Fiduciary risk behaves differently from every other risk on a bank's balance sheet, and the differences explain why trust departments need a control structure rather than good intentions.

The exposure is not capped by the transaction. A credit loss is bounded by the loan amount. A fiduciary breach is bounded by the harm, which can exceed the account's value and bears no relationship to the fee the bank earned.

The tail is long. Claims arrive ...

Fiduciary duty is the highest standard of care the law imposes on one party acting for another, and most training on the subject stops at listing the duties. The list is not the hard part. The hard part is that every duty resolves into specific administrative acts, and a trust department gets into trouble not by misunderstanding loyalty in the abstract but by making a distribution nobody documented.

This post connects the duties to the acts. Our companion post on

"RegTech" describes a market rather than a technology, and the market's marketing has converged on a single promise: software will make compliance cheaper and more reliable. Sometimes it does. The variable that decides is almost never the software.

This post takes a buyer's view. Our post on AI in compliance covers what machine learning specifically can and cannot do in AML and fraud ...

Most community bankers believe they have limited cloud exposure because the institution has not migrated anything. That belief is almost always wrong, and the reason is worth stating first: the bank's core processor, digital banking platform, monitoring system, and document repository are running on someone's cloud infrastructure. The institution's exposure is real, it is indirect, and it is largely invisible in a vendor file that describes the provider without naming what ...

RPA has an unglamorous nature that vendor material obscures: it is software that operates other software the way a person would, by clicking and typing. It has no judgment, no learning, and no understanding of the work. It repeats a defined sequence quickly and consistently, and it does so whether or not the sequence is correct.

That description is not a criticism. Repeating a defined sequence quickly and consistently is exactly what a great deal of bank operations work consists of, ...

Open banking arrives at a community bank in two forms, and only one of them is a compliance project.

The first is regulatory: a framework requiring institutions to make a consumer's own financial data available, at the consumer's direction, to third parties the consumer chooses. The second is commercial and already here: customers have connected their accounts to budgeting apps, payment services, lenders, and tax software, and the institution's data is already leaving through ...

Escrow administration produces more customer complaints per dollar of balance than any other function in a bank, and nearly all of them trace to one of two things: a setup error made at closing, or an annual analysis the borrower did not understand.

The rules themselves are prescriptive and learnable. Regulation X specifies how the account must be calculated, what must be disclosed and when, what cushion may be held, and how surpluses and shortages are handled. Very little is ...

Self-employed borrowers are the largest category of mortgage denial that should have been an approval, and the reason is almost always that nobody analyzed the returns properly.

The mechanics are not difficult. What makes them feel difficult is that the analysis inverts ordinary intuition: the objective is not to find what the borrower earned, but to establish how much cash the business reliably produces that the borrower can actually access. Those are different ...