Compliance Management and Regulatory Environment
A compliance management system has five moving parts
Board and management oversight, written policies and procedures, training, monitoring and audit, and consumer complaint response. Examiners assess whether these elements operate together and whether the bank identifies, escalates, and corrects its own problems. Modern expectations add a compliance risk assessment, change management for new products and vendors, third-party oversight, and a clear three-lines-of-defense structure: the business owns the risk, compliance advises and monitors, and internal audit provides independent assurance.
The regulatory environment
Prudential supervision (OCC, Federal Reserve, FDIC, NCUA) is layered with the CFPB, state regulators, and state attorneys general. The examination cycle runs from scoping and the first-day letter through sample requests, fieldwork, and a report of examination. Findings appear as violations, matters requiring attention, or matters requiring immediate attention, and the bank is expected to respond with a root cause, an owner, and a date. Enforcement tools escalate from informal commitments to formal agreements, cease-and-desist orders, civil money penalties, and restitution. Self-identification and self-correction generally reduce severity.
Retention anchors
Reg B: 25 months for application and adverse action records. Reg Z: 2 years. HMDA: 3 years. BSA and CTR records: 5 years.
Traps
- Assuming the compliance officer alone owns compliance.
- Treating a repeat violation as an isolated error rather than a control failure.
- Confusing a matter requiring attention with an enforcement action.
Rule of thumb
One complaint is an incident. Five similar complaints in a quarter across channels is a control weakness: open a corrective action plan with an owner, a root cause, and a validation date, and track it through the CMS monitoring report.