoing due diligence, technology and data, vendor oversight, employee execution, investigations, and remediation. The objective is not to apply bank-specific obligations to every company, but to examine how comparable weaknesses could arise in customer relationships, distributor networks, procurement processes, payment controls, and automated compliance systems.

Each lesson links a finding to a practical action, giving CCOs a framework to review their own programs. The series concludes with an assignment: select three areas of greatest exposure, identify accountable owners, examine the evidence that existing controls work, and address what remains unresolved. The final question is whether your organization has accepted a plan to address a material risk without verifying that it worked.

Categories
Blog

BOA Part 2: The $5 Billion Blind Spot About Compliance Technology

An automated compliance system can operate exactly as configured and still fail to perform the function the organization needs.

That distinction is central to FinCEN’s findings concerning Bank of America’s proprietary transaction monitoring system, Event Processor. The FinCEN Consent Order attributes missed and delayed reporting of more than $5 billion in suspicious activity to deficiencies in internal controls and other parts of the bank’s anti-money laundering program. That figure reflects suspicious activity that was not reported on time, not a determination that every dollar represented criminal proceeds.

In Part 1, we examined management decisions about known risks. This installment examines how those decisions were embedded in technology, testing, and investigative processes. In Part 2, we review the natural follow-up to that statement: the lesson is not that automation is inherently unreliable. Automating a decision does not remove the obligation to establish that the decision is supportable.

Inside Event Processor

Bank of America developed Event Processor to manage transaction monitoring alerts. The bank’s records describe an interconnected model system intended to support identifying, investigating, and reporting suspicious activity. Its development also addressed a practical problem: there were not enough investigators to review all the alerts being generated.

The diagram on page 10 of the Consent Order illustrates the basic process. Individual alerts received weighted risk scores and were generally consolidated into customer-level Event Groups. Unless an automatic promotion applied, the group ordinarily did not become an investigative case until its combined score reached 20 points. Stakeholders initially set that threshold, and it remained in place until December 2023.

The timing rules were equally important. An Event Group generally needed to reach the threshold within 13 months of its oldest active alert. Older alerts could remain in the group but no longer contribute to its score. Consequently, retirement of an alert did not establish that the underlying concern had been investigated or resolved. For compliance leaders, the distinction is consequential. A system that generates an alert does not necessarily ensure meaningful review.

The Testing Challenged the Design

The Consent Order describes repeated evidence that the system’s risk weights did not adequately reflect the risks being identified. One internal report found that an ATM large-cash-deposit risk factor carried only one point in Event Processor even though the bank’s testing associated it with a SAR yield of 56.75%. FinCEN also notes that SAR yield can be useful but is not the only metric for evaluating a control. The issue was the bank’s failure to respond appropriately to evidence that its design was not addressing its risks.

The chart on page 21 makes the threshold problem particularly clear. In tested samples, Event Groups scoring 19 points, just below the investigative threshold, had SAR yields of 45.49% in the first quarter of 2022 and 45.03% in the second quarter. Earlier testing of groups scoring 20 to 24 points, which qualified for investigation, had produced yields of approximately 34%. FINCEN consent order

These results did not establish the precise performance of every unreviewed transaction. However, they challenged the justification for leaving the threshold unchanged. Management should have asked, “What does this evidence tell us about the activity we are not investigating?”

When Efficiency Becomes the Wrong Objective

FinCEN found that the bank’s testing often focused on whether yields above and below the threshold differed statistically, without adequately considering the implications of missed suspicious activity. The bank also lacked an objective benchmark to assess whether the threshold was appropriate.

In another example, a calibration model reduced the number of cases requiring investigation by more than 8,200. An accompanying report described the associated loss of SARs as permissible without explaining how that conclusion had been reached.

This distinction matters for any automated compliance process. Reducing unnecessary reviews can legitimately improve a process. Reducing reviews is not, by itself, evidence of improvement. Consider an expense-monitoring tool. Eliminating repetitive, demonstrably irrelevant alerts may improve performance. Raising thresholds until the review team can handle the remaining volume does not establish that the excluded transactions present acceptable risk.

That is an application of the case, not a finding about an expense system at Bank of America. The transferable principle is that the performance objective must remain tied to the compliance purpose.

Exceptions Can Defeat the Primary Control

The Event Processor also used rules that rescored certain risk factors to zero. The Consent Order describes those rules as developed through an ad hoc and subjective process without adequate testing. When the bank discontinued the logic in December 2023, approximately 150,000 active Event Groups had triggered one or more aspects of it.

One particularly useful example involved customers exempted from certain currency transaction reporting requirements. Event Processor used that status to suppress some alerts, even though the applicable exemption did not remove the obligation to report suspicious activity. The broader control lesson is to examine the legal and factual basis for every exception.

An exception for one purpose should not silently become an exemption from a different control. A previously approved customer should not automatically become exempt from future review. A false-positive determination based on yesterday’s information should not permanently determine tomorrow’s result.

Data Gaps Limit What Technology Can Detect

FinCEN found that the bank’s systems did not adequately distinguish among types of negotiable instruments, such as checks and money orders, which limited targeted monitoring. The Consent Order also describes insufficient monitoring and data quality issues involving credit card activity. The lesson for compliance technology governance begins before model selection.

What information does the control need? Is that information captured consistently? Does it reach the monitoring system? Can investigators retrieve and use it? Who is responsible when a required field is incomplete or a relevant product lacks coverage? A sophisticated analytical tool cannot compensate for an unidentified gap in the information supplied to it.

Recalibration Revealed the Scale of the Problem

Following regulatory engagement, Bank of America lowered the investigative threshold in December 2023 to 10 or 12 points, depending on the Event Group. A limited lookback identified nearly 8,900 SARs involving approximately $4 billion in activity that the bank had failed to identify and report under the prior parameters.

The bank estimated that the revised thresholds would double ongoing monthly investigative volume and require about 750 additional personnel, plus another 800 consultants for the one-time lookback. These were the bank’s staffing estimates, not evidence that every position had already been filled. For a CCO, those numbers make the resource question concrete. Technology configuration and staffing cannot be governed as unrelated decisions when one determines the other’s workload.

The Application to AI Governance

The Consent Order describes Event Processor as a proprietary interconnected model system. It does not establish that it was a generative AI system. Nevertheless, its governance failures provide useful comparison points for organizations deploying AI in compliance. FINCEN consent order

NIST’s AI Risk Management Framework organizes risk management around Govern, Map, Measure, and Manage. Applied here as an analytical framework, those functions suggest a practical sequence: assign accountable ownership, define the intended use and relevant risks, test actual performance, and act when the evidence identifies deficiencies.

ISO/IEC 42001 provides a complementary management-system approach for establishing, maintaining, and continually improving AI governance. Neither framework is presented here as a standard that FinCEN found Bank of America had violated. The objective is not to prohibit innovation. It is to ensure that innovation remains explainable, testable, and subject to effective challenge.

Three Key Takeaways

First, validate the decision rules, not merely system availability. Establish why thresholds, weights, prioritization rules, and exceptions address the intended risk.

Second, test what the control misses. Include below-threshold activity, incomplete product coverage, data gaps, and delayed escalation.

Third, connect technology governance to resources and remediation. A finding that requires additional review must lead to a supportable operational response.

The CCO question: Can you demonstrate that your compliance technology addresses the intended risk, or only that it operates according to its configuration?

In Part 2, we examined how BOA’s Event Processor transaction monitoring system failed to translate automated alerts into effective detection and investigation. FinCEN identified unsupported design choices, inadequately calibrated risk weights, poorly governed suppression rules, and monitoring gaps that persisted despite testing that challenged the system’s effectiveness.

After the bank lowered its investigative thresholds, a limited lookback identified nearly $4 billion in suspicious activity that it had failed to identify and report under the previous parameters. The central lesson for CCOs is that reducing alert volumes or investigative workloads does not, by itself, demonstrate improved compliance. Effective technology governance requires reliable data, supportable decision rules, independent testing, attention to missed activity, and resources sufficient to address the findings. These principles also provide practical guidance for AI oversight. An automated control is measured by whether it addresses the intended risk, not simply whether it operates as configured.

Join us Tomorrow

Tomorrow, Part 3 broadens the analysis from transaction monitoring to sanctions compliance, examining OFAC’s findings on blocked-bank payment routing, improperly prioritized alerts, delayed watchlist updates, and mishandled accounts associated with blocked persons. These incidents raise a broader management question: when several controls fail in different ways, does the organization investigate each error separately, or does it examine whether they reveal shared weaknesses in oversight, resources, and operational execution?

We will explore the importance of vendor oversight, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation. We will also examine the difference between completing a corrective action and proving it works, including the role of interim safeguards and independent validation. Boards and compliance leaders must ask whether management has corrected individual incidents or verified that the underlying controls work across the enterprise.

Categories
Blog

BOA Part 1: $1.2 Billion Compliance Failure: When Red Flags Meet Revenue

A compliance program is tested when someone identifies a risk that the business would prefer not to address. The question is not whether compliance can produce a memorandum. The question is whether the organization makes a timely, supportable decision and implements controls that address the concern.

