CCBCO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

A governance framework in which business units own risk, a compliance or risk function provides oversight and challenge, and internal audit gives independent assurance to the board.

Compliance risk appetite

A board-approved statement defining the amount of compliance risk the bank is willing to accept, often expressed as tolerances and escalation triggers for violations.

Compliance officer independence

The compliance officer reports to the board or a board committee, has unfiltered board access, and controls the compliance budget and staffing decisions.

Issue management lifecycle

A structured process to identify, log, assign ownership, remediate, validate, and close compliance issues, with aging and repeat findings reported to the board.

Regulation DD APY disclosure

Truth in Savings requires disclosure of the annual percentage yield, interest rate, minimum balance, balance computation method, and fees before account opening.

Regulation E error resolution

For consumer electronic fund transfer errors, the bank must investigate and generally provide provisional credit within 10 business days, extendable to 45 days with written notice.

Regulation E liability tiers

Consumer liability for unauthorized transfers is $50 if reported within two business days, $500 within 60 days of the statement, and unlimited after 60 days.

Regulation CC exception holds

Permitted holds include large deposits, redeposited checks, repeatedly overdrawn accounts, and reasonable cause to doubt collectibility, each with notice requirements.

FDIC ownership categories

Deposit insurance covers $250,000 per depositor, per insured bank, per ownership category, such as single, joint, revocable trust, and retirement accounts.

ECOA prohibited bases

Race, color, religion, national origin, sex, marital status, age, public assistance income, and good faith exercise of consumer protection rights.

Adverse action timing

Under Regulation B, creditors must notify applicants of action taken within 30 days of receiving a completed application, with reasons and the ECOA notice.

HMDA reporting thresholds

Covered closed-end dwelling-secured loans and open-end lines of credit meeting volume thresholds must be reported with application, action, pricing, and denial data.

Qualified mortgage standards

Ability-to-repay rules require verification of eight underwriting factors; QM status determines whether safe harbor or rebuttable presumption protection applies.

Flood insurance requirement

Improved real property in a special flood hazard area securing a loan requires flood insurance, escrow in most cases, and notice to the borrower.

Disparate impact analysis

A facially neutral policy that disproportionately affects a protected class may violate fair lending unless justified by business necessity and no less discriminatory alternative.

BSA five pillars

Designated BSA officer, internal controls, training, independent testing, and customer due diligence including beneficial ownership identification for legal entity customers.

Currency Transaction Report

A report filed for cash transactions over $10,000 in one business day by or on behalf of one person, aggregating multiple transactions when known.

Suspicious Activity Report timing

SARs are filed within 30 calendar days of initial detection, or 60 days if no suspect is identified, and the subject must not be tipped off.

Beneficial ownership threshold

The CDD rule requires identifying individuals owning 25 percent or more of a legal entity and one individual with significant managerial control.

Money laundering stages

Placement of illicit funds, layering to obscure origin through transactions, and integration of funds into the legitimate economy.

Section 314(a) requests

FinCEN requests that institutions search records for named subjects within a stated period, generally 14 days, and respond only when a match exists.

GLBA opt-out right

Consumers may opt out before a financial institution shares nonpublic personal information with nonaffiliated third parties, subject to servicing and joint marketing exceptions.

Safeguards Rule requirements

A written information security program with a qualified individual, risk assessment, encryption, access controls, vendor oversight, and incident response planning.

FTC breach notification

Under the Safeguards Rule, notice to the FTC is required within 30 days for security events affecting 500 or more consumers.

Third-party risk stages

Planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination, with heightened oversight for critical activities.

CRA performance tests

Large banks are evaluated on lending, investment, and service tests; intermediate small banks use a community development test; small banks use a lending test.

CRA assessment areas

Geographies where the bank has its main office, branches, and deposit-taking ATMs, plus areas of substantial lending under the revised framework.

CRA rating consequences

Ratings of Outstanding, Satisfactory, Needs to Improve, or Substantial Noncompliance are considered in applications for mergers, branches, and charters.

Fair Housing Act scope

Prohibits discrimination in the sale, rental, and financing of dwellings based on race, color, religion, sex, national origin, familial status, and disability.

Residual risk formula

Residual risk equals inherent risk adjusted for the effectiveness of controls; it is compared with risk appetite to decide acceptance or remediation.

BSA monitoring alert tuning

Scenario thresholds are adjusted based on alert volume, false positive rates, and risk assessment results, with disposition rationale documented for each alert.

Regulatory change lifecycle

Identify the change, assess impact on products and controls, assign ownership, implement, validate, and retain evidence of completion with target dates.