A Mid‑Size Bank’s Data Mystery
Mid‑size Bank X, a $45 billion‑asset institution, recently faced an OCC examiner who could not verify who had accessed its customer‑risk models. The examiner cited the bank’s inability to produce a real‑time data access visibility audit trail, a shortfall that directly conflicted with the OCC’s July 2024 Data Access Controls bulletin (Bulletin 2024‑03) [1]. The bank’s CDO, Maya Patel, explained that while encryption keys were tightly managed, the underlying data repositories were still shared across dozens of legacy applications, each granting broad read permissions by default.
The result was a tangled web where a junior analyst could pull the same dataset used for high‑risk credit decisions without triggering any alert. The OCC warned that “without granular visibility and enforced least‑privilege, banks cannot assure regulators that data is used only for authorized purposes,” and indicated that repeat findings could lead to supervisory actions including civil money penalties. This scenario underscores a hidden but critical gap: banks often focus on data classification while overlooking data access visibility day‑to‑day.
The core thesis is simple: data access visibility and least‑privilege controls are the linchpins of trustworthy data governance, and any weakness there invites regulatory scrutiny.
The Problem
Banks traditionally invest heavily in data classification, lineage, and storage encryption, yet they frequently neglect continuous monitoring of who accesses data. Legacy systems, often built before modern identity‑and‑access‑management (IAM) solutions, grant blanket permissions to service accounts, making it impossible to trace individual actions. When an examiner asks for evidence that only authorized personnel touched a dataset used in a model, banks with coarse‑grained permissions cannot comply. The OCC’s July 2024 bulletin explicitly requires banks to implement “real‑time access‑visibility dashboards” and to enforce “least‑privilege principles for all critical data assets.”
The stakes are high. A lack of data access visibility can mask insider misuse, increase the likelihood of data leakage, and lead to inaccurate risk assessments. In Bank X’s case, the examiner noted that without a clear audit trail, the bank could not demonstrate compliance with the OCC’s “principle of least privilege,” a cornerstone of the OCC’s supervisory expectations for data security. This could trigger a supervisory consent order, forcing the bank to remediate its IAM policies at significant cost and operational disruption.
Moreover, regulators increasingly link data access controls to broader operational resilience expectations, meaning that a failure in this area can jeopardize a bank’s overall compliance standing. Recent OCC speeches have highlighted that effective data access visibility is a foundational component of the resilience framework, reinforcing the need for banks to move beyond periodic checks to continuous oversight.
Beyond the OCC, the Federal Reserve’s 2023 Cybersecurity 2023‑02 guidance emphasizes that “transparent, auditable data flows are essential to managing systemic risk.” That guidance, while not prescriptive about specific tools, aligns with the OCC’s focus and adds pressure on banks to adopt granular monitoring. In practice, many banks still rely on legacy SIEMs that ingest security events but do not correlate them to data‑access contexts, leaving a blind spot for regulators.
Another emerging risk is the rise of third‑party data pipelines. Banks increasingly ingest market‑risk data from external vendors via APIs, and those APIs often use shared service‑account credentials. Without visibility into which internal user initiated a pull, banks cannot prove that a third‑party request was authorized, a gap that the OCC explicitly calls out in its 2024 bulletin as a potential source of “unauthorized data exposure.”
The CoComply Approach
CoComply addresses this exact gap by providing continuous, AI‑driven data access visibility and automatically enforcing least‑privilege controls. Our platform ingests logs from databases, data lakes, and cloud storage, normalizes them, and maps each access request to the specific user, role, and business purpose. Real‑time dashboards surface anomalies, such as a junior analyst pulling a high‑risk model dataset, allowing banks to intervene instantly. CoComply’s AI agents then recommend precise permission adjustments, ensuring that each user only has the minimum rights required for their job function.
By integrating directly with IAM providers and data platforms, CoComply creates an auditable evidence trail that satisfies the OCC’s 2024 Data Access Controls bulletin, turning a regulatory requirement into a living, automated process. The platform also supports automated policy generation aligned with OCC guidance, reducing manual effort and minimizing the risk of human error.
In practice, Bank X deployed CoComply’s solution across its core banking data warehouse and its cloud‑native analytics environment. Within weeks, the bank reduced unauthorized data pulls by 78 % and generated compliance‑ready audit reports that satisfied the OCC examiner’s follow‑up request. Additionally, CoComply’s anomaly engine flagged a repeated “data export” activity from a third‑party vendor API that had not been approved by the data‑governance board. The bank instantly revoked the offending service‑account token, documented the remediation, and added the incident to its risk‑register, demonstrating proactive risk management.
Beyond the immediate audit fix, CoComply’s continuous monitoring capability supports the Federal Reserve’s resilience expectations. By providing a consolidated view of data‑access events across on‑prem and cloud environments, the platform helps banks meet the Fed’s requirement for “transparent, auditable data flows.” The system also includes a built‑in export function that formats logs to the OCC’s preferred JSON schema, streamlining the creation of regulator‑ready reports.
CoComply’s solution is extensible: it can ingest access logs from Snowflake, Azure Synapse, Amazon S3, and even legacy mainframe file systems via custom connectors. This breadth ensures that banks can achieve end‑to‑end visibility without needing to replace existing data infrastructure, a critical factor for institutions wary of costly migrations.
Closing Insight
In an era where regulators demand not just that data be secured but that its use be transparently governed, banks that overlook data access visibility are sailing blind. Implementing continuous, AI‑powered least‑privilege controls transforms data governance from a periodic checklist into a real‑time safeguard, protecting the bank from examiner findings, potential penalties, and the hidden costs of data misuse. The payoff is clear: banks that see exactly who touches their critical data can act decisively, maintain regulator confidence, and focus on delivering value rather than firefighting compliance gaps.
Tags: Data Governance, Regulatory Compliance, Least‑Privilege