How should I decide which rule governs a customer payment dispute?

Identify the payment method and the alleged problem first. Regulation E addresses covered electronic fund transfers and its error process; Regulation CC addresses when deposited check funds become available. A customer disputing an unauthorized debit needs an error investigation, while a customer asking why a deposited check is on hold needs an availability and notice review. The account can be subject to both rules, but the event determines the immediate duty.

How do ECOA, the Fair Housing Act and HMDA differ in a mortgage case?

ECOA governs credit discrimination and application decisions across covered credit products. The Fair Housing Act adds protections for residential real estate transactions. HMDA generally concerns collecting and reporting data for covered institutions and transactions. A mortgage denial may therefore require a fair lending review and an adverse action notice, while a separate coverage test determines whether the application belongs in HMDA data.

What is the practical difference between a compliance violation and a CMS weakness?

A violation is a failure to meet a particular legal requirement, such as using an incorrect disclosure. A CMS weakness is a failure in governance or controls that can allow violations to arise or persist, such as a product change that never reaches disclosure testing. The manager should correct affected customer outcomes, identify the control failure and verify both fixes with evidence.

CRCM Study Guide: US Banking Compliance in Practice

Start with concept 1 Choose a topic

A compliance manager has to identify the product, customer, transaction and stage of the relationship before choosing a rule. An electronic payment dispute, a mortgage application and a complaint about fees may reach the same team, but each starts with a different coverage test and calls for different evidence. This guide develops those decisions across core consumer laws, related banking requirements and the compliance management system that keeps them working. The planned cases ask you to classify facts, calculate with stated assumptions, distinguish similar obligations and decide what the bank should do next. Pay particular attention to where a rule applies, what triggers a duty and how the bank verifies that a remedy fixed the underlying problem.

Core Compliance

1. Classify an electronic transfer error

Start with the account and the payment rail. Regulation E addresses errors involving covered electronic fund transfers from a consumer account, including a debit card transaction the consumer says was unauthorized. Record what the customer reports, identify the transaction, and investigate the claim; a merchant's assertion that the sale was valid does not settle whether the customer authorized the transfer. A paper check follows check law and the bank's check-dispute process. A complaint about defective goods may instead be a merchant dispute if the customer admits authorizing payment. Likewise, regretting an authorized purchase does not turn it into an unauthorized transfer. Classification matters because it determines the investigation, any provisional credit, and the explanation owed to the customer. Preserve transaction records and the customer's account of events before drawing a conclusion.

Worked example: Maya sees a $240 debit card purchase she says she never made and a $60 paper check she confirms writing. The bank opens a Regulation E error investigation for the $240 debit, gathers authorization and transaction evidence, and explains its finding. It routes the $60 check through the check process only if Maya raises a separate concern. Her acceptance of the check does not weaken the debit claim.

Watch the distinction: A posted debit card charge is not automatically authorized. Posting shows that the transfer reached the account; authorization requires a separate factual assessment.

Reference: [1]

2. Separate transfer authorization from overdraft consent

Ask two separate questions: did the customer authorize the transfer, and did the customer consent to the particular overdraft service that produced a fee? A recurring electronic debit generally needs a written or similarly authenticated authorization, with the consumer given a copy. That authorization supports the scheduled payment, subject to applicable stop-payment and error rights. It does not give the bank permission to charge an overdraft fee for paying an ATM withdrawal or one-time debit card transaction. Regulation E's affirmative opt-in rules address fees for those overdraft services. Recurring debits follow a different overdraft-fee treatment, so identify the transaction type before applying the opt-in test. Evidence should connect the customer's consent to the relevant service and account, rather than treating a general account agreement as proof of every authorization.

Worked example: Luis signs an authorization for a $90 utility debit each month. He has not opted in to ATM overdraft service. The scheduled $90 debit is supported by his transfer authorization. Later, an ATM withdrawal would overdraw the account and the bank proposes a $30 overdraft fee. The utility authorization supplies no consent to that ATM fee; the bank must assess the ATM transaction under the separate opt-in rule.

Watch the distinction: Consent to a recurring payment is not blanket consent to overdraft fees. The payment authorization and the ATM or one-time debit overdraft election answer different questions.

Reference: [1]

3. Test deposit yield claims

An interest rate states how interest is calculated; annual percentage yield expresses the annualized return after accounting for the relevant earning and compounding terms. To test an advertised yield, first identify the balance, interest actually earned during the measurement period, and period length. Divide interest by principal to obtain the period yield, then annualize using the appropriate compounding assumption. Compare that result with the advertisement and the account disclosures, including any balance conditions or introductory period that change what a typical customer can earn. A headline yield cannot be evaluated from its percentage alone. Check whether the advertised product and the disclosed product have the same terms, and whether qualifications are presented clearly. The CRCM content outline places deposit disclosures within core compliance; the account's actual terms supply the calculation inputs.

Worked example: Assume a $1,000 balance earns $10 over 90 days, with no other deposits or withdrawals and the same yield available throughout a 365-day year. The period yield is $10 ÷ $1,000 = 1%. Effective annualization gives (1.01)^(365/90) − 1 ≈ 4.12%. An advertisement claiming 5% APY needs a different supported rate or set of terms; these assumed earnings do not support it.

Watch the distinction: Multiplying a short-period yield by four is only a rough estimate for a quarter. APY reflects the specified annualization and compounding assumptions, which must match the advertised account.

Reference: [1]

4. Recognize a credit application

An inquiry asks about possible credit terms. An application is a request for credit made under the creditor's established procedures for the kind of credit requested. The distinction affects when the bank must evaluate and document a decision, but procedures cannot be used to avoid fair lending duties by relabeling real requests as inquiries. Identify the requested product, what information the bank normally requires to decide, and what the customer actually submitted. A request may be an incomplete application if the customer has applied but omitted information needed for a decision. Keep consumer and business purpose distinct: Regulation B's nondiscrimination framework reaches both, while some procedural notice requirements differ by context. Record the first meaningful request and later submissions so the bank can explain why it treated each stage as an inquiry, incomplete application, or complete application.

Worked example: At a store desk, Dana asks what rates the bank offers and provides no personal or financial information. Staff give a rate sheet: that contact is an inquiry. The next day, Dana submits the information the bank requires to decide a personal loan. The bank now has an application under its procedures and should process and document it as consumer credit, even if a final decision needs verification.

Watch the distinction: An application does not begin only when an employee clicks “submit.” The customer's request and the bank's established decision procedures determine its status.

Reference: [1]

5. Resolve adverse action

Trace the decision against what the applicant requested. A denial of requested credit is adverse action. A counteroffer gives different terms; if the applicant accepts or uses it, the original request is generally resolved through that offer. If the applicant declines or does not accept the counteroffer, the bank must follow the applicable adverse-action notice path. Incompleteness is different: the bank lacks information needed to decide and must use the appropriate request-for-information or action process rather than disguising a credit judgment as missing paperwork. Reasons must identify the actual principal factors behind the decision, such as insufficient verified income or a credit history issue, with enough specificity to be useful. Review the application, underwriting record, offer, and customer response in sequence. Business-credit procedures can differ from consumer procedures, so retain the product classification.

Worked example: A consumer requests $20,000. Underwriting concludes that documented income supports only $12,000 and offers that amount. The applicant rejects it. The bank treats the unaccepted counteroffer as adverse action on the $20,000 request and follows the applicable notice process, identifying the actual underwriting reason. Because underwriting reached a decision using the available information, calling the file incomplete would misstate what happened.

Watch the distinction: A smaller offer does not always end the notice question. Whether the applicant accepted the counteroffer determines the next step for the original request.

Reference: [1]

6. Investigate a fair lending disparity

A pricing disparity is a signal to investigate, not by itself a finding of discrimination. Begin with applicants who are genuinely comparable on documented, permitted pricing factors: product, timing, credit profile, loan structure, and any approved exceptions. Reconstruct how each fee was set, including discretion given to staff and the reason recorded for using it. If a legitimate factor explains the difference, check whether it was applied consistently. If the records do not explain it, expand the review to similar files and protected-class patterns. Disparate treatment concerns different treatment of similarly situated people; a neutral pricing rule may instead warrant review for a disproportionate effect on a protected group. Evaluate both customer outcomes and the control that permitted the difference, then document any correction or broader remediation.

Worked example: Two applicants receive the same loan product on the same day, with identical documented risk factors. One pays a $300 discretionary fee and the other $100, a $200 difference. The pricing matrix permits neither a risk adjustment nor a promotional exception. Compliance investigates who set each fee, reviews comparable loans for a pattern, and assesses customer correction. The unexplained difference is an escalation trigger, not yet proof of intent.

