[horsawlarway]

This has been my exact experience (some of it gained working adjacent to a big bank).

At a certain level, folks dropped any real pretense that the compliance regulations in industry were for anything other than shifting liability around and ensuring you can check the right checkbox when doing sales or getting audited.

Actual security varied widely, and had zero relation to the compliance checklists.