Ninety Days to Examination with No Compliance Officer and Two Unreviewed Products
A $3.1 billion bank's compliance officer resigned five months ago; the deputy is acting in the role while also running BSA. The enterprise compliance risk assessment was last refreshed 20 months ago, before the bank launched two products: a small-dollar installment loan ($300–$1,200, 36% APR, originated through a third-party platform) and a round-up savings feature that moves spare change from checking to savings and advances funds when the round-up would overdraw the account. Monitoring for Reg E disputes has not run for two quarters; 340 disputes were open more than 45 days at last count. The board's compliance committee received no compliance report in Q1 or Q2. Internal audit's 2025 plan excludes both new products, and the platform's SOC report is 26 months old. Examiners arrive in 90 days.
1. Build and justify a 90-day remediation plan. What runs first, and why?
Read the worked answer
Rank by consumer harm first, regulatory exposure second, exam optics third. Optics without harm reduction fools no one at a $3.1 billion bank.
Tier 1 - active harm, fix in weeks 1–4.
- Reg E dispute backlog. 340 disputes open beyond 45 days is an error-resolution failure under 12 CFR 1005.11 and ongoing consumer harm. Fund provisional credits, assign a dedicated team, and report volume and aging weekly to the acting officer.
- Round-up advance feature. Characterize it before defending it: is the advance an overdraft subject to the 1005.17 opt-in, a closed-end extension of credit subject to Regulation Z, or something else? The design - advancing funds precisely when the customer would overdraw - looks like functional overdraft. Suspend the advance functionality until the characterization is documented and the disclosure set matches it.
- Small-dollar installment. Confirm the finance charge and APR are computed on the all-in cost (origination, platform, and any ancillary fees), check the Military Lending Act 36% MAPR test for covered borrowers, and verify state licensing and the third party's origination role.
Tier 2 - governance evidence, weeks 4–10. Refresh the enterprise risk assessment with both products scored; charter an independent review of each; update the SOC review and vendor due diligence; reconcile the complaint log against dispute data.
Tier 3 - week 10–13. Board reporting restarted, remediation tracker with owners and dates, and a written status package for examiners. A credible dated plan with interim milestones is itself supervisory evidence.
2. The compliance committee has received no report for two quarters and one person is running compliance and BSA. What governance structure should you put in place before the examination?
Read the worked answer
Diagnose it as a governance failure, not a paperwork gap. Two missed quarters and a combined compliance/BSA role without a deputy mean the board cannot have been overseeing compliance risk, and an examiner will say so in the first paragraph of the report.
What to build.
- Restore reporting. Reinstate a written quarterly report now - monthly during remediation - covering risk assessment results, open issues and aging, monitoring results, complaint themes, regulatory change impacts, and remediation status. Not a violation count.
- Fix the concentration. Document a coverage plan for the combined role: a named deputy, interim resources, and a search timeline with board visibility. Combining compliance and BSA in one person with no backup is a standing MRA waiting to be written.
- Ratify the gaps. Have management present the stale risk assessment and the two unapproved product launches so the committee can formally direct corrective action - examiners look for evidence of board challenge, not just receipt of a deck.
- Escalation triggers. Any dispute aged past 45 days, any product launch without compliance sign-off, and any exam finding goes to the committee within 30 days, by rule.
- Minutes. Record the discussion, the questions asked, and the resource decisions. The minutes are the evidence.
Do not present a clean story. Present the gap, the plan, and the interim milestones - a candid package dated before the exam is far stronger than one produced after the first request letter.
3. Design the metrics set that should be reported to the committee, and explain how each ties to a specific failure in this scenario.
Read the worked answer
Each metric should map to a demonstrated failure - and carry a threshold that forces escalation.
Reg E disputes (maps to the 340 aged items):
- Percent of disputes resolved within 45 days - target 100%, escalate below 98%.
- Count of disputes aged over 30 and over 45 days.
- Median days to provisional credit; dollars of provisional credit issued and reversed.
- Reopen rate, as a proxy for investigation quality.
Round-up advance (maps to the uncharacterized product):
- Percent of advances that result in a fee; opt-in coverage rate if 1005.17 applies.
- Complaints per 1,000 active accounts; net charge-off rate. Use both count and rate - a stable ratio in a growing product can hide a rising count.
Third-party small-dollar platform (maps to the 26-month-old SOC report):
- Loans originated where required disclosures were delivered late or not at all.
- Complaint rate per 1,000 loans; open vendor due-diligence items and their age.
Program health (maps to the 20-month risk assessment and the audit scope gap):
- Percent of products and processes scored in the current risk assessment; days since last refresh.
- Issues past due, with aging buckets and owners.
- Monitoring plan completion percentage by compliance area.
- Regulatory change items implemented before their effective date.
- Training completion for front-line and product staff, segmented by role.
Design rules. Segment by product and channel so growth does not mask deterioration. Every metric needs a named owner, a source system, and a documented escalation threshold - otherwise it is a slide, not a control.