Wells Fargo & Co. (WFC) - Get Report director Enrique Hernandez Jr. will step down from the company's board in April, following the costliest scandal in the U.S. bank's corporate history and an order by the Federal Reserve to improve risk-management and oversight.

But Hernandez, the 62-year-old majority owner of a private-security company he took over from his father, could keep getting riches from his board tenure long after he's gone.

Here's how: Shortly after Hernandez joined the Wells Fargo board in 2003 as an independent board member, where he was supposed to help oversee the company on behalf of shareholders, he approached then-Chairman and CEO Richard Kovacevich to ask if his company, Inter-Con Security Systems Inc., could get some business from the bank.

Kovacevich promised to look into the question. Soon afterward, he asked his staff if there might be contracts that Inter-Con could bid on. The answer came quickly: Yes. In 2005, Inter-Con won contracts to provide security to Wells Fargo branches that have continued ever since, providing an average $2.3 million a year in payments from Wells Fargo, totaling at least $25.7 million over the period, regulatory filings show.

The payments came on top of Hernandez's compensation by Wells Fargo as a board member, roughly $400,000 a year for the part-time job.

According to Wells Fargo regulatory filings, the contracts with Inter-Con were made on terms "at least as favorable" as those from other security companies. So the initial sales lead Hernandez pursued via his boardroom connection at Wells Fargo could theoretically continue well into the future.

Hernandez's side deals with Wells Fargo have drawn criticism from some corporate-governance experts as potentially compromising his ability as an independent board member to provide tough oversight to bank executives, given that the same people are also effectively his clients. The matter drew added scrutiny as the Wells Fargo board faced criticism from lawmakers and state-government officials, including U.S. Senator Elizabeth Warren of Massachusetts and California Treasurer John Chiang, for failing to stop a series of scandals stemming from overly aggressively sales practices.

A Wells Fargo spokesman, when asked if the contracts with Inter-Con would be terminated once Hernandez steps down, confirmed that the bank is still buying services from the security company, while declining to "comment further or speculate on that relationship." A spokesman for Hernandez at Pasadena, California-based Inter-Con didn't respond to requests for comment.

Last month, the Federal Reserve ordered Wells Fargo to refrain from increasing its loans and other assets until the San Francisco-based bank improves its board oversight -- an unprecedented sanction that CEO Tim Sloan estimates could cost $300 million to $400 million this year in foregone net income. In 2016, the San Francisco-based company agreed to pay $185 million to settle allegations by federal regulators and the State of California that employees, pressured by management's exacting sales targets, created millions of unauthorized accounts. The bank still faces a slew of lawsuits over various alleged misdeeds by customers, investors and current and former employees.

A company in turmoil.

As a result of the scandals and failed oversight, Wells Fargo has missed out on a big rally in bank stocks in recent years. Since news of the unauthorized accounts broke, the company's stock is flat, while large-bank shares on average are up 43%.

At Wells Fargo's annual meeting last year, Hernandez, who had served as head of the board's risk committee, received just 53% of shareholder votes, the lowest among 15 board nominees. Such a result was seen as a harsh rebuke, since directors run unopposed; it's rare in such corporate elections to receive approval ratings below 90%.

The bank announced a shakeup of its board last August, and Hernandez was replaced as head of the risk-management committee, which is tasked with preventing major corporate blunders that can lead to big losses. But he was allowed to retain his board seat and kept his post as head of the finance committee, which covers capital planning and financial risks.

Then early this month, just four weeks after the Fed imposed last month's asset-growth ban and directed the bank to improve its corporate oversight, the bank announced that Hernandez and three other long-serving directors would "retire" in late April as part of a "board refreshment process."

Kovacevich, the former CEO, confirmed the previously unreported interactions with Hernandez in a phone interview, while asserting that the transactions with Inter-Con were "all above board" and that the "price was right." Furthermore, he said, the contracts were all approved by the rest of the directors, and the deals were disclosed in regulatory filings, satisfying the need to be transparent about such matters.

The former CEO said he doesn't think directors are influenced on boardroom matters simply by the existence of side deals like Inter-Con's. Kovacevich, 74, served as Wells Fargo's chairman from 2001 through 2010. His successor, John Stumpf, stepped down in October 2016, roughly a month after the sales-practices scandals came to light.

"If you think that a board member will not be independent because you have a contract with them, you just don't know what's going on," Kovacevich said. "If somebody doesn't like that, that's just the way it is."

In fact, Kovacevich said, Wells Fargo's decision to keep the contracts in place following the announcement of Hernandez's departure should serve as proof that the company is receiving a good service at a good price - and not merely trying to buy the good graces of a board member.

Under New York Stock Exchange standards, publicly-traded companies are supposed to limit business transactions with board members designated as "independent." The rationale is that these directors are paid to represent shareholders' interests, and their independence from the company gives them greater leeway to second-guess CEOs on management decisions and spot troubles that senior executives might want to minimize.

Inter-Con's payments from Wells Fargo last year, at $1.28 million, amounted to less than 1% of the closely-held security company's total revenue for the year, according to a filing by the bank.

Wells Fargo could give even more business to Inter-Con now that Hernandez is leaving, since the limitation on business transactions with directors will no longer apply, Kovacevich said.

Unhampered by the limits, "you can do any damn thing you want," he said.

Nell Minow, vice chair of consultant ValueEdge Advisors, which counsels big investors on corporate governance, said in a phone interview that Hernandez never should have asked Kovacevich for the business, and Kovacevich never should have allowed it. The side deals raise too many questions about whether Hernandez is truly free of conflicts of interest, she argues.

"The fact that they were not doing business until he asked about it suggests to me that it was not a strictly arm's-length transaction," Minow said. "And the fact that they continue the business is still a signal to the rest of the board that this is how we behave, this is how we treat people on the board."