CCBCO cheat sheet

Three lines model: first line (business) owns and manages risk; second line (compliance/risk) sets frameworks, advises, and monitors; third line (internal audit) provides independent assurance to the board.

Board-approved compliance program elements: written policy, designated compliance officer, training, monitoring and testing, consumer complaint handling, and third-party service provider oversight.

A compliance officer's independence is evidenced by reporting lines to the board or a board committee, direct access to the board without management filter, and authority over compliance budget and staffing.

Board responsibilities: approve compliance policy and risk appetite, receive periodic compliance reporting, oversee corrective action for significant issues, and evaluate the compliance officer's performance.

A compliance risk appetite statement defines the level of compliance risk the bank accepts, expressed as tolerances (for example, zero tolerance for willful violations) and escalation triggers.

Issue management lifecycle: identify, log, assign owner and due date, remediate, validate, and close; aging and repeat findings are reported to the board or risk committee.

A compliance charter states purpose, scope, authority, independence, and reporting obligations; it is approved by the board and reviewed at least annually.

Regulatory relations protocol: notify the board and legal of any examination findings or supervisory correspondence, centralize regulator communications, and track commitments made to examiners.

Regulation DD (12 CFR 1030): funds availability schedules, substitute check rules, and electronic check collection; disclosure timing tied to account opening and material changes.

Expedited Funds Availability Act categories: next-day items (cash, wire, electronic, Treasury checks, cashier's and certified checks), local checks by second business day, nonlocal checks by fifth business day under the older schedule.

Regulation CC exception holds: large deposit (over $5,000, up to $5,000 available next day), redeposited check, repeatedly overdrawn account, and reasonable cause to doubt collectibility; notice required.

Regulation E error resolution (12 CFR 1005.11): provisional credit within 10 business days for most errors, 45-day investigation extension with written notice, 20 business days for new accounts.

Regulation E liability tiers for unauthorized transfers: $50 if the consumer notifies within 2 business days of learning of loss, $500 if within 60 days of the statement, unlimited after 60 days.

Truth in Savings Act (Regulation DD): disclose APY, interest rate, minimum balance and balance computation method, fees, and compounding; APY must be calculated using the annual percentage yield formula on a 365-day basis.

FDIC deposit insurance limit is $250,000 per depositor, per insured bank, per ownership category; revocable trust coverage is $250,000 per beneficiary up to five beneficiaries.

Regulation D reserve requirements were reduced to zero in 2020, but savings deposit transfer limitations were retained in many account agreements; the six-transfer limit is no longer a regulatory requirement.

Unfair, deceptive, or abusive acts or practices (UDAP/UDAAP): assess whether the practice causes substantial injury not reasonably avoidable and not outweighed by benefits; abusive standard adds interference with understanding and unreasonable advantage.

Equal Credit Opportunity Act (Regulation B): prohibits discrimination on race, color, religion, national origin, sex, marital status, age, receipt of public assistance, and good faith exercise of rights under the Consumer Credit Protection Act.

Regulation B adverse action notice: notify within 30 days of a completed application; statement of action taken, principal reasons, and ECOA notice; counteroffer may extend timing with notice.

Regulation B collection of demographic data: prohibited except for government monitoring information under HMDA or self-testing; HMDA data collected for most closed-end dwelling-secured loans and open-end lines of credit.

Fair Housing Act prohibited bases: race, color, religion, sex, national origin, familial status, and disability; applies to dwellings, including lending and appraisal practices.

Home Mortgage Disclosure Act (Regulation C) thresholds: closed-end dwelling-secured loans, open-end lines of credit (200 in each of prior two years), and purchased covered loans; report application, action, pricing, and denial reasons.

Truth in Lending (Regulation Z) ability-to-repay/QM: consider and verify eight underwriting factors; general QM uses price-based thresholds; rebuttable presumption versus safe harbor depends on APR relative to APOR.

Flood insurance (Regulation H): require flood insurance for improved real property in a special flood hazard area, escrow in most cases, and provide notice; force-placement allowed with notice if borrower fails to maintain coverage.

Fair lending analysis uses disparate treatment (intent, similarly situated borrowers) and disparate impact (facially neutral policy with disproportionate effect not justified by business necessity); the burden-shifting framework follows the three-step analysis.

BSA five pillars: designated BSA officer, internal controls, training, independent testing, and customer due diligence (including beneficial ownership for legal entity customers).

Currency Transaction Report: file for cash transactions over $10,000 in currency by or on behalf of one person in one business day; multiple transactions aggregated when the bank has knowledge of aggregation.

Suspicious Activity Report: file within 30 calendar days of initial detection (60 days if no suspect identified); threshold $5,000 for BSA violations and $25,000 for insider abuse; no tipping off the subject.

Customer Due Diligence rule: identify beneficial owners owning 25% or more of a legal entity and one individual with significant control; certify at account opening and update on risk-based triggers.

