10 Banking Compliance Trends to Watch in 2027

Trend lists usually forecast rules. This one does not, because rule forecasts age badly and because the more useful question for a compliance officer is how the job is changing. These ten shifts are already visible in examination findings, enforcement patterns, and hiring.

1. Effectiveness over process

Supervisory emphasis has been moving from whether required activities occurred to whether they produced anything. The AML Act's direction to restructure program requirements around programs that are "effective, risk-based, and reasonably designed" is the clearest statement of it.

Operationally: be able to explain why your monitoring thresholds sit where they do, why your training covers what it covers, and what your program has actually detected. "We completed the required activities" is becoming an insufficient answer.

2. Evidence is the binding constraint

Across every area covered in this series — BSA, consumer compliance, information security, CECL — the most common finding is the same: the program is documented but not evidenced. Policies exist; records showing the control operated do not.

Operationally: the highest-return compliance investment at most institutions is not a new control. It is recording the ones already being performed.

3. Third-party and partnership risk became a first-order domain

Bank-fintech arrangements, middleware providers, and vendor concentration have moved from a procurement topic to a supervisory priority, driven by failures where end customers lost access to funds and banks could not determine ownership.

Operationally: third-party risk needs a named owner, contractual data rights, and independent visibility rather than partner attestations.

4. Data quality is compliance infrastructure

HMDA, small business lending data collection, and CECL all depend on fields captured correctly at origination by people not thinking about compliance. None can be fixed retroactively.

Operationally: validation at entry beats scrubbing at year end, every time, and it is the difference between a clean submission and a resubmission.

5. Model risk management is expanding to automated decisioning

Expectations built for credit and ALM models increasingly reach fraud scoring, monitoring systems, and AI-assisted decisioning. The obligations attach to what a model does, not to the technology used to build it.

Operationally: inventory what the institution would call a model, including vendor-supplied tools, and confirm each has documentation, validation, and an owner. Where automated decisioning touches credit, the requirement to state accurate adverse action reasons constrains what models can be used.

6. Individual accountability is a standing theme

Regulators have pursued compliance officers and other individuals directly. This is not new, and it has not receded.

Operationally: escalate in writing, document resource gaps and recommendations, and never represent a program's condition as better than it is. The exposure attaches to concealment far more than to imperfection.

7. Complaints are supervisory input

Complaint volume, themes, and the adequacy of the response process are used to scope examinations and to identify UDAAP risk.

Operationally: categorize by root cause rather than by product, capture complaints from every channel including regulator portals, and be able to name changes the institution made because of a complaint theme.

8. State-level divergence is increasing

As federal posture shifts, states have been more active — in consumer protection, data privacy, elder exploitation, and enforcement of federal consumer financial law by state attorneys general.

Operationally: multi-state institutions need state monitoring built into the regulatory change process, not treated as an afterthought. This is the source community banks most consistently under-monitor.

9. Fraud, BSA, and information security are converging operationally

A phishing campaign is a security incident that produces fraud losses and generates BSA filings. Institutions running these functions separately produce three partial pictures of the same event.

Operationally: shared detection with separate decisioning, and a standing forum where the three functions compare what they are seeing. Supervisors increasingly ask how information moves between them.

10. Compliance staffing is the constraint nobody budgets for

Community institutions face a genuine market for experienced compliance staff, and the work has grown faster than the headcount. Chronic alert backlogs and deferred monitoring are usually resourcing problems presented as process problems.

Operationally: succession planning for the BSA officer and the compliance officer, documented programs that survive a departure, and honest reporting to the board about capacity. An institution where one person holds the program is one resignation from a difficult year.

What These Have in Common

Reading the list together, a pattern emerges that is more useful than any individual item.

Eight of the ten are about demonstrability rather than about new requirements. Effectiveness, evidence, data quality, model documentation, individual accountability, complaint analysis, and function convergence all describe the same underlying shift: the question is moving from what does your program require to what can you show it produced.

That reframing is good news for a well-run small institution and bad news for a well-documented one. A community bank with modest technology, a clear risk assessment, and disciplined records is in a stronger position than a larger institution with more tooling and no evidence trail — because what is being assessed is increasingly the trail.

The practical implication for planning: an institution deciding where to spend next year's compliance budget should probably weight recording, testing, and evidence over acquiring capability. The controls most institutions need are already being performed by someone. What is missing is proof.

Structured coverage across these areas is available through our bank compliance training, the Certificate in Compliance Management System (CMS), and the Certificate in BSA and AML Compliance.

