In 2019, during a Morgan Stanley hardware refresh, 42 servers containing sensitive customer data were physically gone and could not be located through the bank’s internal inventory reconciliation process. That gap, paired with a separate 2016 disposition failure at two wealth management data centers, ultimately produced $161.5 million in cumulative regulatory and civil penalties. Data center asset reconciliation decommissioning failures rarely produce numbers that round; they produce numbers that compound.
The mechanic that drives those compounding penalties is the same mechanic in every large decommissioning project: scanning is not reconciliation. Reconciliation is the mathematical comparison of what came in against what went out, and its absence is what regulators cite first.
What Did Morgan Stanley’s Reconciliation Failure Actually Look Like?
The penalties broke down by source, and each one cited a different control failure.
The Office of the Comptroller of the Currency’s 2020 enforcement action assessed a $60 million civil money penalty, citing “unsafe or unsound practices” related to the bank’s failure to oversee subcontractors and maintain an appropriate inventory of customer data. The Securities and Exchange Commission followed in 2022 with an additional $35 million penalty, with the Commission characterizing the systemic security lapses as “astonishing.” The New York Attorney General settled separately in 2022 for $6.5 million. Civil class action exposure added approximately $60 million to the cumulative total.
What got cited was not exotic. The 2016 incident involved hiring a moving and storage company that lacked data destruction certifications to decommission two wealth management data centers; over the following five years, devices containing unencrypted customer data ended up sold to unauthorized third parties and auctioned online. The 2019 incident was different: a separate hardware refresh produced 42 missing servers that the bank’s internal reconciliation could not account for. Same end result. Different decade. Different vendor. Same control gap.
The lesson the OCC put on paper applies to any data center asset reconciliation decommissioning project: an appropriate inventory of customer data is the standard, and it has to be demonstrable.
Why Does Scanning Fail as a Reconciliation Control?
Most decommissioning projects produce ample scanning data. Every rack gets walked, every chassis gets a barcode read, every drive gets logged. The output is a ledger of what was found in the cage on the day extraction started.
That ledger answers one question: what was here when we looked. It does not answer the question regulators ask, which is whether everything that was ever installed actually left through a documented disposition channel.
The difference is the inbound record. Reconciliation requires comparing the day-of-extraction scan against the inbound CMDB or DCIM record across the asset’s full life in your facility. Drives that were swapped during a 2021 break-fix and never updated in the asset registry will never appear in an extraction scan. They will appear as variance only when the master inventory is reconciled against historical procurement and refresh activity.
Scanning is data collection. Reconciliation is the comparison.
Could your team produce a zero-variance reconciliation for last quarter’s refresh? Take the free ITAD Readiness Assessment →
How Should a Data Center Asset Reconciliation Decommissioning Workflow Be Structured?
Hyperscalers and large financial institutions have largely converged on a standard pattern. The names vary by vendor, but the controls map closely to what regulated industries adopted after the Morgan Stanley enforcement actions.
Inbound record establishment. The starting state is your CMDB or DCIM platform’s cumulative record of every asset deployed in the cage; refresh tickets, break-fix swaps, and warranty replacements included. Without this baseline, downstream reconciliation has nothing to reconcile against.
DCIM-to-vendor API integration. At extraction, the IT asset disposition (ITAD) vendor’s tracking system pulls directly from the DCIM platform via API rather than from a manual spreadsheet handed off at the loading dock. Every asset is barcode-scanned at the cage, scanned again at the ITAD vendor’s truck, and scanned a third time on arrival at the processing facility, with each scan timestamped in the integrated record.
Blind audit at receipt. The defensible-disposition framework adopted by major financial institutions deliberately withholds the master inventory from the ITAD vendor at receipt. The vendor performs an independent count, and the institution reconciles the vendor’s count against the master record. Variance discovered through a blind audit is real variance; variance discovered when the vendor was given the answer in advance is a checkmark.
