The charges refer to the bank dismantling two data centres connected to its wealth management business in 2016.
According to the OCC, Morgan Stanley failed to oversee third-party companies responsible for the erasure and removal of personal data.
The OCC says the bank failed to “effectively assess or address risks associated with decommissioning its hardware”.
It adds US lender did not exercise “adequate due diligence” in selecting a vendor and monitoring its performance.