The Bank of America enforcement record provides a detailed examination of that problem. FinCEN (Consent Order) describes repeated internal warnings, testing that identified weaknesses, and customer relationships that continued without controls commensurate with the risks. Its findings place management decisions about revenue and resources at the center of the compliance failure.

For chief compliance officers, the central lesson is straightforward: Identifying a material risk is the beginning of compliance work, not its completion. Over this four-part blog series, we will review the FinCEN Consent Order, OFAC’s Enforcement Release, and the Department of the Treasury’s Press Release to mine each for how this was allowed to occur, how it continued, the governance failures, the marginalization of compliance, and the penalties assessed. Today in Part 1, we examine the governance failure at the heart of the Bank of America enforcement actions: compliance personnel identified significant risks, but management did not ensure those concerns led to timely, effective corrective action.

Understanding the Enforcement Actions

On October 13, 2026, the Department of the Treasury announced enforcement actions involving FinCEN, the Office of the Comptroller of the Currency, and the Office of Foreign Assets Control. Treasury described combined penalties exceeding $1.21 billion for anti-money laundering and sanctions failures.

The penalty structure matters. FinCEN assessed $1.2 billion but credited the bank’s $750 million OCC payment, leaving $450 million payable under the FinCEN Consent Order. OFAC’s separate Enforcement Release states a settlement of $11,662,930. Adding the full FinCEN and OCC assessments together would therefore overstate the combined financial penalty.

The legal posture also matters. Bank of America admitted the facts and violations in the FinCEN Consent Order. It expressly limited its admission of willfulness to the civil Bank Secrecy Act enforcement standard. By contrast, OFAC resolved potential civil liability for apparent violations. These documents should not be characterized as a criminal guilty plea.

The Warnings Were Already Inside the Organization

Consider the relationship identified in the FinCEN Consent Order as Customer A, an online marketplace connecting sellers of salvaged vehicles with domestic and international buyers. The bank had maintained accounts for this customer since 1995. By 2022, compliance personnel had identified concerns involving third-party payments, limited visibility into the source of funds, and repeated fraud-related investigations. In July, compliance recommended that the customer’s accounts be considered for closure. Subsequent internal analysis identified more than 100 customer-related cases between 2020 and August 2022.

This was not simply a disagreement about a customer’s reputation. Compliance was identifying a weakness in the bank’s ability to understand the funds moving through the relationship. An important distinction must remain clear. The Consent Order records that no evidence shows Customer A orchestrated the underlying fraud. The concern was that its accounts appeared to have received and moved fraud proceeds, creating risks the bank needed to address. Suspicion concerning transactions is not proof that the customer knowingly participated in the underlying misconduct.

That distinction makes the compliance lesson more useful. An organization does not need to prove a business partner is a criminal before deciding the relationship requires stronger controls.

When Commercial Importance Becomes the Answer to a Different Question

Following an internal meeting in September 2022, the relationship manager prepared a memorandum describing Customer A as a “large and valued client” generating approximately $6 million in annual revenue. The memorandum emphasized the broader commercial relationship and the business line’s support for retaining it. Compliance personnel continued asking how the underlying risks were being mitigated. FINCEN consent order

Here is the governance problem: commercial value and risk mitigation answer different questions. Revenue explains why the business wants to retain a relationship. It does not establish that the relationship can be maintained within an effective control environment.

Nor does compliance independence require that every recommendation to terminate a relationship prevail. FinCEN expressly states that account closure is not the only appropriate response to heightened financial crime risk. Enhanced monitoring, restrictions on products or services, and other risk-based controls may be appropriate. The real question is whether the alternative works.

A defensible decision to retain a high-risk customer should explain what will change, who will implement it, what evidence will show it works, and what happens if the customer does not meet the agreed conditions. Without those elements, an alternative mitigation plan can become a way to defer the original decision.

A Mitigation Plan Is Not the Same as Mitigation

In March 2023, more than six months after compliance recommended closure, the relationship manager summarized proposed measures, including limiting payments to registered buyers or dealers. Compliance withdrew its closure recommendation based on the communication and implementation of those measures, while reserving the possibility of revisiting the decision.

However, Customer A continued processing third-party payments through its Bank of America account until June 2025. The bank did not adequately update the customer’s risk profile, ongoing monitoring, or other due diligence measures to address the continuing practice. Some other changes were implemented, but the central payment risk persisted.

This is where compliance activity and compliance effectiveness separate. A meeting is an activity. A mitigation plan is an activity. A customer assurance is information. None, standing alone, establishes that the risk has been reduced. For the CCO, the missing discipline is verification. When the organization decides to continue a relationship subject to conditions, those conditions need an owner, an implementation date, evidence requirements, and consequences for nonperformance.

Resources Are Also a Governance Decision

FinCEN found that management’s approach to transaction monitoring was influenced by the resources required to investigate additional cases. When remediation began, the bank estimated that investigative volumes would double and that approximately 750 additional personnel would be needed. FinCEN concluded that the bank had likely avoided hundreds of millions of dollars in compliance-related expenditures during the relevant period. That was FinCEN’s assessment, not a separately calculated figure of realized profit.

The business lesson is not that every compliance function should receive every requested dollar. Resource decisions need to address the actual risk. Management should not resolve a capacity problem by treating the activity that exceeds capacity as less important without a supportable risk basis.

What the CCO and Board Should Ask

As a comparison framework, the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) examines whether a program is well designed, adequately resourced and empowered, and effective in practice. It also asks whether managers tolerate greater compliance risks to pursue revenue and how the company responds when compliance raises concerns. These are useful analytical questions here, not the legal standards under which FinCEN resolved this case.

Board oversight provides another comparison. In Marchand v. Barnhill, the Delaware Supreme Court emphasized the need for a good-faith effort to establish board-level monitoring of a critical compliance risk. Caremark liability involves a demanding bad-faith standard, not automatic liability whenever a control fails. The Bank of America documents discussed here are not Caremark judgments against its directors.

The practical board questions nevertheless follow naturally. Which material compliance recommendations remain unresolved? Which business decisions depend on mitigation that has not been verified? Which deficiencies have appeared repeatedly without an effective response? Those questions move oversight beyond receiving presentations to examining whether management is controlling the risk.

Three Key Takeaways

First, require decisions, not indefinite escalation. Material concerns need accountable decision-makers, documented reasoning, deadlines, and follow-through.

Second, separate commercial justification from control effectiveness. A valuable relationship may be retained, but its revenue does not demonstrate that its risks are mitigated.

Third, verify the conditions supporting the decision. Keep an approved remediation plan open until the organization has evidence that the relevant controls work.

The CCO question: When the business rejects or modifies a compliance recommendation, can you demonstrate that the alternative actually reduced the risk?

Today we examined the governance failure at the heart of the Bank of America enforcement actions: compliance personnel identified significant risks, but management did not ensure that those concerns produced timely, effective corrective action. FinCEN’s findings describe an organization that prioritized customer revenue and resource considerations while known risks persisted without commensurate controls.

The central lesson is not that compliance must prevail in every disagreement or that every high-risk relationship must be terminated. Decisions to retain those relationships must rest on demonstrable risk mitigation, not commercial importance alone. For CCOs, this means establishing accountable decision-makers, deadlines, documented reasoning, and verification that agreed measures work. For boards, it means examining unresolved exposure rather than merely receiving reports of completed activities. A mitigation plan does not establish that a risk has been mitigated. The organization must verify the result.

Join us Tomorrow

Management decisions about compliance don’t stay confined to committee meetings and customer relationship discussions. They also shape the technology that determines which risks receive attention and which remain uninvestigated. In Part 2, we turn to Bank of America’s Event Processor transaction monitoring system and FinCEN’s findings concerning unsupported design choices, investigative thresholds, alert suppression, gaps in monitoring coverage, and inadequate responses to testing.

Our focus shifts from whether management acted on known concerns to whether its automated controls could identify and escalate the relevant activity. We will examine the difference between reducing investigative workload and improving compliance effectiveness, with practical applications for data governance, model validation, and AI oversight. Every CCO must ask whether your technology addresses the intended risk, not simply whether it operates according to its configuration.

Categories
Blog

Frankenstein and Compliance: Part 3 – Son of Frankenstein: You Inherited the Castle, You Inherited the Risk

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox dives deep into the first five Frankenstein movies. Over October, Tom Fox will consider Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. This blog post accompanies the podcast series.

The first two Frankenstein films present two distinct compliance failures. Frankenstein examined innovation without adequate governance. Bride of Frankenstein shows leadership that understands the risk but lets pressure, ambition, and rationalization override judgment. Son of Frankenstein (1939) presents the next stage: inherited risk, or in the business world, risks through acquisition.

Wolf von Frankenstein, played by Basil Rathbone, returns with his family to his ancestral estate hoping to restore the Frankenstein name. Instead, he encounters Ygor, played by Bela Lugosi, and discovers that his father’s Monster is still alive. Wolf had no role in creating the original problem, but his discovery forces him to decide how to address the legacy he has inherited.

That situation should be familiar to companies following acquisitions, leadership transitions, compliance investigations, or changes in the control environment. New management may have no connection to historical misconduct. An acquiring company may not have created the target’s problematic third-party relationships. A new CCO may inherit investigations and remediation projects that were initiated years earlier. Historical responsibility and current responsibility are different questions. The business issue is how management responds once a legacy risk becomes known.

