Federal Reserve Board issues enforcement action with former employee of Banco Popular de Puerto Rico

When an employee diverts customer funds or exceeds authority, the first control failure is upstream: no one documented the scope of access granted, the business rationale for that level of privilege, or the schedule for supervisory review. Decision Governance treats access delegation as a decision artifact—owner, rationale, evidence, outcome—produced at hire, promotion, or role change and revisited on interval. The enforcement action confirms that post-incident investigation is expensive; the missing artifact is the contemporaneous access-grant record that would have constrained authority or flagged abuse in real time.