A branching, choose-your-path tabletop built for a cross-border payments fintech. Nothing was hacked and nothing went down — a control simply stopped working, and nobody noticed for nineteen months. Six shared injects establish the failure, then the room's own decision — suspend the affected services, or keep operating under manual controls — sends the exercise down one of two independent, fully-scripted paths. Both of them end in front of a regulator.
Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any regulated firm whose license to operate depends on controls most of its leaders never see.
A venture-backed money transmitter headquartered in Miami, licensed in 47 states, moving about $9B a year in cross-border payments for 1.3 million customers — most of them sending money to family abroad. ~650 employees. Kestrel operates through a sponsor bank, Harborline Bank, and is preparing for an IPO in six months.
Kestrel's growth story is speed and price. Its license to operate is its anti-money-laundering and sanctions program — the transaction monitoring and screening controls that regulators, its sponsor bank, and its future public shareholders all assume are working. Nobody outside compliance looks at them until they fail.
Six injects, delivered over the first 47 hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.
A compliance analyst eight months into the job notices that alert volumes for the six higher-risk corridors dropped 70% after a platform migration nineteen months ago — and never recovered. She traces it to a rule set that was disabled during the migration and never turned back on.
The BSA officer confirms it: about 240,000 transactions, totaling $410M, never ran through the structuring and high-risk corridor rules. A preliminary re-screen against sanctions lists returns 14 potential matches.
Internal audit pulls its files. Eleven months ago, an audit flagged an "anomalous decline in alert volume" — and the former chief compliance officer marked it remediated with no supporting evidence. She left the company in the spring.
An operations manager emails the CEO: he raised the alert-volume issue internally last year, nothing happened, and he filed a whistleblower tip with a regulator four months ago. He wants to know whether he's in trouble.
On a routine call, Harborline's BSA officer asks why Kestrel's suspicious activity referrals have dropped so sharply over the past year. Harborline's own regulatory exam starts next month, and Kestrel's flows are in scope.
Outside counsel and the compliance team present two options: suspend all six higher-risk corridors until a lookback is complete — 28% of revenue, and 300,000 customers who can't send money home — or keep operating while 30 contract reviewers manually check every transaction in those corridors. Halden Ventures is asking what this does to the IPO. The room has to decide.
From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.
Kestrel notifies 300,000 customers that transfers to six countries are paused "for a compliance review." Within hours, support queues pass 40,000 contacts. Many customers send money to cover rent, school fees, or medical care for family abroad.
Community organizations hold a press conference about families losing access to remittances. A member of Congress sends a letter asking why customers from specific countries were cut off. The coverage frames the pause as discriminatory.
Halden Ventures tells the board the IPO is off the calendar for at least two quarters and asks whether management has the right compliance leadership. Two competitors are already running ads aimed at Kestrel's paused customers.
The re-screen confirms 3 of the 14 potential matches as true sanctions hits — payments totaling $186,000 that should have been blocked. Counsel recommends a voluntary self-disclosure to sanctions authorities, which must be made before regulators raise the issue themselves.
State regulators, coordinating through a multistate process, move Kestrel's next exam up by five months and request a written lookback plan within ten business days — including who will perform it and how independence will be assured.
The consulting firm scoping the lookback estimates sixteen weeks and $9M. Kestrel's cash runway, with 28% of revenue paused, is about nine months.
Harborline sends formal notice: suspension alone doesn't address its concerns. Unless Kestrel appoints an independent compliance monitor and gives Harborline weekly reporting, it will terminate the program agreement in 90 days.
The engineering team that ran the migration and the compliance team that signed off on it are blaming each other in meetings and in writing. A trade publication quotes the former chief compliance officer saying she warned leadership about migration risk.
Accelerated lookback work on two of the six corridors finds no further sanctions issues. The business wants to resume them immediately to stop the revenue bleed. Compliance says resuming before the full lookback and regulator sign-off would look like the problem was never taken seriously. The room has to decide.
Counsel advises that regulators are likely to propose a consent order with a monitor, a civil money penalty, and limits on growth. The board asks what a three-year remediation program will look like and who will run it.
Thirty contract reviewers start manually checking every transaction in the six corridors. By evening, the queue holds 18,000 transactions and reviewers are clearing about 900 an hour, with a near-100% pass rate.
A transaction approved by a manual reviewer this morning matches a sanctioned entity. The funds have already been paid out. It's a new apparent violation — made during the remediation, under the room's decision.
Harborline's monitoring flags the change in Kestrel's review patterns and asks what's going on. When told, its BSA officer is furious that Kestrel kept operating without telling the bank first, and demands daily reporting.
A state regulator calls the chief compliance officer, referencing a whistleblower complaint about transaction monitoring. She asks directly: when did Kestrel learn of the problem, and why are the corridors still open?
The re-screen confirms 3 of the original 14 matches, plus the new hit from Day 3. Counsel advises that a self-disclosure will still help — but that keeping the corridors open after discovery will weigh against Kestrel when penalties are set.
Two compliance analysts resign. One tells HR she was pressured by an operations manager to "clear the queue" faster, and that she approved transactions she wasn't comfortable with.
A national financial outlet reports that a "fast-growing payments startup" kept operating for days after discovering a monitoring failure, citing sources at the company and the analyst's resignation.
Harborline issues a termination notice: the program agreement ends in 60 days. Without a sponsor bank, Kestrel can't move money in most states. Two prospective replacement banks decline to take a meeting.
With Harborline leaving and regulators asking why the corridors stayed open, the room faces the decision it declined a week ago: suspend the six corridors — now as a damage-control move, not a voluntary one — or keep operating to preserve revenue while it searches for a new bank. The room has to decide.
The IPO is withdrawn. Halden Ventures and two other directors propose replacing the CEO and chief compliance officer and bringing in an interim leader with regulatory credibility. The CEO asks the board for 30 days to stabilize the company first.
The two paths are built to converge on the same hard questions, arrived at from opposite directions.
The full Kestrel scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.
The Kestrel exercise is a sample — built to show how a compliance failure simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your regulators, your control environment, and your escalation paths.
Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.
Talk to us about a custom simulation →
The Crisis Studio