Federal Reserve Board issues enforcement actions with former employee of Ally Bank and former employee of Regions Bank

Unauthorized access at scale is always a failure of the access-grant decision record. Someone approved these employees' system privileges, but no artifact captured who authorized access, why the scope was justified, or when entitlements would be reviewed. The enforcement pattern is consistent: when data access decisions lack owner, rationale, and review cadence, privilege creep becomes privilege abuse. Decision Governance requires that every grant of customer data access be produced as a system of record at the moment of authorization—not discovered in a forensic audit years later.