OPINION

Roque De La Fuente II petitions for review of an order of the Board of the Federal Deposit Insurance Corporation (“Board”) removing him as a director of First International Bank (“FIB”) and forbidding him from participating in, voting shares of, or serving on the board of any federally regulated bank for life. The Board found that De La Fuente had used his position at FIB to secure several loans in excess of applicable limits for entities in which he and his close associates were interested, as well as to engage in other self interested lending practices. We have jurisdiction to review the Board’s decision under the judicial review provisions of the Administrative Procedures Act, 5 U.S.C. §§ 701-706 . See 12 U.S.C. § 1818 (h)(2); see also 5 U.S.C. § 706 (2)(A) (Courts may set aside agency orders if they are “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.”). We grant the petition in part, deny it in part, and remand the matter to the Board.

I. The Entities, the Transactions, and the Agency Proceedings

De La Fuente became a board member of FIB, formerly known as People’s Bank, on March 30, 1987, and served in that position until he was removed. This appeal centers around twelve FIB loans and two loan-related transactions, all of which occurred between 1990 and 1995, involving entities in which De La Fuente, his family, or his close associates were interested.

The loans that formed the basis for the removal action are (in chronological order):

(1) a May 17, 1990 loan in the amount of $1 million to the Roque de la Fuente Alexander Trust (“Fuente Alexander Trust”), a revocable trust set up by De La Fuente’s father in which De La Fuente had a 25% contingent interest.

(2) an October 8, 1990 loan in the amount of $1 million to Rancho de la Fuente International Industrial Park (“Fuente/ IIP”), an entity owned by De La Fuente’s mother through offshore corporations. De La Fuente’s mother is a housewife who lives in Mexico City and does not participate in the operations of Fuente/ IIP. Jose Luis Andreu, one of De La Fuente’s close associates — who is also vice president of American International Enterprises (“AIE”), a company solely owned by De La Fuente — is the agent for Fuente/IIP.

(3) a December 26, 1990 loan in the amount of $400,000 to Rancho Vista del Mar, Inc. (“RVDM”), another entity owned by De La Fuente’s mother through offshore corporations. As he is for Fuente/ IIP, Andreu is the company’s agent. RVDM has no employees.

(4) a January 24, 1992 loan in the amount of $800,000 to RVDM.

(5) a July 15, 1992 loan in the amount of $1.6 million to RVDM.

(6) September 9, 1992 personal loan to De La Fuente in the amount of $800,000.

(7) a July 20, 1995 loan in the amount of $763,000 to the Fine Particle Technology Corporation (“FPTC”), a company of which De La Fuente owned 5.6%. De La Fuente transferred his interest in FPTC into trusts for his children in 1995. Among FPTC’s other shareholders are Andreu (24.42%), and Isaías Zapata (5.02%), another close De La Fuente associate. Andreu is also the president of FPTC, and has been a director and board chairman. This company also has no employees.

(8) an August 11, 1995 loan in the amount of $1.35 million to FPTC.

(9) an October 27, 1995 loan in the amount of $750,000 to National Enterprises, Inc. (“NEI”), an entity of which De La Fuente was the sole owner. De La Fuente transferred his interest in NEI into his children’s trusts in 1995. The trustees at relevant times were Zapata and Sidney Schwartz, another close De La Fuente associate, who is currently the chairman of the FIB board. Schwartz is also a director of NEI.

(10) a November 8, 1995 loan in the amount of $600,000 to FPTC.

(11) a December 18, 1995 loan in the amount of $200,000 to C.T. Produce, Inc. (“C.T.Produce”), an entity of which Andreu is a director, and which is engaged in a joint venture with NEI.

(12) a December 28, 1995 loan in the amount of $800,000 to FPTC.

The Board’s removal order was based on two additional transactions involving collateral for FIB loans:

(13) a 1994 FIB decision to accept the substitution of inferior substitute collateral to secure a loan the bank had made to RVDM (the “Collateral Substitution Transaction”); and

(14) a 1995 FIB decision to allow a non-creditworthy NEI employee to assume liability for a loan the bank had made to the Parking Company of America (“PCA Transaction”).

In 1997, the Federal Deposit Insurance Corporation notified De La Fuente that it was proceeding against him under 12 U.S.C. § 1818 (e) for his role in FIB’s lending practices. It charged him with lending sums to the various entities identified above over the period from 1990 through 1995, which exceeded the percentage of a bank’s funds that may be loaned to “affiliates” or “insiders” of a bank’s directors under Regulation O and Section 23A of the Federal Reserve Act. It also charged De La Fuente with facilitating the Collateral Substitution Transaction and the PCA Transaction, alleging that his role in these transactions violated 12 U.S.C. § 1818 (e).

