---
title: Fraud Controls Are Everywhere. So Where’s the Accountability?
source_page: https://www.sardine.ai/media/fraud-forward/episodes/fraud-controls
canonical: https://www.sardine.ai/media/fraud-forward/episodes/fraud-controls
format: text/markdown
date: 2026-10-14T04:01:00.000Z
description: Fraud controls only help if they work. Breaking down two enforcement cases and five questions to test your risk assessment, ownership, and oversight…
---

**Quick links:** [Human page](https://www.sardine.ai/media/fraud-forward/episodes/fraud-controls) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# Fraud Controls Are Everywhere. So Where’s the Accountability?

**Published:** 2026-10-14T04:01:00.000Z

Fraud controls only help if they work. Breaking down two enforcement cases and five questions to test your risk assessment, ownership, and oversight…

What’s up fraud fighters, and welcome back to Fraud Forward!
I want to talk about something that might be a little uncomfortable. It isn’t about a new scheme or a criminal using AI to break into a bank. It’s about our own fraud controls, and the gap between having them and knowing they work.
Two stories from the past week made me want to have this conversation. The first is a $350 million penalty against American Express National Bank tied to deficiencies in its BSA and AML program. The second is a guilty plea from a former TD Bank employee who admitted to accepting bribes and helping launder more than $4.8 million. The facts are very different, and neither institution looks like a community bank or credit union with a fraud team of two. Even so, the same questions show up at every size. Does your risk assessment reflect the business you run today? Who reviews the people with the power to override a control? And when someone finds a weakness, who makes sure it gets fixed?
I’m also bringing in what we’ve learned from our financial institution fraud benchmarking research, because it points to a question I keep returning to. What does a mature fraud program actually look like? Let’s get into it.
What you’ll hear in this episode:
Why the American Express enforcement action is a lesson in fraud risk assessment, and what happens when an assessment focuses on a narrow part of a much larger business
Why the roughly $13 billion in suspected activity cited by the OCC reflects deficiencies in a BSA and AML program, and why it shouldn’t be repeated as a fraud loss
How a former TD Bank employee allegedly used legitimate access to unblock restricted cards, and why employee override monitoring deserves more attention than it gets
What 86 accounts at one commercial address teach us about transaction monitoring and what should happen after an alert fires
Practical ways smaller teams can use compensating controls when they can’t fully separate duties
Why documenting a known control weakness is not the same as managing it, and how remediation tracking can quietly stall
A simple framework that separates control existence vs execution vs effectiveness
Metrics that show real exposure to leadership, beyond alert counts and cases closed
Five questions to bring to your fraud team on Monday
You should listen to this episode if you:
Lead or support a fraud program at a community bank or credit union and have to cover a lot of ground with a small team
Want to know whether your fraud risk assessment is driving decisions or only documenting them
Are responsible for managing insider risk or employee access and want practical ways to review overrides
Need help explaining known control weaknesses to leadership in a way that leads to action
Are comparing your program against peers and want to know what a mature fraud program looks like
### Episode notes
A $350 million penalty and a risk assessment that missed the business
The OCC said American Express National Bank had not tailored its BSA and AML risk assessment to the business it was actually running. The assessment concentrated on a narrow piece, demand deposit accounts, and gave far less attention to the much larger credit and charge card operations. A risk assessment that doesn’t match the business produces controls with blind spots. At a community bank or credit union, the same thing can happen when ACH volume doubles or a new digital account opening process launches and the assessment still spends most of its pages on debit cards. My challenge is to ask when your fraud risk assessment last changed a decision, because that tells you whether it drives your program.
The insider who unblocked the cards
According to the DOJ, a former TD Bank employee used his position to open fraudulent accounts, issue hundreds of debit cards, and lift restrictions on cards the bank had blocked over potential fraud. An override function isn’t a problem on its own, since every institution needs an exception process. What matters is who reviews the override, whether the person who starts it can also approve it, and whether anyone looks for patterns. Insider fraud also includes selling access or looking the other way, and not only stealing, which is why I want teams spending as much effort understanding employee behavior as customer behavior. For smaller institutions that can’t separate every duty, compensating controls such as a second reviewer for high-risk overrides or a weekly exception report can make misuse much easier to notice.
