Sample Scenario — Regulatory & Compliance Failure Simulation

The Aldermoor Bank Remediation Exercise

A branching, choose-your-path tabletop built for a regional bank. A system change two years ago quietly started charging customers overdraft fees the bank's own disclosures didn't allow. Six shared injects establish the problem, then the room's own decision — refund customers now on an estimate, or finish the full lookback and agree a plan with regulators first — sends the exercise down one of two independent, fully-scripted paths. Both of them end with a regulator asking why it took this long.

16injects per path
2diverging paths
10 dayssimulated timeline
3.5 hrstypical runtime

Fictional, but built to feel real in the room.

Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any regulated firm where a technical change can quietly break a promise to customers.

Aldermoor Bank

A regional bank headquartered in Pittsburgh with $45B in assets, about 1.9 million checking customers, and ~6,200 employees. Aldermoor is publicly traded and supervised by both banking and consumer protection regulators.

Twenty-six months ago, Aldermoor upgraded its core banking platform. The project was delivered on time and under budget. One configuration change altered the order in which transactions post to accounts. Nobody tested what that did to overdraft fees — until now.

Checking customers — about 410,000 potentially overcharged
Core platform vendor — led the system upgrade
Regulators — banking and consumer protection supervisors
Investors — quarterly earnings in nine days

The crisis everyone faces.

Six injects, delivered over the first 48 hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.

DAY 0
10:00
INJECT 1Detection

A pattern in the complaints

A complaints analyst notices a cluster of customers saying they were charged overdraft fees even though they had enough money when they made the purchase. She traces it to the order in which transactions post.

Tests: whether a pattern spotted in the complaints team reaches compliance and risk leadership quickly.
17:00
INJECT 2Scoping

410,000 customers, two years

Compliance confirms the problem: since the core platform upgrade, transactions have posted in an order that generates more overdraft fees than Aldermoor's customer disclosures allow. Roughly 410,000 customers may have been overcharged, by an estimated $38M to $60M.

Tests: scoping a problem whose cost depends on assumptions that aren't settled yet.
DAY 1
09:00
INJECT 3Governance

Signed off, never tested

Internal audit finds the posting-order change was approved through the vendor-led project's change process. Compliance signed off on the project, but nobody tested the fee logic against the disclosures.

Tests: owning a control failure that crossed several teams, each of which thought someone else was checking.
14:00
INJECT 4Regulators

An exam in three weeks

Aldermoor's consumer compliance exam starts in three weeks. Its regulatory relationship manager is already asking about complaint trends in overdraft fees.

Tests: candor with a regulator who is close to finding the problem on their own.
DAY 2
09:00
INJECT 5Financial

Nine days to earnings

Quarterly earnings are nine days away. The CFO asks whether the remediation needs to be reserved for this quarter, and how to describe it to investors.

Tests: aligning financial disclosure with a remediation plan that doesn't exist yet.
10:00
INJECT 6Decision point

Refund now, or lookback first

The room has two options. Refund customers now based on the current estimate — about $45M — and fix the details later. Or complete a full transaction-level lookback, about twelve weeks, and agree the remediation plan with regulators before paying anyone. Either way, the posting order will be corrected this week. The room has to decide.

Tests: speed versus accuracy in remediation, with customers, regulators, and investors all watching. This is the fork.

The room decides. The exercise branches.

INJECTS 1–6 DECISION A — REFUND NOW B — LOOKBACK FIRST

From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.

Path A — the room refunds customers nowTen injects. Refunding fast buys goodwill, not precision — and every number paid out today has to survive the lookback that follows it.
DAY 3
09:00
INJECT 7ACustomers

Money nobody expected

Refund credits post to 410,000 accounts with a short notice. Customers call to ask what the credits are for, and the call center wasn't briefed in time.

Tests: operational readiness for remediation, not just the decision to remediate.
DAY 4
11:00
INJECT 8AAccuracy

Eight percent are wrong

Quality checks find that about 8% of refunds were calculated incorrectly — some too high, some too low. Clawing back overpayments would be a second customer harm.

Tests: deciding what to do about errors in the remedy itself.
16:00
INJECT 9ARegulators

"Why weren't we told first?"

Regulators learn about the refunds from a customer complaint. They ask why Aldermoor didn't notify them before paying, and how it calculated the amounts.

Tests: the cost of acting before engaging the people who will judge the action.
DAY 5
10:00
INJECT 10AMedia

"Bank admits overcharging"

A local paper reports that Aldermoor is refunding customers for improper overdraft fees. National consumer finance writers pick it up.

Tests: owning the story when you chose to make it public through your actions.
DAY 7
09:00
INJECT 11AScope

Another fee type

The ongoing lookback finds that the same posting-order change also affected returned-item fees. A second round of refunds will be needed.

Tests: returning to customers and regulators a second time — and keeping trust when you do.
15:00
INJECT 12AFormer customers

Sixty thousand people who left

About 60,000 affected customers have closed their accounts. Aldermoor has no current way to pay them, and some addresses are years out of date.

