5.2 Activity: Danske Bank case study by Gia Instructor

Question 1

2025-03-23 08:07:58 UTC

The Danske Bank money laundering scandal and the lack of oversight and internal controls demonstrates failure relating to the following ASX principles:

• Principle 3: Instill a culture of acting lawfully, ethically and responsibly – criminal behaviour went undetected by staff at all levels, with negligence and possible collusion reported.

• Principle 4: Safeguard the integrity of corporate reports – the Estonian branch was reporting far greater profits than any other European branch, but this was in reality not the case.

• Principle 7: Recognise and manage risk – the risk of money laundering was not adequately addressed by internal controls, such as a separate and less secure IT system for the Estonian branch as opposed to the rest of Danske Bank, failure to effectively monitor and screen transactions to ensure they matched information on customer and business profiles, and failure to provide the Board with information from a whistleblower.

Question 2

2025-03-23 08:17:30 UTC

This case is a clear example of the Swiss cheese model, where the levels of defence failed to hold up to prevent, detect or correct the risk of money laundering within this particular branch of Danske Bank.

There appeared to also be a lack of appropriate feedback within the control system, demonstrated by a lack of ability or willingness to provide assurance at any level of the activities which were being undertaken by the branch. For a financial institution, performance metrics which appear to be too good to be true should ideally be subjected to audit and assurance activities to provide confidence to the Board and senior management that they are performing as intended.

Q1

2025-06-29 03:23:30 UTC

The Danske Bank failure could most sensibly be described as a failure of the organisation to adhere to sufficient risk management controls in alignment with the ASX Principle 7 - Recognise and Manage Risk.

Q2

2025-06-29 03:32:05 UTC

The failure of multiple layers of risk management controls can be viewed through the Swiss Cheese model, where controls were not adequate and subsequently the fraudulent activity continued undetected.

In addition, the archetype of drifting goals can be applied as the bank clearly did not detect that the ethical standards of the organisation had been compromised (presumably in favour of short term financial gain), allowing behaviours that contributed to the fraudulent activity.

Q1

2025-07-28 02:54:24 UTC

The failures relate to Principles 1 (foundations for management and oversight), 3 (lawful, ethical and responsible culture) and 7 (recognise and manage risk). Taking the swiss cheese model, failures against all of these three principles enabled criminal money-laundering to continue unabated.

From a systems perspective, a control systems diagram could be applied to Danske Bank's acquisitions process, with analysis of the customer portfolio - desired output being 'customer profile complies to DB's expectation, and regular measurement of deviations from that. Another desired output response would be ' acquired bank onboarded into DB's IT architecture and reporting systems'. These systems tools as part of management practice would have guided a more appropriate and risk-focused acquisitions process.

2025-07-28 03:00:57 UTC

The Swiss Cheese Model shows the cumulative effect of flaws in the risk management approach to this acquisition.

The financial performance of Sampo Bank, which was outperforming the rest of the banking sector in Europe at the time should have been a red flag for Danske Bank's board and management, but instead the 'shifting the burden' archetype seems to have been in play - they looked only at the surface results and did not look at this anomalous result as indicative of a problem symptom

Q1

2025-10-17 04:00:52 UTC

The Principle 3 of having a Culture to Act Lawfully, ethically and responsibly was not followed by the bank. It would appear that unethical practices were encouraged and rewarded, and probably was done by way of collusion by key staff members.

Q2

2025-10-17 04:03:30 UTC

It would appear that a type of Swiss Cheese scenario took place with multiple failures in multiple systems, which were either undetected or ignored for personal gain.

A good risk management system would be robust enough to have checks and balances in place to make sure money laundering could not and would not take place, particularly if risk mitigation systems are in place and there is a culture of ethics and responsibility.

There are 3 principles here the bank did not adhere to and the result was serious. Lay solid foundations for management there was a lack of oversight and internal controls. Principle 3 instil a culture of acting lawfully, ethically and responsibly it was clear there had been a violation of the law here. Principle 4 corporate reporting again lack of oversight led to poor or fraudulent reporting.

2026-01-05 03:16:05 UTC

I would start by reinforcing the interconnectedness of all systems such as the simple action of opening and international account if not checked properly leads to fraud. Then systems mapping / Context diagram for visualising boundaries and elements of the system also introduce feedback loops to encourage staff transparency

2026-01-05 03:20:37 UTC

4 Principles

2026-07-13 03:29:18 UTC

The scandal highlights failures in Principle 7 (Recognise and Manage Risk) due to inadequate risk management and internal controls, and Principles 1 (Lay Solid Foundations for Management and Oversight), 2 (Structure the Board to Add Value) and 3 (Instil a Culture of Acting Lawfully, Ethically and Responsibly) due to weak governance oversight, accountability, escalation processes and ethical culture. These failures allowed significant money laundering activity to go undetected.

Swiss cheese + Reinforcing loop

2026-07-13 03:31:59 UTC

Swiss Cheese Model – failures in governance, risk management, internal controls and regulatory oversight all aligned, allowing ongoing money laundering over an extended period.
Reinforcing Loop – the continued acceptance of high-risk transactions reinforced lack of controls and unlawful conduct and allowed the problem to grow over time.

Q1

2026-08-10 00:20:54 UTC

Principle 7 (Risk Management) failed because governance structures did not identify, escalate and manage known risks. Failure indicators:

Ineffective risk identification and monitoring.
Weak AML control environment.
Poor due diligence and customer screening.
Failure to act on known risk information.

Principle 3 (Culture and Ethics) explains why those failures were allowed to persist. Failure indicators:

Compliance concerns were overridden by business objectives.
Ethical obligations were not embedded into decision-making.
Warning signs were repeatedly ignored.

Q2

2026-08-10 00:31:59 UTC

The Swiss Cheese Model explains how multiple control failures aligned to allow the money laundering activities to occur. Weaknesses existed across governance, risk management, compliance, internal audit and regulatory oversight, creating a pathway for suspicious transactions to go undetected.

The shifting the burden archetype is evident in the focus on financial performance over underlying control weaknesses. Strong profits masked emerging risks, causing management attention to remain on short-term results rather than addressing root causes such as poor AML controls and governance failures.

The case demonstrates ineffective feedback loops, with warning signs from whistleblowers, compliance teams and external parties either not escalated or not acted upon. As a result, the Board and senior management lacked accurate visibility of the risks within the Estonian branch.