These aren't hypothetical control gaps. They happened at real institutions, were uncovered by regulators, and ended in headline-grabbing penalties. Each one is the kind of finding an honest RCSA — one that scores effectiveness, not just existence — would have surfaced years before the consent order arrived. Your examiner, bank partner, and board read these the same way you should: as evidence that documented controls are not the same as working controls.
October 2024
TD Bank — $3.1B Historic AML Settlement
TD Bank pleaded guilty to conspiracy to commit money laundering — the largest US bank ever to do so. From 2014-2023, executives prioritized the bank's "flat cost paradigm" over an adequate AML program. Transaction monitoring intentionally excluded all domestic ACH and most check activity.
Impact: Total $3.1B: $1.43B DOJ + $452.4M forfeiture, $1.3B FinCEN, $450M OCC, $123.5M Fed. 92% of transaction volume — roughly $18.3T from Jan 2018 to Apr 2024 — went unmonitored. OCC imposed a $434B asset cap until remediation is complete.
Lesson: Documented controls are not effective controls. TD's AML monitoring existed on paper but excluded 92% of transactions by design. The RCSA effectiveness scoring rubric — "does it work," not "do we have it" — and the testing calendar by risk tier are built to surface gaps like this.
August 2020
Capital One — $80M OCC Penalty for Failed Risk Assessment
OCC fined Capital One $80M for "failure to establish effective risk assessment processes" before its 2015 cloud migration. Capital One didn't implement effective network controls, DLP, or alerts. In 2019, a former AWS employee exploited a misconfigured firewall and posted ~30GB of card application data on GitHub.
Impact: 100M US + 6M Canadian consumers affected — names, addresses, credit scores, and ~140,000 SSNs exposed. Cease and desist order required an independent compliance committee, enhanced risk assessment processes, and board oversight. ~$190M in customer remediation and response costs.
Lesson: A new operating environment is a control environment reset. The OCC's exact language — "failure to establish effective risk assessment processes" — is RCSA-speak. The template's chapter on running an assessment without existing controls documentation is built for exactly this scenario.
October 2020
Citigroup — $400M OCC Penalty for ERM Failures
OCC fined Citibank $400M for "long-standing failure" in enterprise risk management, compliance, data governance, and internal controls. Risk management policies failed to identify, measure, and control risks across the enterprise. Board and senior management oversight was inadequate.
Impact: Original $400M penalty + additional $75M in July 2024 for failure to remediate. Cease and desist order required OCC non-objection before significant acquisitions. Remediation cost Citi $2B+ across 2021-2024 and forced major board and management changes.
Lesson: Inadequate board reporting on control effectiveness is itself a control failure. The OCC explicitly cited that "inadequate reporting hinder[ed] effective oversight." The RCSA Results Dashboard and Board Report tab translate assessment output into the heat map a board can act on.
February 2020
Wells Fargo — $3B Settlement for Sales Practices Misconduct
DOJ and SEC fined Wells Fargo $3B for the cross-selling scandal. From 2002-2016, branch employees opened ~3.5M unauthorized accounts to meet sales quotas. Sales-practice controls were self-attested by the same managers being incentivized on volume — and executives denied the connection for over a decade.
Impact: $3B combined DOJ/SEC settlement, 5,300+ employees fired, ~3.5M unauthorized accounts. Earlier $185M to CFPB/OCC/LA City Attorney in 2016. Fed imposed an unprecedented asset growth cap (still partially in place). Multi-year remediation under heightened supervision.
Lesson: Self-attestation is not control testing. The same managers incentivized on sales volume signed off saying their controls worked. The RCSA questionnaire requires evidence-based scoring, and the 1LOD/2LOD/Joint approach selection pairs every self-assessment with explicit 2LOD challenge.
If you're reading this trying to make sure your control environment doesn't end up as someone else's case study — that's exactly what RCSA is for. Here's what you'd recognize:
