CRCM cheat sheet

Regulation DD (Truth in Savings) requires the annual percentage yield to be disclosed before an account is opened, calculated and rounded to two decimal places using the Part 1030 Appendix A formula; APY accuracy tolerance is 1/20 of one percentage point (0.05%).

Regulation DD requires 30 calendar days' advance written notice of an adverse change in account terms (for example a fee increase or a new minimum balance), with limited exceptions such as variable-rate changes and check-printing fees.

Regulation E error resolution: provisional credit within 10 business days of a timely notice of error (20 business days for new accounts and certain point-of-sale or foreign-initiated transfers), with investigation completed within 45 calendar days (90 days for those excepted transactions).

Regulation E liability tiers: $50 maximum if the consumer notifies the institution within 2 business days of learning of loss or theft; $500 if reported within 60 days of transmittal of the periodic statement; unlimited liability thereafter.

Overdraft fees on ATM and one-time debit card transactions require the consumer's affirmative written opt-in under Regulation E; the consent must be documented, revocable, and cannot be a condition of account opening.

Regulation CC next-day availability applies to cash, wire transfers, cashier's, certified, teller's and certain government checks for the first increment of the deposit ($5,525 through June 2025, indexed every five years); exception holds require a case-by-case delay notice.

The former Regulation D six-transfer-per-month limit on savings and money market accounts was removed in 2020; institutions may still impose and disclose their own transfer limits.

FDIC deposit insurance covers $250,000 per depositor, per insured bank, per ownership category; revocable trust coverage is $250,000 per beneficiary, and insurance is not increased by splitting funds within the same ownership category.

Regulation GG prohibits an insured depository institution from establishing accounts or accepting funds for unlawful internet gambling businesses and requires related due diligence policies.

Regulation Z APR accuracy: the disclosed APR must be within 1/8 of one percentage point for regular transactions and within 1/4 of one percentage point for irregular transactions (multiple advances, irregular payment periods).

TRID timing: the Loan Estimate must be delivered or mailed within 3 business days of application and received at least 7 business days before consummation; a revised Loan Estimate caused by a changed circumstance must be received 4 business days before consummation.

TRID closing: the consumer must receive the Closing Disclosure at least 3 business days before consummation; a corrected CD that increases the APR or changes loan terms restarts the 3-business-day period.

Right of rescission: 3 business days for a refinance or home equity loan secured by the consumer's principal dwelling; waiver is permitted only for a bona fide personal financial emergency.

ECOA/Regulation B: notice of action taken is due within 30 days of a completed application; a counteroffer may extend the notice period to 90 days, and adverse action notices must state specific reasons or disclose the right to request them.

HMDA reporting thresholds: closed-end coverage at 25 or more covered loans in each of the two preceding calendar years; open-end coverage at 200 or more covered open-end lines of credit.

HOEPA high-cost mortgage triggers include points and fees exceeding 5% of the total loan amount (loans of $20,000 or more) and an APR exceeding the average prime offer rate by 6.5 points for first liens or 8.5 points for subordinate liens.

Flood insurance: borrower notice before closing, escrow required for residential improved real estate, and force placement permitted after 45 days from the lender's lapse notice.

Regulation Z loan originator compensation may not be based on transaction terms other than the amount of credit, and an originator may not receive compensation from both the consumer and another party.

Regulation Z advertising: a trigger term (APR, payment amount, down payment, finance charge, number of payments) obligates clear and conspicuous disclosure of the APR, terms of repayment, and down payment as applicable.

Regulation DD advertising: an APY trigger term obligates disclosure of the minimum balance to obtain the APY, the time period the APY is offered, and any conditions such as fees or transaction requirements; bonus offers must state their conditions.

'Free' or 'no cost' claims are permissible only if the product is genuinely free; a maintenance or activity fee attaching to the account bars the claim, and a free product may not be conditioned on another paid product.

