Q2 2026 Integrity Advocate

Compliance Controls: Only as Strong as Their Weakest Link

A recent enforcement action involving TradeStation Securities, Inc. offers an important reminder for every employee: even well-designed compliance programs can fail if the processes, controls, and technology supporting them are not properly configured, tested, monitored, and maintained. One weak link in the control chain can expose the entire compliance process. 

TradeStation agreed to pay $1,110,661 to settle potential civil liability for 481 apparent sanctions violations involving customers located in Iran, Syria, and Crimea, according to the Office of Foreign Assets Control (OFAC). OFAC is a division of the U.S. Department of Treasury with the primary role of administering and enforcing economic and trade sanctions. The issue was not that the company lacked compliance controls on paper. Rather, weaknesses in testing, change management, technology configuration, and oversight caused key controls to stop working as intended.

What Went Wrong

TradeStation had multiple layers of sanctions controls, including customer screening, daily rescreening, and geo-blocking tools designed to prevent access from sanctioned jurisdictions. However, several breakdowns prevented those controls from working as intended:

• A prior mobile platform upgrade affected one geo-blocking control.
• A later cloud-related software update resulted in another control being disabled and not re-enabled.
• Automated testing intended to confirm whether those controls were working was discontinued without an effective replacement.
• The company did not promptly detect that both its compliance processes and supporting technology were no longer operating as designed.

Why This Matters to Us

This case demonstrates that compliance controls are only as effective as their day-to-day operation. Technology can strengthen a compliance program, but neither processes nor systems should be treated as “set it and forget it.” Changes to systems, platforms, workflows, vendors, responsibilities, or configurations can create unintended gaps if they are not reviewed through a strong change management process. Regular testing, validation, documentation, and oversight help ensure controls continue to function as intended—especially after upgrades, migrations, vendor changes, process updates, or other significant changes.

Warning Signs That Controls May Need Attention

Employees should remain alert to indicators that a control may no longer be operating as intended, including:

• A recent system upgrade, migration, or configuration change
• Replacement of a vendor or third-party platform
• A recurring review, test, certification, or monitoring activity that has been discontinued
• Changes in personnel, responsibilities, or ownership without corresponding process updates
• Control activities that suddenly stop generating exceptions or results
• Documentation that no longer reflects current practices

What Employees Can Do

• Confirm processes and systems are properly designed, configured, documented, and understood by the employees responsible for them.
• Test controls at appropriate intervals and after significant process, system, vendor, responsibility, or configuration changes.
• Use proper change management before controls are altered, disabled, bypassed, or replaced.
• Raise concerns promptly if a control does not appear to be working as intended or no longer aligns with the process it supports.
• Understand who owns each control, who performs it, and who is responsible for verifying that it remains effective following process or system changes.

Employees who own, support, or rely on compliance-related processes and systems should confirm that controls are properly designed, configured, tested at appropriate intervals, and reviewed after any significant change. If something does not appear to be working as expected, or if a control is disabled, bypassed, changed, or no longer aligned with the process it supports, raise the issue promptly. Effective compliance requires more than well-written policies and well-designed controls. It requires continuous ownership, testing, monitoring, and improvement. A control that exists on paper, but no longer works in practice, provides little protection when regulators come calling.

Source: Radical Compliance, “Trader Fined $1.1M on Testing, Software Snafus,” March 17, 2026.