The ease was tried before an administrative law judge (“ALJ”), who issued a recommended decision finding that all of the above loans and transactions violated § 1818(e) and concluding that De La Fuente should be ordered removed from the board of FIB and prohibited from participating in the banking industry for life. On review, the Board adopted and incorporated these findings, and affirmed the AL J’s recommended decision.

II. “Control” Under Regulation O

The Board correctly found that De La Fuente “controlled” all of the loan recipients, and that the loans therefore violated the provisions of Regulation O, 12 C.F.R. § 215.1 -.13. Regulation O restricts the ability of member banks in the Federal Reserve system (as well as nonmember, FDIC-insured banks such as FIB, see 12 U.S.C. § 1828 (j)(2)) to extend credit to their “insiders].” 12 C.F.R. § 215.4 (a). The regulation defines “insider,” in turn, as “an executive officer, director, or principal shareholder, and includes any related interest of such a person,” id. § 215.2(h); a “[rjelated interest” is defined to include “[a] company that is controlled by that person,” id. § 215.2(n)(l). Under the regulation, a person controls a company, when inter alia he or she owns 25% or more of the shares of a company, id. § 215.2(c)(l)(i), or “[h]as the power to exercise a controlling influence over the management or policies of the company,” id. § 215.2(e)(l)(iii). The regulation also creates certain rebuttable presumptions of control for persons who own more than 10% of the stock in a company. Id. § 215.2(c)(2).

The Board found that De La Fuente controlled FPTC by owning, controlling, or having the power to vote 25% or more of its shares, under § 215.2(e)(l)(i). With respect to the other loans (except the loan to C.T. Produce), the ALJ found that the borrowing entities were “actually] controlled]” by De La Fuente, which the Board determined constituted a finding of exercising a controlling influence under § 215.2(c)(l)(iii).

De La Fuente argues that because the regulation contains rebuttable presumptions of control in § 215.2(c)(2) for persons who own more than 10% of a company’s shares, it creates a “safe harbor” insulating people who do not fall within the rebuttable presumption (i.e., De La Fuente) from a finding of control under § 215.2(e)(l)(iii). We disagree. Subsection 215.2(c)(1) establishes the test for control. The following subsection, § 215.2(c)(2), sets forth a list of circumstances from which “control” is to be presumed. “Control” may be established if a proper finding under the first subsection is made, or if one of the requirements of the second subsection is met and the presumption of control is not rebutted. De La Fuente would have us disregard the test in the first subsection because he was not presumed to have control under the second subsection. This is illogical. To read the regulation in this manner would render portions of the regulation surplusage, and would defeat the plain purpose of the regulatory scheme.

De La Fuente cites two twenty-odd-year-old unpublished Federal Reserve Board interpretive letters in support of his position that the presumptions in § 215.2(c)(2) create a “safe harbor.” See 1979 WL 44400 , at *1 (“The rebuttable presumptions in [§ 215.2(c)(2) ] are intended to be dispositive of the issue of control of a company by an individual who is an executive officer or director of that company.”); 1980 WL 121899 , at *1 (stating that when the 10% share ownership condition is met, “these presumptions [in § 215.2(c)(2)] are intended to be disposi-tive of the issue of control of a company by an individual who is an executive officer or director of that company”).

In response, the FDIC cites an interpretive letter from the Office of the Comptroller of the Currency (“OCC”), which explains that the rebuttable presumptions of § 215.2(c)(2) are only implicated when an agency relies for its determination of control on the person’s stock ownership, but that a finding of control under § 215.2(c)(l)(iii) “is not dependent upon share ownership.” 1991 WL 338390 (“If share ownership were a prerequisite for a finding of control in all circumstances, the regulation could be easily evaded, especially ... [by] limiting share ownership to passive investors within the family. Such a formalistic approach ignores the fact that Regulation 0 clearly contemplates situations in which control may be established by indirect means.”).

We are not sure whether any deference is due to the FRB’s determination that § 215.2(c)(2) creates a “safe harbor,” espe- ■ dally given the contrary interpretation of the regulation by the OCC. Even if we were to give some deference to the FRB’s letters, however, we would have to reject its position as clearly erroneous and inconsistent with the plain language of the regulation. See Singh-Bhathal v. INS, 170 F.3d 943 , 945 (9th Cir.1999). We therefore agree with the Board that its interpretation of § 215.2(c) is the reasonable one, and conclude that it correctly found that all twelve loans violated Regulation 0.

III. Notice and Hearing Requirements of Section 23A

Although we agree with the Board’s Regulation 0 analysis, we disagree with its determination that all of the loans (except the Fuente Alexander Trust loan and the De La Fuente personal loan) were extended to entities that De La Fuente “controlled” in violation of Section 23A of the Federal Reserve Act, 12 U.S.C. § 371c. De La Fuente correctly argues that the Board’s findings of control under Section 23A were improper because they were made without affording De La Fuente the statutorily required notice and hearing in advance of making such a determination.