Watch the distinction: Matching credit scores alone does not make two borrowers comparable. Loan terms, timing, documented risk, and authorized pricing adjustments also matter.

Reference: [1]

7. Apply flood insurance coverage

Mandatory flood insurance analysis follows the collateral and the loan, not the borrower's business label. Determine whether the lender and loan are subject to the flood rules, whether the security includes a building or qualifying mobile home, whether that structure lies in a special flood hazard area, and whether the community participates in the federal flood insurance program. A land parcel's location alone does not establish that the secured building is in the hazard area. Conversely, a commercial-purpose loan can trigger the requirement when it is secured by a covered structure. Once coverage applies, evaluate the required amount using the applicable rule and the insurable value and loan facts; do not invent an amount from the property address alone. Retain the flood determination, collateral description, insurance evidence, and any required notices.

Worked example: A bank lends to a bakery and takes its building as collateral. The flood determination places that building in a special flood hazard area, and the community participates in the federal program. The bank treats the secured building as the coverage trigger and obtains the required insurance analysis before proceeding. The bakery's commercial purpose does not remove that duty; an unsecured loan to the same bakery would require a different analysis.

Watch the distinction: A business loan is not automatically outside flood insurance rules. A covered building securing the loan can trigger them regardless of the borrower's purpose.

Reference: [1]

8. Build the finance charge

The finance charge measures the dollar cost of consumer credit under Regulation Z. Start with interest, then examine each fee for whether it is imposed as an incident to, or condition of, the credit and whether a specific exclusion applies. An origination charge retained from proceeds is ordinarily part of the cost; a charge genuinely payable in comparable cash transactions may have different treatment. Separate the note's face amount from the amount financed, because withholding a fee leaves the borrower with less usable money while repayment may still be based on the full note. That difference raises the effective cost. An annual percentage rate calculation also depends on payment timing, so a simple finance-charge-to-proceeds ratio is only an illustration unless the assumed cash flows support it. Verify classifications before using figures in disclosures.

Worked example: Assume a one-year, single-payment consumer loan with a $10,000 note. The bank withholds a $100 origination charge, so the borrower receives $9,900 and repays $10,500 after one year. Interest is $500; adding the $100 charge gives a $600 finance charge. Under these simplified cash flows, $600 ÷ $9,900 ≈ 6.06% for the year. Installments or different timing would change the annualized rate.

Watch the distinction: Using the $10,000 note as the amount received hides the withheld fee. The borrower has $9,900 to use and pays $600 for that credit.

Reference: [1]

9. Decide whether rescission applies

For a consumer credit transaction secured by a principal dwelling, ask why the credit is being extended and whether a statutory exemption applies. A covered nonpurchase loan secured by the home can carry a right to rescind, allowing eligible consumers to cancel within the applicable period after the required disclosures and notice. A loan used to acquire the dwelling is a residential mortgage transaction and generally falls outside that rescission right. Other transactions, including certain refinancings, require their own exemption analysis; the presence of home collateral alone is insufficient. Confirm the property is the consumer's principal dwelling, identify all parties with an ownership interest whose rescission rights may matter, and determine when the required materials were delivered. Keep rescission analysis separate from ordinary loan cancellation or underwriting decisions.

Worked example: A homeowner obtains a new consumer loan from another lender, secured by her existing principal dwelling, to renovate the kitchen. That is a candidate for rescission analysis because it is secured by an existing home and is not purchase money. Separately, she takes a loan to buy a different principal dwelling. The purchase loan generally falls within the residential mortgage transaction exception, so the same rescission conclusion cannot be carried over.

Watch the distinction: Every loan secured by a home does not carry the same rescission right. The dwelling's use and the loan's purchase or nonpurchase purpose matter.

Reference: [1]

10. Map mortgage disclosure stages

Mortgage disclosure work is an event sequence. First determine whether the transaction falls under the integrated disclosure rules and when the creditor has received the information that constitutes an application. That event starts the Loan Estimate workflow. Later changes require analysis rather than an automatic reissue: identify what changed, whether it is a permitted basis for revising estimates, which charges are affected, and whether the applicable timing conditions can be met. Near consummation, the Closing Disclosure presents the final transaction terms. Compare it with the latest valid estimate and investigate differences, including whether a correction or new waiting period is required under the governing rules. Preserve a timeline of information received, estimates delivered, borrower requests, and final terms. This makes the reason for each disclosure and revision auditable.

Worked example: Nina supplies the information that makes her home loan request an application, and the lender issues a Loan Estimate. She later asks to increase the loan amount from $250,000 to $265,000, a $15,000 change. The lender records her request, evaluates its effect on pricing and whether it permits a revised estimate, then prepares the Closing Disclosure from final terms. The changed amount alone does not excuse an unsupported fee increase.

Watch the distinction: Any change before closing does not automatically reset every disclosure tolerance. Identify the permitted revision reason and the costs it actually affects.

Reference: [1]

11. Evaluate ability to repay

Ability to repay concerns the borrower's capacity to make the scheduled payments on a covered dwelling-secured consumer loan. Evaluate and verify relevant income or assets, employment where relied upon, existing obligations, the proposed payment, and other required underwriting factors using reliable records. Equity is valuable collateral, but it does not show that the borrower can meet monthly obligations without selling or refinancing the home. Qualified Mortgage status is a separate classification with defined product and underwriting criteria. A loan's failure to qualify as a QM does not, by itself, prove that no reasonable ability-to-repay determination was made; similarly, calling a product QM does not replace evidence for the determination. Keep the payment calculation, verification sources, debts, and decision rationale together so a reviewer can trace the conclusion.

Worked example: A homeowner offers a property worth an assumed $500,000 against a proposed $150,000 loan, leaving $350,000 of apparent equity. Her stated income is $6,000 per month but has not been verified, and her existing debts are unknown. The bank cannot infer repayment capacity from the $350,000 equity figure. It obtains reliable income and debt records, calculates the proposed payment, evaluates ability to repay, and separately tests QM classification.

Watch the distinction: Strong collateral does not substitute for verified repayment capacity. Ability to repay evaluates the payment burden during the loan, even when foreclosure recovery looks likely.

Reference: [1]

12. Handle an open-end billing dispute

A charge on a credit card account is an open-end credit issue; a debit from a checking account may instead be an electronic transfer issue. For a qualifying credit card billing-error notice, identify the disputed entry, preserve when and how the customer notified the creditor, and investigate using transaction and merchant records. If the charge is wrong, correct the account and associated charges as required, then communicate the result. If the creditor concludes the bill is correct, its explanation must address the dispute rather than merely repeat the merchant's position. A disagreement over goods or services can raise different credit-card rights from a duplicate or unauthorized billing entry, so classify the allegation carefully. The CRCM practice questions can reinforce that payment-rail distinction.

Worked example: A cardholder's statement shows the same $75 purchase twice, creating $150 in charges for one purchase. She disputes the second entry through the creditor's billing-error channel. The creditor compares authorizations, clearing records, and merchant evidence. If only one purchase occurred, it removes the duplicate $75 and any related charges required to be corrected, then reports the investigation result. No checking-account debit is involved.

Watch the distinction: A credit card billing error should not be routed as a checking-account Regulation E dispute merely because a card was used. Identify the account being charged.

Reference: [1]

13. Test HMDA reportability

HMDA reportability is a sequence of coverage tests. First determine whether the institution is covered for the reporting period. Next classify the request or transaction: what credit was sought, whether a dwelling secures it, and whether the transaction fits a reportable loan or application category rather than an exclusion. Then confirm the property's and transaction's relevant characteristics before recording fields. A customer's stated wish to improve a home does not automatically turn an unsecured personal loan into a reportable mortgage transaction. Nor does every request from a mortgage applicant belong in the loan application register. Use the application and collateral documents to support classification, and apply the same logic to approvals, denials, withdrawals, and completed loans. Coverage decisions should be reproducible from the file, not inferred from the lending department that handled it.

Worked example: Assume the bank is a covered HMDA reporter. It receives an application to buy a dwelling with a loan secured by that dwelling, plus a separate $8,000 unsecured personal-loan request from the same customer. The bank evaluates the home-purchase application for HMDA reporting and records it if the transaction tests are met. It does not add the unsecured $8,000 request solely because the customer also sought a mortgage.

Watch the distinction: A loan handled by the mortgage team is not necessarily HMDA reportable. Institution, transaction, collateral, and exclusion tests control the answer.

Reference: [1]

14. Validate HMDA data fields

A HMDA data field should describe the event that actually occurred, supported by a traceable source. For action taken, reconstruct the chronology: what the applicant requested, what the bank decided, whether an offer was made, and when the applicant withdrew. A system label can be wrong even when the underlying application history is sound. Correct a coding or interface error in the reporting record without rewriting the customer's actual conduct. Conversely, if the file reveals a genuine later decision that changes the transaction status, update the field based on that evidence. Check supporting documents, dated communications, and system logs. Once a mapping defect is confirmed, search the broader population that used the same workflow. A single corrected record does not address a rule that has miscoded many similar applications.

Worked example: The file contains a dated message in which Omar withdraws his application before underwriting reaches a decision. The reporting system lists “denied” because its status mapping treated all closed files alike. The bank verifies that no denial preceded the withdrawal, corrects action taken to withdrawn, and searches other files closed through the same status code. If an earlier denial existed, the chronology would require a different conclusion.

Watch the distinction: The latest system status is not always the reportable event. Dated applicant communications and credit decisions establish what happened and in what order.

Reference: [1]

15. Define CRA assessment areas

Under the CRA framework the Federal Reserve says it continues to apply, assessment-area analysis starts with the bank's main office, branches, and deposit-taking facilities, along with surrounding geographies that meet the applicable delineation criteria. Map those locations and the areas they serve, then test the proposed boundaries against geographic and demographic facts. A new branch can require revisiting the delineation; advertising into a county, by itself, is not the same physical footprint. Review lending distribution within the assessment area, but do not draw boundaries simply to exclude low- or moderate-income neighborhoods. Keep the delineation rationale and branch-change dates documented. The Federal Reserve's CRA implementation page says it continues to apply the 1995 regulations, so do not base current controls on the enjoined 2023 framework.

Worked example: A bank with branches in County A opens a deposit-taking branch in neighboring County B. It maps the new branch, nearby geographies, and existing assessment-area boundary, then evaluates whether the boundary needs revision under the 1995 framework. A separate online advertising campaign reaches County C but adds no branch or deposit-taking facility there. The campaign may inform lending analysis; it does not alone create a branch-based assessment area.

Watch the distinction: A marketing footprint does not automatically define a CRA assessment area. The applicable framework gives branch and deposit-taking locations a central role.

Reference: [1]; [3]

16. Evaluate CRA activity

CRA analysis asks how the bank serves its entire community, including low- and moderate-income neighborhoods and people, within the applicable evaluation framework. Raw loan count is only a starting point. For retail lending, examine geographic and borrower distributions against relevant opportunities and comparators; a percentage has little meaning without the market and product context. Community development activity has its own qualifying-purpose analysis. Financing an eligible affordable-housing project may qualify, while an ordinary mortgage does not become community development solely because the bank originated it. Avoid double counting and retain evidence of the project's purpose, beneficiaries, and bank participation. Interpret performance using the operative 1995 CRA regulations described by the Federal Reserve, recognizing that evaluation methods can differ by bank type and size. The goal is a supported assessment, not a mechanical target invented from one count.

Worked example: A bank makes 100 mortgages in its assessment area; 12 are in low-income tracts, so that tract share is 12 ÷ 100 = 12%. Analysts compare the share with local housing opportunities and peer activity before interpreting it. Separately, the bank finances a documented affordable-housing project that meets the applicable community-development criteria. They assess that project on its merits rather than labeling all 100 mortgages community development.

Watch the distinction: High lending volume alone does not establish strong CRA performance. Distribution and qualifying community-development purpose need their own evidence and context.

Reference: [1]; [3]

17. Recognize unfair, deceptive and abusive conduct

Unfair, deceptive, and abusive conduct call for distinct analyses. Unfairness focuses on substantial consumer injury that people cannot reasonably avoid and that is not outweighed by countervailing benefits. Deception asks whether a representation, omission, or practice is likely to mislead a reasonable consumer and is material. Abusiveness addresses interference with understanding or unreasonable advantage taken from specified customer vulnerabilities or reliance. A complaint can reveal facts for any of these tests, but the complaint itself proves none of them. Examine the full customer journey: advertisement, enrollment screen, agreement, actual fee, and servicing communications. A disclosure buried after a prominent contrary promise may fail to cure the initial impression. Document how customers encountered the claim, what they paid, and whether the practice affected others.

Worked example: A deposit page prominently says “no monthly fee.” After enrollment, a mandatory $12 monthly charge appears on statements. Over six months, one customer pays $12 × 6 = $72. The bank compares the claim with the enrollment terms and statement history, investigates likely consumer understanding and materiality, and identifies similarly enrolled customers. A later disclosure of the charge does not automatically resolve the misleading headline.

Watch the distinction: Every disliked fee is not automatically a UDAAP violation. Analyze the representation, avoidability, injury, or abusive mechanism against the actual customer experience.

Reference: [1]

18. Trace a UDAAP issue across a product

A product-level UDAAP issue requires a path from the customer-facing practice to actual outcomes. Identify where the claim or omission entered the journey, what the system charged, how statements described it, and when staff learned of the mismatch. Stop or correct the misleading presentation, then define the affected population using enrollment dates, product versions, fee codes, and exceptions. Transaction records provide the basis for calculating customer remedies; account averages cannot replace individual histories when charges differ. Consider related effects, such as fees caused by the original charge, where the facts and applicable remedy require them. Test the revised display with realistic accounts and confirm that downstream servicing messages agree. Track whether customers were notified and whether the defect recurs after release.

Worked example: A screen omits a $15 fee that appears on statements for 400 enrolled customers. The bank finds that 120 customers paid it once and 280 paid it twice. Direct fee refunds total (120 × $15) + (280 × $30) = $10,200, before any separately identified related charges. It fixes the screen, reconciles the affected population to transaction records, and tests new enrollments and statements for consistency.

Watch the distinction: Correcting the screen alone leaves past harm unresolved. The bank must identify who saw the defective presentation and what each customer was actually charged.

Reference: [1]

19. Use the BSA program pillars

The Bank Secrecy Act program joins five mutually supporting elements: internal controls, a designated responsible officer, training, independent testing, and risk-based customer due diligence. Controls translate risks into actions such as identifying unusual transactions, retaining evidence, and escalating alerts. The officer coordinates the program and ensures identified weaknesses receive attention. Training gives staff the judgment to recognize and handle the situations their roles encounter. Independent testing checks whether the design and operation work beyond the team's own assurances. Customer due diligence supports understanding of expected activity and ongoing risk. A gap in one element can weaken the others: trained staff cannot review alerts that the system never creates. The CAMS study guide provides related anti-money-laundering practice; a bank's own risk profile still drives its control design.

Worked example: A bank launches international wires. Staff complete training, but no monitoring rule examines wire patterns and no independent test covers the new product. Training addresses one program element, not the missing controls or testing. The BSA officer assigns a monitoring design based on customer and corridor risk, ensures alerts have owners, and schedules independent testing of alert generation, investigation, and escalation.

Watch the distinction: A completed training roster does not establish an effective BSA program. Training cannot compensate for absent transaction controls, oversight, due diligence, or independent testing.

Reference: [1]

20. Verify customers and understand ownership

At account opening, identity verification asks whether the bank has obtained and checked the information needed to form a reasonable belief about the customer's identity. For a legal entity, that inquiry concerns the entity; verifying an authorized signer does not by itself establish who owns or controls it. Applicable beneficial-ownership procedures gather and verify information about relevant owners and a control person, subject to the rule's definitions and exceptions. Customer due diligence then uses the relationship's purpose, expected activity, and risk information to support ongoing monitoring and updates when warranted. These tasks answer different questions: who is the customer, who stands behind the entity, and whether later activity fits the relationship. Keep the entity documents, signer authority, ownership information, and risk assessment linked so gaps can be found before the account is treated as complete.

Worked example: A company provides incorporation papers and names Priya as an authorized signer. The bank verifies Priya's identity and authority, but the file contains no information about the company's relevant owners or control person. Staff complete the applicable legal-entity ownership review, check for any rule-based exception, and document the expected business activity. The signer check supports account access; it does not finish the ownership or ongoing due-diligence work.

Watch the distinction: A valid corporate charter and verified signer do not answer every customer-due-diligence question. Entity identity, beneficial ownership, and expected activity require separate analysis.

