Blog: Compliance

Every bank has compliance training. Most of it is an annual online course assigned to everyone, tracked by completion percentage, and forgotten within a week. It satisfies the requirement, it produces a report for the board, and it changes almost nothing about what people do.

The reason is not that the courses are bad. It is that completion is not the outcome anyone actually wants, and a program measured on completion optimizes for the wrong thing. What an ...

Organizing a new bank is the most demanding project in banking, and the number of people who complete it in any given year is small. Charter formation slowed dramatically after the financial crisis and has recovered only partially, which means most bankers — including experienced ones — have never seen the process.

It is worth understanding for three reasons. Organizers are usually experienced community bankers, so it is a genuine career path. Existing institutions face de novo ...

Bank compliance is one of the few remaining banking careers a person can enter from almost anywhere in the institution, without a specific degree, and advance in on the strength of demonstrated competence. It is also consistently misunderstood by the people considering it.

The misunderstanding is that compliance is a knowledge job — that the work is knowing the regulations, and the path is learning them. Knowing the requirements is the entry ticket. What determines whether someone is ...

Banks buy chatbots as a customer service investment and govern them as a marketing asset. Both framings miss what the thing actually is.

A chatbot is a channel through which customers make statements to the bank. Some of those statements have legal consequences the moment they are made — and unlike a phone call routed to a trained representative or a letter routed to a dispute department, a chat message lands in a system that was designed to answer questions about branch ...

Every AML and fraud vendor now describes its product as AI-powered, and most compliance officers have sat through a demonstration promising a large reduction in false positives. Some of those claims are real. Almost none of them are the reason an implementation succeeds or fails.

The binding constraint on using machine learning in a compliance function is not the model's capability. It is whether the institution can explain, validate, and defend what the model did — ...

Most community banks believe model risk management does not apply to them. The belief is understandable — the supervisory guidance was written with large institutions in view, and the word "model" suggests something more elaborate than what a $600 million bank operates.

It is also wrong in a specific and consequential way. A bank that calculates its allowance in a spreadsheet, prices loans with a tool the CFO built, screens transactions with a vendor's monitoring system, and measures ...

Trend lists usually forecast rules. This one does not, because rule forecasts age badly and because the more useful question for a compliance officer is how the job is changing. These ten shifts are already visible in examination findings, enforcement patterns, and hiring.

1. Effectiveness over process

Supervisory emphasis has been moving from whether required activities occurred to whether they produced anything. The AML Act's direction to restructure program

Internal fraud is the least frequent category of bank fraud and the most expensive per event. It runs longer before discovery than any external scheme — often years — because the person committing it understands the controls, has legitimate access, and is trusted.

It is also the category institutions are least willing to discuss honestly, which is precisely why the controls that address it get relaxed.

The Common Schemes

Cash theft. Teller drawer