Bank Compliance FAQs

What is bank compliance?

Bank compliance refers to the policies, procedures, controls, and oversight a financial institution uses to comply with applicable federal and state laws, regulations, regulatory guidance, and internal requirements.

Who is responsible for bank compliance?

Compliance is an institution-wide responsibility. The board of directors and senior management provide oversight, while the compliance function develops and administers the compliance program. Employees and business units are responsible for following applicable policies and procedures.

What is a compliance management system (CMS)?

A CMS is the framework a bank uses to manage compliance risk. It generally includes board and management oversight, policies and procedures, training, monitoring, testing, complaint management, corrective action, and reporting.

What are the key areas of bank compliance?

Common areas include:

• BSA/AML and sanctions compliance
• Consumer protection

• Fair lending
• Truth in Lending (TILA)
• Truth in Savings (TISA)
• Equal Credit Opportunity Act (ECOA)
• Fair Credit Reporting Act (FCRA)
• Real Estate Settlement Procedures Act (RESPA)
• Electronic Fund Transfer Act (EFTA)
• Home Mortgage Disclosure Act (HMDA)
• Flood insurance requirements
• Privacy and information-sharing requirements
• Unfair, deceptive, or abusive acts or practices (UDAAP)

What is regulatory compliance risk?

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational harm resulting from failure to comply with applicable laws, regulations, rules, or supervisory requirements.

What is consumer compliance?

Consumer compliance focuses on laws and regulations designed to protect consumers in their interactions with financial institutions, including requirements concerning lending, deposits, disclosures, privacy, fair treatment, and complaint handling.

Who regulates banks in the United States?

It depends on charter and size. National banks and federal savings associations are supervised by the OCC; state member banks by the Federal Reserve; state non-member banks by the FDIC and the state banking department; and credit unions by the NCUA. The CFPB has consumer protection supervisory authority over institutions above an applicable asset threshold, with smaller institutions generally examined for consumer compliance by their prudential regulator. FinCEN administers BSA rules across covered financial institutions.

What is a compliance management system?

A compliance management system is the framework an institution uses to manage compliance risk. It includes board and management oversight, the compliance program itself — including policies, training, monitoring, and consumer complaint response — and independent audit or testing. Regulators evaluate the CMS as a whole, and a common finding is that the individual components exist but are not effectively connected.

Which consumer regulations should every bank employee know by name?

The core set includes Regulation B (equal credit opportunity), Regulation C (HMDA), Regulation CC (funds availability), Regulation DD (truth in savings), Regulation E (electronic fund transfers), Regulation Z (truth in lending), Regulation P (privacy), the Fair Credit Reporting Act, RESPA, the Fair Housing Act, UDAAP, and the Servicemembers Civil Relief Act. Front-line staff do not need to know the regulations in depth; they need to recognize when one may apply and know when to escalate.

What is UDAAP, and why is it treated differently from other regulations?

UDAAP stands for unfair, deceptive, or abusive acts or practices. It differs because it is not limited to a checklist of prescribed disclosures or timelines. It addresses conduct based on applicable legal standards and its effect on consumers. This can make UDAAP considerations particularly important in areas such as fees, marketing claims, servicing practices, and customer communications.

What is the difference between a regulation and guidance?

A regulation has the force of law and applicable violations can result in legal or regulatory consequences. Guidance, such as supervisory bulletins, interagency statements, and examination materials, generally communicates supervisory expectations and approaches. Banks should understand the distinction while also taking applicable supervisory expectations seriously.

What actually happens during a compliance examination?

A request list typically arrives before the examination. Examiners review policies, training records, monitoring results, audit reports, complaint files, and other documentation. They may test transactions in higher-risk areas, conduct interviews, and hold an exit meeting before issuing their findings. Preparation includes being able to demonstrate that controls operate effectively, not merely that policies exist.

What is an MRA, and how serious is it?

A Matter Requiring Attention (MRA) identifies a deficiency that the institution is expected to address. The significance depends on the nature, severity, and persistence of the issue. Unresolved or repeat findings can result in increased supervisory attention and potentially more serious corrective action.

Do consumer complaints matter to examiners?

Yes. Complaint volume, trends, and themes can help inform examination scope, and the effectiveness of the complaint-management process may itself be reviewed. Institutions should categorize complaints, identify root causes, monitor resolution, and demonstrate that significant themes are used to improve products, processes, controls, or training.

What does a bank compliance officer actually do?

A compliance officer may be responsible for maintaining policies, coordinating training, conducting or overseeing monitoring and testing, managing regulatory change, supporting examinations and audits, reporting to the board, and advising business units on compliance considerations for new products and services. Responsibilities vary by institution and organizational structure.

How does someone build a career in bank compliance?

Many compliance professionals transition from banking operations, lending, risk management, or internal audit. Relevant professional credentials may include the CRCM for regulatory compliance, CAMS for BSA/AML, and CIA or CISA for certain audit and technology-focused career paths. A valuable long-term skill is regulatory change management — understanding new requirements and translating them into practical changes for the bank.

What is regulatory change management?

Regulatory change management is the process of identifying new and amended requirements, determining which products and processes are affected, assigning responsibility, implementing necessary changes, and validating that the changes were properly adopted. Effective regulatory change management helps institutions respond consistently to changes in laws, regulations, and supervisory expectations.