Reference: [1]

21. Separate reporting from suspicious-activity analysis

Currency transaction reporting and suspicious activity analysis answer different questions. For a currency report, identify cash transactions by or on behalf of the same person, determine what the bank knows occurred during the relevant business day, and apply the applicable aggregation rule and reporting threshold. Do not combine cash received with cash paid out without checking the rule for each direction. Suspicious activity analysis instead asks whether the pattern, purpose, and available explanation warrant escalation and a reporting decision. Repeated deposits just below a reporting threshold can suggest structuring, but size alone does not establish intent. Preserve transaction records, examine related accounts and channels, seek an appropriate explanation, and document the decision. A currency report does not resolve the suspicion, and a suspicious activity decision does not excuse a required currency report. The CAMS study guide offers related financial crime concepts.

Worked example: Assume a hypothetical rule requires a currency report when one person's cash deposits at the bank exceed $10,000 in a business day. At two branches that day, a customer deposits $6,200 and $4,100. Their combined deposits equal $10,300, so the assumed reporting trigger is met. The customer says they split the deposits to avoid reporting. Investigate and document possible structuring separately, regardless of whether the currency report is filed.

Watch the distinction: Treating each branch deposit in isolation misses aggregation. Treating a filed currency report as the end of the matter misses the separate question of suspicious intent.

Reference: [1]

22. Resolve a sanctions alert

A screening alert is a lead for investigation, not a finding that the customer or beneficiary is sanctioned. Compare reliable identifiers such as date of birth, address, entity registration, and other available details; document why they confirm or rule out the match. If the person is confirmed, identify the particular restriction and any property interest in the transaction. A blocked person's interest can require the bank to hold property rather than release it. A prohibited transaction without a blockable property interest may instead require rejection. These dispositions are different, and the governing sanctions program determines which applies. Escalate uncertain matches before funds move, retain the evidence used to decide, and follow applicable reporting requirements. Screening only at onboarding can miss later list changes or payment participants, so review the relevant parties when processing the transaction.

Worked example: A $7,500 wire names a beneficiary who shares a listed person's name. The bank verifies a different birth date and different identifying address, with no other matching identifiers. It records a false match and processes the wire if no other restriction applies. If the beneficiary were confirmed as blocked and had an interest in the funds, the bank would stop the transfer, block the property, and escalate the required reporting review.

Watch the distinction: Blocking every name match can freeze legitimate funds. Clearing a match on a single weak detail can release restricted property; use reliable identifiers and the specific program's restriction.

Reference: [1]

Foundational Compliance

23. Obtain valid electronic consent

For a consumer disclosure that a law requires in writing, electronic delivery generally needs more than a usable email address. E-SIGN calls for affirmative consent after the consumer receives specified information about the electronic process, including withdrawal, paper copies, and the hardware and software needed to access and retain records. The consent method should reasonably demonstrate access to the format the bank will use. The disclosure itself must remain accessible and capable of retention for the required period. Work through the sequence: identify whether the law permits electronic delivery, obtain valid consent, confirm the chosen format, deliver the record, and retain evidence of delivery and consent. A consumer may later withdraw consent under the disclosed terms. The CRCM content outline includes electronic records and signatures among its foundational topics.

Worked example: A customer types an email address into a deposit application but skips the electronic-consent step. The bank has no affirmative consent or demonstration that the customer can open its PDF disclosures. It sends the required disclosure through a valid paper channel and records that choice. If the customer later completes the consent process, future eligible disclosures may use the agreed electronic format, subject to the applicable delivery rules.

Watch the distinction: An email address proves only that the bank has an address. It does not prove consent, access to the disclosure format, or delivery of a retainable record.

Reference: [1]

24. Explain a check hold

Funds availability rules govern when a customer may use deposited funds; they do not guarantee that the check will be paid. Start by identifying the deposit type, channel, account status, and ordinary availability schedule. Then determine whether a recognized exception supports a longer hold, how much of the deposit it covers, and what notice the customer must receive. An account's age may matter, but a teller should establish the facts rather than select an exception from a system menu without support. The notice should give the reason and the expected availability date under the applicable rule. Keep the hold calculation separate from the bank's collection and return process: a check can be returned after funds become available, and a valid hold can end before the bank learns the final outcome. Review any later extension on its own basis.

Worked example: A customer deposits a $4,000 paper check into an account opened recently. Assume the bank confirms that the account meets the applicable new-account exception and that its calculated release date is Friday. The teller gives the required notice stating the reason and Friday's date, and records the hold. On Friday the funds become available under that calculation; availability does not mean the paying bank has guaranteed the check.

Watch the distinction: A hold is a timing control, not insurance against a returned check. Calling an account 'new' without verifying the applicable definition can also produce an unsupported hold.

Reference: [1]

25. Use and furnish consumer-report data

Obtaining a consumer report and furnishing account information are separate activities with separate tests. Before requesting a report, establish a permissible purpose tied to the transaction, such as evaluating a genuine credit application. Access should match that purpose and be limited to authorized users. Once the bank furnishes information, it must maintain reasonable accuracy and respond appropriately to disputes. Trace a challenged balance or status to payment records, posting dates, account terms, and prior corrections; do not simply repeat what the furnishing system currently displays. A dispute received through a consumer reporting agency and one received directly may have different procedural paths, so classify the route and the information disputed. Correct inaccurate data and provide required updates to affected reporting agencies. A lawful reason to obtain a report never validates later inaccurate furnishing.

Worked example: A consumer applies for a loan, giving the lender a permissible purpose to request a report. Months later, the bank furnishes the loan as delinquent despite a payment record showing it was paid in full before the reported period. On dispute, the bank reconciles the ledger, changes the delinquent status, sends the appropriate correction to the reporting agencies, and examines whether the mapping error affected other loans.

Watch the distinction: Permissible access to a report does not excuse furnishing errors. Conversely, correcting a furnished tradeline does not establish that the original report request had a permissible purpose.

Reference: [1]

26. Respond to identity-theft signals

Identity theft controls work by combining signals, not by treating any one credential as conclusive. A new device, recent address change, unusual transaction, failed challenge, or inconsistent identifying data can alter the risk of an otherwise authenticated session. Determine whether the signals fit an account takeover or an ordinary customer change. Check the source and timing of the address change, verify identity through an independent channel already trusted by the bank, and limit the risky action while the review is unresolved. Avoid sending a confirmation solely to the newly changed contact point. Record the signals, the verification method, the decision, and any account safeguards so staff can recognize repeated attempts. If a consumer report presents an address discrepancy, resolve its relationship to the applicant's identity before relying on it for a decision. A passed login is useful evidence, but stolen credentials can pass.

Worked example: A customer account logs in from a new device, changes its mailing address, and requests a $9,000 transfer ten minutes later. The bank pauses the transfer and calls a previously verified number. The customer denies both actions, so the bank prevents release, secures access, and investigates the attempted takeover. The successful password login does not overcome the independent denial and the sequence of red flags.

Watch the distinction: Sending a code to the newly entered phone number can confirm only that the actor controls that number. Use an independent, previously trusted contact or verification route.

Reference: [1]

27. Identify debt-collection coverage

Debt collection coverage begins with who is collecting and whose debt it is. A bank collecting a loan it originated generally occupies a different position under the Fair Debt Collection Practices Act from an outside business collecting debts owed to others. Status can depend on the collector's business, how the debt was acquired, and whether a creditor uses another name that suggests a third party. Assignment for collection does not itself erase these distinctions. Identify the actor and the debt's history before applying FDCPA duties concerning communications, representations, validation, and disputes. Then assess the conduct under other applicable consumer protection rules even if the bank is outside the FDCPA definition of debt collector. A false threat or misleading amount can still create a compliance problem. Review scripts, call records, payment histories, and complaints to test what the consumer actually heard.

Worked example: A bank calls about its own overdue loan. An outside agency then receives the account for collection and calls the borrower. The bank reviews its calls for accurate balances and fair conduct; the agency also assesses its FDCPA duties as a third-party collector. If both scripts claim a $600 fee that the contract does not permit, both actors must correct the claim, even though their statutory classifications differ.

Watch the distinction: Assuming every collection call is governed by the same statute obscures actor-specific duties. Assuming a creditor has no conduct limits because it collects its own debt is equally unsafe.

Reference: [1]

28. Apply housing and accessibility protections

Residential lending decisions and access to banking facilities present related but distinct civil rights questions. The Fair Housing Act addresses discrimination in covered residential real estate transactions, including treatment based on familial status. Review whether the applicant met the bank's stated credit criteria, who made the decision, and whether comparable applicants received different treatment. Accessibility duties address whether a person with a disability can use the branch, service channel, or communication method on applicable terms. Examine the physical route, available assistance, and feasible correction for the access barrier. One investigation should not substitute for the other: a compliant credit file does not establish accessible service, and an accessible branch does not validate a discriminatory denial. Preserve decision records and customer accounts of the barrier, identify affected customers, and remedy each problem through its own legal and operational path.

