Morgan Stanley to pay $60 million penalty for insufficient oversight of data centers

Reuters

Published Oct 08, 2020 02:22PM ET

Updated Oct 08, 2020 02:45PM ET

By Pete Schroeder

WASHINGTON (Reuters) - Morgan Stanley (N:MS) will pay a $60 million penalty after a U.S. banking regulator found the firm lacked proper oversight as it decommissioned two business data centers.

The Office of the Comptroller of the Currency said on Thursday the bank failed to properly monitor an outside vendor as it wound down the centers in 2016, and failed to maintain inventory of customer data. The regulator said the bank had similar vendor management issues in 2019 when decommissioning other network devices.

In July, the bank began notifying some wealth management customers that their personal data might have been compromised, after computer hardware the bank had disposed of was found to still contain some of that information. The bank offered two years of free credit monitoring services to affected customers.