What do the chief executive of a US online store, the chief information officer at a UK bank and multiple senior employees at a US bank all have in common? They have all faced individual enforcement action for failing to comply with compliance expectations around the use (or indeed abuse) of technology.
In October 2022 the U.S. Federal Trade Commission took action against a firm and its CEO for security failures that exposed the data of 2.5m customers. The firm was alerted to the security problems two years before the breach but failed to take steps to protect customers’ data from hackers. The sanctions imposed included a requirement to destroy unnecessary data, restrictions on the data the company can collect and retain, and specifically binds the CEO to specific data security requirements for his role in presiding over unlawful business practices. Notably, the FTC order will follow the CEO even if he leaves the firm - he will be required to implement an information security program at future companies if he moves to a business collecting consumer information from more than 25,000 individuals, and where he is a majority owner, CEO, or senior officer with information security responsibilities.
In April 2023, the UK Prudential Regulation Authority fined the former chief information officer of a UK bank £81,620 for failing to take reasonable steps to ensure the bank managed and supervised appropriately its outsourcing arrangements in relation to its 2018 IT migration program. The fine followed the enforcement action taken in December 2022 against the bank for operational resilience failings, which resulted in a financial penalty of £48.7m. The bank also paid £32.7m in redress to customers who suffered detriment. The regulator determined that the CIO’s failings undermined the bank’s operational resilience and contributed to the significant disruption experienced.
In January 2023, it was reported that another U.S. bank had clawed back millions of dollars in employee fines as part of the remedial action following the $2bn+ fines imposed in the U.S. for failing to capture unmonitored communication channels. In some cases, the pay is being clawed back from previous bonuses and in other cases it will be deducted from future pay. The fines which ranged between a few thousand dollars and more than $1m were reportedly based on a points system that looked at the number of messages sent, the employee’s seniority and whether they received prior warnings.
Firms in all sectors need to understand, and have robust policies and procedures to manage, all aspects of security and compliance relating to the deployment of technology. That ranges from lax data security to failed outsourcing to the use of unmonitored channels. It is no longer a theoretical business risk but, as has become increasingly apparent, a potential personal liability.
|
“[...] the President believes Congress can and should do more to hold senior bank executives accountable. Congress must take action to strengthen the ability of the federal government to hold senior management accountable when their banks fail and enter FDIC receivership. Specifically, when banks fail because of mismanagement and excessive risk taking, it should be easier for regulators to claw back compensation from executives, to impose civil penalties, and to ban executives from working in the banking industry again.” FACT SHEET: President Biden Urges Congressional Action to Strengthen Accountability for Senior Bank Executives, March 2023 |
There are several key lessons for firms and their senior employees:
Theta Lake’s multi-award winning product suite provides patented compliance and security for modern communications utilizing over 100 frictionless partner integrations that include RingCentral, Webex by Cisco, Microsoft Teams, Slack, Zoom, Movius and more.
Theta Lake’s regulatory and data science teams are happy to discuss any of the issues in greater detail. You can find further regulatory perspectives from Theta Lake here or you can join a weekly 30-minute demo webinar here.