Worked example: A qualified home-loan applicant is denied after an employee says the bank prefers borrowers without children. The same branch has no accessible customer route for a wheelchair user. The bank compares the applicant's file with its underwriting criteria and similar files, then addresses the familial-status decision. It separately assesses the branch route and provides accessible service while correcting the physical barrier under applicable requirements.

Watch the distinction: Grouping both complaints as one generic fairness issue can hide two distinct duties. Familial status concerns the residential lending decision; disability access concerns the customer's ability to obtain service.

Reference: [1]

29. Examine settlement-service referrals

Settlement-service referral analysis asks what was paid, for what work, and whether the payment depends on steering business. A fee for each referred closing is a strong signal of compensation for referrals under RESPA's settlement-service restrictions. Genuine payment for actual services requires evidence of the services and a defensible amount; a label such as 'marketing' does not change a referral payment's function. Common ownership between providers raises a separate affiliated-business analysis. An arrangement may require an appropriate disclosure, freedom of provider choice, and limits on the benefits received through the referral. Map the parties, the covered transaction, the flow of money, and any required use before deciding. Review loan officer incentives and customer communications because an arrangement can appear optional on paper while staff present the provider as mandatory. Document both the legal structure and actual practice.

Worked example: A title company pays a loan officer $50 for each mortgage closing sent to it. Twenty referrals yield $1,000, calculated as 20 × $50. Because payment rises with referrals rather than documented services, the bank stops the arrangement and reviews affected files. If the bank also owns part of the title company, it separately tests the affiliated-business conditions; ownership does not make the per-referral fee permissible.

Watch the distinction: Calling a referral fee a marketing allowance does not resolve its purpose. Nor does an affiliated-business disclosure authorize separate payments for steering customers to the affiliate.

Reference: [1]

30. Track mortgage servicing and insurance

Servicing begins after origination and creates its own payment, escrow, transfer, and insurance questions. Reconstruct the loan ledger around a servicing transfer: what the prior servicer received, what it transmitted, what the new servicer posted, and when any shortage or fee appeared. A transfer notice does not cure a misapplied payment. For an escrow error, compare the payment instruction, escrow analysis, disbursement history, and account balance, then correct resulting charges or credit consequences as appropriate. A private mortgage insurance request requires a separate review of the loan's coverage, payment history, property value or balance conditions, and any applicable cancellation route. Do not assume the answer from the original Loan Estimate or Closing Disclosure, which described terms at origination. Keep the borrower's error claim, information request, and insurance request distinct so each receives the response its rules require.

Worked example: A borrower pays $1,200 to the old servicer before transfer; the new servicer posts only $1,000 and assesses a $35 shortage fee. Records confirm the missing $200, so the bank credits $200 and reverses $35, a $235 account correction. It then evaluates the borrower's separate PMI cancellation request using the applicable loan and payment facts, rather than treating the ledger repair as a PMI decision.

Watch the distinction: A servicing transfer does not reset the borrower's payment history. Correcting escrow or posting records also does not answer a separate private mortgage insurance cancellation request.

Reference: [1]

31. Control disclosure of customer information

Customer information may leave a bank for different reasons, and each route has its own legal test. For a marketing partner, identify the data, purpose, recipient, and whether a privacy notice, exception, or customer choice permits the sharing under the applicable privacy framework. Limit disclosure to the authorized purpose and account for onward use. A government request for account records raises a different question under financial-records law: identify the requesting authority, legal process, scope, any customer notice or exception, and required records of disclosure. An agency letter is not interchangeable with customer consent or a commercial sharing permission. Classify the request before production, preserve the exact records and period supplied, and protect unrelated customer information. Operationally, the bank needs a traceable decision showing who approved release and which legal basis supported it, even when both requests arrive on the same day.

Worked example: A marketing firm asks for customers' balances and emails; an agency separately requests one customer's statements for a stated period. The bank assesses the firm's proposed use against its privacy permissions and does not send data merely because it has a vendor contract. It validates the agency's authority and requested scope, then produces only records supported by the applicable financial-records process, logging the production.

Watch the distinction: A government seal does not remove the need to verify process and scope. A vendor contract does not itself supply a privacy exception or customer sharing choice.

Reference: [1]

32. Protect information through vendors

When a service provider stores bank information, the bank still needs to understand the information's sensitivity, who can reach it, and how the provider detects and contains misuse. Start with the data flow: account records, administrator privileges, subcontractors, backups, and deletion at exit. Match controls to those risks, including strong administrator authentication, limited access, logging, encryption where appropriate, incident escalation, and regular access review. Due diligence establishes the provider's capabilities before work begins; contract terms make expected controls and evidence enforceable; ongoing monitoring tests whether the controls actually operate. A questionnaire alone does not prove that a stated safeguard is enabled. Review independent assessments, configuration evidence, incidents, and remediation dates. If a weakness remains, assess exposure and temporary restrictions rather than assuming the vendor's acceptance of the risk settles the bank's responsibility.

Worked example: A storage vendor holds 40,000 account files and permits administrator login with only a password. The bank identifies broad access to sensitive records, requires stronger authentication and narrower privileges, and restricts new uploads until controls are verified. A later configuration report and observed login test show the change is active. The bank records residual risk and continues access reviews because the data remains with the vendor.

Watch the distinction: Outsourcing storage does not outsource accountability. Accepting a vendor's statement that a control exists, without evidence it operates on the bank's environment, leaves the original exposure unresolved.

Reference: [1]

33. Distinguish military borrower protections

The Military Lending Act and the Servicemembers Civil Relief Act address different moments in a borrower's financial life. For a new transaction, determine whether the borrower is a covered person and whether the credit product falls within MLA coverage; then assess the applicable cost, disclosure, and contract restrictions at origination. For an obligation incurred before military service, examine whether SCRA protections apply because of service status and the timing of the debt. The same person can bring both questions to a bank, but one answer does not determine the other. Establish the service dates, application and origination dates, product type, and any co-borrower facts before changing terms. Document the source of status verification and the terms reviewed. Avoid applying an origination restriction retroactively to every older debt or overlooking an existing-obligation protection because the customer is seeking new credit.

Worked example: A servicemember applies today for a covered consumer loan and asks about a separate loan signed before entering service. The bank verifies current covered-borrower status and tests today's offer under MLA requirements. It then compares the earlier loan date with the service start date and evaluates SCRA relief for that obligation. Approval of the new loan does not answer whether the older loan's terms need adjustment.

Watch the distinction: Treating MLA and SCRA as one military discount misses product coverage and timing. A loan made during service and a debt incurred before service can require different analyses.

Reference: [1]

34. Protect federal benefits from garnishment

A garnishment order does not automatically make every dollar in an account available to the creditor. The bank first performs the applicable automated review for qualifying federal-benefit payments in the prescribed review period. Identify eligible deposits by their payment information, calculate the protected amount under the governing method, and compare it with the current account balance. Funds beyond the protected amount may require a separate assessment under the order and other law. The bank should not require a customer to prove the source of properly identified benefit deposits before performing the mandated review. Nor should it classify wages as federal benefits because they appear in the same account. Keep the order, deposit records, balance calculation, and notices together so the amount made available to the customer and any amount held can be reproduced.

Worked example: Assume an account has a $1,200 balance when an order arrives. Within the assumed review period, it received $900 in qualifying federal-benefit deposits and $300 in wages, with no other activity. Under an assumed rule protecting the lesser of qualifying deposits or the current balance, the protected amount is min($900, $1,200) = $900. The remaining $300 needs separate analysis under the order and applicable exemptions.

Watch the distinction: Protecting the entire $1,200 because benefits entered the account overstates the identified benefit amount. Freezing all $1,200 before the required account review understates it.

Reference: [1]

35. Screen insider and affiliate transactions

Insider credit and affiliate transactions expose a bank to different conflicts. Regulation O focuses on extensions of credit to covered insiders, including directors, and calls for attention to status, terms, approval, and aggregate exposure under applicable rules. Regulation W addresses covered transactions between the bank and its affiliates, including certain asset purchases, with limits and safeguards intended to protect the bank. Begin with the counterparty and transaction type: a director borrowing personally raises the insider-credit path; an affiliate selling an asset to the bank raises the affiliate path. Then determine whether exemptions or additional restrictions apply and document the economic terms. The bank should not infer fairness from a market-looking price without checking the specific relationship and required controls. The ARM study guide gives broader risk concepts that can help frame, but do not replace, these transaction-specific legal tests.

