The Commonwealth Bank case is not an indictment of Commonwealth Bank alone. Nor is it an indictment of the Australian banks nor even the Australian regulated sector in isolation.
It is an indictment of the fact that banks and other regulated businesses, all over the world, simply do not take regulation and, even, criminal conduct sufficiently seriously and that boards do not consider it a part of their core function.
Even where periodic reports are required to be filed by e.g. MLROs, the boards rarely go behind the numbers presented, especially if to do so might open a conversation in which a demand for more budget is likely.
For the CEO to fall on his sword after the Commonwealth Bank revaluations is not a solution. What is needed is for CEOs to understand that there are regulatory and criminal sanctions for failing to comply with law and regulations and that those sanctions apply to both the company and to the board, including non-executive directors.
They must understand that the compliance and risk functions are not ring-fenced by appointing a Director of Compliance and Financial Crime Risk, or some-such.
There is a clear duty on all directors, regardless of title and seniority, to actively manage the company and that includes all subsidiaries wherever they are located.
It is not enough to point to senior staff and say “we paid for them to get qualifications” because no one officially approves any such qualifications : they are all the product of unregulated private corporations, regardless of the grand name they print at the top. And regardless of how effectively they embed themselves within FIUs and thereby gain reflected credibility.
The fact that a handful of such companies dominate the training and certification industry is not a guarantee of quality nor, even, of the broader education that is required to properly perform duties.
One only has to look at the material published on LinkedIn by those claiming qualifications of one sort or another to see that it is superficial and buzzword driven and that the ability to, essentially, cut and paste features more than comprehension.