Hold-until-reconciled gating. Vendors are contractually prohibited from processing, destroying, or remarketing any asset until the institution has formally verified the reconciled inventory. The vendor has the assets; the institution has the manifest; processing waits until both match.
Per-serial Certificate of Destruction. When reconciliation closes, a Certificate of Destruction is issued tied to the specific serial number, sanitization method, technician identity, date, and disposition pathway. Bulk certificates do not survive enforcement scrutiny. The per-serial standard is what auditors and regulators expect to see.
What Should Your Vendor Contract Require?
A vendor contract that does not address reconciliation explicitly is a contract that defaults to scanning. Five provisions move the document closer to defensible.
Right to API integration with your DCIM or CMDB platform, with a specified data schema and refresh cadence. Vendors that cannot or will not integrate are flagging a capability gap, not a procurement preference.
Right to perform unannounced facility audits, mirroring the NAID AAA model. NAID AAA-certified processors operate under continuous unannounced-audit posture; if your vendor cannot accept the same posture from you, that is a credibility signal.
Hold-until-reconciled processing gate, specifying that no asset may be destroyed, recycled, or remarketed until you have countersigned the reconciliation against the master inventory.
Per-serial Certificate of Destruction issuance with a maximum issuance window (typically 30 days from receipt) and the format the certificate must take.
Variance escalation procedure, naming the threshold (often any non-zero variance) and the response timeline. Variance found at the vendor must reach your compliance team before the reconciliation window closes.
Wondering how your vendor contract reads against this list? Take the free ITAD Readiness Assessment →
How Does Reconciliation Connect to the Broader Decommissioning Checklist?
Asset reconciliation is one phase of the broader decommissioning workflow, but it is the phase where regulator findings and civil exposure concentrate. Sanitization failures get caught by NIST 800-88 audit logs. Cooling and extraction failures get caught by environmental incident reports. Reconciliation failures get caught months or years later, when a serial number surfaces somewhere it should not have, and the question becomes: where in the chain did this asset leave the documented pathway?
The defensible answer is the unbroken record, integrated through DCIM, validated through blind audit, gated until variance is resolved. The indefensible answer is “we scanned everything we found.” The first answer survives an OCC examination or an SEC enforcement inquiry. The second produces consent orders.
Where You Stand Matters
Data center asset reconciliation decommissioning failures are among the cheapest control failures to prevent and the most expensive to remediate. Morgan Stanley’s $161.5 million cumulative exposure compounded across multiple regulators and a class action because the underlying gap, an appropriate inventory of customer data the OCC could verify, was never closed.
The work itself is procedural. Establish the inbound record. Integrate DCIM with vendor systems. Run blind audits at receipt. Gate processing on reconciled inventory. Demand per-serial certificates. None of these controls is exotic; what makes them effective is that they operate together. A blind audit without an inbound record produces a count, not a reconciliation. A per-serial certificate without a hold-gate produces paperwork the auditor cannot trust.
Consult counsel on your specific situation for the regulatory frameworks that apply to your data; the operational controls above are the floor on which compliance counsel can build.
Ready to assess your organization’s ITAD readiness? SureDispose’s free assessment evaluates your current practices across data center asset reconciliation decommissioning workflows, vendor selection, sanitization standards, and audit trail completeness, then connects you with certified providers matched to your requirements. Take the Assessment →
Further reading:
- OCC News Release 2020-134: $60M Civil Money Penalty Against Morgan Stanley
- SEC Press Release 2022-180: Morgan Stanley Smith Barney Charged With Customer Data Protection Failures
- NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
- NAID AAA Certification (i-SIGMA)
SureDispose is an independent advisory platform. We connect organizations with vetted ITAD service providers but do not perform disposition services directly. Providers compensate us for qualified introductions.
This article is educational and reflects SureDispose’s reading of publicly available regulations and enforcement records as of April 2026. It is not legal advice. Regulatory determinations for your organization are the responsibility of your compliance counsel. Specific enforcement actions referenced are summarized from public settlement documents; characterizations are the regulator’s, not SureDispose’s.