Why It Matters
The case shows that ambiguous escalation policies expose firms to legal risk and put compliance professionals in career jeopardy, urging firms to formalize clear, auditable processes.
Key Takeaways
- •Scotiabank dismissed compliance staff for not escalating insider‑trading case
- •Whistleblower triggered legal review that uncovered unregistered spouse accounts
- •Failure to document decisions creates exposure to retaliation and lawsuits
- •Clear escalation protocols protect compliance officers and reduce risk
- •CCOs must train staff on when to involve legal
Pulse Analysis
The Scotiabank incident underscores a growing tension in corporate compliance: the need to act decisively without overstepping authority. When a whistleblower bypassed an internal decision that labeled a potential insider‑trading case as "nothing there," the legal department uncovered additional policy breaches, ultimately leading to multiple firings. This chain reaction illustrates how a single missed escalation can cascade into reputational damage, regulatory scrutiny, and costly litigation, especially in highly regulated financial institutions where personal‑trading rules are stringent.
Effective escalation hinges on three pillars: clear policy definitions, robust documentation, and continuous training. Chief Compliance Officers must delineate precisely which red flags warrant escalation to senior management, the board’s audit committee, or the legal function. Written protocols should include decision trees, hypothetical scenarios, and mandatory record‑keeping checkpoints to ensure every analyst’s rationale is traceable. Regular simulations and refresher courses reinforce these standards, reducing the likelihood that staff will either suppress a legitimate concern or flood leadership with low‑risk noise.
Regulators worldwide are tightening expectations around governance and accountability, making documented escalation trails a compliance imperative. Firms that embed transparent escalation frameworks not only protect their staff from career fallout but also demonstrate proactive risk management to supervisors and investors. By integrating automated monitoring tools with human oversight, organizations can flag anomalies early, route them through predefined channels, and retain an auditable paper trail. In the long run, such disciplined approaches mitigate legal exposure, preserve market confidence, and reinforce the strategic value of the compliance function.
‘Failure to Escalate’ and Career Risks
We’ve had a few posts lately about compliance officers who suffer retaliation for raising misconduct issues to senior management. Today we flip the script, and wonder about the career harms that can befall compliance officers who don’t raise issues high enough up the command chain.
This is on my mind thanks to a jarring story from Scotiabank, where it recently came to light that three senior compliance officers were fired in 2024 after closing an investigation into two bankers possibly violating insider‑trading policies. A whistleblower subsequently reported the matter to the legal team; the legal team conducted its own investigation and eventually did fire the bankers; and then the compliance officers who made the original “nothing there” ruling were sent packing too.
The case has spilled into public view because the fired senior bankers are now suing Scotiabank for wrongful termination. Canadian business press obtained copies of the whistleblower complaint and the bankers’ civil suit is now winding its way through court.
I was struck by the case because it so neatly spotlights the perilous position compliance officers can face: retaliation for pushing a matter too hard, and disciplinary action for not pushing a matter hard enough. How on earth can you walk that high‑wire act with confidence every day?
The Scotiabank Drama
Let’s first unpack the Scotiabank lawsuit allegations more fully.
The two bankers involved are brothers Michael and George Doumet. The Doumets worked as stock analysts for Scotiabank and were making good money in the early 2020s. The allegations, as detailed in the Financial Post, are that Michael Doumet frequently chatted with the CFO of a Canadian company, Data Communications Management Corp. (DCM), and built up a large holding of DCM stock in his personal portfolio. By August 2023, Doumet had reaped a $1 million profit from those holdings in the prior 12 months alone.
Scotiabank discovered Doumet’s DCM holdings during a routine compliance review of employees’ personal stock holdings. Except, senior compliance staffers at Scotiabank weren’t concerned about Doumet’s trading or his communications with the DCM financial officer. One staffer labeled Doumet’s conversations “banter” and another said he wasn’t concerned that Doumet was trading on material non‑public information. The compliance team closed their review in January 2024.
A whistleblower (identity unknown) didn’t like that decision and filed a complaint to Scotiabank’s legal department. The legal team hired an outside law firm to investigate, and in the course of that investigation discovered that both Doumets failed to register their wives’ trading accounts as related‑party personal investing accounts.
Failing to register the wives’ personal accounts violated Scotiabank’s personal‑trading policy, and the Doumet brothers were fired in spring 2024. Less than a week later, three senior compliance officers at Scotiabank were fired too — apparently because they failed to escalate George Doumet’s trading violation with DCM when they first noticed it.
We don’t know the identity of the whistleblower. Were they a compliance staffer who disagreed with the first decision to close George Doumet’s probe? Someone with a personal animus against the Doumets? Someone who didn’t know about the original compliance investigation and reported separately? The answer is unclear.
But if compliance officers step away from the specifics of this case and think about “failure to escalate” risk more broadly, a few points come into view.
‘Failure to Escalate’ Issues
The key issue for compliance officers is whether their teams are evaluating internal matters properly. That seems to be what went wrong at Scotiabank and got compliance officers fired, which is the thing compliance officers worry about the most.
It’s a matter of policy management, investigation protocols, and documentation. Compliance, HR, and legal teams need clear guidelines about how they’ll investigate matters (like an insider‑trading violation) and how they’ll document their decisions (such as deciding there’s nothing to pursue) — especially since those decisions might be subject to scrutiny from other parties, sometimes years after the fact.
“Another question I have, however, is failure to escalate to whom? Like, where were those now‑fired Scotiabank compliance staffers supposed to send the Doumet trading matter?”
If lower‑level compliance staffers fail to escalate a matter to the chief compliance officer, that could be a question of internal policies and training that a CCO needs to handle directly. The risk is that staff make a decision they shouldn’t make. How are you, CCO, instructing and training compliance analysts so they know what to escalate and what not? Do you have a review process to study all matters that your subordinates have closed?
There’s also the question of “escalating” a compliance matter to someone outside the compliance function. Again, escalate to whom?
Sure, the compliance team might need to escalate some matters to the legal department; but those matters should be clearly defined in advance, with written rules of engagement (i.e., policies) about when legal should be involved. Or if the compliance team is supposed to escalate a matter to the board’s audit committee, you still want clear rules of engagement then, too.
Once the compliance team escalates, you surrender control of where the matter goes from there, so you want to bulletproof your original decision to escalate. You also want to bulletproof your decision not to escalate, since someone might disagree with that decision (or not even know you made it), declare themselves a whistleblower, and escalate the issue out of your control anyway.
Properly documenting a decision not to escalate will be crucial. Each decision will depend on the specific facts of the matter and how your team applied corporate policies to those facts.
-
Can your compliance monitoring and review systems gather all facts?
-
Are your policies clear, perhaps even with hypotheticals that staffers can consider?
-
Have you hired and trained competent staff, so they can make those analyses correctly? Have they documented their work thoroughly?
Those are the questions you need to ponder if you want to avoid a predicament like Scotiabank now faces.
0
Comments
Want to join the conversation?
Loading comments...