Enhanced due diligence for high-risk customers includes source of funds, source of wealth, expected activity, senior management approval, and ongoing monitoring; foreign politically exposed persons require EDD.

Money laundering stages: placement, layering, integration; structuring (smurfing) to evade the $10,000 reporting requirement is a federal offense under 31 USC 5324.

Section 314(a) requests from FinCEN require a search of records within the stated timeframe (generally 14 days) and a response only if a match is found; 314(b) allows information sharing among institutions with safe harbor.

OFAC sanctions compliance: screen customers and transactions against SDN and other lists, block and report within 10 business days, and maintain a risk-based sanctions compliance program.

GLBA privacy rule (Regulation P): provide initial privacy notice at account opening, annual notices where required, and opt-out rights before sharing nonpublic personal information with nonaffiliated third parties, except for exceptions.

Regulation P exceptions to opt-out include servicing and processing, joint marketing with a written agreement, and fraud prevention; sharing with affiliates is governed by FCRA affiliate marketing rules and opt-out.

Safeguards Rule requires a written information security program with a designated qualified individual, risk assessment, encryption of customer data in transit and at rest, access controls, and vendor oversight.

Incident response notification: the FTC Safeguards Rule requires notice to the FTC of a security event affecting 500 or more consumers within 30 days; state breach laws set their own timing and content rules.

Interagency guidance on third-party relationships covers planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination; critical activities require heightened oversight.

Vendor contract provisions: right to audit, confidentiality, data security, incident notification timelines, subcontractor approval, business continuity, and termination/transition assistance.

Regulation P definition of nonpublic personal information includes personally identifiable financial information and any list derived from it; publicly available information is excluded.

Data classification tiers (public, internal, confidential, restricted) drive handling, retention, and access controls; retention schedules must satisfy legal hold obligations.

CRA performance tests: lending, investment, and service tests for large banks; community development test for intermediate small banks; small bank lending test; strategic plan option available.

CRA assessment areas consist of the geographies where the bank has its main office, branches, and deposit-taking ATMs, plus areas with substantial lending outside branch networks under the 2023 rule.

CRA ratings: Outstanding, Satisfactory, Needs to Improve, Substantial Noncompliance; ratings are considered in applications for mergers, branches, and charters.

Community development activities: affordable housing, community services for low- and moderate-income individuals, economic development, and revitalization of designated areas.

Fair Housing Act Section 805 prohibits discrimination in residential real estate transactions, including lending terms, appraisals, and services; Section 804 covers the sale or rental of dwellings.

The Equal Housing Opportunity poster and logo requirements apply to lenders; advertising must not imply a limitation based on a protected class.

Redlining indicators include unexplained geographic gaps in applications or originations in majority-minority areas, disparate marketing, and branch distribution.

CRA data collection and reporting for large banks includes small business, small farm, and community development loan data by census tract and income level.

Inherent risk times control effectiveness yields residual risk; residual risk is compared to the risk appetite to determine acceptance or remediation.

Risk assessment dimensions commonly used: size, complexity, volume, product risk, customer risk, geography, and channel; BSA risk ratings are typically High, Moderate, or Low.

Monitoring systems generate alerts from scenarios (structuring, rapid movement of funds, unusual cash activity); alert disposition must be documented and tuned to reduce false positives.

Compliance testing attributes: sample size, population definition, sampling method, pass/fail criteria, and root cause analysis; results feed the issues management process.

Internal audit independence: audit reports to the audit committee, does not perform operational compliance work, and applies a risk-based annual audit plan.

Key risk indicators and key performance indicators are tracked with thresholds and escalation triggers; KRIs measure risk exposure, KPIs measure control performance.

Model risk management (SR 11-7): model inventory, validation, ongoing monitoring, and governance; applies to BSA monitoring and credit scoring models.

Audit finding severity ratings drive escalation: significant findings are reported to the board or board committee with remediation plans and timelines.

Regulatory change lifecycle: identify, assess impact, assign owner, implement (policies, procedures, systems, training), validate, and record evidence of completion.

Sources of change include final rules, supervisory guidance, enforcement actions, and state law; guidance is not law but examiners expect documented consideration.

Impact assessment maps each requirement to affected products, processes, systems, and controls; gaps are logged and tracked to closure with target dates.

Effective dates and compliance dates may differ; mandatory compliance dates and legacy provision transitions must be tracked separately from issuance dates.

Code of ethics elements: conflicts of interest, gifts and entertainment limits, outside employment, confidentiality, and reporting channels with non-retaliation protections.

Insider trading policy restricts trading on material nonpublic information and requires pre-clearance or blackout periods for covered persons.

Whistleblower protections: prohibited retaliation against employees reporting suspected violations; internal reporting channels and escalation to the board or audit committee.

Recordkeeping and evidence: retain regulatory change logs, training records, and testing results per retention schedules; examiners request evidence of implementation, not just policy updates.