Professional Ethics & Integrity
We build systems that decide who gets access to financial services. They hold people's most sensitive data. They stand between criminals and the financial system. That power comes with a duty: be honest, protect the people affected by our work, and refuse to do the wrong thing, even when it would be easy, profitable, or expected. Integrity is non-negotiable here. That includes the hardest honesty of all: telling the truth when it makes you look bad.
Professional ethics is what you do when no one is checking and a shortcut is available. For engineers, it shows up in clear moments. Do you report the bug you could hide? Do you skip a security step to hit the date? Do you speak up about a feature that harms users? Do you tell the truth about what is really done?
In a regulated AML business, ethical failures are not just personal. They can be crimes, breaches, and real harm to real people. The rules below are about being someone the team, our customers, and the regulator can trust. Some of them are serious enough that breaking them is treated as serious misconduct.
Be honest
- AlwaysTell the truth about the state of your work — what is done, what is untested, what is risky — even when the truth is unwelcome.
- DoReport your own mistakes quickly and plainly. Owning an error early is how you limit the harm.
- DoPresent estimates, test results, and risk honestly. Never let a number say something you know is not true.
- ConsiderAsking yourself: "Would I be comfortable explaining this to a regulator, or seeing it on the front page?" Use that as a quick test.
- NeverFalsify, fabricate, or misrepresent data, test results, audit records, or the status of compliance controls.
- NeverMisuse access to customer data, systems, or insider information for personal gain, curiosity, or any purpose outside your job.
Honesty when it is hard — no saving face
The hardest moment to be honest is when the truth makes you look bad. You missed a step, broke something, or do not actually know. That is exactly when our standard matters most. Owning it is respected here. Covering it up to protect your reputation is not, and it is treated as a serious matter.
- AlwaysAdmit a mistake, a missed step, or "I do not know" the moment you realise it. Owning it early is respected, and it is always better than the truth coming out later — bigger, and at a worse time for you.
- AlwaysPut honesty above pride. Embarrassment, fear of looking bad, or any habit of "saving face" does not override the duty to tell the truth here. This is a professional standard everyone follows, whatever their background or seniority.
- DoGive bad news clearly and early, in plain words. Do not soften it into something misleading or hide it where it will not be noticed.
- DoTrust that owning an honest mistake is safe. We fix the system, not punish the person (see Ownership & Accountability). That safety is exactly why there is never a reason to lie.
- NeverLie, cover up, or create a false impression to protect your reputation, avoid blame, or save face. This includes lying by leaving things out, giving vague non-answers, or claiming something is done, tested, or checked when it is not.
- NeverBlame someone else, or let a false account stand, to move attention away from your own mistake.
Lead: "Did the sanctions screening run on that batch?"
You: "Yeah, all good." // it didn't run — you just don't want to look bad
This is a lie told to avoid looking bad. An unscreened batch is now treated as cleared, which is a possible AML failure. A false statement about a compliance control is itself a serious matter, and may have to be reported. The small embarrassment you avoided becomes a real harm with your name on it.
You: "No — I didn't get the screening run on that batch. I'm flagging
it now so we hold it before anything is cleared. My mistake; here's
the fix and how I'll stop it happening again."
This is uncomfortable for a moment, and it is exactly what is respected here. The harm is prevented, the record is honest, and a blameless fix follows. There is no penalty for the honesty, unlike a cover-up.
Protect people and speak up
- DoThink about the people affected by what you build: the customer wrongly flagged, the user whose data you hold, the person on the other side of an automated decision.
- DoRaise ethical, safety, security, or compliance concerns through the proper channels, and keep raising them until they are dealt with.
- DoPush back on requests to do something unsafe, unfair, or unlawful. Escalate it rather than quietly going along with it.
- ConsiderThat "I was told to" is not a defence for crossing a line you knew was wrong. You are still responsible for what you build.
- Do notStay silent about a harm, risk, or wrongdoing because it is awkward, not your area, or above your level.
- NeverKnowingly build, ship, or hide something designed to deceive users, evade regulators, or cause harm.
Self-review checklist
- AskAm I about to say something is fine, done, or tested mainly because the truth is embarrassing?
- AskWould I be comfortable explaining this decision honestly to a regulator or to the affected customer?
- AskAm I showing the real state of this work, or a more comfortable version of it?
- AskWho is affected by what I am building, and could it harm them or treat them unfairly?
- AskIf I have been asked to cross a line, have I escalated it rather than quietly going along?