The Castle Is an Acquisition

Think of Wolf’s return to the Frankenstein estate as an acquisition. He receives the property, assets, name, and opportunity to benefit from his father’s scientific legacy. He also assumes the consequences associated with that legacy. Corporate acquisitions work much the same way. Companies acquire revenue, customers, employees, technology, intellectual property, distribution networks, and market access. They may also inherit high-risk third parties, weak internal controls, questionable historical practices, unresolved investigations, government relationships, and cultural problems.

This is why compliance due diligence should focus on how the target actually conducts business rather than simply whether it has the expected compliance infrastructure. A target may have a Code of Conduct, an anti-corruption policy, annual training, and a hotline. Those are relevant data points, but they do not establish program effectiveness.

Compliance needs to understand the target’s business model and risk profile. Consider such questions as: Where does the business operate? Who are its customers? Does it interact with government agencies or state-owned entities? Which third parties generate or facilitate business? How does the company select and compensate those parties? What does the investigation history reveal? Are there recurring audit or control deficiencies? What does speak-up data indicate? Are significant policy exceptions concentrated in particular markets or business units? The objective is to understand the risk embedded in the business being acquired.

Due Diligence Is the Beginning, Not the End

Even well-designed pre-acquisition due diligence has limitations. Transactions operate under deadlines and time pressures. Access to employees and records may be restricted. (See: Opinion Release 08-02) Data may be incomplete. Privacy requirements may constrain review. Some risks simply do not become visible until the buyer gains access to systems, records, personnel, and financial information after closing. Those limitations make the connection between due diligence and post-acquisition integration critical.

If the buyer cannot complete diligence on a high-risk distributor before closing, that relationship should become a post-closing priority. If investigation records are incomplete, they should be reviewed during integration. If significant controls cannot be tested before the transaction, testing should be incorporated into the integration plan. Compliance should therefore document unresolved diligence issues and carry them forward with assigned owners and deadlines.

This discipline matters because closing creates competing priorities. Management quickly shifts to customers, systems, personnel, financial reporting, cost savings, and expected synergies. Compliance integration can become one workstream among many. An unanswered compliance question doesn’t become less significant once the transaction closes.

Post-Acquisition Integration Is the Operational Test

An acquiring company can conduct excellent due diligence and still create exposure if it fails to integrate the acquired business effectively. Post-acquisition integration is where the buyer’s compliance expectations become operational. Employees need to understand the acquiring company’s Code of Conduct, policies, reporting mechanisms, investigation procedures, third-party requirements, approval processes, and internal controls. High-risk third parties may require additional diligence. Contracts may need updated compliance provisions. Financial controls may need harmonization. Employees need risk-appropriate training.

Integration should also reflect the acquired company’s actual risk profile. A business operating primarily in lower-risk markets with direct sales may require a different approach than a company that depends on agents and distributors in jurisdictions with substantial government interaction. Do not apply the same integration checklist mechanically to every acquisition.

The CCO should know which issues require immediate attention, which can be addressed over a reasonable integration period, and who is accountable for each significant action. Without ownership and monitoring, temporary integration gaps can become lasting control weaknesses.

Ygor and the Informal Organization

Ygor provides one of the movie’s most useful compliance lessons. He understands the Frankenstein estate better than Wolf does. He knows its history, its secrets, and how things actually work. Every organization has a formal structure and an informal operating system. The organizational chart describes reporting relationships. Policies describe required processes. Procedures identify approvals. Employees know how business actually gets done.

They know which approvals receive meaningful scrutiny and which are largely administrative. They know which managers routinely approve exceptions. They know which third parties have special relationships with executives. They know which controls become flexible near quarter-end. They know whether raising a concern is welcomed or career-limiting. This is why compliance risk assessment cannot rely exclusively on documents.

Policies lay out how an organization is supposed to operate. Interviews, focus groups, hotline information, investigations, transaction testing, third-party monitoring, audit findings, and employee surveys can show how it operates in practice. That distinction becomes particularly important following an acquisition. The buyer needs to understand not only the target’s compliance architecture but also its operating culture.

Institutional Memory Is a Compliance Control

Inspector Krogh represents the other side of organizational knowledge. He remembers the consequences of the original Frankenstein experiment because he experienced them personally. His perspective is shaped by history, not by Wolf’s confidence that the past can be managed differently. Companies need mechanisms for preserving similar institutional knowledge.

Investigations produce knowledge. Internal audits produce knowledge. Regulatory inquiries produce knowledge. Compliance monitoring and remediation projects produce knowledge. That knowledge can disappear surprisingly quickly. Employees retire. CCOs leave. Executives change roles. Board members rotate. Investigations close. Outside counsel completes an engagement. Remediation projects are marked complete.

Years later, new management may propose a business arrangement, third-party relationship, market strategy, or control change similar to one the organization previously determined was problematic. An effective compliance program should prevent important lessons from depending entirely on the memories of individual employees.

Significant investigation findings should inform future risk assessments. Root causes should influence control design. Remediation lessons should affect monitoring. Historical third-party concerns should remain available when relationships are reconsidered. An investigation’s purpose is not simply to resolve an allegation. It should also improve the organization’s understanding of its risks.

New Leadership and the Risk of Exceptionalism

Wolf demonstrates another challenge common to leadership transitions. New leaders often believe they can manage risks that previous leaders could not. Sometimes they can. New leadership may bring stronger systems, better controls, additional resources, and improved judgment. The problem arises when confidence leads management to discount why earlier controls or restrictions were established.

A new sales executive may propose reengaging a distributor previously terminated for compliance concerns. A new CEO may reconsider a market that previous management considered too risky. A new business leader may conclude that an approval requirement imposed after earlier misconduct is unnecessarily restrictive. Any of those decisions may be appropriate. Controls should not remain in place indefinitely simply because they are old. But management should understand the history before changing them.

Before removing a control, determine why it was created. Before reengaging a third party, understand why the relationship ended. Before changing monitoring requirements, identify the risk they were designed to address. Some controls become obsolete. Others represent lessons learned. Good governance distinguishes between the two.

Red Flags and the Governance Response

The central compliance issue arises when Wolf learns the Monster is alive. At that point, the question moves from discovery to response. Corporate compliance systems serve a similar purpose. Internal controls, monitoring, Internal Audit, risk assessments, investigations, hotlines, and management reporting should surface significant information.

The effectiveness of those systems depends upon what happens after the information arrives. The Evaluation of Corporate Compliance Programs (ECCP) suggests such inquiries as: Was the issue investigated? Was it escalated appropriately? Did management assign remediation? Was completion tracked? Was effectiveness tested? Did significant information reach the board or appropriate committee? A sophisticated reporting system provides little protection if material concerns repeatedly reach decision-makers without producing action.

For a CCO, this means escalation protocols matter. The organization should understand which issues remain within normal management processes, which require senior management attention, and which warrant board notification.

Legacy Third Parties Require Fresh Review

Inherited third-party relationships deserve particular attention because longevity can create a false sense of security. The distributor has worked with the business for fifteen years. The consultant is well known locally. The customs broker has always handled interactions with government agencies. No significant problems have been reported previously. Those facts provide context. They do not replace risk-based oversight.

Acquisitions and leadership transitions provide an opportunity to reassess significant legacy relationships. Is the third party still necessary? Is the business rationale documented? Is beneficial ownership information current? Has the risk profile changed? Are payment arrangements appropriate? Are contracts current? Has monitoring identified concerns? Longstanding relationships should not automatically be grandfathered into the current compliance program. Some may warrant closer attention precisely because they were established under different controls, different management, and different expectations.

Practical Actions for the CCO

Son of Frankenstein suggests a practical agenda for compliance leadership. Due diligence should examine actual business operations, not just the existence of policies. Unresolved diligence issues should move directly into the integration plan with defined ownership and deadlines. Integration should be risk-based and should include controls, training, reporting mechanisms, investigations, and third-party oversight.

Significant legacy third parties should be reassessed rather than automatically accepted. Preserve investigation findings and past control failures as institutional knowledge and incorporate them into future risk assessments. New leadership should understand why significant controls were established before deciding to eliminate or weaken them. Finally, significant inherited risks should have clear owners. Issues that sit between the transaction team, business leadership, Legal, Compliance, Finance, and Internal Audit can otherwise remain unresolved because everyone assumes someone else is responsible.

The Compliance Lesson

Son of Frankenstein demonstrates the difference between responsibility for creating a problem and responsibility for managing one. Organizations routinely inherit compliance risks through acquisitions, leadership transitions, longstanding business practices, third-party relationships, and unresolved control weaknesses. New management should not be treated as responsible for conduct that occurred before it arrived. Its responsibility begins with the response.

Effective compliance requires the organization to identify inherited risks, prioritize them by significance, assign ownership, integrate acquired operations, preserve institutional knowledge, and verify corrective actions. That is the business lesson from Wolf von Frankenstein’s return to the family estate. The value of an inheritance cannot be separated from its risks.

The next stage of the Frankenstein story raises another familiar compliance issue. Organizations can identify problems, investigate them, revise policies, conduct training, complete remediation plans, and close findings. Yet sometimes the same problem returns.