Section 23A restricts the ability of member banks in the Federal Reserve system (as well as nonmember, FDIC-insured banks such as FIB, see id. § 1828(J)(1)) to engage in certain transactions — such as the extension of loans — with their “affiliates.” Id. § 371c(a). The term “affiliate” is defined, inter alia, as “any ... company that is controlled by the company that controls the member bank.” Id. § 371e(b)(l)(A) (emphasis added). The statute defines “control” to mean, inter alia, ownership of 25% or more of a company’s shares, id. § 371 c(b)(3)(A)(i), or circumstances where “the Board determines, after notice and opportunity for hearing, that [the person] exercises a controlling influence over the management or policies of the ... company,” id. § 371 c(b)(3)(A)(iii) (emphasis added).

The Board determined that the ALJ’s finding of “actual control” under Regulation 0 “satisfie[d]” the requirements for a finding of control under § 371 c(b)(3)(A)(iii). This cannot be the case: the Board did not provide De La Fuente with the required “notice and opportunity for hearing” in advance of making such a determination.

We reject the agency’s argument on appeal that the Board could have made a finding of control under § 371e(b)(3)(A)(i) with respect to certain of the entities because De La Fuente owned in excess of 25% of the shares of the entities. We can uphold an agency’s decision only on the basis of the reasoning in that decision. Anaheim Mem’l Hosp. v. Shalala, 130 F.3d 845 , 849 (9th Cir.1997). Because the Board determined that the loans violated § 371c(b)(3)(A)(iii), not § 371c(b)(3)(A)(i), we decline to consider whether this provision could support its decision.

We also reject the agency’s argument that any error was harmless because all of the loans found to violate Section 23A were also found to violate Regulation 0. We recognize that the Board concluded that “findings' of violations of either Regulation 0 or section 23A, standing alone, would support” its decision. However, as we discuss below, the penalty the Board assessed against De La Fuente was extraordinary, and the Board may decline to reimpose it in the absence of Section 23A violations.

IV. Statute of Limitations

We also agree with De La Fuente that the Board erred in failing to apply the five-year statute of limitations in 28 U.S.C. § 2462 to limit the conduct for which he could be held liable. The FDIC commenced this action on June 11, 1997. Therefore, the agency should not have prosecuted him for transactions that occurred before June 11, 1992 (i.e., the May 17, 1990 Fuente Alexander Trust loan, the October 8, 1990 Fuente/IIP loan, and the December 26, 1990 and January 24, 1992 RVDM loans).

Section 2462 provides: “Except as otherwise provided by Act of Congress, an action, suit or proceeding for the enforcement of any civil fine, penalty, or forfeiture, pecuniary or otherwise, shall not be entertained unless commenced within five years from the date when the claim first accrued_”28 U.S.C. § 2462. Although we have previously stated that “[tjhere is no federal statute of limitations specifically applicable to ... action under 12 U.S.C. § 1818 ,” Simpson v. Office of Thrift Supervision, 29 F.3d 1418, 1425 (9th Cir.1994), we agree with the D.C. Circuit that this statute of limitations is applicable to FDIC enforcement actions, see Proffitt v. FDIC, 200 F.3d 855, 862 (D.C.Cir.2000). The D.C. Circuit reasons persuasively that an FDIC proceeding under 12 U.S.C. § 1818 (e), such as here, imposes a “penalty” within the meaning of § 2462. See id. The Simpson statement is dictum because that case involved a § 1818 action predicated on two-year-old transactions, 29 F.3d at 1421 ; thus, whether the five-year § 2462 statute of limitations applied was not properly before us in that case. In fact, the FDIC now concedes that the statute of limitations applies.

De La Fuente raised the limitations issue before the agency solely as to the Fuente Alexander Trust loan; thus the Board erred in relying on this loan in its order. De La Fuente argues that we should exercise our discretion to apply the limitations period to the other loans, citing our long-standing rule that we may do so when “the issue presented was purely one of law and the opposing party would suffer no prejudice as a result of the failure to raise the issue in the trial court.” Taniguchi v. Schultz, 303 F.3d 950, 959 (9th Cir.2002) (citing United States v. Flores-Payon, 942 F.2d 556, 558 (9th Cir.1991)). We need not do so at this juncture; rather, on remand the Board may exercise its discretion in the first instance and determine whether to address this issue. If it chooses to do so, it may also consider the agency’s argument that the statute of limitations should be equitably tolled as to these other loans due to De La Fuente’s fraud or concealment.

