Re point #2 - this is one of the crazy things for me. When you work in finance, in the UK at least, you get it drilled into your head what "client money" is, what that implies, what you can do with it, and notably you get reminded during any training session the size of the fines that get imposed on people who fuck with client money.
So to me it suggests that they simply don't employ anyone with any experience in banking or compliance, if they did those people would be raising hell or at least leaking or whistleblowing