How to Use a List Like This

A caution about the genre, applied to this piece.

Trend lists are not a work plan. They describe the environment, not this institution's gaps. The work plan comes from the compliance risk assessment, the open examination and audit findings, and the board's own commitments — none of which a published list knows about.

Directional claims are not dated requirements. Nothing here should be implemented as though it were a rule. Where an item describes a supervisory emphasis, the useful response is to prepare to answer a question, not to build a control.

The right test is comparison. Read the ten items against your own program and note where you could not answer the operational prompt. Those are worth investigating. The rest is context.

Institutions that treat trend content as a checklist end up with programs shaped by industry commentary rather than by their own risk. Institutions that treat it as a set of questions get the value without the distortion.

What Is Not on This List, and Why

Omissions are as informative as inclusions, and three things that appear on most published trend lists are deliberately absent here.

Specific pending rules. Several significant rulemakings were in proposed form, in litigation, or awaiting agency action at drafting. Listing them as trends would invite institutions to prepare for requirements that may never take effect, which is the characteristic failure of this genre. Threads worth monitoring are covered in the companion post on regulatory change; they are not trends in the sense used here.

Technology predictions. "AI will transform compliance" is both true and useless as guidance. What is actionable is narrower and appears above as item five: automated decisioning brings existing model risk expectations with it, and adverse action reason requirements constrain what can be deployed in credit. The rest is vendor marketing.

Anything requiring a forecast of enforcement priorities. Agency priorities shift with leadership, and an institution that reallocated its program toward a predicted enforcement focus would be building on the least stable input available. The durable position is a program proportional to the institution's own risk, which survives whichever priorities are announced.

There is a fourth omission worth naming explicitly. Nothing on this list says compliance will get easier or cheaper. Trend content aimed at practitioners often includes an efficiency claim — automation reducing burden, streamlined requirements, proportionality relief for smaller institutions. Some of that is real at the margins. None of it has reduced the aggregate obligation in any period covered by this series, and a community bank planning on the basis that the burden will lighten has consistently been wrong.

The honest framing for a board conversation: the compliance obligation is stable to growing, the standard for demonstrating it is rising, and the constraint at most community institutions is people rather than policy. Those three statements have held for some years and are the safest planning assumptions on this list.

A final note on the audience for a list like this. Trend content circulates most among compliance officers, who are already aware of most of it, and least among the executives and directors who control the resources it implies. That mismatch is worth correcting deliberately. A compliance officer who forwards an industry trend list to the board has communicated very little; one who takes two items from it, states plainly what the institution cannot currently demonstrate, and attaches a cost and an owner has turned commentary into a decision the board can actually make. The list is raw material for that conversation rather than a substitute for it.

Frequently Asked Questions

What does "effectiveness over process" mean for a compliance program?

That supervisory attention is shifting from whether required activities were performed to whether the program produces useful results and directs resources at the institution's actual risks. In practice it raises the importance of being able to explain why monitoring thresholds, training content, and testing scope are set where they are — rather than simply confirming each was completed.

Why is evidence the most common compliance finding?

Because programs are typically documented and not recorded. Policies and procedures exist, but there is no record showing that the access review occurred, the incident response plan was tested, the exemption was reviewed, or the alert was dispositioned with a reason. For examination purposes, an unevidenced control is treated as one that did not operate.

How does data quality become a compliance issue?

Because HMDA, small business lending data collection, and CECL all depend on fields captured correctly at origination by staff not thinking about compliance, and none of it can be reconstructed later. Validation at the point of entry prevents what would otherwise become year-end scrubbing, resubmission risk, and inaccurate public data.

Does model risk management apply to fraud scoring and AI tools?

Increasingly yes. Expectations developed for credit and ALM models attach based on what a model does rather than the technology used to build it, and that includes vendor-supplied tools. Where automated decisioning touches credit, the requirement to provide accurate principal reasons for adverse action constrains which models can be used at all.

Why is state-level monitoring becoming more important?

Because states have been more active as federal posture has shifted — in consumer protection, data privacy, elder financial exploitation, and enforcement of federal consumer financial law by state attorneys general. Multi-state institutions accumulate obligations invisibly, and state monitoring is the element community banks most consistently omit from regulatory change processes.

Should a trend list be used as a compliance work plan?

No. It describes the environment rather than the institution's gaps, and it knows nothing about the compliance risk assessment, open findings, or board commitments that should drive the work plan. The productive use is comparison — read each item against your own program, investigate where you could not answer the operational question, and treat the rest as context.