The National Court has ratified the indictment of BBVA, its former president Francisco González, and several former executives. They are being investigated for hiring former commissioner José Manuel Villarejo for allegedly illegal tasks over twelve years. The court dismisses the bank's version of ignorance and points to indications of bribery and disclosure of secrets.
When compliance systems fail: control architectures that don't control 🛡️
The judicial ruling highlights the ineffectiveness of the bank's crime prevention system. In technical terms, it was a control architecture failure: the established protocols and channels failed to audit or restrict the actions of top management. This allowed operations outside procedures, evidencing a critical gap between the system design and its real application at executive levels.
The human firewall that let all suspicious traffic through 🔍
It seems the bank had a sophisticated prevention system, but with a permanent exception rule for the top brass. A kind of executive sudo that allowed bypassing any audit. The court has basically said that the famous ignorance was as credible as a 404 error message on a page everyone visited daily. A textbook case of how not to manage user permissions.