In our next selection, we consider The Ghost of Frankenstein. In this movie, the compliance issue is no longer discovery or inheritance. It is program effectiveness. If management says the problem has been remediated, what evidence demonstrates that the remediation actually worked?

For a discussion on these topics and a review of the movie, check out Timothy and Fiona in this episode of Popcorn and Compliance.

Categories
Blog

AMEX’s $350 Million AML Penalty: Part 2 – Lessons for CCOs and Boards

Paying a penalty and demonstrating an effective compliance program are different tasks. The AMEX enforcement actions make that distinction concrete.

In Part 1, we examined the OCC’s $350 million civil money penalty and findings concerning risk assessment, customer information, suspicious activity reporting, resources, training, and independent testing. The Federal Reserve’s Order focuses on enterprise-level change. Its starting point is board oversight.

For compliance professionals across industries, that is the opportunity: use the remediation requirements to challenge your own governance and controls. The orders bind the named entities. The broader applications below are recommendations, not claims that banking-specific obligations apply to every company.

Board oversight must produce accountable decisions

Within 90 days of the order’s effective date, AMEX’s board must submit a written oversight plan to the Federal Reserve. The plan must explain how directors will hold senior management accountable for remediation, ensure adequate resources, oversee an effective enterprise-wide BSA/AML compliance risk management program, and secure effective reporting and escalation. The board’s responsibilities expressly encompass remediation under both the Federal Reserve order and the OCC order.

Notice the allocation of responsibility. The board oversees. Senior management executes. Neither role should disappear into an instruction that “compliance will handle it.” For another company applying this lesson, I recommend that each material remediation item identify an accountable executive, responsible business owner, required resources, completion criteria, and independent reviewer. The CCO should help coordinate and challenge the work without becoming the default owner of every operational control.

COSO’s Internal Control–Integrated Framework provides a corresponding board-oversight benchmark. Under Principle 2, directors should independently oversee internal control development and performance. Translate that principle into board practice. Record the questions directors asked, the evidence management provided, resource decisions, and the follow-up required. A presentation should support an oversight decision, not substitute for one.

Make enterprise-wide compliance operational

The Federal Reserve requires AMEX to submit an acceptable plan within 90 days to improve enterprise-wide BSA/AML compliance risk management. Required content includes business-line and legal-entity policies, customer due diligence, cross-business-line suspicious activity reporting, and transaction-monitoring methodologies. Establish, analyze, test, and document monitoring rules and thresholds, paying attention to factors such as customer, product, or service, and geography.

That requirement suggests a practical exercise for any CCO: select a significant risk and trace how the organization treats it. Who collects the relevant information? Who assesses it? What triggers review? Which team investigates? When does senior management receive the issue? What reaches the board? But do not stop at the organization chart. The order calls for risk-based oversight of BSA/AML systems and the use of information from network partnerships, ATM partners, and third parties supporting compliance.

For a nonfinancial company, a comparable review could follow a high-risk distributor relationship from onboarding through orders, payments, exceptions, and termination. Test the handoffs, including information held by outside providers. The Federal Reserve also requires the travel-related services subsidiary to submit an acceptable Office of Foreign Assets Control (OFAC) compliance plan within 90 days. It must address risk assessment, ongoing job-appropriate training, and enhanced policies and screening procedures. This is a distinct sanctions-compliance remediation requirement; it should not be recast as a finding of a particular prohibited transaction.

Use COSO to examine the connections between controls

COSO organizes internal control around five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The framework emphasizes that these components must work together, not exist as separate administrative exercises. Applied to the AMEX findings, I recommend testing a connected chain of evidence.

Begin with the commercial activity and its risk assessment. Identify the resulting control, the person responsible, the information required, the escalation decision, and the independent test. Then examine what happens when one element fails. For example, don’t accept a customer-risk rating as useful just because a system has a completed field. Ask whether supporting information is reliable, whether the rating changes monitoring, and whether testing confirms that the resulting controls address the assessed risk.

COSO’s Principles 16 and 17 reinforce evaluating controls and promptly communicating deficiencies to those responsible for correction, including senior management and directors where appropriate. The practical point is to test relationships between controls, not merely their individual existence. Otherwise, management may demonstrate that every department completed its task without demonstrating that the overall risk was addressed.

Resource commitments need an operational explanation

The Federal Reserve requires the board to ensure senior management has adequate resources for required remediation. Make that discussion more useful than a comparison of this year’s compliance budget with last year’s. You should perform a capacity assessment for each critical control. Identify the workload, expertise, systems, quality-review capacity, and unresolved dependencies. Where management proposes automation, require evidence that the tool handles the relevant risk and that someone owns exceptions.

The DOJ’s 2024 ECCP provides a useful cross-check: evaluate program design, resources and authority, and effectiveness in practice. Its resource analysis should also examine personnel qualifications and compliance’s access to the board.

A board paper should therefore explain what a resource request will accomplish and what risk remains without it. Ask management to identify work that cannot be completed to the required standard, rather than presenting an unexplained staffing total.

Accountability must survive changes in personnel

Paragraph 4 of the Federal Reserve order deserves careful attention. Based on the firm’s investigative record compiled from 2024 to the order’s issuance, it prohibits the firm from directly or indirectly retaining individuals who meet all three specified conditions: participation in the underlying misconduct, formal disciplinary action connected to it, and separation or legal termination connected to that misconduct. The restriction covers retention as an officer, employee, agent, consultant, or contractor within the firm or its subsidiaries or affiliates.

This is not a blanket prohibition covering everyone who was investigated. The conditions are cumulative. The order also requires continued cooperation and substantial assistance with Federal Reserve investigations of parties affiliated with the involved institution.

For other CCOs, the lesson is to connect substantiated investigation outcomes with hiring, contracting, and vendor controls. Subject to applicable employment and privacy requirements, test whether a person excluded through one channel could return through another. Require documented review rather than allowing a change in job title or engagement structure to bypass accountability.

Remediation requires evidence, not just a timetable

The Federal Reserve requires implementation timelines with specific component deadlines. Approved plans must be adopted within ten days of approval and then promptly implemented. Amendments or rescissions require prior approval from the Reserve Bank. Board or authorized committee progress reports are due within 45 days after the end of the first full calendar quarter following the order and each quarter thereafter, addressing actions, schedules, and results. The 90-day submissions are plan deadlines, not requirements to complete every remediation measure within 90 days. For your program, distinguish a completed task from a corrected risk. A revised procedure is a deliverable. Evidence that employees apply it correctly is a different milestone.

The ECCP similarly examines root-cause analysis, control testing, lessons learned, and whether improvements can prevent or detect similar misconduct. The ECCP asks, “What methodology has the company used to identify, analyze, and address the particular risks it faces? What features of the company reduce its exposure to such risks? Is the company’s approach to risk management proactive or reactive? What information has the company identified and collected to help detect the type of misconduct in question? How has that information informed the company’s compliance program?” Use those questions to challenge proposed closure evidence.

The bottom line is that you must demonstrate implementation and an appropriately independent reviewer to evaluate operating effectiveness. Define the testing period, evidence, and acceptable results before the item is marked complete.

CCO actions and board questions

  • For the CCO: build one end-to-end evidence trail. Select a material risk and connect the assessment, controls, information, decisions, escalation, testing, and corrective action. Identify exactly where evidence is missing.
  • For the board: challenge ownership and capability. Which executive owns the unresolved risk? What resources are missing? What decision does management need from directors now?
  • For both: define success before declaring completion. What independent evidence supports closure? Have the underlying causes been addressed? What would alert us that the problem has returned?

Summary

The bottom line is that a compliance program must reflect the business’s actual risks and demonstrate that its controls work. The OCC’s central finding was a mismatch between the bank’s risk assessment and its operations: the assessment emphasized relatively narrow deposit activities while inadequately addressing dominant credit and charge card products. Weak customer identification, due diligence, suspicious activity reporting, independent testing, staffing, and job-specific training compounded that failure.

AMEX processed about $13 billion in suspected trade-based money laundering activity between June 2014 and May 2025 without timely identifying and reporting its full scope. It carefully distinguishes those findings from a conclusion that AMEX itself laundered that amount. The broader lesson is that completing assessments, filing reports, and delivering training do not, by themselves, establish program effectiveness.

We next considered the shift from compliance failures to governance and remediation, emphasizing that directors must oversee the work while senior management remains accountable for execution. Remediation should have identifiable executive and business owners, adequate resources, clear completion criteria, and independent review, rather than becoming an undefined assignment for the compliance department.

Drawing on COSO’s Internal Control Framework and the DOJ’s Evaluation of Corporate Compliance Programs, we reviewed how risk assessments, controls, information, escalation, and monitoring work together, and whether personnel and systems can perform the required work. The practical message for CCOs and boards is to distinguish a completed task from a corrected risk: a revised procedure is not proof of effective remediation. Leaders should require evidence that underlying causes have been addressed, controls operate effectively, and recurring problems will be detected. Risk alignment, accountability, and demonstrated effectiveness must become part of how the business is governed.

Categories
Blog

AMEX’s $350 Million AML Penalty: Part 1 – What Went Wrong

A compliance risk assessment should describe the business the company actually conducts. What happens when it does not?

