There is an old Dutch saying which goes: "Trust comes afoot and leaves on horseback". When you're in the compliance business you cannot fumble this ball, but you have.
Their existing customers are seriously exposed, i don't see this going anywhere except court
The problem is the malicious intent, you just can't do that anywhere, esp not in a trust based business..