Y. Equitable Estoppel

The Board correctly found that the agency should not be equitably es-topped from prosecuting De La Fuente for his role in transactions that had been previously investigated by agency inspectors. From 1991 to 1997, agency inspectors reviewed the Alexander trust loan, the RVDM and Fuente/IIP loans, and the NEI loan, but never reported any violations. In addition to the traditional elements of equitable estoppel, “[w]hen a party seeks to invoke equitable estoppel against the government, we ... require a showing that the agency engaged in ‘affirmative conduct going beyond mere negligence.’ ” United States v. Hemmen, 51 F.3d 883, 892 (9th Cir.1995) (quoting Watkins v. United States Army, 875 F.2d 699, 707 (9th Cir.1989) (en banc)). Because De La Fuente has not alleged any such “affirmative conduct going beyond mere negligence,” the agency is not equitably es-topped from prosecuting him for these transactions.

VI. Substantial Evidence

We reject De La Fuente’s contention that three of the Board’s factual findings were not supported by substantial evidence: its determinations that (1) De La Fuente owned, controlled, or had the power to vote more than 25% of the shares of FPTC; (2) De La Fuente violated 12 U.S.C. § 1818 (e) in facilitating the Collateral Substitution Transaction by committing an improper act that either benefitted De La Fuente or hurt FIB and was accompanied by a culpable state of mind; and (3) De La Fuente violated 12 U.S.C. § 1818 (e) in facilitating the PCA Transaction by committing an improper act that either benefitted De La Fuente or hurt FIB and was accompanied by a culpable state of mind.

A. Control of FPTC

Reviewing the record as a whole, Reddick v. Chater, 157 F.3d 715, 720 (9th Cir.1998), we conclude that the finding of control underlying the Board’s conclusion that FIB’s four loans to FPTC (totaling over $3 million in one year) violated Regulation 0 and Section 23A is supported by substantial evidence. See Mayes v. Massanari, 276 F.3d 453, 458-59 (9th Cir.2001); Hoffman v. FDIC, 912 F.2d 1172, 1173-74 (9th Cir.1990). “Substantial evidence is more than a mere scintilla but less than a preponderance; it is such relevant evidence as a reasonable mind might accept as adequate to support a conclusion.” Mayes, 276 F.3d at 459 (internal quotation marks omitted). Because De La Fuente owned, controlled, or had the power to vote 25% or more of FPTC’s shares, FPTC was an affiliate or related interest of De La Fuente’s under Regulation 0, 12 C.F.R. § 215.2 (c)(1)(i), and Section 23A, 12 U.S.C. § 371 c(b) (3) (A) (i).

De La Fuente owned 5.6% of FPTC, which he transferred to trusts for his children in 1995. Among FPTC’s other share holders are Andreu (24.42%) and Zapata (5.02%), both close associates and frequent business partners of De La Fuente’s. An-dreu is also the president of FPTC, and has been a director and board chairman. The company has no employees. Andreu purchased his share in FPTC with funds drawn on the account of Witec Patents (a company of which De La Fuente was a part owner, and of which Andreu eventually became president) supported by the votes of De La Fuente and Zapata.

Furthermore, one business day after FIB’s directors were faced with $500 per day fines as a result of noncompliance with an FDIC cease-and-desist order, FPTC purchased two loans from FIB, saving it from the payment of the penalties. In addition, FPTC diverted $600,000 of a loan it received to De La Fuente (on undisclosed terms), who used the funds to pay-down an unrelated loan, not connected with FPTC. Finally, both the ALJ and the Board found that “Andreu represented to [a third party] that FPTC was one of the ‘De La Fuente’ companies.”

De La Fuente attempts to provide innocent explanations for this evidence, arguing that it could be consistent with a scenario in which he did not control FPTC. However, when the evidence is susceptible to more than one rational interpretation, we will not substitute our judgment for that of the agency. Edlund v. Massanari, 253 F.3d 1152, 1156 (9th Cir.2001). It is a reasonable inference from the evidence as a whole and the very structure of FPTC that De La Fuente controlled FPTC. As the trier of fact, the ALJ was in a superior position to evaluate any conflicting testimony and assess De La Fuente’s arguments that FPTC’s actions were not controlled by his interests.

B. Collateral Substitution Transaction

As collateral for a $1.6 million loan to RVDM, FIB held a lien over 320 acres of real property owned by Fuente/IIP. De La Fuente orchestrated a complex transaction whereby this encumbered property was to be released so that it could be sold to a third party (McMillin) as “environmental mitigation” property. The real property to be sold to McMillin eventually came to include some RVDM property and some property personally owned by De La Fuente. The property to be substituted as collateral was other RVDM land on which FIB already had a secondary lien.

Thus, De La Fuente requested that FIB release its lien on the Fuente/IIP land. Around the same time, NEI, one of De La Fuente’s other companies, committed the proceeds of the McMillin sale to pay down a different loan. De La Fuente then met with U.S. Fish and Wildlife Service officials on behalf of Fuente/IIP and RVDM to clear any environmental regulatory hurdles to the transaction.