The AMEX enforcement actions provide a consequential answer. On October 8, 2026, the Office of the Comptroller of the Currency (OCC) announced a $350 million civil monetary penalty (OCC Penalty) and a cease-and-desist order(OCC Order) against American Express Company and American Express Travel Related Services Company, Inc. (collectively, AMEX) for Bank Secrecy Act and anti-money laundering deficiencies. The Federal Reserve separately issued a cease-and-desist order (FED Order) against AMEX. The OCC Press Release noted that the monetary penalty was imposed by the OCC, not both agencies.

For Chief Compliance Officers, directors, counsel, and internal auditors, the central lesson extends beyond banking: a compliance program must reflect the business’s actual risks, and oversight must demand evidence that it works. Over the next couple of blog posts, we will explore the Orders and Penalties. Today, we’ll start with what went wrong at AMEX.

What the enforcement record establishes

The OCC found violations involving the BSA/AML program, suspicious activity reporting, customer due diligence, and customer identification. According to the OCC Order, from approximately June 2014 through May 2025, the bank processed approximately $13 billion in suspected trade-based money laundering activity. That figure includes suspicious card charges and associated repayments. In some cases, the activity passed through accounts linked to bank insiders. The bank periodically reported suspicious activity but lacked the controls and monitoring capabilities to identify and report its full scope promptly.

Precision matters. The $13 billion figure does not mean AMEX laundered that amount, nor should it be described as $13 billion in distinct criminal proceeds. The findings concern suspected activity and failures in detection, evaluation, and reporting. The reference to insider-associated accounts also does not establish that every associated individual knowingly participated in misconduct.

The risk assessment did not match the business

The OCC’s most instructive finding concerns the program’s starting point. The bank’s risk assessment focused on its relatively narrow demand deposit products and services while giving insufficient attention to its more dominant credit and charge card products. This was a mismatch between the business being conducted and the risks being assessed.

For a CCO, the question should be immediate: does our assessment accurately represent how our company generates revenue, moves money, serves customers, and uses intermediaries?

The DOJ’s 2024 Evaluation of Corporate Compliance Programs (ECCP) begins its risk-assessment analysis by understanding the company’s business and examining how compliance scrutiny and resources address its risks. The ECCP asks “how the company has identified, assessed, and defined its risk profile, including specific factors that mitigate the company’s risk, and the degree to which the program devotes appropriate scrutiny and resources to the remaining spectrum of risks.” That provides a useful comparison here, not an additional finding against AMEX or the legal basis for these orders.

Consider a hypothetical manufacturer that rigorously reviews employee expenses but inadequately evaluates high-risk distributor payments. The expense controls may function exactly as designed. They still do not answer the more consequential risk question. The lesson is that the largest business line does not always present the greatest compliance risk. Management should demonstrate a defensible relationship between business activities, assessed risks, and control coverage. Completing an assessment is not the same as assessing the right business.

Customer information failures undermined monitoring

The OCC identified weaknesses in two distinct functions. Customer identification procedures did not adequately support a reasonable belief that the bank knew each customer’s true identity. Ongoing customer due diligence did not effectively establish the nature and purpose of customer relationships, undermining risk ratings and monitoring. Read together, these findings describe more than incomplete onboarding files. They connect customer knowledge to the ability to recognize transactions that warrant further investigation.

For businesses outside banking, the useful analogy is the difference between collecting a distributor’s documents and understanding what the distributor actually does. Who is involved? What commercial purpose does the relationship serve? What activity would fall outside that purpose?

The OCC also found systemic breakdowns in suspicious activity monitoring, investigation, and reporting, resulting in late, missed, or incomplete suspicious activity reports (SARs). Those failures extended beyond suspected trade-based money laundering to other suspicious activity. Importantly, the bank did file some reports. The OCC criticized the bank for failing to promptly identify and report the full scope of the activity.

That distinction should change how a compliance committee evaluates performance. Ask what the reporting process covered, what it missed, and how those conclusions were tested. A report count alone does not establish the answer. The same challenge should be applied to investigation totals, due diligence completions, and training statistics.

Audit, resources, and training did not provide effective safeguards

The OCC found that the internal audit did not effectively monitor BSA/AML compliance. Independent testing was neither appropriately scoped nor effective relative to the bank’s risk profile, contributing to delayed detection and remediation of deficiencies. The key takeaway is that an audit plan should challenge the compliance program’s assumptions, not simply confirm that documented procedures were followed. Testing a process against an incomplete view of risk can leave the underlying problem untouched.

The findings also addressed staffing and capability. Historically, the bank has not supported its BSA/AML program with appropriate resources, including personnel with the necessary skills, expertise, and training. Employee training did not adequately address job-specific responsibilities, impairing identification, escalation, and reporting of risks and suspicious activity.

For compliance leadership, those findings support a practical distinction: headcount, competence, and operational capacity should be assessed separately. Hiring more people should not substitute for determining which expertise a control requires.

Likewise, training should be evaluated against decisions employees must make. Can an investigator recognize a relevant pattern? Can an account manager identify a concern and route it correctly? Can a director challenge an explanation of control effectiveness? These are better questions to bring to the next program review than whether everyone completed the assigned course.

The Federal Reserve extended the concern to the enterprise

The FED Order identified significant deficiencies in the enterprise-wide financial crimes risk management program, including transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management. Its order directs the AMEX board to address management accountability, remediation resources, program effectiveness, and reporting and escalation.

The broader governance lesson is not that the compliance department alone must work harder. Management responsibilities and board information should be examined alongside the technical controls. A remediation plan should identify who must act, what resources are required, and how directors will know whether the action worked.

AMEX’s public response

In its October 8 public statement, AMEX said internal and external reviews identified areas for improvement. It described investments in people, technology, training, governance, and oversight, as well as cooperation with regulators and law enforcement. Chairman and Chief Executive Officer Stephen J. Squeri stated, “While we have made meaningful progress, we know there is more work to do.”

The company also said the penalty would not affect full-year 2026 guidance, that the orders imposed no asset cap, and that anticipated remediation costs would not affect 2027 guidance. These are company statements, including forward-looking expectations, not regulatory findings about remediation effectiveness. The Federal Reserve separately acknowledged cooperation and remedial actions already undertaken. Progress deserves recognition, but corrective work should not be confused with demonstrated completion.

Three practical takeaways

  1. Start with business reality. Compare the risk assessment with actual products, transaction flows, customer relationships, and third-party arrangements. Require explanations for significant gaps in coverage.
  2. Challenge evidence of effectiveness. Ask the internal audit to test whether controls identify the risks that matter, not merely whether staff follow procedures. Examine decision quality and timeliness alongside activity counts.
  3. Make capability a governance discussion. Bring the board a clear account of required expertise, unresolved resource constraints, and the risks those constraints leave exposed.

The question for the next board meeting is straightforward: What evidence demonstrates that our compliance program addresses the business we actually operate?

Join us tomorrow, in Part 2, as we examine how the Federal Reserve’s remediation requirements can help CCOs and directors turn that question into accountable action.

Categories
Blog

Modern Philosophers and Compliance: Part 5 – Hans Jonas and Responsibility for the Future of Corporate Compliance

This week we have concluded our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have examined Hannah Arendt and her concepts of personal responsibility and how they relate to the modern compliance program; Simone de Beauvoir and the conditions for ethical action in a corporation; John Rawls and institutional justice and fairness in a corporate compliance program; and Jürgen Habermas and the governance of speaking up. In Part 5, we conclude by looking at Hans Jonas and the responsibility for the future of corporate compliance programs.

A corporate decision can continue affecting people long after its sponsors have moved on. Technology makes that possibility especially important. A system approved for a limited purpose can expand across business units, influence thousands of decisions, and create consequences that emerge gradually. Hans Jonas asks us to consider the responsibility that power entails.

For the Chief Compliance Officer (CCO), that perspective changes the approval question. What evidence supports proceeding, what harm could follow, and who will remain responsible as circumstances change? These questions connect ethical responsibility with the practical governance of technology, particularly artificial intelligence.

Technological Power Expands Responsibility

In The Imperative of Responsibility (1984), Jonas reconsidered ethics in light of technological power. His concerns included ecological destruction, nuclear threats, and genetic engineering. The scale and reach of human action created duties extending toward posterity and the environment.

His argument reaches beyond responsibility for an immediate transaction. Decisions can affect the conditions under which others will live, including people unable to challenge those decisions today. The ethical horizon must therefore extend beyond the decision-maker’s own interests and present relationships.

The application to corporate compliance is an interpretation of that argument. Jonas did not write an AI approval checklist. His philosophy nevertheless provides a reason to examine the duration, scale, and reversibility of technological choices. A company’s responsibility should reflect the consequences its capabilities make possible.

This perspective complements the earlier Enlightenment chapters. Evidence and clear reasoning remain essential. Jonas asks what responsibilities follow when the organization can act on that knowledge at a scale whose full consequences remain uncertain. For compliance, the answer begins with disciplined anticipation and continues throughout the activity’s life.

The Approval Whose Consequences Keep Growing

What do you think about the following situation? A multinational company purchases an AI tool to prioritize third-party due diligence. The tool ranks potential intermediaries using corporate records, transaction information, and public data. During a pilot, it reduces the time required to identify files for additional review.

