"Remediation is in progress."
It's a reassuring line in a status report. It can also be true for years while the thing being remediated keeps happening.
What the OCC found
On October 13, 2026, the OCC assessed a $750 million civil money penalty against Bank of America for deficient compliance with anti-money-laundering rules, the largest penalty in the agency's history. The OCC said the bank knew for years that it was failing to escalate potentially suspicious activity to its investigators, and did not correct the problem. More than a year after a December 2024 cease-and-desist order required it to fix its program, the bank still had not escalated potentially suspicious activity for review. The OCC also said the bank's audit function failed to identify long-standing concerns that examiners later found.1
The penalty followed an order that was already in place. The bank wasn't penalized for not knowing. The release describes a bank that knew.
Progress can look fine while the fix stalls
Remediation programs report milestones: policies rewritten, staff hired, systems bought, training delivered. Each can arrive on schedule while the underlying failure continues. The milestones measure the project. Only the outcome measures the problem.
Take escalation, in general terms. A bank can hire investigators on schedule and still not route the cases to them. The hiring milestone turns green. The outcome that matters, suspicious activity actually escalated and reviewed, may not move at all. Boards should ask for the outcome measure first and the milestones second.
That gap is where waiting hides. Every known, unfixed failure has a period in which it keeps happening, and someone is accepting that risk, whether or not anyone says so.
Make the waiting a signed decision
Put the acceptance in writing, with a name and an end date:
Known failure: [description]
Known since: [date]
Still occurring? [yes or no, and how it's measured]
What limits the harm in the meantime: [interim control]
Risk of continuing accepted by: [name, role], until [date]
Next evidence that it has stopped: [measure, date]
The third line is the one that matters. If the honest answer is "we don't measure that," the program is reporting on its activity, not its outcome.
The audit finding points to the same gap. Internal audit should test whether the failure has stopped, not only whether the remediation plan is on track. An audit that confirms the plan is on schedule can still miss that the problem is unchanged.
For a founder, the equivalent is the known bug in the onboarding checks that's "on the roadmap." Until it's fixed, someone is accepting what gets through. Decide who.
A problem you know about and haven't fixed is a decision. Make sure someone signed it.
Related Reading
Read The Indicators Were Green. The Situation Was Not. for how reported progress and the actual situation can come apart.
