The Federal Reserve has barred a former Banco Popular de Puerto Rico employee from the banking industry after a consent order said he misappropriated approximately $65,747 from customers through at least 50 transactions.
The August 24 order concerns Gadiel J. Rosario-Alvarado, who worked as a telephone banking consultant at the Puerto Rico bank from 2023 to 2025. The Fed publicly announced the action on August 27.
According to the order, Rosario-Alvarado debited funds from customer accounts and applied the money to pay down credit-card balances belonging to him and a relative. Banco Popular terminated him on June 11, 2025, after he admitted conducting some of the unauthorized transactions, the regulator said.
Rosario-Alvarado consented to the prohibition without admitting or denying the Fed’s allegations. The settlement is a regulatory action, not a criminal conviction. The order does not allege that Banco Popular directed the conduct.
Legitimate system access did not establish customer authority
The case illustrates a basic insider-risk problem for banks and payment operators: valid staff credentials can show who used a system, but they do not prove that the customer authorized the underlying movement of money.
The Fed’s order says the activity unfolded over a multiyear period and involved a series of at least 50 debits. It characterizes the conduct as violations of law or regulation, unsafe or unsound banking practices, or breaches of fiduciary duty, and says it involved personal dishonesty or willful or continuing disregard for the bank’s safety and soundness.
The public order does not identify the individual customers, the value of each transaction, the precise internal workflow used to post the debits, or whether customers were reimbursed. It also does not explain how the activity was detected, what alerts were generated, or whether a specific Banco Popular control failed. Those evidence limits matter: the case supports scrutiny of employee-access governance, but not a conclusion that any named monitoring tool or authentication process malfunctioned.
What payments-control teams should examine
For banks, processors and other firms that give employees the ability to move customer funds or alter payment instructions, the practical issue is how to distinguish permitted servicing activity from misuse of otherwise legitimate access.
Risk teams can test whether controls connect staff identity, customer authority, beneficiary relationships and transaction purpose. Repeated transfers involving unrelated customer accounts but a common employee, card account or connected party can be more informative than reviewing each transaction in isolation.
Other relevant safeguards include risk-based dual approval for higher-risk account debits, restrictions on employee-linked destinations, surveillance for repeated overrides or manual exceptions, and prompt comparison of complaints with employee activity. These are general control considerations; the Fed’s order does not say which measures Banco Popular had in place or whether any particular measure would have prevented the alleged conduct.
The order prohibits Rosario-Alvarado, without prior regulatory approval, from participating in the affairs of insured depository institutions and other covered organizations, soliciting or voting certain proxies, or serving as an institution-affiliated party. It remains effective unless the Fed stays, modifies, terminates or suspends it in writing.
The case follows other recent Federal Reserve prohibition orders involving alleged employee misuse of customer accounts. Its payments-industry significance lies less in the transaction amount than in the repeated use of privileged access: firms need controls that validate not only the operator’s identity, but also the customer’s authority and the legitimacy of the destination.