Worked example: A bank director requests a $75,000 personal loan, while a company under common control offers to sell the bank a $200,000 asset. The director's role sends the loan to Regulation O review of terms, approvals, and exposures. Common control sends the asset purchase to Regulation W analysis of coverage, valuation, limits, and safeguards. The two dollar amounts are recorded separately; combining them into one generic insider total would obscure the applicable tests.

Watch the distinction: A director is not automatically an affiliate, and an affiliate asset sale is not automatically an insider loan. Identify the legal relationship and transaction before choosing controls.

Reference: [1]

36. Classify leasing and investment sales

A lease, a loan, and an investment can appear at the same branch but create different disclosure and sales duties. For a consumer vehicle lease, establish whether the transaction falls within consumer leasing coverage and explain payment obligations, upfront amounts, end-of-term conditions, and any purchase option under the lease rules. Credit disclosures should not be copied into a lease merely because both involve periodic payments. For a nondeposit investment or insurance product, focus on what the customer could reasonably believe about principal, return, and deposit insurance. Separate the product from insured deposit accounts in signs, conversations, and materials; explain investment risk and the identity of the provider as applicable. A branch location and a bank employee's involvement do not convert a security or insurance contract into a deposit. Review the actual sales script and customer documents together.

Worked example: A branch offers a three-year consumer car lease with monthly payments and an end-of-term mileage charge. Staff provide the applicable lease information, including that charge. At the next desk, a customer considers a mutual fund beside a savings account. Staff explain that the fund's value can fall and that it is not an insured deposit; the savings account's status does not transfer to the fund.

Watch the distinction: Periodic lease payments do not make a lease a loan. Selling an investment inside a bank does not give it the deposit insurance or principal stability of a deposit.

Reference: [1]

37. Review payment-network obligations

Payment-network compliance requires identifying the rule attached to the transaction and the actor. Debit-card interchange questions concern the issuer, the card transaction, applicable issuer coverage, and network routing or fee restrictions. Determine which entity sets or receives the fee and which network processes the transaction before judging a proposed rate. Restricted internet-gambling controls address whether the bank or payment system participates in covered payment transactions and what policies and procedures identify and block restricted transactions. Merchant category data can be useful but may be incomplete; investigate merchant activity and transaction context rather than treating a code as conclusive. These programs can both involve payment processors, yet a permissible interchange amount says nothing about gambling controls. Document the network role, product, merchant type, and control evidence for each question so an exception in one program is not mistakenly carried into the other.

Worked example: A processor proposes a debit-card interchange fee for one issuer, while a different merchant's payment pattern suggests restricted internet gambling. The bank first determines issuer coverage and network terms to assess the fee. It separately checks merchant information, payment types, and blocking procedures for the suspected gambling activity. Even if the fee complies with the applicable debit rules, the merchant review remains open until the bank resolves the transaction classification.

Watch the distinction: A payment processor's single approval does not answer every network obligation. Fee limits concern debit economics; gambling controls concern identifying and preventing restricted payment transactions.

Reference: [1]

38. Classify securities-linked banking activity

Stock collateral does not by itself settle margin-credit requirements. Determine whether the pledged security is margin stock, whether the credit is for purchasing or carrying margin stock, who extends the credit, and which purpose and collateral rules apply. A borrower may pledge shares for an unrelated business need, so document the actual use of proceeds rather than guessing from collateral alone. A request to execute a securities trade poses a different issue: banking activities that involve securities must fit an applicable bank broker exception or use an appropriately authorized channel. A teller's customer service role does not automatically permit order execution. Keep the lending file's purpose evidence separate from the trade instruction and any referral record. If the customer changes the loan purpose or asks the bank to handle the trade, reassess the relevant activity before proceeding.

Worked example: A customer pledges publicly traded stock for a $60,000 loan, states that proceeds will buy more stock, and asks a teller to execute the purchase. The bank documents the securities and investment purpose, then applies the relevant margin-credit analysis to the loan. It routes the trade request through its permitted securities process. The collateral review does not authorize the teller to act as a broker.

Watch the distinction: Treating all stock-secured loans alike misses the credit's purpose. Treating a securities referral or trade as ordinary teller service misses the separate broker-activity question.

Reference: [1]

39. Explain deposit classification and coverage

Deposit insurance depends on the depositor's ownership capacity at the same insured bank, not simply the sum of every account bearing a name. Identify each account's legal ownership category, all owners and beneficiaries where relevant, and any other deposits in the same category at that bank. Apply the applicable insurance limit to the category and ownership share, subject to the actual account rules. Deposit classification for banking records and reserve purposes is a separate question based on the account's terms and function. Tax reporting is separate again: interest earned and ownership or taxpayer information determine reporting duties; insurance coverage does not decide taxable interest. Work through these classifications independently and reconcile account records before making a coverage statement. The CRCM practice questions can help reinforce the distinction between ownership analysis and other deposit controls.

Worked example: Assume a hypothetical insurance limit of $200,000 per depositor per ownership category at one bank, and no other deposits. Dana has $180,000 individually and a $90,000 joint account with Lee, owned equally. Dana's individual amount is $180,000; her joint share is $45,000, and Lee's is $45,000. Each is below the assumed category limit, so all $270,000 is covered under these assumptions. Interest reporting is evaluated separately.

Watch the distinction: Adding $180,000 and $90,000 and comparing $270,000 with one limit ignores ownership categories. Deposit insurance status also cannot substitute for account classification or tax reporting analysis.

Reference: [1]

40. Validate mortgage personnel and valuation

A sound mortgage file must support both the authority of the person who originated the loan and the independence of its valuation. For a bank employee, examine actual duties: taking an application and offering or negotiating residential mortgage terms may trigger loan-originator registration requirements, while a job title alone is inconclusive. Verify the person's registration status for the covered role and the period of activity. Separately, trace how the appraisal was ordered, who communicated with the appraiser, and whether compensation or pressure could have influenced the opinion. A high value is not proof of improper influence, but a request to raise value to make a loan work is a direct warning sign. Preserve communications, stop pressure, obtain an independent valuation response where appropriate, and assess whether affected loan decisions need review. Fix both personnel controls and valuation controls if both failed.

Worked example: An employee without the required registration negotiates rate and loan terms on a residential mortgage. A commissioned lender then tells the appraiser to increase the value by $30,000 to support approval. The bank confirms the employee's covered duties and registration gap, removes the employee from those activities pending correction, preserves the lender's message, and obtains an independent appraisal review before relying on the valuation.

Watch the distinction: An acceptable final loan-to-value figure cannot cure an unregistered covered originator or pressure on an appraiser. Each issue requires its own factual and control review.

Reference: [1]

41. Control outbound customer messages

Classify an outbound message by its purpose, channel, recipient and sending method before deciding which controls apply. A promotional text or automated call raises consent and revocation questions under telephone rules; a commercial email calls for accurate sender information and a working opt-out process. Telemarketing restrictions may also govern who can be contacted and how a request to stop calls is handled. A service alert can have a different purpose from an advertisement, but adding a sales pitch may change the analysis. Social-media posts need review for misleading claims, omitted conditions and customer-information exposure. Keep a channel-specific record of consent, message content and customer preferences. When a customer asks to stop, read the words and surrounding facts carefully: a broad request may require a broader response than a request limited to calls.

Worked example: Maya asks the bank to stop marketing calls. The next day, a campaign sends her promotional texts and emails. The bank suppresses calls immediately, examines whether her request also covered other marketing, and checks its text-consent and email opt-out records. It pauses any message lacking the required basis and honors a broader preference if that is what Maya communicated.

Watch the distinction: A call opt-out does not automatically settle text and email compliance. It also cannot be ignored for those channels if the customer's actual request clearly covered all marketing.

Reference: [1]

42. Map special privacy regimes

Privacy analysis begins with who holds the data, whose data it is, where the people are, and why it was collected. A child-directed online service may trigger children's privacy rules when it collects personal information, including a birth date tied to an identifiable user. Health information needs a separate classification: HIPAA duties depend on the entity and its role, so a bank record is not automatically a HIPAA record merely because it mentions health. Cross-border data may bring foreign privacy rules into scope based on an organization's establishment, the people involved, or the activity directed toward them. Map collection, consent, sharing, retention and deletion for each data flow. Ordinary bank privacy and security controls still matter, but they do not answer every special-regime question. Contract labels alone cannot replace analysis of the actual parties and information.

