It's responsibility of the CEO/BoD to ensure compliance. At that size and in that market, compliance departments are huge. We get regular audits of our work by

It's responsibility of the CEO/BoD to ensure compliance. At that size and in that market, compliance departments are huge. We get regular audits of our work by an outside company. The exact auditing company rotate to ensure no incompetence/cronyism hides something. As the article states: > Indeed, prior to 2010 when the OCC cited the bank for many AML deficiencies—including a huge backlog of unreviewed accounts and failure to file Suspicious Activity Reports (SARs)—for the previous six years the agency failed to take any enforcement action against the bank