Management approves a broader deployment. Over the following year, procurement teams begin treating low-risk scores as permission to abbreviate diligence. The vendor changes the model. The company expands into countries poorly represented in the original testing. Responsibility for reviewing performance splits among procurement, technology, and compliance.

Later, an investigation finds that several intermediaries with incomplete ownership records received low-risk scores. The model treated missing information as weak evidence of risk, while reviewers interpreted the scores as evidence that meaningful checks had been completed. No one had tested that assumption in the new markets.

The scenario does not establish that AI inevitably weakens diligence. It shows how a limited approval can take on a different operational meaning. A prioritization tool became a basis for reducing scrutiny. Changes in use, data, and responsibility accumulated after the initial decision.

Jonas helps the CCO frame the governance issue. The approval must account for how the system could develop and what its outputs could enable. Responsibility includes the conditions for expansion, the information needed to detect failure, and the authority to intervene before harm spreads.

The DOJ Connection Through Emerging Risk

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) explicitly addresses emerging technology. It asks how companies assess AI’s impact on criminal-law compliance, integrate technology risk into enterprise risk management, and address unintended consequences and misuse. It also examines controls supporting trustworthy, reliable use.

These inquiries make technology governance part of the compliance effectiveness assessment. A company using AI within its own compliance function should apply the same discipline it expects from business operations. The stated purpose of improving compliance does not establish that the tool works appropriately.

In our question above, the CCO should define the approved use precisely, as mission creep is always to be avoided. Prioritizing review is different from authorizing a third party. The decision record should explain what the score means, what it cannot establish, and which diligence requirements remain mandatory. Users need instructions that preserve those distinctions under commercial pressure.

Changes should trigger review according to their significance. A new market, a material vendor update, or a proposal to automate approvals may require additional testing and authorization. The company should assign an accountable owner who can obtain the necessary evidence across functions. Shared participation works best when responsibility for the final decision remains clear.

Uncertainty Calls for Proportionate Safeguards

Companies rarely possess complete information before introducing a technology. See generally Andrew McBride in Recommended Practice for Buying & Selling Compliance Technology, which is based on surveys of compliance technology buyers and vendors. Governance must make uncertainty visible and connect it to a defensible decision. The relevant questions include the severity of possible harm, the number of people affected, the ability to detect errors, and the possibility of reversing the consequences.

A tool that suggests training topics raises different concerns than one that determines which allegations to investigate. The latter can affect whether misconduct is detected at all. Its potential benefit should be assessed alongside the consequences of overlooking a credible concern.

For the third-party tool, a practical safeguard would be to sample low-risk classifications for independent review. Testing only the files the model flags leaves false reassurance largely unexamined. The company should also assess how missing records, unfamiliar languages, and changes in business conditions affect performance.

Deployment can be limited while those questions are tested. Appropriate measures might include restricted uses, defined populations, additional review, or a delay where critical evidence is missing. These are proposed governance responses to the hypothetical. Their suitability depends on the use case and the harm at stake.

The business case should include the cost of maintaining those safeguards. A project whose expected savings depend on eliminating the review needed for reliable operation has an unresolved design problem. Compliance should make that tradeoff explicit before approval and when the project’s economics change.

Turning Responsibility into Continuing Governance

The NIST AI Risk Management Framework provides a voluntary approach to managing AI risks. Its core functions are Govern, Map, Measure, and Manage. Together, they offer an organizational structure for understanding uses and impacts, evaluating risks, and determining responses throughout the AI lifecycle.

Applied to our hypothetical, governance assigns ownership and approval authority. Mapping identifies where the model operates, who relies on its scores, and who could be harmed by error. Measurement tests performance under relevant conditions. Management determines whether to proceed, add safeguards, restrict use, or suspend the tool. These activities should inform one another as evidence changes.

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. Its relevance here is the organizational discipline of sustained responsibility. The company needs repeatable processes that survive personnel changes and remain connected to actual use.

These frameworks serve different purposes from DOJ’s prosecutorial guidance. Adopting a framework or obtaining certification does not establish compliance with every applicable law or prove that a particular deployment is effective. The company still needs evidence that its controls address the risks of its own activities.

The practical objective is to maintain a record that connects the approved purpose, responsible people, test results, changes, incidents, and remedial decisions. That record enables the next owner to understand why the system was approved and what conditions remain essential to its continued use.

Intervention Must Remain Possible

Responsibility becomes difficult to exercise when the organization cannot change course. Before deployment, determine who can suspend the system, what circumstances require escalation, and how business will continue during an interruption. A fallback process must be sufficiently resourced to operate when needed.

In the hypothetical, repeated unexplained low-risk scores involving missing ownership records could trigger restricted use and a review of affected files. The response should examine past decisions and current performance. Correcting the model does not resolve every consequence of earlier reliance on it.

Vendor arrangements also matter. (See McBride, above.) The company should seek information and contractual provisions appropriate to its risks, including notice of material changes, access to relevant performance evidence, and cooperation with investigations. When adequate visibility is unavailable, decision-makers should account for that limitation in deciding whether and how to use the tool.

Human review requires similar scrutiny. A named reviewer adds little protection if that person lacks time, training, supporting information, or authority to question an output. Test whether reviewers can identify errors and whether their interventions produce corrective action. Human responsibility needs operational support.

Board Oversight Must Extend Beyond Launch

Boards need a view of material technology risks over time. Approval-stage reporting often emphasizes expected benefits. Subsequent oversight should examine whether those assumptions remain valid, whether the use has expanded, and whether the organization retains the resources and authority needed to manage it.

The ECCP examines the information used in board oversight and compliance access to governing authorities. For significant AI deployments, the CCO can use those channels to report unresolved limitations, incidents, changes in use, and overdue corrective actions. Technical detail should explain a decision the board needs to understand.

Directors should ask whose interests the business case omits. Future customers, workers, communities, or business partners may bear costs not reflected in the current project budget. The analysis should consider foreseeable consequences and explain material uncertainties without pretending to predict every outcome.

Accountability should also survive the original sponsor’s departure. Assign continuing ownership, require documented handovers, and maintain review obligations through reorganizations and vendor changes. A system’s effects may persist for years. Its governance should not depend on one individual remembering the conditions attached to launch.

Five Key Jonas Takeaways for the Compliance Professional

  1. Assess consequences across time and scale. Consider who could be affected, how harm might accumulate, and whether decisions can be reversed. Include foreseeable effects beyond the immediate business case.
  2. Define the approved use and review material changes. Specify what a system may do, what its outputs establish, and which decisions require human authorization. Reassess expansion, vendor updates, and changes in operating conditions.
  3. Match safeguards to uncertainty and potential harm. Test the errors that routine monitoring could miss. Use staged deployment, independent review, or restrictions where the evidence does not support broader reliance.
  4. Preserve the ability to intervene and remediate. Establish suspension authority, workable alternatives, and a process for reviewing past decisions. Verify that human reviewers have the resources and authority to act.
  5. Make responsibility endure beyond the project team. Maintain ownership, evidence, and review obligations through organizational change. Give the board a clear account of unresolved risk and the decisions required.

Jonas brings our series to a fitting conclusion. Arendt asks who exercises judgment. Beauvoir asks whether people can act on it. Rawls tests the fairness of the rules, and Habermas examines whether concerns influence decisions. Jonas extends responsibility to the consequences that outlast those discussions and to people who cannot participate in them.

Together, these perspectives give compliance professionals a practical agenda for governing corporate power. Build processes that let people question, decide, explain, and correct their actions. Then ask the final board question: what obligations will this decision leave to others, and what have we put in place today to meet them?

Categories
Blog

Frankenstein and Compliance: Part 2 – Bride of Frankenstein: When Leaders Know Better

Ed. Note: This month, on his podcast series Popcorn and Compliance, Tom Fox takes a deep dive into the first five Frankenstein movies. Over October, he will cover Frankenstein, The Bride of Frankenstein, The Son of Frankenstein, The Ghost of Frankenstein, and Frankenstein Meets the Wolf Man. The blog post accompanies the podcast series.

The compliance problem in Frankenstein was innovation without governance. Henry Frankenstein became so focused on whether he could create life that he failed to consider adequately what would happen if he succeeded. He had extraordinary technical capabilities but almost no governance infrastructure around his experiment. There was no meaningful risk assessment, no effective challenge function, no contingency planning, and no clear accountability for the consequences. In Bride of Frankenstein (1935), the compliance problem is different and considerably more troubling. Henry now knows better.

Henry has survived the consequences of his original experiment. He has seen the Monster die and the destruction it caused. He understands that his scientific ambition created risks he could not control. At the beginning of the sequel, Henry appears ready to put his experiments behind him and build a life with Elizabeth. Then Dr. Pretorius arrives.

Pretorius is one of the great characters in the Universal horror canon, but anyone who has spent time in corporate compliance will recognize him. He is intelligent, sophisticated, persuasive, and completely convinced that conventional ethical boundaries should not interfere with extraordinary achievement. More importantly, he understands Henry. Pretorius knows which arguments will appeal to Henry’s ambition and which pressures will overcome his judgment.

This changes the compliance analysis. Henry cannot claim that the risk is unknown. He has already experienced the consequences. The question is whether he has learned from them. That distinction provides the central compliance lesson of Bride of Frankenstein. A significant difference exists between an organization that fails to identify a new risk and one that identifies it, experiences the consequences, and then allows the same underlying conduct to return.

