Compliance, Regulatory, and Legal Requirements
This domain, Compliance, Regulatory, and Legal Requirements, tests the rules that govern credit union conduct and the compliance management system that keeps violations from recurring. Expect questions on BSA/AML, privacy, fair lending, consumer protection, and examination readiness.
Core regulatory map
The NCUA examines federally insured credit unions; the CFPB enforces federal consumer financial law for larger institutions; state regulators supervise state charters. Key rules include Regulation Z (credit disclosures), Regulation E (electronic transfers), Regulation B/ECOA (fair lending), RESPA (mortgages), FCRA (credit reporting), GLBA (privacy and safeguards), and BSA/AML (CIP, CTRs, SARs, OFAC screening). UDAAP prohibits unfair, deceptive, or abusive acts or practices even when no specific rule is broken.
Compliance management
A sound compliance management system includes board and management oversight, written policies, training, monitoring, complaint analysis, and corrective action. Recordkeeping must support what was disclosed and when. Third-party vendors extend compliance risk and require due diligence and contract controls. Staff should escalate red flags rather than resolve them informally.
Worked example
A title company calls and asks for a member’s account balance and payoff amount “to speed up closing.” Reasoning: the request involves nonpublic personal information. Confirm whether the member authorized the disclosure and whether the title company is an authorized third party; verify identity through approved channels. Without authorization, do not disclose. Document the request and the response. Privacy rules do not bend because the caller sounds urgent.
Traps
Do not treat compliance as the compliance officer’s job alone. Do not assume a signed form covers every disclosure. Do not confuse a CTR with a SAR. Do not disclose member information to a friendly-sounding caller without authentication and authority.