“WOW.”

That was the reaction of one Bank of America compliance officer upon learning that a customer had been the subject of more than 100 internal compliance investigations.

The unnamed customer had repeatedly been connected to suspected fraud schemes, suspicious international wire transfers, and investigations by multiple law enforcement agencies. Compliance personnel raised concerns about the customer’s activities and recommended closing the accounts.

But the business wanted to keep the customer. So it did.

Eventually, the recommendation to close the accounts was withdrawn in favor of a plan to mitigate the risks while keeping the relationship open.

Sound familiar?

The Bank of America Debacle

These details come from the regulatory findings surrounding Bank of America’s massive $1.2 billion settlement for violations of anti-money laundering laws, alongside a separate sanctions settlement. The bank is also required to undergo independent reviews of its compliance program.

The case is extraordinary in its scale, but the underlying problem is painfully familiar to compliance officers everywhere.

The compliance team identifies a serious risk. The business sees an important customer, a lucrative transaction, or an opportunity it doesn’t want to lose. Compliance recommends against moving forward, and the business pushes back.

Sometimes, no matter how compelling the evidence, the business simply refuses to take compliance’s advice.

So what should you do when you’re the compliance officer in this situation?

One of the challenges of working in compliance is that we spend our days looking for things that can go wrong. And when you’re constantly identifying red flags, it’s easy to start treating every red flag as though it’s an enormous one.

But not every concern warrants a major escalation.

Before you take on the business, ask yourself how serious the issue really is. Are we talking about a technical violation with relatively minor consequences? A risk that can reasonably be mitigated? Or something that could result in significant legal exposure, regulatory intervention, or substantial harm?

You want to address all of the problems you identify. But you also need to be strategic about which battles you fight and how hard you fight them.

If every disagreement becomes an escalation to senior management, you risk becoming Chicken Little. Eventually, people may stop taking your warnings as seriously as they should.

Save your biggest escalations for the situations that truly warrant them. You’ll be much more effective when you do.

When you’re bringing a serious concern to the business, make sure that you’ve documented it.

That means being clear about the facts, the risks you’ve identified, the relevant legal or regulatory requirements, and your recommendation.

It also means documenting the conversations you’ve had and the information you’ve shared.

This isn’t about creating a giant paper trail every time someone disagrees with you. It’s about making sure that there is an accurate record of what Compliance knew, what Compliance communicated, and what the business understood when it made its decision.

You want to be able to demonstrate that the concerns were properly raised and that the relevant decision-makers had the information they needed.

It’s particularly important when a situation develops over time. What looks like an isolated problem in January may look very different after six additional incidents by September.

3. Document the Outcome

It’s not enough to document that you raised concerns. You also need to document what happened afterward.

If the business accepts your recommendation, fantastic. Record the decision and the actions that will be taken.

But if the business decides to override your recommendation, you need to make sure that is documented as well.

What exactly did Compliance recommend? What did the business decide to do instead? Who made that decision? What was the rationale?

These are important questions, particularly if the decision eventually becomes the subject of regulatory scrutiny.

Where a decision is made against compliance’s recommendation, an accurate record of the decision and the individuals responsible for it is critical.

Don’t assume that because everyone was in the meeting, everyone will remember the decision the same way six months later.

They probably won’t.

4. Too Big a Problem? Escalate

If the issue is serious enough and the business continues to ignore your concerns, you may need to escalate.

That could mean going to the General Counsel, the CEO, the Audit Committee, or ultimately the Board.

The appropriate escalation route will depend on your organization’s structure, the seriousness of the issue, and who has already been involved in the decision.

But here’s the uncomfortable reality: escalating a major issue against the wishes of powerful business leaders can put you in a very difficult professional position.

Retaliation is a real concern. Be aware of that possibility and watch for it.

This doesn’t mean you shouldn’t escalate. Sometimes escalation is absolutely necessary, regardless of the personal consequences.

5. Consider Whether You Want to Stay

Sometimes, despite everything you’ve done, the organization makes a decision you simply cannot live with.

You’ve raised the concerns. You’ve documented the risks. You’ve escalated appropriately. And the answer is still no.

At that point, you may need to ask yourself whether this is an organization where you want to continue working.

You’re Probably Not Going to be Personally Liable

Look – the likelihood of an individual compliance officer being personally prosecuted or held responsible for an organization’s misconduct is generally extremely low, particularly when that person has been diligently performing their responsibilities.

The cases where we’ve seen compliance officers face personal criminal consequences have generally involved extraordinary circumstances, including individuals who participated in wrongdoing or seriously failed to perform their duties. Of course, your specific legal exposure will depend on the facts, your responsibilities, and the relevant jurisdiction.

For most compliance officers, the decision to leave is therefore much more personal than legal.

Do you want to continue fighting the good fight? Do you believe that you can still influence the organization and make things better? Are there enough people who support compliance that you believe progress is possible?

Or have you reached the point where the constant resistance has become untenable?

There is no universally correct answer.

Some compliance officers will decide to stay and continue trying to improve the organization from within. Others will decide that their energy and expertise would be better spent somewhere that actually wants to take their advice.

Both can be reasonable decisions.

You don’t have to spend the rest of your career fighting the same battle if you no longer believe it’s one you can win.

The Bottom Line

The Bank of America case illustrates just how difficult these situations can become.

Think about it. More than 100 compliance cases involving the same customer. Repeated law enforcement interest. Serious concerns about suspicious activity. And still, the business wanted to maintain the relationship.

Unfortunately, many of us will encounter some version of it during our careers. Sometimes the business will listen. Sometimes it won’t. And sometimes the stakes will be high enough that the disagreement becomes genuinely uncomfortable.

You can’t control the decisions the business makes.

But you can control how you evaluate the risk, how you communicate your concerns, how you document the decision, when you escalate, and ultimately whether you want to continue working in that environment.

Having a systematic approach to these situations won’t eliminate the difficulty. But it will help you make better decisions, protect your professional integrity, and understand your options when the business decides not to listen.