FTX’s favored account was a setting in the code, and banks have settings too
The FTX charges described control failures that regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run their own controls the same way.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On December 12, 2022, the founder of the collapsed crypto exchange FTX was arrested in the Bahamas at the request of US authorities. On December 13 federal prosecutors in New York unsealed an indictment charging him with fraud and conspiracy, and the SEC and CFTC filed civil complaints. The SEC alleged that customer funds had been diverted to his trading firm, Alameda Research, and that Alameda received special treatment on the FTX platform. That treatment, it said, included an exemption from the automatic liquidation that applied to other customers and an effectively unlimited line of credit. The same day, the executive appointed to run FTX in bankruptcy told the House Financial Services Committee that the company had lacked basic record-keeping and financial controls.
It was tempting in December 2022 to file FTX under crypto and move on. That missed the part most relevant to regulated firms. The alleged fraud did not depend on exotic technology. It depended on a few people being able to change how a trading platform treated one account, with nobody independent watching. Three control questions follow for any bank, broker-dealer or wealth manager: who can change business rules in code, who can see money moving, and who is accountable when the same people build, run and finance the platform.
Who can change business rules in code
Traditional segregation of duties assumed one person approved a payment and another released it. Modern platforms encode many of those approvals as rules: margin thresholds, liquidation triggers, credit limits, payment limits and account flags. Whoever can edit those rules, or create an exception for a single account, holds a power that once needed several signatures.
The SEC’s complaint described exactly that kind of exception. Regulated firms carry the same exposure in other forms. A configuration table in a core banking system sets overdraft limits. A feature flag switches off a fraud check for one merchant. A hard-coded exclusion keeps an account out of trade surveillance. Each one can be legitimate. Each one is also a control that a developer can change.
Code review does not close this gap on its own. Reviewers check whether a change works, not whether the business should allow it. The stronger control has four parts. Keep an inventory of business rules and account-level exceptions as data, separate from application code. Require approval from someone outside engineering, in risk, finance or compliance, for any change to them. Log every change with the approver. Re-certify the full exception list on a schedule, so stale exceptions expire rather than persist.
Who can see money moving
The second question is reconciliation. The bankruptcy filings and testimony described a company that could not readily produce a reliable list of its own bank accounts or a reconciled view of customer balances. That is extreme. The smaller version is common: ledgers that reconcile in total while individual accounts or omnibus balances drift.
For broker-dealers, the SEC’s customer protection rule and its reserve computations exist to keep customer assets separate and verifiable. Banks have general ledger and subledger reconciliation controls, and partner banks in banking-as-a-service programs depend on reconciling their records with the fintech’s. The practical test is independence. Are reconciliations performed by people and systems outside the team that runs the platform? Are breaks escalated with an age limit, or absorbed into suspense accounts? Can the platform team edit the reconciliation logic or its tolerances?
Useful metrics are simple. Track the number and age of open breaks, the value held in suspense accounts, and the time to produce an account-level customer balance from records the business does not control. A firm that cannot produce that balance within a day has a control gap, whatever its policies say. Internal audit can test this directly by picking a sample of customer accounts at random and asking operations to prove each balance to bank or custodian statements, without help from the platform team.
Who is accountable when the same people do both
The third question is about people. In a fast-growing firm, the engineers who build a platform often also operate it, hold production access and sit close to executives making financial decisions. Young fintechs, crypto firms and new digital units inside banks share that profile. Concentration of knowledge and access in a handful of people was central to how FTX operated.
Regulated firms address this with privileged access management, production change approval and separation between developers and operators. Those controls erode under delivery pressure. Emergency access is granted and never revoked. Administrative accounts are shared. One lead engineer becomes the only person who understands a critical system, and nobody can review that person’s work.
The CIO’s question is uncomfortable but concrete: list everyone who could change how money moves without a second person seeing it, and decide whether that list is acceptable. Shortening it usually means just-in-time production access with automatic expiry, session recording for privileged work, and a second engineer able to support each critical system. It also means making sure the head of engineering does not report solely to the executive whose results the platform produces.
The same questions apply to partners. Banks and broker-dealers rely on fintechs, banking-as-a-service platforms and custodians whose controls were built by small teams. Due diligence that reads policies tests the wrong thing. Ask instead for the change history of business rules over a recent quarter with approvers, the list of accounts treated differently from standard rules with reasons, and the current roster of production access. A partner with sound controls can answer in days. One that cannot answer has given its answer.
With hindsight
The founder was convicted on all seven counts in November 2023 and sentenced in March 2024 to 25 years in prison. Trial testimony described a setting in the platform’s code that let Alameda run a negative balance, which matched the kind of account-level exception the SEC had alleged. The bankruptcy estate began repaying creditors in 2025. US crypto policy changed course: bank regulators issued cautious statements in early 2023, withdrew them in 2025, and Congress enacted a federal stablecoin law in July 2025. The control argument did not depend on any of that. Failures at banking-as-a-service middleware firms, notably the 2024 bankruptcy of Synapse, showed again what happens when partner ledgers cannot be reconciled to bank records at the account level. Examiners have since pressed partner banks on exactly that capability.