> Doesn't that violate all kinds of compliance controls?

Technically, only if it causes some kind of security, privacy, availability or accounting issue. The risk is high but it can be done.

Half of our customers do not have anything resembling a test environment. It is incredibly expensive to maintain a meaningful copy of production in this domain. Smaller local/regional banks don't bother at all.