The FIB board of directors met on June 17, 1994 to consider the collateral substitution on the RVDM loan. De La Fuente initially was not present during the FIB board’s deliberations. However, when it became clear that the other FIB board members did not understand the transaction, De La Fuente was called in to explain it. De La Fuente answered the board members’ questions, but did not disclose certain crucial facts which later came to light. At the time, the FIB board members were under the mistaken impression that Fuente/IIP was in bankruptcy, so that it might be advantageous for FIB to divest itself of Fuente/IIP property; in fact, however, De La Fuente knew that Fuente/ HP’s bankruptcy proceedings had terminated a few months earlier. De La Fuente also knew and did hot disclose that RVDM was delinquent on the loan in question and subject to foreclosure proceedings by another bank. Finally, although the FIB board was under the impression that the Fuente/IIP property would be difficult to sell because of “environmental issues,” De La Fuente knew that the property was in fact valuable because it could be used as environmental mitigation property.

After the transaction was approved, RVDM defaulted on its loan, and FIB foreclosed on the substituted collateral and lost over $700,000. De La Fuente sold the released Fuente/IIP property to McMillin for $2.1 million, and received an additional $260,000 for his own land.

The Board found that De La Fuente’s actions in facilitating this transaction violated 12 U.S.C. § 1818 (e). This statute has three elements: (1) the banker committed an improper act; (2) the act had an impermissible effect, either an adverse effect on the bank or a benefit to the actor; and (3) the act was accompanied by a culpable state of mind. See Seidman v. Office of Thrift Supervision (In re Seidman), 37 F.3d 911, 929 (3d Cir.1994). We examine the Board’s order to ensure that substantial evidence supports its findings as to each of these elements. See id. at 930 .

A. Improper Act

The Board correctly found that De La Fuente acted improperly by engaging in an “unsafe or unsound practice” and/or by breaching his fiduciary duty to FIB. We have held that an unsafe or unsound practice is “one which is contrary to generally accepted standards of prudent operation, the possible consequences of which, if continued, would be abnormal risk or loss or damage to an institution, its shareholders, or the agencies administering the insurance funds and that it is a practice which has a reasonably direct ef-feet on an association’s financial soundness.” Simpson v. Office of Thrift Supervision, 29 F.3d 1418, 1425 (9th Cir.1994) (internal quotation marks omitted). The Board properly relied on the fact that at the time FIB was deciding whether to approve this transaction, De La Fuente failed to disclose critical facts that should have counseled against its approval.

De La Fuente objects that because he answered all of the FIB board members’ questions regarding the transaction, he could not have breached a fiduciary duty by simply failing to volunteer additional relevant information. De La Fuente is wrong. It is well established that a person can breach a fiduciary duty by failing to disclose material information, even if not asked, see, e.g., Harmon v. Kobrin (In re Harmon), 250 F.3d 1240, 1246 (9th Cir.2001) (in bankruptcy context), and that De La Fuente had a fiduciary duty to disclose everything he knew relating to the transaction. “A fiduciary’s duty of candor is encompassed within the duty of loyalty. The duty of candor requires corporate fiduciaries to disclose all material information relevant to corporate decisions from which they may derive a personal benefit.” Seidman, 37 F.3d at 935 n. 34 (emphasis added and internal quotation marks and alteration omitted).

That De La Fuente may only have possessed information about the existing collateral does not alter our decision. The information he possessed was relevant because the FIB board agreed to permit the transaction only “as long as the [replacement] collateral was equal or superior in value and market ability [to] the existing collateral.” This required the FIB board to know the value of the existing collateral, an inquiry De La Fuente hindered by failing to disclose the information he had.

B. Impermissible Effect

The Board also correctly concluded that De La Fuente’s actions had an impermissible effect because he received financial benefit from the transaction and/or because the interests of FIB’s depositors were prejudiced thereby. De La Fuente argues that neither his financial gain (his receipt of loan proceeds to pay off an NEI loan and of the proceeds of selling his personal property to McMillin) nor the bank’s loss (the costs associated with the foreclosure and the losses from the substitution of the inferior collateral) were proximately caused by his failure to disclose the information he possessed. See 12 U.S.C. § 1818 (e)(1)(B) (“[B ] y reason of the violation .... such insured depository institution ... has suffered or will probably suffer financial loss or other damage.... ” (emphasis added)).

The D.C. Circuit has interpreted § 1818(e) to require that the risk of loss to the bank be “reasonably foreseeable” to the offender: “Any ... risk must of course be reasonably foreseeable. That is not to say-that the exact series of events that cause injury or loss to the institution must be perceived or even perceivable, but surely no director can be faulted for approving a management proposal that does not pose an increased risk of some kind to the financial institution.” Kaplan v. United States Office of Thrift Supervision, 104 F.3d 417, 421 (D.C.Cir.1997). It is undoubtedly reasonably foreseeable to any banker that substituting inferior collateral for superior collateral on a bank loan would “pose an increased risk of some kind to the financial institution.” We agree with the D.C. Circuit that it is immaterial whether or not De La Fuente should have been aware of the precise sequence of events that would transpire leading to this impermissible effect.

