iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Office of the Comptroller of the Currency (OCC) announced an $80 million civil money penalty against Capital One, N.A., and Capital One Bank (USA), N.A., on August 6, 2020. The regulator said the banks had weaknesses in assessing and managing risks as they moved significant IT operations to the public cloud. The penalty was payable to the U.S. Treasury, not by Capital One customers.
Why did the OCC fine Capital One?
The OCC said the banks failed to establish effective risk-assessment processes before migrating significant IT operations to the cloud and did not correct deficiencies in a timely way. The regulator characterized the conduct as unsafe or unsound practices and noncompliance with its information-security standards. The OCC’s August 6, 2020 announcement explains the penalty and its stated rationale.
The consent order describes findings about conduct beginning “in or around 2015.” It identifies weaknesses in cloud risk management and in the design and implementation of certain network-security and data-loss-prevention controls. It also says the banks did not adequately handle alerts. Internal audit did not identify numerous control weaknesses and gaps or effectively report identified issues to the Audit Committee, and the Board failed to take effective action to hold management accountable on certain concerns. These are the Comptroller’s findings as set out in the order, not a statement that every cloud migration is inherently unsafe.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat did the consent order say?
The consent order is dated August 5, 2020, one day before the OCC’s public announcement. Its legal qualification matters: “The Comptroller finds, and the Bank neither admits nor denies, the following.” The order says the bank consented to its issuance and waived specified procedural rights; it became final and effective upon issuance. The consent order contains the detailed findings and terms.
#1 Best Overall
What did the $80 million penalty mean for customers?
The penalty was assessed against the two named bank entities and was to be paid to the U.S. Treasury. It was not a charge or repayment obligation imposed on Capital One customers. The OCC said it positively considered Capital One’s customer-notification and remediation efforts. The official order and announcement do not quantify affected customers or individual losses, so they do not establish a customer-impact total.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is the status of the OCC action?
The OCC enforcement database lists the civil-money-penalty entry with an August 5, 2020 start date and records a related cease-and-desist order as terminated on August 31, 2022. The database warns that its records may not reflect current status and advises checking whether an order has been modified or terminated. That entry alone does not support describing the penalty as a currently active supervisory restriction. The OCC enforcement-actions database is the place to check for status information.
The OCC’s stated point was that banks may pursue responsible innovation, but must maintain sound risk management and internal controls to protect operations and customers. This article describes the OCC’s historical 2020 action; the cited records do not provide an independent assessment of Capital One’s present-day security posture.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Rank #4
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