Worked example: A bank's child-directed app records named users' birth dates. Separately, an overseas wellness partner sends identifiable health information. The bank reviews the app's collection and parental-consent design under children's online privacy rules. For the partner feed, it identifies each party's role, the individuals' locations and the transfer purpose before determining applicable health and geographic obligations.

Watch the distinction: Calling all sensitive records “HIPAA data” skips the role test. Equally, treating ordinary bank privacy consent as sufficient for a child-directed app or cross-border transfer misses distinct requirements.

Reference: [1]

43. Manage branch and community commitments

A branch decision can create several independent compliance workstreams. For a closing, identify whether the site is a covered branch, then establish the required customer and regulator communications, supporting reasons, and evidence of delivery under the applicable rules. For an opening across a state line, test the bank's authority to expand, the proposed location, and any necessary approvals before committing to operations. A CRA-related agreement with a community group presents a third question: determine whether its parties, purpose and terms bring it within CRA Sunshine disclosure and reporting rules. Payment for a community project does not by itself answer that classification. Consider how a branch change affects the bank's assessment-area analysis under the operative CRA framework, while keeping that analysis separate from branch-closing and interstate-authority requirements.

Worked example: A bank will close its Oak Street branch, open a branch in another state and fund a neighborhood group's CRA-related project. Compliance creates three records: a closure plan with notices and reasons, an expansion review of authority and approvals, and an agreement review of parties, purpose and disclosure duties. It also checks whether the branch changes affect its CRA assessment-area delineation.

Watch the distinction: A favorable CRA purpose does not authorize interstate branching or excuse closure procedures. Likewise, describing a payment as a donation does not settle whether the related agreement requires disclosure.

Reference: [1]

44. Respond to integrity and security events

Integrity and physical-security events demand different first responses. For a suspected improper payment, preserve communications, identify the recipient, business objective and anything of value offered, and examine whether an intermediary was involved. A foreign official creates potential foreign-bribery exposure; an improper domestic inducement may raise other bribery or bank-conduct concerns. Do not wait for payment to clear before escalating an offer. A robbery calls for immediate protection of people, law-enforcement contact and the bank's established security response, followed by preservation of relevant records and review of physical safeguards. Compliance should coordinate the investigation without substituting its judgment for emergency responders. Where a payment also involves suspicious transactions, assess the separate financial-crime obligations on their own facts rather than assuming the anti-bribery review covers them.

Worked example: An employee emails an offer of money to a foreign official to obtain a bank contract. Compliance preserves the email, stops further contact and escalates the offer for anti-bribery investigation. Later, a branch reports a robbery. Staff prioritize safety, contact emergency responders and preserve security records. The two incidents receive separate owners and evidence trails.

Watch the distinction: An unpaid bribe offer can still be serious; waiting for a completed transfer loses evidence. A robbery investigation also cannot replace the immediate steps needed to protect staff and customers.

Reference: [1]

Compliance Management System (CMS)

45. Assign CMS accountability

A compliance management system works when decision rights match accountability. The board oversees the program, challenges material risk reports and ensures management has resources; it does not process individual disclosures. Senior management translates that oversight into staffing, procedures, control operation and timely fixes. The business that owns a product owns its compliant execution. Compliance interprets requirements, advises on design, monitors results and challenges an unsafe launch decision, with a clear route to escalate unresolved material issues. Separate these roles in approvals and issue logs so an advisory sign-off cannot be mistaken for ownership of a defective product. When deciding whether to launch, identify the defect, affected customers, available controls and residual exposure. Record who accepted or rejected the decision and what information reached the board.

Worked example: The board approves a new deposit strategy. Before launch, compliance finds that an advertised fee is absent from the account disclosure. Product management pauses release, corrects the disclosure and verifies the revised customer journey. Compliance records its challenge and retest. If management proposes launching despite the defect, the unresolved material risk is escalated through governance reporting.

Watch the distinction: A compliance review does not transfer the product's operating duty to compliance. Nor does board approval of a strategy approve every later disclosure, advertisement or customer outcome.

Reference: [1]

46. Assess inherent and residual risk

Inherent risk describes the exposure a product presents before considering controls. Assess the relevant failure, transaction volume, complexity, customer harm, distribution channels and pace of change. Residual risk is what remains after controls are considered, but a control earns credit only when its design addresses the failure and evidence shows that it operates. A procedure document may explain what employees should do; it does not show that disputes enter a queue or receive action. Test coverage, missed cases, overrides and timeliness, then reassess likelihood and impact. A simple rating matrix is useful only if its definitions and evidence are consistent. This distinction also appears in broader risk management practice: reducing one failure path may leave others, such as vendor outages or poor complaint classification, largely unchanged.

Worked example: A new transfer product handles 80,000 transactions monthly and initially has high error-handling risk. An automated queue captures disputes, assigns owners and is tested against a sample of incoming cases with no misses. That evidence supports a lower residual rating for intake failure. An untested written procedure would not justify the same reduction, and investigation quality still needs separate assessment.

Watch the distinction: High transaction volume is an inherent exposure, not proof of a control failure. A low residual rating is also unjustified when the only control evidence is a policy document.

Reference: [1]

47. Maintain an applicability inventory

An applicability inventory connects each obligation to a product, customer type, legal entity, state, delivery channel and transaction stage. Start with what the bank actually offers, then ask which rules govern solicitation, application, decision, servicing, reporting and termination. Record why a rule applies or does not apply, who owns the resulting control, and what business change would reopen the decision. Consumer mortgage controls should not be copied wholesale into business lending, yet business-credit and fair-lending obligations may still matter. Online delivery adds consent and record-access questions. Financial-crime controls also cross product lines; anti-money laundering controls can help frame that separate obligation family. Revisit the inventory when a bank adds a channel, vendor, customer segment or jurisdiction, because an old classification can become wrong while the procedure appears unchanged.

Worked example: A bank launches online loans for small businesses in two states. Its inventory identifies business-credit application and adverse-action duties, applicable fair-lending controls, electronic-delivery conditions and each state's relevant rules. It records that consumer mortgage disclosure workflows do not apply to these unsecured business loans on the stated facts, then assigns owners and review triggers for future product changes.

Watch the distinction: “Business loan” is not a blanket exemption from every credit rule. Conversely, applying every consumer mortgage form to a business product creates noise and can obscure the duties that actually govern it.

Reference: [1]

48. Turn rules into operating controls

A useful procedure turns a legal obligation into an observable sequence. Name the triggering event, the data needed to classify it, the owner, the required action, the system record and the exception route. For a notice process, an application decision may trigger a queue; a specialist verifies the correct notice type and address; the delivery system records what was sent and when. Controls should catch both missing cases and incorrect output. A reconciliation between decisions and notice records can reveal omissions that a sent-mail dashboard cannot. Define who investigates rejects, stale addresses and manual overrides, and how unresolved items reach compliance. Write the procedure at the point where an employee or system must decide. A broad instruction such as “comply with notice rules” leaves the actual control unspecified.

Worked example: A bank's procedure merely says to send required notices. It replaces that sentence with a workflow: the decision system creates a notice case, the lending team verifies the reason and address, and a delivery log stores the final version. Each day, unmatched decisions enter an exception queue. An owner resolves them and escalates failures that threaten the applicable deadline.

Watch the distinction: A procedure is not complete because it quotes a regulation. Without a trigger, owner, evidence and failed-delivery path, staff cannot consistently execute or prove the required action.

Reference: [1]

49. Target training to decisions

Training should follow the decisions a role actually makes. A teller deciding whether a check hold has a valid basis needs a different exercise from a mortgage employee coding whether an application was withdrawn. Build scenarios around the cues that change the answer, show the correct action and explain the consequence of choosing incorrectly. Use real error themes from monitoring, complaints and system changes, with customer details removed as needed. Attendance proves exposure to material, not competence or changed behavior. A short knowledge check can reveal confusion immediately; later file sampling shows whether the process improved. Compare results by role and error type, and adjust procedures if staff lack the information needed to decide. Repeating the same slide deck will not fix a missing system field.

Worked example: Tellers repeatedly apply a new-account check hold without recording its basis; mortgage staff code customer withdrawals as denials. Tellers practice choosing and documenting a hold reason. Mortgage staff classify dated application histories. After training, reviewers sample 20 files from each workflow and compare the same error types with the prior sample, investigating any remaining failures.

Watch the distinction: One completion percentage cannot show whether employees learned the right decisions. Training also cannot repair a system that never presents the facts employees need to classify a case.

