CCBCO common mistakes
CCBCO · Understand the traps and how to avoid them.
Treating the board's role in the compliance program as advisory and answering that senior management 'owns' the compliance program, rather than stating that the board (or its committee) must approve the compliance program, receive regular reporting, and appoint a qualified compliance officer with authority and resources.
Candidates study the compliance officer's day-to-day duties far more than governance mechanics, so they default to 'management runs compliance' and blur the distinction between oversight responsibility (board) and execution (compliance officer and management).
What to do instead
Memorize the governance triad as a table: board approves policy and receives reporting; senior management implements and resources; the compliance officer administers. For any stem naming a governance failure, first ask which of the three legs is missing, then answer with that leg's specific obligation.
Answering deposit questions with the Reg DD disclosure timing or the Reg CC funds-availability schedule that 'sounds reasonable' instead of the exact statutory trigger, such as applying the next-business-day availability rule to all local checks or assuming new-account exceptions last indefinitely.
Availability and disclosure rules have multiple exception categories, dollar thresholds, and case-by-case vs. blanket holds, and candidates conflate them under time pressure because they never built a decision tree.
What to do instead
Build a one-page matrix of Reg CC availability categories (cash, wire, cashier's check, local/nonlocal checks, large deposits, redeposited checks, repeat overdrafts, new accounts, emergency conditions) with the specific hold limits and notice requirements, and practice classifying 20 hypothetical deposits into the correct category before answering.
On fair lending questions, identifying disparate treatment only when intent is explicit, and failing to recognize that a facially neutral policy with a disparate impact, or inconsistent application of an underwriting exception, can be a violation even without discriminatory intent.
Candidates carry a lay intuition that discrimination requires bad intent, and exam stems often describe neutral-sounding policies whose discriminatory effect is the point of the question.
What to do instead
For every fair lending stem, run a two-step check: (1) is a protected class treated differently on similar facts (disparate treatment), and (2) does a neutral criterion disproportionately exclude a protected class without a legitimate business necessity (disparate impact)? Practice writing both analyses for the same fact pattern before choosing an answer.
Confusing the BSA recordkeeping and reporting thresholds, mixing up when a Currency Transaction Report is required versus when a Suspicious Activity Report is required, and treating aggregation of same-day cash transactions by or on behalf of the same person as optional.
The thresholds, aggregation rules, and the distinction between a completed transaction and an attempted transaction are taught together and blur, and candidates answer from memory of the number rather than from the rule's logic.
What to do instead
Create a threshold card: CTR for currency transactions over $10,000 in a day, aggregated by person and by day; SARs for suspicious activity at the institution's stated dollar trigger with no dollar floor for certain insider or terrorism-related activity; and note that attempted transactions count. Then answer each stem by first naming the report type and then confirming the trigger.
Treating the privacy notice as a one-time account-opening document and missing the annual notice, opt-out, and sharing-limit obligations, including the distinction between sharing with affiliates versus nonaffiliated third parties and the exception for joint marketing arrangements.
Candidates learn the initial notice requirement well, then assume subsequent obligations are administrative, so they overlook annual notice timing, opt-out effectiveness, and the limits on redisclosure and reuse.
What to do instead
Map the Reg P lifecycle: initial notice at establishment of the relationship, annual notice while the relationship continues, opt-out before sharing nonpublic personal information with nonaffiliated third parties, and the joint marketing and service-provider exceptions with their contractual requirements. Answer by locating which lifecycle stage the stem describes.
Reading a CRA question as a fair lending question, or assuming CRA ratings depend mainly on the dollar volume of community development loans, rather than on the assessment area, the institution's performance context, and the separate tests for lending, investment, and service.
CRA and fair housing overlap in subject matter (lending to low- and moderate-income borrowers and areas), so candidates apply the wrong framework, and they underestimate how performance context and assessment area definition drive the evaluation.
What to do instead
Before answering, classify the stem: does it ask about prohibited discrimination (fair lending/fair housing) or about meeting community credit needs in a defined assessment area (CRA)? For CRA, identify the assessment area, the applicable test (small, intermediate small, or large institution), and which of the lending, investment, or service tests the fact pattern implicates.
Performing a risk assessment by assigning a single overall risk rating to a business line without documenting the inherent risk, the control effectiveness, and the resulting residual risk as separate judgments, or by rating risk without reference to likelihood and impact.
Candidates compress the assessment into one number because that is how risk is often discussed in practice, and they skip the documentation step that exam questions test as the actual requirement.
What to do instead
Practice writing every risk conclusion in the three-part form: inherent risk (likelihood times impact, with the specific product, customer, geography, and channel drivers), control effectiveness (design and testing results), and residual risk. When a stem gives only an overall rating, the correct answer usually identifies the missing inherent or control analysis.
Treating monitoring, testing, and audit as interchangeable, and answering that the compliance officer should 'audit' the program, rather than distinguishing first-line monitoring, second-line compliance testing, and independent third-line internal audit reporting to the audit committee.
The terms are used loosely in industry writing, and candidates do not hold a clear model of the three lines of defense, so they assign audit work to the compliance function or vice versa.
What to do instead
Memorize the three-lines model with an example for each: business unit monitoring of its own transactions, compliance testing of controls and regulations, and internal audit's independent assessment reporting to the audit committee. For each stem, identify who performed the activity and to whom the results should go.
Handling a regulatory change by updating the policy document only, without a documented change-management process covering impact analysis, assignment of ownership, system and form updates, training, and verification of implementation by a deadline.
Candidates equate 'compliance with a new rule' with 'revising the policy,' because policy revision is the most visible artifact, and they underweight the implementation and validation steps that exam questions probe.
What to do instead
Use a fixed sequence for every change question: identify the rule and effective date, assess applicability and impact, assign an accountable owner, update policies, procedures, systems, disclosures, and training, then validate and document completion. If an answer option stops at policy revision, it is usually incomplete.
On ethics and conflict-of-interest questions, choosing the option that protects the institution's short-term interest or the employee's position, rather than the option that requires escalation, disclosure, or recusal, and failing to recognize when an apparent conflict must be reported even if no improper act occurred.
Candidates answer ethics items as if they were business-judgment items, weighing outcomes instead of duties, and they underestimate how often the correct answer is to disclose and step away rather than to resolve the matter personally.
What to do instead
Apply a duty-first rule to every ethics stem: identify the duty owed (to the customer, the institution, the regulator, or the public), disclose any personal or related-party interest, and escalate or recuse before acting. Eliminate any option that resolves the conflict quietly or keeps the information within the involved employee.