Knowledge Changes the Governance Obligation

Corporate compliance programs generate information. Risk assessments identify vulnerabilities. Internal audits identify control weaknesses. Investigations identify misconduct. Hotline reports identify cultural problems. Due diligence identifies third-party risks. Compliance monitoring identifies patterns that may require further attention. The value of that information depends upon what the organization does with it.

An investigation that establishes what happened but produces no organizational change has limited compliance value. The same is true of an internal audit finding that is administratively closed without determining whether the underlying risk has been reduced. Knowledge must lead to action. This is where Henry fails. He possesses precisely the information that should prevent him from returning to the laboratory. He knows his previous experiment had catastrophic consequences. Nevertheless, Pretorius gradually pulls him back toward the same underlying conduct.

For a CCO, this raises an important question about repeat misconduct. When the same type of compliance problem appears more than once, the organization should ask whether the earlier incident was treated as an isolated event rather than a systemic warning. Questions you might ask include: Did the investigation identify root causes? Were controls changed? Were incentives examined? Was management behavior considered? Was remediation tested? Were lessons incorporated into the next risk assessment? Once an organization knows where a material risk exists, future failures become more difficult to characterize as unforeseeable.

The Pretorius Problem

Pretorius represents a particular type of organizational risk: an influential individual who consistently finds reasons why normal controls shouldn’t apply. Every experienced compliance professional has encountered some version of this problem. A business executive explains that a particular transaction is unique. A salesperson argues that a questionable practice is standard in the local market. A manager insists that due diligence must be completed after onboarding because the customer cannot wait or you will cause the company to miss the quarter’s numbers. None of those statements necessarily establishes misconduct. They should nevertheless cause a compliance professional to ask additional questions.

The danger often comes through rationalization rather than an explicit request to violate the law. The transaction is too important. The amount is too small. The customer relationship is too valuable. The competitor already does it. The process takes too long. The documentation can be completed later. Pretorius works on Henry in much the same way. He does not persuade Henry that the original experiment was harmless. He persuades him that there is a sufficiently compelling reason to cross the boundary again. That is a leadership problem because effective ethical leadership requires executives to recognize when commercial, personal, or organizational pressure is changing their risk tolerance.

When Exceptions Become the Business Process

One of the most important implications for a compliance program is managing exceptions. Most corporate policies need some mechanism for legitimate exceptions. Business circumstances are too complex to assume every rule applies equally in every situation. The problem arises when exceptions become routine.

Consider third-party due diligence. A distributor needs to begin work immediately because of a time-sensitive commercial opportunity. Management approves an exception that lets work begin before diligence is complete. The exception may be entirely defensible. Then another distributor receives the same treatment. Then another. Eventually, business personnel begin viewing due diligence as a process that can routinely be completed after onboarding. The written policy has not changed. The actual control environment has.

The same issue can arise with gifts and entertainment, conflicts of interest, expense approvals, sanctions screening, contracting requirements, AI approvals, cybersecurity requirements, or financial controls. Each exception may have a plausible business explanation. Taken together, the exceptions may demonstrate that the organization has developed an operating practice inconsistent with its stated policy.

Compliance should therefore monitor exceptions as data. How many are being granted? Which business units request them? Which executives approve them? Are the same reasons repeatedly used? Do temporary exceptions become permanent arrangements? A pattern of exceptions can early indicate the normalization of deviance.

Culture Becomes Visible When the Stakes Rise

Bride of Frankenstein also provides an important lesson about corporate culture. Culture is relatively easy to discuss when ethics and commercial objectives don’t conflict. The real test comes when the two appear to diverge.

Suppose Compliance identifies significant concerns about the company’s highest-revenue distributor. What happens next? Suppose an investigation substantiates allegations involving a senior executive responsible for a strategically important business. How does management respond? Suppose an AI application promises significant cost savings, but Legal, Privacy, Information Security, or Compliance recommends delaying deployment for additional testing. Does the company wait? Those decisions reveal more about corporate culture than a values statement.

Henry believes he has changed after the events of Frankenstein. Pretorius tests that belief. Once scientific ambition, pressure, and personal consequences enter the equation, Henry’s commitment to walking away begins to erode. Companies experience the same tension. A business may have strong written values and an extensive compliance program, but employees pay attention to what happens when adherence to those values becomes costly.

This is particularly important for boards. Boards cannot assess culture solely through training completion rates, hotline statistics, or employee surveys. Those metrics can help, but directors should also understand how management handles difficult decisions involving high performers, major customers, significant third parties, and substantial revenue. Culture becomes visible in decisions.

The Monster and the Importance of Organizational Experience

One of the most significant developments in Bride of Frankenstein is the Monster’s evolution. In the original film, he is largely reactive. In the sequel, he begins to learn about human relationships and the world around him. The sequence with the blind hermit is particularly important. The hermit does not judge the Monster by his appearance. He provides food, companionship, music, and kindness. The Monster responds to that environment. For a brief period, we see how different surroundings produce different behavior.

That provides a useful analogy for corporate culture. Employees learn what an organization values through experience. They observe how their supervisors behave. They see who receives promotions and bonuses. They notice whether high performers receive exceptions from policies. They see whether the organization respects or marginalizes people who raise concerns. They learn whether management wants bad news delivered promptly or prefers problems to stay below the surface.

Compliance should therefore pay particular attention to management behavior. Employee surveys, exit interviews, hotline data, investigation trends, turnover information, disciplinary records, and audit findings can help identify business units where the local management culture differs from the company’s stated expectations.

Incentives Can Become the Corporate Pretorius

Pretorius uses Henry’s ambition as leverage. Corporations use compensation and performance systems to influence employee behavior every day. That makes incentives a central compliance issue. A company may tell employees that integrity is its highest priority while evaluating them primarily on revenue, growth, margin, or quarterly performance. Employees will quickly determine which message matters more.

This does not mean financial incentives are inappropriate. Companies exist to generate economic value, and employees should be rewarded for performance. The compliance issue is whether the incentive structure unintentionally encourages excessive risk-taking or undermines controls.

Compliance should understand how significant employee populations are compensated. The Evaluation of Corporate Compliance Programs (ECCP) makes similar inquiries. Should questions include: Are sales targets realistic? Do employees get rewarded for the quality and sustainability of performance, or simply for the amount of revenue generated? Does compliance performance affect bonuses or promotion decisions? Are managers held accountable for control failures within their teams? Can compensation be reduced or recovered following significant misconduct? The goal is alignment. Employees should understand that how results are achieved matters as much as the results themselves.

High Performers Are the Real Test of Accountability

Perhaps the clearest test of ethical culture comes when a high-performing employee violates policy. If the organization disciplines junior employees while protecting commercially valuable executives, employees will understand that there are two compliance systems. One exists in the policy manual. The other exists in practice.

Consistency does not require identical discipline in every case. Facts, intent, seniority, cooperation, prior conduct, and other circumstances can legitimately affect disciplinary decisions. But commercial value should not create immunity. Boards should understand how management handles misconduct involving senior leaders and significant revenue producers. The issue is not whether directors should participate in routine disciplinary decisions. They should not. The governance question is whether accountability applies throughout the organization.

Pretorius operates as though ordinary ethical constraints are for other people. Companies should ensure they do not inadvertently create executives who reach the same conclusion.

The Compliance Lesson

Bride of Frankenstein is ultimately about organizational learning. Companies will make mistakes. Controls will fail. Employees will engage in misconduct. Compliance programs will occasionally fail to identify risks before those risks become problems.

Program effectiveness shows up in what happens next. An investigation should generate knowledge. That knowledge should inform root-cause analysis. Root-cause analysis should drive remediation. Remediation should change controls, incentives, training, supervision, or business processes where necessary. Those changes should then be tested to determine whether they work.

Henry Frankenstein fails because he doesn’t turn knowledge into durable change. He knows what happened the first time. He understands the consequences. Yet Pretorius finds the ambition, pressure, and rationalization needed to pull him back into the laboratory.

That is why Bride of Frankenstein provides such an important compliance lesson. The greatest organizational risk may not be the risk management failed to identify. It may be the risk management already knows about but has learned to tolerate.

The next stage of the Frankenstein story moves the problem forward again. Leadership changes. A new generation arrives. Wolf von Frankenstein did not create his father’s Monster and bears no responsibility for the decisions that originally brought him to life. Then Wolf discovers what he has inherited.

In Son of Frankenstein, the compliance question becomes one every acquiring company, new CEO, board member, and CCO should understand: You did not create the problem. Once you know it exists, what will you do about it?

Check out Timothy and Fiona’s commentary on the compliance lessons from the Bride of Frankenstein here.

Categories
Blog

Modern Philosophers and Compliance: Part 4 – Jürgen Habermas and the Governance of Speaking Up

This week we will continue our lengthy exploration of the philosophical underpinnings of the modern corporate compliance program. We have looked at, or will look at, Hannah Arendt and her concepts around personal responsibility; Simone de Beauvoir and the conditions for ethical action in a corporation; and John Rawls and the twin concepts of institutional justice and fairness in a corporate compliance program. We will review Hans Jonas and the responsibility for the future of corporate compliance. Today we continue with Jürgen Habermas and the governance of speaking up.