C. Culpable State of Mind

We agree that De La Fuente’s actions evidenced personal dishonesty and/or willful or continuing disregard for the safety and soundness of FIB. Although “some scienter” is required to establish culpability under this standard, there are “many types of misconduct that, by their very nature, evidence willful disregard for a bank’s safety or soundness.” Oberstar v. FDIC, 987 F.2d 494, 502-03 (8th Cir.1993). ‘Willful disregard” means “deliberate conduct which exposed the bank to abnormal risk of loss or harm contrary to prudent banking practices.” Grubb v. FDIC, 34 F.3d 956, 961-62 (10th Cir.1994) (internal quotation marks omitted). “Continuing disregard” means “conduct which has been voluntarily engaged in over a period of time with heedless indifference to the prospective consequences.” Id. at 962 (internal quotation marks omitted).

Both of the Board’s findings are supported by substantial evidence. The evidence showed personal dishonesty in that De La Fuente acted untruthfully, and in violation of his fiduciary duty, when he failed to disclose the information he possessed to the FIB board. That his conduct constitutes willful and continuing disregard for the safety and soundness of FIB is evidenced by De La Fuente’s deliberate actions, over a period of nine months, in benefitting from the transaction while placing the bank’s assets in danger by substituting what he knew to be inferior collateral.

C. PCA Transaction

The PCA Transaction involved a parking lot FIB sold in 1992 to its tenant, Parking Corporation of America (“PCA”), at De La Fuente’s suggestion. The purchase was financed with a $560,000 FIB loan and guaranteed by a lien on the lot and a personal guarantee by PCA’s owner, Mark Battaglia. The parking lot had some environmental “issues” requiring clean-up. Within two months of the transaction, Bat-taglia claimed that he had been fraudulently induced to buy the lot by FIB, and specifically by De La Fuente, and wished to rescind the contract. While this dispute was pending, FDIC agency examiners visited the bank to inspect its records. FIB’s president told them that De La Fuente had reported that he had settled the dispute with Battaglia, and that an agreement to that effect would be forthcoming. This was not the case; rather, PCA had just sent FIB a letter renewing its demand for rescission — a letter that was not in FIB’s files or disclosed to the agency investigators at that time. Contemporaneous FIB board meeting notes stated that the parking lot property was “clean,” suggesting that the environmental problems had been remedied, when they in fact had not been. As a result of these omissions and misrepresentations, the FDIC investigators classified the loan as “special mention” instead of “substandard,” saving FIB’s board members (including De La Fuente) from having to make substantial capital injections into the bank.

In early 1995, De La Fuente attempted to find a different entity to assume ownership of the parking lot and take over the accompanying loan. He located Gabriel Arce, an employee of NEI and AIE. De La Fuente arranged for Arce, acting through a specially established limited liability corporation, to buy out PCA. De La Fuente and the bank knew that Arce was financially unqualified to assume the loan, but the FIB board nevertheless approved the transfer. De La Fuente abstained from the vote because of his conflict of interest. When Arce fell behind on his payments, NEI supplied him with funds to make payments for several months. Nevertheless, the loan eventually went into arrears, and was eventually classified as a substandard loan. Thereafter, De La Fuente arranged for NEI to purchase the delinquent loan in October 1996.

The Board found that De La Fuente’s role in facilitating this transaction violated § 1818(e). We conclude that the Board’s findings regarding all three § 1818(e) elements are supported by substantial evidence.

A. Improper Act

The Board found that De La Fuente engaged in an unsafe or unsound practice and/or that he breached his fiduciary duty to FIB. De La Fuente hindered the FDIC investigation by failing to disclose the Battaglia dispute and letter, causing the agency to classify the loan as “special mention” instead of “substandard.” This action saved him and his fellow board members from having to infuse funds into FIB. Failure to disclose relevant information to a government investigator can constitute an unsound banking practice, cf. Seidman, 37 F.3d at 936-37 (holding that “an attempt to hinder an OTS investigation constitutes an ‘unsafe or unsound practice’ ”), as can failure to keep accurate records of the status of a bank’s loans. More importantly, it is certainly an “unsafe or unsound [banking] practice” to knowingly allow an unqualified borrower to assume a bank loan.

It is true, however, that there is no proof that De La Fuente acted improperly when he facilitated the sale of the parking lot to PCA. (Although Battaglia threatened to sue FIB and De La Fuente for fraudulent misrepresentation, the mere existence of a lawsuit cannot be dispositive on the issue of wrongdoing.) Thus, when Battag-lia started complaining about the property, it was certainly reasonable for De La Fuente to attempt to locate a different buyer. Furthermore, although it may be an unsound banking practice to substitute one bad borrower for another, there is no suggestion here that De La Fuente hid anything from the FIB board when it approved the substitution.

