CCBCO key terms

A structured process that identifies, measures, and prioritizes the compliance risks a bank faces, weighing likelihood and impact so that controls, monitoring, and training resources are directed where exposure is greatest.

The level of risk that exists before any controls are applied, driven by the nature of the product, customer base, geography, and transaction volume of a business line.

The risk that remains after existing controls are applied. Comparing residual to inherent risk shows how much protection controls actually deliver and where gaps warrant remediation.

A governance model in which the business owns and manages risk, a separate compliance or risk function oversees and advises, and internal audit provides independent assurance to the board.

Ongoing, scheduled testing and surveillance performed by the compliance function to confirm that business processes follow laws, regulations, and internal policy, with findings tracked to resolution.

A targeted examination of a specific control to confirm it is designed properly and operating as intended, often through sampling transactions or observing the process in action.

An independent function reporting to the audit committee that evaluates the effectiveness of risk management, controls, and governance, including the compliance program, without owning the controls it reviews.

The board's duty to approve compliance policy, appoint accountable executives, receive regular risk reporting, and ensure the compliance program has adequate authority, staffing, and independence.

The executive responsible for administering the compliance program, including policy, training, monitoring, issue escalation, and reporting to senior management and the board.

The full set of policies, procedures, training, monitoring, reporting, and governance a bank maintains to prevent, detect, and correct violations of law and regulation.

The shared values and behaviors that determine whether employees raise concerns, follow rules under pressure, and treat compliance as everyone's job rather than a single department's burden.

The signals senior leaders send through their words, decisions, and incentives about how seriously compliance is treated, which strongly shapes behavior throughout the organization.

A confidential channel, often anonymously available, through which employees and others can report suspected misconduct, with protections against retaliation for good-faith reports.

The disciplined process of logging, risk-rating, assigning ownership for, remediating, and validating closure of compliance deficiencies found through monitoring, audit, or complaints.

A method for tracing a compliance failure back to its underlying driver, such as unclear policy, inadequate training, or system design, so remediation fixes the cause rather than the symptom.

A repeatable process for identifying new or amended laws and rules, assessing their impact on products and processes, assigning owners, implementing changes, and confirming completion by deadlines.

A crosswalk that links each applicable legal requirement to the specific policies, procedures, controls, and systems that satisfy it, enabling gap analysis and change impact assessment.

The process for receiving, categorizing, investigating, responding to, and analyzing complaints, including root-cause trending and reporting to regulators where required.

Unfair, Deceptive, or Abusive Acts or Practices: a prohibition on conduct that causes substantial consumer harm without offsetting benefit, misleads reasonable consumers, or exploits unequal bargaining power.

The rule implementing the Truth in Savings Act, requiring clear disclosure of interest rates, annual percentage yield, fees, and terms on deposit accounts before an account is opened.

A standardized rate that reflects the total interest earned on a deposit account in a year, including the effect of compounding, allowing consumers to compare accounts across banks.

A law, implemented by Regulation CC, that limits how long a bank may hold deposited funds before making them available for withdrawal and governs check collection and return.

The law, implemented by Regulation E, that sets consumer rights and bank duties for debit card, ATM, and other electronic transfers, including error resolution and liability limits.

The Regulation E process requiring a bank to investigate a consumer's asserted electronic transfer error within set timelines, provisionally credit funds in some cases, and report the outcome in writing.

A Regulation E subpart requiring disclosures of fees, exchange rates, and amounts to be received for international consumer money transfers, plus cancellation and error resolution rights.

The body of law prohibiting discrimination in credit on prohibited bases such as race, sex, or age, enforced through the Equal Credit Opportunity Act, Fair Housing Act, and their implementing rules.

A law, implemented by Regulation B, that bars creditors from discriminating against applicants on prohibited bases and requires notices, record retention, and appraisal disclosures.

A written statement a creditor must give an applicant when credit is denied or terms are changed unfavorably, explaining the reasons or how to request them and stating ECOA rights.

A discrimination theory holding that a neutral policy or practice violates fair lending law when it disproportionately harms a protected group and is not justified by business necessity.

The practice of denying or limiting credit or services to residents of particular neighborhoods, typically minority communities, regardless of individual applicants' qualifications.

A law requiring banks to help meet the credit needs of their entire assessment areas, including low- and moderate-income neighborhoods, and to be evaluated and rated on that performance.

The geographic area, generally one or more metropolitan areas or counties, that a bank delineates for CRA evaluation because it contains its branches, deposits, and lending activity.

The composite evaluation result given to a bank under the Community Reinvestment Act, ranging from Outstanding to Substantial Noncompliance, which can affect merger and branch applications.

The core U.S. anti-money laundering statute requiring banks to keep records, file reports such as currency transaction reports, and maintain risk-based programs to detect and deter illicit finance.

A confidential filing to the financial intelligence unit reporting transactions that the bank knows, suspects, or has reason to suspect involve illegal activity or have no apparent lawful purpose.

A report filed for currency transactions in excess of the regulatory threshold in a single business day, including multiple transactions the bank knows are by or for one person.

Risk-based steps to identify and verify customers, understand the nature of their relationships, and identify beneficial owners of legal entity customers, forming the basis for ongoing monitoring.

The identity of the natural persons who ultimately own or control a legal entity customer, which banks must identify and verify under customer due diligence rules.

Additional scrutiny applied to higher-risk customers, such as politically exposed persons or foreign correspondent relationships, including source-of-funds review and more frequent monitoring.

A law requiring financial institutions to safeguard customer information and to give privacy notices explaining how nonpublic personal information is shared and how consumers may limit it.

The GLBA rule requiring financial institutions to maintain a written information security program with risk assessment, access controls, encryption, vendor oversight, and incident response.

A disclosure given to customers describing the categories of information collected, how it is shared, and the consumer's opt-out rights, with annual delivery required in defined circumstances.

The lifecycle of due diligence, contracting, ongoing monitoring, and termination oversight applied to vendors and service providers, scaled to the criticality and risk of the activity.

A documented plan for detecting, containing, eradicating, and recovering from data breaches, including notification to regulators, customers, and law enforcement within required timeframes.