A compliance concern has value when it receives a fair hearing and an accountable response. Employees may submit reports, attend risk meetings, and complete surveys while important decisions remain insulated from what they say. Jürgen Habermas gives compliance professionals a way to examine whether internal communication lets evidence and reasons influence the exercise of authority.

For the Chief Compliance Officer, the practical question is what happens next. Who considers the concern? What evidence is examined? Who explains the response? A speak-up culture needs answers to those questions throughout ordinary business operations and within the formal reporting system.

Reasoned Dialogue as an Ethical Discipline

Habermas was a German philosopher and social theorist whose major twentieth-century works include The Theory of Communicative Action and Moral Consciousness and Communicative Action. He distinguished action oriented toward mutual understanding from strategic action aimed at achieving an actor’s purposes. His discourse ethics examines how moral norms are justified through reasoned discussion among those affected.

The conditions of that discussion matter. Participants must be able to question assertions, offer reasons, and express their concerns without coercion preventing participation. Agreement matters differently when it results from examining arguments than when it reflects pressure or exclusion.

Corporate decision-making operates within authority structures, commercial obligations, and legal requirements. Applying Habermas does not turn every management decision into a vote. His ideas offer a demanding test of the process: have relevant claims been open to challenge, and have decision-makers responded to the reasons presented?

That test gives compliance a practical responsibility. The function should help create conditions in which a concern can reach the right decision-maker without losing its substance. Participation must include a meaningful opportunity to affect the analysis. Otherwise, consultation can become a procedure for endorsing a conclusion already reached.

The Meeting Where Agreement Came Too Quickly

Consider the following. A company plans to enter a new market through a local distributor. During a launch meeting, the regional president announces that the agreement must be signed before quarter-end. She then asks whether anyone has compliance concerns.

A diligence analyst explains that the distributor’s ownership information remains incomplete and that a proposed subcontractor has not been reviewed. The sales leader responds that the distributor comes highly recommended. The president asks whether there is evidence of wrongdoing. The analyst says there is not but explains that important questions remain unanswered.

The discussion moves on. The meeting summary records that compliance raised no substantiated misconduct concern and that the team supported proceeding. The analyst’s request for additional review disappears from the decision record.

The facts do not establish that the distributor is improper. They establish a failure to address the question raised. The analyst identified an information gap relevant to approval. Management answered a different question about proven misconduct. The resulting agreement rested on an incomplete description of the discussion.

Habermas helps the CCO identify that failure. The analyst spoke, but the process did not meaningfully engage the claim. A useful response would clarify the missing information, define the approval criteria, and assign responsibility for resolving the issue before an authorized decision.

The DOJ Connection Through Reporting and Response

The Department of Justice’s Evaluation of Corporate Compliance Programs (ECCP) examines whether employees are comfortable using reporting mechanisms, whether company practices discourage reporting, and whether compliance has access to reporting and investigative information.

Those inquiries connect employee voice to program effectiveness. A concern cannot inform the company’s response if employees are discouraged from raising it, it is mischaracterized, or it is withheld from the people responsible for assessing it. Habermas supplies a philosophical lens for examining the quality of that communication.

The CCO should extend this inquiry beyond hotline intake. Concerns arise in procurement discussions, contract reviews, operational meetings, and informal requests for guidance. The company needs a proportionate way to capture material unresolved issues from those settings. Employees should know when a conversation must be documented as an escalation.

In our hypothetical, the meeting summary should preserve the substance of the analyst’s concern. It should identify the missing information, the required review, the decision owner, and any conditions on proceeding. If the summary is inaccurate, the analyst should have a practical means to correct it. That mechanism protects the reliability of the decision record.

Management Must Answer the Concern Raised

Reasoned dialogue requires attention to what a person is actually saying. In compliance speak, a speak-up culture must be paired with a listen-up culture. A concern about missing diligence should receive an answer about diligence. A concern about an incentive should receive an examination of how that incentive affects behavior. General assurances about leadership commitment do not resolve either issue.

The CCO can help managers distinguish disagreement about facts, disagreement about applicable standards, and disagreement about available options. Each calls for a different response. Missing facts may require investigation. An unclear standard may require legal or policy interpretation. Competing options may require an authorized decision about a risk that can lawfully be accepted.

Return to the distributor. If the policy requires ownership verification before approval, management should obtain it or follow an authorized exception process where one exists and is permissible. A commercial deadline does not, by itself, satisfy the requirement. If the concern rests on a misunderstanding, the decision-maker should explain the evidence that resolves it.

This approach makes discussion more useful to the business. It identifies what must be resolved and who can resolve it. It also prevents repeated requests for assurance from replacing a decision. An effective compliance professional should state the issue clearly enough that management can respond to its substance.

Hierarchy Can Distort the Conversation

Managers influence discussion through timing, framing, and reaction. Announcing the desired outcome before inviting concerns can make disagreement appear obstructive. Requiring employees to prove misconduct before raising uncertainty can exclude the very questions that preventive controls are intended to address.

The ECCP examines whether senior and middle managers encourage or discourage compliance and whether their commitment persists when commercial interests compete with it. Compliance professionals can translate that inquiry into observation of actual decision processes.

For material risk reviews, circulate relevant information early enough for participants to assess. Invite questions before seeking approval. Ask responsible functions to identify unresolved matters in their own words. Where hierarchy discourages discussion, provide an independent route for concerns and follow up on how employees who challenge decisions are treated.

These measures do not guarantee agreement, nor should agreement be the sole objective. Decision-makers may reasonably reject an objection after reviewing the evidence. The record should explain why. A team can disagree about the preferred option while understanding the basis for the authorized decision and the obligations that follow.

The quality of the discussion also depends on access. An employee working overnight or speaking another language may need a different way to participate. A written question or private conversation can carry the same substantive concern as a confident presentation in a committee meeting. The company should assess the argument without making presentation style a proxy for credibility.

Closing the Loop Requires Evidence

Receiving a concern creates an obligation to route it appropriately and determine what response is warranted. The ECCP addresses timely investigation, follow-up, and accountability for findings and recommendations. The practical challenge is connecting those steps so an issue doesn’t disappear when one function transfers it to another.

For significant concerns, assign an owner, a response date, and a defined basis for closure. Record whether the company obtained additional evidence, changed the decision, introduced a safeguard, or concluded that further action was unnecessary. The explanation should be specific enough for an independent reviewer to follow.

Where appropriate, tell the person who raised the concern that it was considered and describe the process or outcome to the extent permitted. Protect personal information, legitimate confidentiality, and the integrity of the investigation. A useful response acknowledges the issue and explains the next step without disclosing restricted details.

The analyst should learn whether the ownership question was resolved and whether the subcontractor review remains a condition of approval. If the transaction proceeds under an exception, the record should identify the authority, rationale, and monitoring obligations. A concern that changes a control or approval condition provides tangible evidence that speaking up influences business operations.

The Board Must Hear Unresolved Disagreement

Board reporting can lose valuable information when management summarizes a complicated risk discussion as organizational alignment. Directors need visibility into material unresolved concerns within their oversight remit, particularly when compliance and business leadership differ about the adequacy of controls.

The ECCP examines private sessions with compliance and control functions, the information used in board oversight, and compliance autonomy and access to the board. These arrangements can help directors examine concerns that ordinary reporting channels have failed to resolve.

The CCO should present the issue, competing explanations, the evidence, and the required decision. Identify what is known, what remains uncertain, and who has authority to act. Directors should ask whether those closest to the issue find the summary accurate.

Reporting should also show whether the process improves decisions. Useful evidence includes material concerns that led to further diligence, changed approval conditions, or remediation. Volume alone provides an incomplete picture. The board needs to understand whether significant questions receive reasoned responses and whether corrective actions are completed.

Five Key Habermas Takeaways for the Compliance Professional

  1. Preserve the substance of employee concerns. Record the actual question, relevant evidence, and unresolved issue. Give employees a practical way to correct summaries that materially misstate what they raised.
  2. Require a response to the reasons presented. Distinguish factual gaps from policy questions and choices among permissible options. Assign each issue to someone with the competence and authority to address it.
  3. Design discussions that permit meaningful challenge. Share information in time for review, invite concerns before decisions, and provide independent escalation routes. Examine whether hierarchy or managerial reactions discourage participation.
  4. Connect reporting with accountable closure. Assign owners and response dates, document the basis for decisions, and communicate appropriate feedback. Verify that promised safeguards and remediation occur.
  5. Bring material disagreement into board oversight. Explain unresolved concerns accurately, including competing views and missing information. Show directors how employee challenge has changed decisions or exposed work still required.

Habermas offers the CCO a practical measure of speak-up culture: can the company show how it considered and answered a significant concern? The corresponding board question is whether a difficult issue can reach directors without being softened into apparent agreement. The answers reveal how seriously the organization treats reasoned challenge.

In our final installment, Part 5, we close out this series with Hans Jonas and responsibility for future consequences. Having examined how people exercise judgment, act under constraints, receive fair treatment, and challenge decisions, we will consider the people who cannot participate in today’s discussion. Jonas takes us into technology governance, AI, and the long-term effects of corporate power.