They just put out a blanket statement and didn't provide any way for a bank to make a call on their own within established parameters.
The bank over-reacted by simply firing the guy, but they weren't over-reacting to the importance of compliance.