Primary-source evidence library
A curated collection of institutional cases supported by regulators, courts, audit institutions, inquiries and other authoritative primary sources. Each case is mapped to the DQIntegrity seven-layer diagnostic chain and one principal failure mode.
How to read the library
Expected populations, identities, reference data and the legitimacy of attributes used in decisions.
Transfer, mapping, migration, enrichment, aggregation, timing and exception handling.
How data feeds monitoring, models, reporting and operational or regulatory decisions.
Proof that controls operated, issues were understood and sustainable correction occurred.
Curated global cases
The official source establishes the institutional fact. The DQIntegrity paragraph is a separate professional interpretation of what that fact demonstrates about completeness, correctness, traceability, control operation, evidence or remediation.
The FCA found that Metro Bank failed to have the systems and controls needed to adequately monitor more than 60 million transactions, worth over £51 billion, for money-laundering risks between June 2016 and December 2020.
DQIntegrity interpretation: A monitoring platform can appear operational while a material part of the expected transaction population remains outside effective control coverage.
Official FCA sourceFinansinspektionen issued a warning and a SEK 4 billion administrative fine after finding insufficient governance and control of anti-money-laundering work in Swedbank’s Baltic subsidiaries.
DQIntegrity interpretation: Local entity controls, group information flows and enterprise oversight must combine into one truthful risk picture.
Official supervisory decisionThe SEC said Danske Bank misled investors about significant deficiencies in its Estonian branch AML programme. The SEC recorded an integrated global resolution of more than US$2 billion.
DQIntegrity interpretation: Control weaknesses become more serious when management information and external disclosures do not present their true condition.
Official SEC sourceFrance’s Cour des comptes again declined to certify the 2024 family-branch and CNAF accounts. It reported €6.3 billion of errors linked to data used to pay benefits that remained uncorrected after 24 months.
DQIntegrity interpretation: Detection does not become an effective control until errors are owned, corrected and evidenced within a defined time window.
Official Cour des comptes sourceThe Dutch Data Protection Authority fined the Tax Administration €2.75 million in connection with unlawful processing of nationality data in childcare-benefit activities.
DQIntegrity interpretation: A risk model cannot be trustworthy when sensitive source attributes and classification logic are not lawful, necessary, challengeable and independently controlled.
Official Dutch DPA sourceThe Royal Commission examined a scheme that used income averaging and data matching in welfare debt activity and issued 57 recommendations covering legality, policy design, evidence, oversight and treatment of affected people.
DQIntegrity interpretation: Administrative data should not be converted into an adverse decision through assumptions that cannot be demonstrated for the individual case.
Official Royal Commission reportAUSTRAC and CBA agreed an A$700 million penalty. CBA admitted 53,750 breaches of Australia’s AML/CTF legislation.
DQIntegrity interpretation: A control framework is not effective merely because it exists; required reports, population coverage and operational evidence must show that it ran as designed.
Official AUSTRAC sourceThe Federal Court ordered Westpac to pay an A$1.3 billion penalty. In the preceding official settlement announcement, AUSTRAC recorded that Westpac admitted contraventions on more than 23 million occasions.
DQIntegrity interpretation: Control coverage, reporting completeness and risk classification need to be measured against the full expected population, not inferred from visible alerts.
Michigan announced a US$20 million class-action settlement resolving allegations that an auto-adjudication system falsely accused unemployment recipients of fraud and enabled seizure of property without due process.
DQIntegrity interpretation: Automated exceptions require reliable inputs, proportionate decision logic, human review and a traceable route to challenge the result.
Official Michigan Attorney General sourceCanada’s Auditor General reported that, as at 30 September 2025, the Phoenix-related backlog exceeded 233,000 pay transactions and affected more than 133,000 employees. The audit also noted significant historical pay issues, including delays, underpayments, overpayments and non-payment.
DQIntegrity interpretation: A transformation cannot be considered closed while unresolved exceptions, inaccurate source inputs and remediation debt remain capable of contaminating the successor system.
Official Auditor General reportBrazil’s TCU estimated that 7.3 million people could have been included without entitlement while 3.3 million people meeting legal conditions were excluded from emergency-assistance payments.
DQIntegrity interpretation: The same weak eligibility and reconciliation controls can create false positives and false negatives, harming both public finances and people who should receive support.
Official TCU sourceNigeria’s ICPC reported final forfeiture of ₦941,994,079.86 linked to suspected ghost-worker activity. Its investigation described fictitious IPPIS identities for nonexistent personnel and multiple salary payments into unrelated accounts.
DQIntegrity interpretation: When records are fabricated at source, downstream totals and dashboards may remain internally consistent while representing a false population.
Official ICPC sourceAdjacent risk category
These cases are kept visibly separate. They concern compromise of confidentiality, access or custody rather than primarily the completeness or correctness of a decision dataset. They remain relevant where an upstream provider or external service becomes part of the decision and evidence chain.
The Reserve Bank confirmed an illegal breach of a third-party file-sharing service used to exchange information with external stakeholders and later published its response and independent assessments.
DQIntegrity interpretation: Data that leaves the direct technical perimeter remains within the institution’s accountability for custody, access evidence and third-party assurance.
Official RBNZ sourceThe US Government Accountability Office reported that attackers accessed personal information belonging to at least 145.5 million people through Equifax’s online dispute portal.
DQIntegrity interpretation: A compromised upstream data provider can propagate risk into identity, credit and eligibility decisions made by many downstream organisations.
Official GAO reportThe OECD Global Forum stated that Bulgaria’s National Revenue Agency system was hacked and that a significant amount of data was provided to the media, including information exchanged with international treaty partners.
DQIntegrity interpretation: Cross-border and regulatory data exchanges require control over access, custody, incident scope and notification beyond the originating system.
Official OECD statementWhat the evidence supports
Locate structural gaps across source populations, data movement, transformations, controls, evidence and ownership.
Assess whether controls operate at every material handover, transformation and non-read-only data touch.
Challenge input integrity, classification logic, traceability, human review and outcome monitoring.
Test whether a product can evidence mappings, controls, exception handling and operation in a regulated environment.
See how documented cases connect to source, movement, transformation, consumption, control, evidence and remediation.
Evidence over assumption.
The question is not whether a dashboard is green. It is what the organisation can prove about the population, meaning, controls and evidence underneath it.