Recognizing, however, that we may not substitute our judgment for that of the agency, Edlund, 253 F.3d at 1156 , we find on balance substantial evidence to support the Board’s determination that De La Fuente engaged in an unsafe or unsound banking practice. The same cannot be said for its conclusion that De La Fuente breached a fiduciary duty, because there is simply no indication that he hid anything from the FIB board. Although the FIB board’s decision may have been unwise, there is nothing to indicate that De La Fuente played a large part in bringing about that outcome, or engaged in any improper behavior that resulted in that outcome. De La Fuente, like any other FIB director, was under no fiduciary duty to disclose the adverse facts to the agency investigators. Cf Phillips v. Comm’r, 114 T.C. 115, 132 , 2000 WL 225899 (2000) (“[T]he mere existence of an [IRS] investigation [does not] bend [a partner in a firm] to the government’s will in dereliction of his fiduciary duties to his partners.”), aff'd, 272 F.3d 1172 (9th Cir.2002).

Because the Board’s finding of an unlawful act can be supported by either a finding that De La Fuente engaged in an unsafe or unsound banking practice or by a finding that he breached a fiduciary duty, see 12 U.S.C. § 1818 (e)(1)(A), the Board’s unlawful-act finding is supported by substantial evidence.

B. Impermissible Effect

The Board found that De La Fuente both received financial gain or other benefits and/or that FIB was prejudiced as a result of De La Fuente’s actions. It found that he benefitted by being relieved of personal liability from Battaglia’s potential lawsuit, and by not being required to infuse capital into FIB after he hindered the FDIC’s investigation. De La Fuente’s attempt to locate a substitute buyer for the lot was not an unlawful act, and thus the consequent benefit to him — relief from potential liability in the Battaglia lawsuit — is not an impermissible gain. However, De La Fuente’s failure to disclose information revealing the true status of the PCA loan to the FDIC investigators did result in an impermissible gain: he was relieved of his obligation to infuse capital into the bank to counterbalance FIB’s over-leveraged status. Thus, substantial evidence supports the finding of a causal relationship between De La Fuente’s failure to disclose the relevant information and the agency investigators’ classification of the loan as “special mention” — obviating the need for capital infusion.

As for FIB’s loss, the evidence is a bit more equivocal. On the one hand, the bank lost a personal guarantee on the loan — by Battaglia, who was credit-worthy — and received a, virtually worthless borrower in his place, Arce. On the other hand, Battaglia was in arrears on the loan, and was unlikely to keep making payments on it, given that he was threatening legal action. It is true that the Board need not find an actual loss to FIB — a potential loss suffices. See Proffitt, 200 F.3d at 863 . Whether substantial evidence supports a finding that the bank would potentially suffer any loss on this transaction, as com pared to the likely outcome if PCA and Battaglia had remained the borrowers on the loan, however, is questionable.

Because the Board’s impermissible-effect finding may be supported on either of the alternative statutory grounds, we find substantial evidence on the basis of the benefit to De La Fuente.

C. Culpable State of Mind

Finally, the Board found that De La Fuente acted with personal dishonesty and/or willful or continuing disregard for the safety and soundness of FIB. De La Fuente’s failure to report the material discussed above to the FDIC agency investigators was clearly dishonest, although it is less clear that approval of the loan was an act of disregard for the soundness of the bank. Thus, we conclude substantial evidence supports the Board’s determination on the first alternative ground.

VII. Due Process

De La Fuente has waived the two due process arguments he asserts for the first time on appeal. First, De La Fuente claims that he was denied due process because the ALJ did not file his recommended decision for nearly two years after the termination of the hearing, much longer than the 45-day limit in the regulation, 12 C.F.R. § 308.38 (a). He argues that such an unreasonable delay in rendering the administrative decision violated his due process rights. Well into the two-year period when the ALJ was considering his recommended decision, however, the FDIC prosecutors made a request for a status report. De La Fuente vigorously opposed any time constraints on the ALJ’s decisionmaking process: “[De La Fuente] respectfully acknowledges the amount of documents presented thus far and the time it will take to sort through all the evidence on the record. In the spirit of the pursuit of truth, [De La Fuente] appreciates this court’s careful analysis of the evidence. The Truth will emerge with time.” Because he opposed the agency’s attempt to speed up the ALJ’s decision, he cannot now object to the length of time that it took the ALJ to render his recommended decision.

Second, De La Fuente complains that he was denied due process because he only had 30 days to file exceptions to the ALJ’s recommended decision once it was issued. However, he never asked the Board for an extension of time within which to file such exceptions. Thus, this argument is also waived.

