Multiple users are logging in with the same userID at the same time using SSH.
Honestly your simplest fix is probably going to be arranging for every person to log in under THEIR OWN USERID and doing their work that way. If they need to run an application as a particular user then give them the ability to run the command over sudo as in:
sudo -u <groupusername> /path/to/command.
This will log the action in the system log if sudo is set up properly, and sudo has some reasonably good extended logging available.
You can get really granular with sudo. It's pretty useful for this.
If nothing else you can set up the workflow such that people ssh into the server then sudo su - which will give you a better chance of tracing them over time.
The problem with setting up the history file is that it can trivially be whacked by a user since it's owned by that user.
From a brief reading of the AIX auditing it looks like it will audit per user and not per login. However ICBW about that. I'd still turn it on.
So in my opinion (and while I don't sell myself as a security expert, I do have a CISSP and maintain the Continuing Education related to that certification) you need to get in touch with your security department and determine what, if any, compliance standards need to be met (In the US I'd expect a bank to have to meet at least Dodd-Frank, PCI and SoX), and what needs to be done to bring your system into compliance with that.
I would then take this list to management and explain that these weren't really optional in today's environment and that there could be rather expensive fines/fees levied if you aren't up to snuff and let them decide how to go forward.
In the mean time I'd turn all my logging up to 11, and start crawling through it looking for ways to correlate what it's telling me. On AIX, especially with the auditing turned on you might be able to compare events across several log files.
As a trivial example a long time ago I got a Technical Support call wanting to know why a particular server had "crashed". I spent about 30 seconds digging through the logs when I noticed that at T - 5 someone had logged in as "root" (bad idea to have that open) and then the shutdown command had been issued.
"Oh. That must have been my partner. Never mind."
"Can I close the case?"
The problem with this is that should you wind up in a criminal case where your correlations are part of the evidence...Oh Boy. I'd not want to be in that position.