Data Visibility and Regulatory Compliance in Financial Services Insider Risk Programs
Financial regulators no longer treat insider risk as something a firm can fold into general HR policy or transaction monitoring. The FCA's 2025 enforcement actions made that expectation concrete: several cases tied compliance failures to weaknesses in anti-money-laundering and financial crime controls, and separate criminal proceedings followed against individuals, including employees, for fraud and money laundering. Across FinCEN, the FCA, and NYDFS, the expectation is the same: institutions must proactively monitor employee conduct, access patterns, and behavioral indicators rather than wait to investigate after something has already gone wrong. The annual board reporting requirement alone signals how far this has traveled: insider risk has moved out of the back office and onto the board's agenda, where a CISO now has to explain, in terms directors can act on, what the institution's exposure actually looks like.
Where insider risk originates inside financial institutions
The regulatory record shows a threat landscape that refuses to sit still inside a single category. A compliance program built to catch only one of these will miss the rest by design. FTI Consulting has documented how nation-state actors, criminal organizations, and terrorist groups actively work to exploit employees, sometimes with the employee's knowledge and sometimes without it, in order to open fraudulent accounts or pull sensitive information out of a bank's systems. That recruitment dynamic means an institution is not only managing its own staff's judgment, but also managing the possibility that an outside actor has already gotten to someone on the inside.
The newest and least understood piece of this picture is AI. Firms now have to watch more than human employees when they define the insider perimeter. These don't fit the traditional picture of an insider threat, so a program that only monitors human behavior misses all of them.
Most financial institutions don't know where their own data lives, a basic gap that undercuts all of this. An institution cannot monitor what moves across its systems if it doesn't know what exists in the first place or where to find it, and every behavioral control built on top of that blind spot inherits the same blindness. Negligence deserves equal weight alongside malicious intent in this picture. Poorly trained staff, undocumented exceptions, and controls that sit unenforced in a policy manual can do as much damage as deliberate fraud, so a program aimed only at bad actors will walk right past the negligent ones.
Siloed risk reporting and the failure to detect what institutions are now required to see
The gap between what regulators require and what most institutions can actually see traces back to organizational design more than to any missing piece of technology. FTI Consulting has laid out how this plays out: unexplained poor performance or absenteeism goes to HR, an attempt to access sensitive files goes to digital security, a failure to follow KYC procedures goes to fraud detection, and an employee accepting an unreported gift from a vendor goes to business integrity. None of those functions sees the other three, and none of them is positioned to notice that the same employee generated all four.
Risk assessments make the problem worse when they run independently of each other. A "medium" risk rating in one function carries no defined relationship to a "medium" rating in another, so even when the ratings reach the same executive, they can't be compared in any meaningful way. FTI also points out that firms often fail to connect what they already know about how criminal networks recruit insiders to their own internal risk assessments, so sophisticated actors find that opening and use it.
Treating IT controls as a complete answer only deepens the silo. A converged structure, one that correlates data across compliance, information security, HR, and internal audit against a shared rubric, measurably improves an institution's ability to catch what a siloed structure misses, and a cross-functional insider threat program with defined escalation protocols is the structural answer to that problem. FinCEN and the FCA already assume this when they call for proactive monitoring of conduct, access patterns, and behavioral indicators: that kind of monitoring only works as a cross-domain function that no single system can deliver on its own.
The failure of static, rule-based controls to meet behavioral monitoring expectations
Insider risk now gets defined in a way that breaks rule-based controls built for an earlier era of risk management. Looked at individually, each of those events looks completely unremarkable.
Scale makes the problem worse. The same report found that nearly half of sensitive data stored in the cloud sits unencrypted, and that shows how far classification and protection practices still lag behind what a label-dependent rule needs in order to fire.
That gap matters most for data that carries no label. An institution's most valuable information, intellectual property, deal terms, client relationship context, the parameters behind a proprietary model, becomes sensitive because of what it means to the business, not because it matches a regex pattern or a classification tag a rule can scan for. NYDFS Part 500's requirement for a comprehensive asset inventory that includes classification and sensitivity levels reflects an understanding that institutions have to know what they hold before they can protect any of it; the regulation is, in effect, writing the data-visibility prerequisite directly into the rule. The behavioral monitoring regulators describe, tracking access patterns, timing anomalies, and conduct signals, calls for a system that understands the person behind an action and the context surrounding it, not a system that can only see the action in isolation. That same limitation extends forward into shadow AI: a rule that has no way of identifying the destination of a data transfer or who owns the account initiating it has no way to govern what that AI service does with the data once it has it.
Real cases from financial services that show what undetected insider risk looks like in practice
The documented incidents in financial services share a common thread: how long the activity went undetected, which traces directly back to the visibility and correlation gaps described above. Departing and departed employees are the most common vector for loss.
At Desjardins, an employee in the marketing department used data placed on a shared drive by colleagues who had legitimate access to copy member data, and continued doing so for more than two years before anyone caught it. The access itself was authorized, so rule-based controls had nothing to trigger on. A system tracking the duration and pattern of that access against the employee's actual role would have flagged the anomaly long before the two-year mark.