VIII. Abuse of Discretion

The ALJ did not abuse his discretion by adopting verbatim the agency prosecutors’ findings of fact and conclusions of law. Judges (and agencies) often adopt the proposed findings submitted by a party, see Russian River Watershed Prot. Comm. v. City of Santa Rosa, 142 F.3d 1136, 1141 (9th Cir.1998), and indeed, the FDIC administrative process allows the parties to submit recommended findings to the ALJ. 12 C.F.R. § 308.37 (a)(1). It is therefore not surprising — and absent any other evidence, certainly not an abuse of discretion — -that the ALJ would adopt the findings proposed by the prevailing party in the administrative hearing.

It is premature for us to consider De La Fuente’s remaining claim, that the Board abused its discretion in banning him for life from the banking industry. We acknowledge that the Board concluded that “findings of violations of either Regulation 0 or section 23A, standing alone, would support” its decision, and further that “any one or combination of [the] loans that, in addition to the $800,000 [personal loan], would violate the lending limits of either Regulation O or section 23A ... would suffice to justify [De La Fuente’s] removal and prohibition.” We also cannot help but note that De La Fuente’s use of FIB as his personal piggy bank was in shocking disregard of sound banking practices and the law to the detriment of depositors, shareholders, and the public. Nevertheless, we remand this matter to the Board for it to consider, in light of this disposition, whether this extraordinary sanction remains deserved.

GRANTED IN PART, DENIED IN PART, REMANDED.

. For the sake of clarity, we refer to the Board of the Federal Deposit Insurance Corporation, the administrative body whose final decision we are reviewing, as "the Board," and to the Federal Deposit Insurance Corpo ration in its regulatory and quasi-prosecutorial capacities, both in internal agency proceedings and before us, as the "FDIC” or the "agency/' . Subsection 215.2(c)(1) provides: Control of a company or bank means that a person directly or indirectly, or acting through or in concert with one or more persons: (i) Owns, controls, or has the power to vote 25 percent or more of any class of voting securities of the company or bank; (ii) Controls in any manner the election of a majority of the directors of the company or bank; or (iii) Has the power to exercise a controlling influence over the management or policies of the company or bank. Id. § 215.2(c)(1). . Subsection 215.2(c)(2) provides: A person is presumed to have control, including the power to exercise a controlling influence over the management or policies, of a company or bank if: (i) The person is: (A) An executive officer or director of the company or bank; and (B) Directly or indirectly owns, controls, or has the power to vote more than 10 percent of any class of voting securities of the company or bank; or (ii)(A) The person directly or indirectly owns, controls, or has the power to vote more than 10 percent of any class of voting securities of the company or bank; and (B) No other person owns, controls, or has the power to vote a greater percentage of that class of voting securities. Id. § 215.2(c)(2). .At the time, this regulation was codified at 12 C.F.R. § 215.2 (b)(2). . To the extent that the FRB simply intended to create a "safe harbor” as a matter of enforcement policy, De La Fuente had no right to expect similar treatment from the Board in light of its 1988 decision predicating a finding of control under § 215.2(c) on a person’s "actual exercise of control of the day-to-day operations of” a company. In re * * * 1988 WL 583065 , at *4 (F.D.I.C.1988). . We reject the agency's arguments that De La Fuente has waived this and several other grounds of appeal by not sufficiently raising them in the proceedings before the ALJ and the Board. See 12 C.F.R. § 308.37 (a)(2), .39(b)(1). Unless otherwise noted, we find that all of these objections were sufficiently raised below to permit our review. .Such transactions cannot constitute more than ten percent of the bank’s capital stock and surplus with regard to each individual affiliate, or more than twenty percent of the bank's capital stock and surplus with respect to all affiliates combined. Id. . Environmental mitigation property is property on which endangered species are found and that is left undeveloped to mitigate the detrimental environmental effect of government-permitted development on other property. See, e.g., Walcek v. United States, 303 F.3d 1349, 1353 (Fed.Cir.2002). . The statute requires finding that: (A) [an] institution-affiliated party has, directly or indirectly— (i) violated .... any law or regulation; .... (ii) engaged or participated in any unsafe or unsound practice in connection with any insured depository institution or business institution; or (iii) committed or engaged in any act, omission, or practice which constitutes a breach of such party’s fiduciary duty; (B) by reason of the violation, practice, or breach described in any clause of subpara-graph (Al- ii) such insured depository institution or business institution has suffered or will probably suffer financial loss or other damage; (ii) the interests of the insured depository institution’s depositors have been or could be prejudiced; or (iii) such party has received financial gain or other benefit by reason of such violation, practice, or breach; and (C)such violation, practice, or breach — ■ (i) involves personal dishonesty on the part of such party; or (ii) demonstrates willful or continuing disregard by such party for the safety or soundness of such insured depository institution or business institution.... 12 U.S.C. § 1818 (e)(1).