Tests: remediation for people who are no longer your customers.
DAY 8
10:00
INJECT 13ALegal

A class action anyway

A class action is filed, arguing the refunds didn't include interest or compensate for secondary harms like declined payments and late fees elsewhere.

Tests: whether early action reduced legal exposure — or just set a floor.
DAY 9
09:00
INJECT 14AFinancial

Earnings day

Aldermoor reports earnings with a $52M charge for remediation. Analysts ask whether fee income was overstated for two years and what other controls might have failed.

Tests: investor communications that are honest about a control failure without overstating it.
14:00
INJECT 15ADecision point

How far back?

Counsel advises that refunds for fees older than a certain period may not be legally required. Paying them would add about $9M and show good faith. The room has to decide how far back remediation goes.

Tests: a values decision about what "making customers whole" really means.
DAY 10
10:00
INJECT 16AGovernance

Who tests the change?

The board asks how a core banking change went live without anyone testing its effect on customer fees, and what other changes from the same project should be re-examined.

Tests: separating the immediate remediation from the change-management failure behind it.
Path B — the room completes the lookback firstTen injects. Waiting buys precision, not time — and customers keep living with the overcharge while the bank works out exactly how much it owes them.
DAY 3
09:00
INJECT 7BCorrection

Fixed going forward

The posting order is corrected, so no new overcharges occur. Customers aren't told, because the lookback hasn't finished. Several call center agents ask what to say if customers ask.

Tests: what front-line staff can say while the bank knows more than it's sharing.
DAY 4
10:00
INJECT 8BRegulators

A plan, not a payment

Aldermoor notifies its regulators and presents a twelve-week lookback plan. Regulators ask why customers can't be refunded sooner, and request weekly updates.

Tests: engaging regulators early — and defending the timeline you chose.
DAY 5
14:00
INJECT 9BWhistleblower

"They knew for months"

A former project team member files a complaint alleging the fee issue was raised during testing two years ago and dismissed. Internal records partly support the claim.

Tests: an investigation whose scope just widened, and anti-retaliation protections for those who raised concerns.
DAY 6
11:00
INJECT 10BMedia

A reporter has the complaint

A reporter obtains the whistleblower complaint and asks whether Aldermoor is still holding money it owes customers.

Tests: communications when your careful process looks like delay from the outside.
DAY 7
10:00
INJECT 11BCustomers

Complaints spike

Complaints about overdraft fees spike after the story runs, including from customers who weren't affected. The complaint volume itself becomes a regulatory data point.

Tests: managing customer contact when uncertainty spreads beyond the affected population.
DAY 8
09:00
INJECT 12BFinancial

Reserve without a number

With earnings next week, the CFO must book a reserve. The lookback isn't done, so the estimate range is wide. Auditors push for the high end.

Tests: financial disclosure under uncertainty that you chose to preserve.
15:00
INJECT 13BInternal conflict

Compliance versus the business

The head of consumer banking argues the lookback is too conservative and will inflate the refund. The chief compliance officer argues anything less will fail regulatory review.

Tests: resolving a disagreement between the business and its second line of defense.
DAY 9
10:00
INJECT 14BRegulators

Enforcement on the table

Regulators signal they're considering enforcement action, citing the length of time customers have gone without refunds and the testing failure two years ago.

Tests: negotiating from a position of cooperation when the facts are still unfavorable.
15:00
INJECT 15BDecision point

Pay an interim refund?

The room must decide whether to make an interim payment now to the most clearly affected customers — about 70% of the expected total — before the lookback is finished. The room has to decide.

Tests: whether the room revisits its first decision on the merits, or only under enforcement pressure.
DAY 10
10:00
INJECT 16BGovernance

Who tests the change?

The board asks how a core banking change went live without anyone testing its effect on customer fees, and why a concern raised two years ago went nowhere.

Tests: separating the immediate remediation from the change-management and escalation failures behind it.

What the debrief surfaces.

The two paths are built to converge on the same hard questions, arrived at from opposite directions.

If the room refunded customers now

  • Were regulators engaged before refunds went out, or after they heard from customers?
  • Was the remediation operationally ready — call center, accuracy checks, former customers?
  • How did the room decide how far back "making customers whole" should go?

If the room completed the lookback first

  • Was the cost of waiting to customers weighed explicitly against the benefit of precision?
  • What could front-line staff say to customers while the lookback was under way?
  • Why did a concern raised during testing two years ago never reach anyone who could act on it?
Aldermoor Bank and all named details in this scenario are fictional and created for exercise purposes only.

Want this as a PDF?

The full Aldermoor scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.

This is one scenario. Yours would be built around your business.

The Aldermoor exercise is a sample — built to show how a regulatory remediation simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your products, your regulators, and your remediation process.

Confidential by design

Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.

Talk to us about a custom simulation →