At Block, a former employee of Cash App Investing kept system access after termination and downloaded brokerage data, and it affected millions of customers. The offboarding process never triggered a corresponding revocation of access, and a system watching for account activity after a termination date would have caught the gap immediately.
American First Finance discovered in 2025 that a former employee of FinWise Bank, a third-party banking partner, had accessed sensitive customer data for a few days between May 31 and June 3, 2024, after that employment had ended. The signal here, as in Desjardins and Block, was not some obviously suspicious action. It was ordinary, authorized access continuing well past the point where it should have been shut off, a pattern detected only by connecting HR offboarding data to account activity.
Low-tech exfiltration shows the limits of even well-built digital monitoring. A departing account manager photographed a CRM screen with a personal phone and printed a contact list the night before leaving. A system tracking timing, role, and departure status as risk multipliers would have flagged the account manager's final days as a high-risk window worth watching, regardless of which channel the data left through, even without relying on digital file controls alone.
The largest of these cases shows what happens when an insider vector meets an external threat at scale. A handful of compromised insiders turned into a compliance failure that cost billions of dollars.
Regulatory requirements for behavioral monitoring and converged oversight
Read closely, the regulatory language converges on one requirement: institutions have to be able to connect data movement to the specific person behind it and to the behavioral context surrounding that movement. That is a data visibility and integration requirement, not a training requirement and not a policy requirement. FinCEN's and the FCA's shared expectation, that institutions proactively monitor "employee conduct, access patterns, and behavioural indicators that may signal compromise or collusion," is written in the language of behavioral analytics and stated as an enforcement expectation.
NYDFS Part 500 requires firms to review access privileges, with particular scrutiny on privileged accounts and access to non-public information, so they know who can reach what and whether that access is actually used appropriately, not just whether the entitlement exists somewhere on paper. FinCEN's guidance on insiders enabling sanctions evasion and trade-based money laundering assumes institutions can link behavioral signals to transaction data, a cross-domain connection that siloed systems are not built to produce.
The practical test follows from all of this directly. If an institution can show it monitors behavioral patterns, connects access events to identity and role context, and escalates anomalies to a converged review function, it is answering what regulators are actually asking. An institution that can only produce a DLP policy document and a log of past alerts is not.
Designing a behavioral data visibility program to satisfy both the regulatory requirement and the actual risk
A program built to meet today's regulatory expectations, and to actually manage the underlying risk, rests on one design principle: it connects what is moving, where, and how sensitive it is, with who is moving it, in what role, and under what behavioral pattern, before any of it reaches a human analyst as an alert.
Data visibility comes first. Roughly two-thirds of financial services organizations lack complete knowledge of where their data lives, the Thales report found, and no institution in that position can monitor what moves if it doesn't know what exists. Behavioral context makes the signal meaningful: off-hours queries, access with no legitimate business purpose, sudden spikes in data volume, these remain the earliest and most reliable warning signs, but reading them correctly requires a system that understands what normal activity looks like for a given role and tenure, and that can flag risk even in behavior that has never technically crossed a threshold before.
Timeline assembly matters before a human analyst ever sees the case. The investigative burden drops significantly when a platform assembles the full sequence on its own, the access event, the behavioral pattern that preceded it, the sensitivity of the data touched, the destination it moved to, and the identity and role context behind it, before the alert ever becomes a task on someone's desk. That is what shortens time to investigation without sacrificing accuracy.
Signal ingestion has to be converged. Shadow AI governance belongs inside this same framework rather than off to the side: with AI agents and unmanaged AI services now operating inside the enterprise, the destination of a data transfer, the account ownership behind it, and the context of the action all need to feed into the same decision. Visibility by itself and blanket blocking by itself both fall short of what the problem actually requires.
Explainability is what lets any of this hold up under scrutiny. And offboarding deserves specific, elevated attention as a risk window: Desjardins, Block, and American First Finance all trace back to access that continued past authorized tenure. A functioning program treats departure as a trigger for accelerated review, not as one more line on an offboarding checklist.
Compliance gaps after deploying behavioral monitoring tools
Deploying a behavioral monitoring platform closes the technology gap, but an institution that treats that deployment as the finish line will end up with a program that satisfies an auditor without actually managing its risk. The remaining gaps sit in governance, scope, and in how the institution defines what counts as sensitive.
Unlabeled data remains the hardest problem to solve. Protecting that kind of material requires a system that understands what the information means to the business, not one that only checks whether it matches a known pattern.
Negligence sits in a blind spot that many programs never close. Negligence, not malice, drives most of the incidents on record.
Privacy and employment law vary by jurisdiction and need to be built into a program from the start. The most effective programs pair behavioral monitoring with real whistleblower protections, because a meaningful share of insider schemes involve collusion among several employees, and behavioral signals alone may not resolve that pattern until the damage is already done.
Alert volume deserves scrutiny as its own governance failure. The real measure of a working program is the ratio of alerts that reach a human analyst against the alerts that actually need human judgment to resolve. The institutions in the strongest position, against regulatory scrutiny and against the risk itself, are the ones that treat the regulatory requirements as a floor to build on.
