I don't want to go out of my way to defend their incompetence, but you have to prove what happened. It's not fair to send a CEO to prison because a different insider independently embezzled funds and they lost the records.

It depends. SOX compliance, if they were, actually literally does say the CFO and other officers who signed off on their accounting are liable. That’s the point of SOX. Synapse itself likely wasn’t unless it was preparing for IPO but their banking partners might be.

Their primary partner Evolve bank is not, but it is held to legal standards by the FDIC and other banking regulators and their lack of controls is probably where you might see executive management facing criminal challenges.

However everyone involved could face civil penalties.

If history had been different it’s likely this event would have turned up regulatory scrutiny on fintech precisely for these reasons - a privately held fintech can basically just fuck around and pretend to be a bank leveraging a poorly managed licensed partner holding the risk and abscond through incompetence with everyone’s money and no one suffer a consequence other than the customers. Sadly I don’t expect this to change in the next four years and there’s every reason to believe accountability will get worse as existing regulations and enforcement are potentially gutted. So caveat emptor is likely the law of the land until something so huge happens it can’t be ignored.

Seems like a rather large moral hazard if we don't?

At some point the courts should be able to say "ok fine you were the directors responsible for the company you're going to prison n years, sorry."

Bet we'd see a lot more documentation suddenly appear.

Command responsibility applies here. CEOs get multiple times their average employee's pay because of their responsibility, which should include responsibility to know when stuff goes wrong.

If you're a CEO running a business that sells what they call 'savings accounts' worth hundreds of millions of dollars and even have a system in place where it's even possible to make "'very large bulk transfers' of funds without identification of who owned the money" then you should be responsible for that. There's a good reason this doesn't happen at banks-- it can't. They have redundant business processes in place that prevent it from happening in the first place, and are constantly redundantly reconciling their transactions so if it does happen, it gets caught and corrected immediately. Not only did it happen, it happened without being able to figure out where the money even went.

Let's say I ran a company that made a product that I acknowledged is extremely dangerous without this one safety mechanism. Instead of creating multiple redundant systems to ensure that safety mechanism is in place, I just trust that some guy takes care of it without being absolutely certain-- it's expensive, annoying time consuming, blah blah blah. When a bunch of people get hurt because that guy pocketed the cash that was supposed to go towards that safety feature, hell yes I should be criminally responsible. It's negligence.

You have to prove the bank robber did it too? Why is it that we wiretap phones, subpoena companies, search homes and detain people for the lowest of drug crimes but everyone throws their hands up here?

Like, how did you expect to make a case if you don't do anything?