You are Íñigo Berasategui-Mendiluce, 49, Chief Compliance Officer at Banca Cantábrica, a Bilbao-headquartered mid-sized Spanish retail and SME bank. Yesterday the hotline received a tip detailed enough to identify the filer. It names the Galicia regional director — who is the CEO's oldest friend.
The situation
Banca Cantábrica: €38B in assets, 1,150 employees, 188 branches across Spain's northern coast and Galicia. You report to the CEO and dotted-line to the audit committee chair. The hotline you operate ("Canal Ético") is the external-vendor service required under Spain's Ley 2/2023 (transposing the EU Whistleblower Directive 2019/1937). It receives, on average, 6 tips a month; most are HR. Yesterday's tip — Canal Ético reference 247-A — is different.
The tip alleges that Manuel "Manu" Cebrián, regional director for Galicia (132 staff, 26 branches), has for the last 11 quarters been adjusting SME-loan internal risk ratings downward at quarter-end — moving loans from "watchlist" to "performing" — to hit his region's quarterly P&L bonus thresholds. The tip names four specific borrower files and references the model-override workflow in the loan-management system. Estimated misclassified exposure: between €38M and €54M. The tip is anonymous but written by someone who knows the loan-monitoring desk's Wednesday standing-meeting agenda — which means it almost certainly came from one of five people. Manu Cebrián and the CEO, Beatriz Casariego, were classmates at Deusto in 1992; he was best man at her wedding. The audit committee meets in 23 days.