FDIC rules require 'Member FDIC' in deposit advertisements; non-deposit products (insurance, annuities, mutual funds) must be clearly identified as not insured by the FDIC, not bank-guaranteed, and subject to loss of value.

TCPA: prior express written consent is required for autodialed or prerecorded telemarketing calls and texts to wireless numbers; calls are limited to 8 a.m. to 9 p.m. local time, and consent may be revoked by any reasonable means.

FCRA prescreened solicitations require a firm offer of credit (or insurance) and a clear, conspicuous opt-out notice included with the solicitation.

Regulation B prohibits advertisements that express a preference, limitation, or discrimination on a prohibited basis; use of the Equal Housing Opportunity statement is a safe harbor for dwelling-related credit advertising.

FINRA Rule 2210 requires retail communications to be fair and balanced, not misleading, and approved by a registered principal, with certain filings due within 10 business days of first use.

Regulation P affiliate marketing rules require a clear opt-out before an affiliate may use eligibility information about a consumer to market products to that consumer.

12 CFR 9 (Regulation 9): bank fiduciary funds must be kept separate from the bank's own assets, fiduciary records maintained separately, and the fiduciary activities audited annually by a committee or auditor.

Collective investment funds under 12 CFR 9.18 require OCC approval or notice for new funds, annual financial reports, and a written fund plan; funds must be examined at least annually.

Prudent Investor Rule: fiduciaries evaluate risk and return at the portfolio level, diversify unless reasonably justified not to, and are not limited to a statutory list of permitted investments.

Insurance and annuity sales in banks require disclosures that the product is not a deposit, not FDIC-insured, not guaranteed by the bank, and may lose value; sales may not be tied to loan approval, and bank and insurance sales areas must be physically distinguished.

Regulation W (12 CFR 223) limits covered transactions with any one affiliate to 10% of capital and in the aggregate to 20% of capital, requires arm's-length terms, and imposes collateral requirements on certain transactions.

Volcker Rule: banking entities may not engage in proprietary trading or acquire ownership in covered funds above permitted limits, subject to exemptions for underwriting, market making, government obligations, and certain funds; a compliance program is required above asset thresholds.

SEC Regulation Best Interest requires broker-dealers recommending securities to retail customers to act in the customer's best interest, satisfying disclosure, care, conflict-of-interest, and compliance obligations.

Brokered deposits: only well-capitalized institutions may accept brokered deposits without restriction; adequately capitalized institutions need an FDIC waiver, and undercapitalized institutions may not accept them.

A CFPB-style compliance management system comprises board and senior management oversight, written policies and procedures, training, monitoring and auditing, consumer complaint management, and third-party service provider oversight.

BSA/AML program pillars: internal controls, a designated BSA officer, ongoing training, independent testing, and risk-based customer due diligence, including beneficial ownership identification at a 25% ownership threshold plus one controlling person.

SARs must be filed within 30 calendar days of initial detection (up to 60 days when no suspect is identified), with supporting documentation retained five years; currency transactions over $10,000 are reported on a CTR.

OFAC sanctions compliance is strict liability; blocked property must be reported within 10 business days and annually, and funds must be held rather than returned.

Regulation O: extensions of credit to executive officers require prior board approval, are subject to the single-borrower lending limit, and are counted against aggregate insider lending limits.

Record retention minimums: Regulation Z 2 years, HMDA 3 years, BSA 5 years, ECOA 12 months (25 months for business credit); retention periods run from the date of the action or the final disposition.

CRA performance is evaluated through lending, investment, and service tests; which tests apply depends on asset size and the institution's CRA rating history, and results are public.

Interagency Guidelines Establishing Information Security Standards (for example 12 CFR Part 30, Appendix B) require a written information security program approved by the board, risk assessment, and vendor oversight, plus annual GLBA privacy notices with opt-out rights.

Compliance risk assessment scores inherent risk (likelihood times impact) against control effectiveness to produce residual risk that drives monitoring, testing, and audit coverage.