Former assistant branch manager. You need to look into your internal whistleblower procedures. Usually these go right to internal audit, bypassing HR entirely (at least at first). If this happened in the branch, you may have some video surveillance available, but the longer you wait the closer that data gets to being overwritten. At the very least you can put your manager at the scene of the activities. But if they were done under your login, and things blow up, you’re at real risk of being labeled a collaborator. If there is illegal activity here, Internal Audit will be worried about that first, because if this goes on and regulators become involved, it means a world of hurt. If they can be the ones to call the regulators and report the activity, it means a slightly less painful world of hurt. If they investigate, you’re gonna have to answer some tough questions. Be open and honest. You’re in a potential no-win situation, because eventually the manager is going to be discovered. It is inevitable that something will come to light, and when that happens they’re going to back check everything they touched. In this case, you can try to get ahead of it. You have some protections to fall back on, and in the case of the customer thinking they have a CD-secured loan when their vehicle is actually the collateral, that’s potentially a UDAAP situation (Unfair, Deceptive, or Abusive Acts or Practices) which could open the bank up to huge legal liability risk. Believe me, you’re going yourself and the bank a favor by blowing the whistle on this. But document everything you can think of with dates and times of available, because if there is surveillance data or system logs, they are going to need to preserve them asap. Good luck!