Documenting a weakness is not managing it
Looking back at the 2024 TD Bank enforcement case, roughly 92% of the bank’s transaction volume went unmonitored by its automated transaction monitoring system over several years, according to federal prosecutors. A pattern I recognize from institutions of every size is that a weakness gets identified, logged, rated, and scheduled for discussion, and then sits there. There can be good reasons remediation takes time, and knowingly accepting a risk with oversight is a legitimate decision. Leaving it open because nobody owns it is an accountability problem. I encourage fraud leaders to explain exactly what activity is not being monitored and what a delay could mean, since leadership makes better decisions when the stakes are clear.
What a mature fraud program really looks like
Our financial institution fraud benchmarking work gathered input from 165 credit union and community bank fraud leaders. Many reported formal risk assessments, alert prioritization, and false positive tracking, which is encouraging. I also want to push on it, because having a control isn’t the same as having an effective one. A wire verification step can be completed perfectly and still fail if the callback goes to a number a fraudster just changed. A 98% alert review rate tells you about process completion and says nothing yet about whether detection worked. This is why I want fraud metrics for leadership to show exposure, such as how much activity monitoring covers and how much confirmed fraud was found internally first.
Accountability without a blame hunt
When something goes wrong, attention usually goes to who failed. Individual accountability matters, but I would rather we build programs where people can raise concerns and challenge decisions before a loss occurs. An analyst who raises the same issue three times and sees nothing change will eventually stop speaking up, and leaders are responsible for that environment. When a control depends on several departments, I also ask teams to get specific about fraud control ownership. Who owns the risk, who owns the control, who tests it, who receives the findings, and who makes sure something changes? Those are five separate responsibilities, and they don’t always belong to one person.
Five questions I’d ask my fraud team on Monday
Five practical questions to think through. What are we not monitoring? Who can override our controls, and who reviews those overrides? Which controls have we tested recently? What known weaknesses are still on our list? And what are our fraud losses telling us about our controls? The last one is where fraud loss root cause analysis comes in. Tracing your largest cases back to the controls that should have prevented or detected them shows whether you are an organization that investigates fraud or one that learns from it.
### Key takeaways
A fraud risk assessment is only useful when it reflects the business as it operates today and changes decisions.
The roughly $13 billion cited in the American Express action describes suspected activity tied to BSA and AML program deficiencies, and it is not a fraud loss figure.
Employee overrides deserve independent review for patterns, and monitoring that activity is part of sound control design and not an accusation.
When segregation of duties isn’t possible on a small team, compensating controls such as a second reviewer for high-risk overrides or a weekly exception report can still limit how much one person can do unnoticed.
An alert is the start of a process, and the outcome depends on what happens after it fires.
Documenting known control weaknesses does not reduce exposure until someone owns the fix.
A control can exist and be executed without being effective, so ask what evidence shows it reduces risk.
Metrics such as monitoring coverage, override frequency, and internal detection rates tell leadership more about exposure than alert volume alone.
Ownership of a fraud control should cover the risk, the control itself, the testing, the findings, and the follow-through.
Tracing large losses back to their controls turns fraud investigation into fraud program improvement.
### Final takeaway
A risk assessment doesn’t reduce exposure because someone completed it. An alert doesn’t prevent fraud because it fired, and a control isn’t effective just because it exists. My challenge for this week is simple. Pick one control you trust, then ask how you know it works, what evidence would prove you wrong, and who is responsible for acting if it doesn’t. If you can answer all three, you’re already having a stronger conversation about fraud program maturity than most. If you can’t, now you know where to start.
Episode resources & links
Connect with Hailey Windham, CFCS | LinkedIn
Host of the Fraud Forward Podcast
Banking Community Lead at Sardine
Certified Financial Crimes Specialist (CFCS)
2023 Credit Union Rockstar, CU Magazine
Continuous Improvement Award, SAFE Federal Credit Union, 2023
Top 20 Professionals Under 40, The Sumter Item, 2022