Federal Reserve Board issues enforcement action with former employee of Manufacturers and Traders Trust Company

When a bank employee accesses customer information without authorization, the failure begins upstream—at the moment access was provisioned without documented need, or reviewed without evidence of ongoing business justification. A functioning access governance regime produces decision records for every entitlement grant: who approved it, why the role required that scope, what review cadence applies, and which control owner certified compliance. The absence of such records means no one can demonstrate whether the employee exceeded granted privileges or whether the privileges themselves were improperly assigned in the first place—and that ambiguity is itself the control failure.