Regulators talk about a compliance or risk management culture—but what about a culture of deception?

That’s what Wells Fargo is dealing with. Earlier this month the banking giant agreed to pay $185 million in fines and fire 5,300 employees after thousands of employees secretly opened over 2 million deposit and credit card accounts for unwitting customers—transferring customers’ funds into them and often collecting fees, according to the Consumer Financial Protection Bureau.

That’s not just a few bad apples, it’s a systemic problem—one spurred by compensation incentives and intense pressure to meet sales goals. It raises the question of why Wells Fargo let it go on for so long and didn’t do enough to stop it?

My take: Either Wells Fargo didn’t have strong enough account opening and management policies and procedures in place or there wasn’t a strong enough system to ensure policies and procedures were followed—or both.

I suspect it’s the last choice. In a Barclays Global Financial Services Conference Call September 13, Wells Fargo CFO John Shrewsberry commented that “These terminations were results of our own internal investigations as part of our internal controls and did not happen all at once but took place over the last five years. The terminations have declined every year since 2013 but on an annual basis represented approximately 1% of the team members that worked in our stores each year,” reports Seeking Alpha.

Over the last five years?!? Wells Fargo knew it had a widespread, systemic problem violating customer trust for five years—and let it continue? Sure, they had ethics workshops telling employees not to invent fictional bank accounts for customers and they hired “risk professionals,” The New York Times reports, but if they knew how employees were skirting protocols, certainly they could have adopted a stronger, more accountable system for monitoring new accounts. It shouldn’t be easy to hide fraud. What if these were BSA violations?

It seems like Wells Fargo wants to blame bad apple employees instead of its own failure to stop them. After all, it was the behemoth’s own sales practices that spurred employees to abuse customers. That’s unconscionable.

Now Wells Fargo paying the price—in fines, lawsuits, bad publicity and lost customer accounts.

Could there be something going on at your financial institution that you don’t know about? Do you have strong policies, procedures and systems to catch malfeasance, ensure regulations are being followed and properly manage risk?

Don’t wait to become a headline to find out.