Reference: [1]

50. Oversee a third-party lifecycle

When a vendor performs a regulated task, the bank remains responsible for the customer outcome. Before selection, assess the vendor's process, staffing, data handling, capacity and evidence that it can perform the specific duty. The contract should define service levels, records, error notification, audit access, subcontracting and cooperation with remediation. During operation, compare the vendor's output with the bank's source events; a report that notices were “processed” is weaker than matched evidence of correct content and delivery. Escalate errors by severity and affected population, and retest fixes. Exit planning matters before a failure: identify the data, systems and people needed to move work back to the bank or another provider. Oversight intensity should follow the potential customer and regulatory harm.

Worked example: A vendor will send adverse-action notices. The bank tests a sample of mock decisions against notice content and addresses before launch. Its contract requires delivery evidence, prompt exception reporting and access to records. Once live, the bank reconciles decisions to notices and samples reasons. It keeps templates and data-export steps ready so another team can continue delivery if the vendor fails.

Watch the distinction: A vendor contract can allocate tasks, but it cannot transfer the bank's compliance accountability. Reviewing the vendor only at onboarding misses errors that appear after volume or systems change.

Reference: [1]

51. Distinguish monitoring from testing

Monitoring watches a control during routine operation; testing challenges whether that control works as intended. A daily dashboard might count items queued, late items and unresolved exceptions. Those measures help an owner intervene, but they depend on the system's definition of success. A tester selects source transactions, traces them through the workflow and checks the actual customer-facing result. Sampling should include exceptions, manual cases and changes in channel or address, not just easy completed records. Independence matters because the operator may overlook a flawed success measure. When testing finds a gap, determine whether the control failed to execute, failed to detect an error, or measured the wrong event. Feed the result back into the dashboard and procedure so routine monitoring becomes more informative.

Worked example: The notice dashboard reports 100% of scheduled notices queued. A tester traces 25 decisions to the mailed output and finds five notices addressed to old customer records. The observed sample failure rate is 5 ÷ 25 = 20%. Queue monitoring worked as defined, but delivery accuracy did not; the bank investigates address sourcing and affected customers.

Watch the distinction: A green dashboard can accurately report queue completion while customers still receive wrong notices. Testing should examine the underlying obligation, not merely recalculate the dashboard's own metric.

Reference: [1]

52. Interpret an exception sample

An exception rate describes what was observed in the selected files. Divide exceptions by files reviewed, state the sampling method and define exactly what counted as a failure. A random sample supports a different inference from a sample chosen because complaints or high-risk products made those files suspicious. Even with random selection, the sample rate is an estimate, not an exact count of affected customers. Stratify or expand review when products, periods, channels or system versions may differ. To assess impact, locate the failed control's start and end dates, identify the full eligible population, and test whether exceptions cluster around a specific cause. Severity also matters: one missed legally significant notice may warrant faster action than several harmless formatting issues. Practice applying this distinction with CRCM practice questions.

Worked example: A hypothetical random sample of 40 loans contains six files without the required review. The observed exception rate is 6 ÷ 40 = 0.15, or 15%. The bank records how the 40 were selected, then checks whether all six share a channel or release date. It does not multiply 15% by the full portfolio and call that an exact affected count.

Watch the distinction: Six exceptions in 40 files do not prove that precisely 15% of every loan failed. A targeted sample is especially unsuitable for projecting a portfolio-wide rate.

Reference: [1]

53. Read complaints as risk signals

A complaint is both an individual request for resolution and evidence about a process. First capture what happened, when, through which channel, and what outcome the customer seeks. Verify the account record and resolve the customer's issue without waiting for a trend study. Then code the underlying allegation consistently, such as an undisclosed fee, failed opt-out or delayed notice. Repeated wording across complaints can point to a shared screen, script or vendor defect, even when complaint counts are small. Compare reports with transaction volume and with customers who may never complain. A rise can reflect a genuine problem, easier reporting, or both, so inspect confirmed cases and process evidence. Broader review should identify the affected period, population, harm and needed remediation.

Worked example: Three customers say a $25 monthly fee appeared only after enrollment. The bank verifies the screen shown to each customer and refunds each confirmed charge, $25 × 3 = $75 for those reports. It then tests the enrollment path and queries every account charged while that screen was live. The three complaints establish a lead, not the total exposure.

Watch the distinction: Resolving three complainants does not establish that only three people were affected. Counting complaints without checking the shared design can leave the same fee problem running.

Reference: [1]

54. Find the control failure

Root-cause analysis asks why a control allowed an error, rather than naming the employee or event nearest to it. Reconstruct the transaction path from the source event to the required output. Compare timestamps, data fields, release notes, handoffs and exception logs before and after the first failure. A cluster beginning with a platform change points toward an interface or mapping defect; isolated failures across periods might suggest another cause. Test the theory by reproducing a case or tracing a known good case through both versions. Then ask why existing monitoring failed to detect the defect promptly. A complete fix repairs the failed mechanism and its detection, identifies past affected customers, and verifies later transactions. Retraining helps only when a decision actually depended on staff knowledge or behavior.

Worked example: Ten disclosures were late immediately after a platform release. The source system recorded each triggering date, but the new interface sent a blank date to the notice queue. No employee received the cases. The bank repairs the field mapping, identifies every transaction since release, handles missed disclosures and tests new cases with populated dates before closing the defect.

Watch the distinction: Calling the ten late notices “staff error” confuses the outcome with its cause. Training employees who never saw the cases would leave the broken interface and missed-case detection unchanged.

Reference: [1]

55. Close an issue with evidence

Issue closure requires evidence across three separate questions. First, were affected customers identified and made whole under the applicable remedy? Second, was the mechanism that created the error repaired? Third, does later evidence show the repair works in normal operation? Track each workstream with an owner, completion criterion and records, including any customers who could not initially be reached. A refund ledger proves payments were made; it does not prove that billing logic stopped charging. A code-change ticket proves deployment; it does not prove the right population or scenarios were tested. Validation should sample transactions after the fix, including edge cases that triggered the original failure. If the test finds a recurrence, reopen the cause analysis rather than declaring a narrower success.

Worked example: The bank finds 120 duplicate $8 fees and refunds $960, assuming one duplicate per customer. That completes the identified refund work. The billing rule still fires twice, so the issue remains open. After correcting the rule, testers run the original triggering scenario and inspect later live bills; only a clean result supports closing the control-repair work.

Watch the distinction: A completed refund is not evidence that future customers are safe. Closing an issue before the faulty rule is repaired and validated invites the same harm to recur.

Reference: [1]

56. Manage regulatory change status

Regulatory change work starts by identifying the status of the legal text. A proposal invites comment; an adopted rule has final text, but its effective date and any separate applicability dates determine when provisions operate. Litigation, agency action and later amendments can alter that picture. Record the source, affected products, operative provisions, dates and any uncertainty before changing controls. The CRA illustrates the need for this sequence: the Federal Reserve's CRA implementation page says it continues to apply the 1995 regulations to banks and describes a proposal concerning the 2023 rule. A historical date attached to the 2023 framework is therefore not enough to treat that framework as current operating law. Maintain a change log so management can see what is binding now, what is proposed, and which future events require another review.

Worked example: A team proposes rebuilding CRA monitoring around a date quoted from the 2023 rule. The change owner checks the Federal Reserve's stated implementation status and finds that it continues to apply the 1995 regulations. The bank keeps current monitoring aligned to that framework, logs the proposed change separately and assigns an owner to watch for a later operative update.

Watch the distinction: Publication of final text does not mean every provision is presently applicable. Copying a former future date from a rule without checking implementation and litigation status can misdirect current controls.

Reference: [1]; [3]

57. Report risk without hiding context

A useful risk report preserves both the trend and its meaning. Define each metric, its time period, source and denominator: complaint counts, confirmed errors, affected customers and overdue fixes measure different things. Show severity and customer impact alongside volume so a low-frequency serious failure is visible. Explain changes in channel, transaction volume or complaint intake that could affect comparisons. For management, include owners and actions needed soon; for the board, elevate material exposure, unresolved decisions and progress against remedies. Avoid using a favorable aggregate to hide a worsening subset. A complaint decline may coexist with more confirmed fee errors because customers do not report every error. Where data are incomplete, say what is known and what investigation will establish the affected population.

Worked example: Complaints fall from 40 last quarter to 30 this quarter: (40 − 30) ÷ 40 = 25% fewer. Confirmed fee errors rise from two to eight, an increase of six and four times the earlier count. The report shows both changes, the number of customers affected and whether refunds and the billing fix are overdue.

Watch the distinction: A 25% complaint decline does not prove compliance improved. If confirmed errors and overdue remedies rise, reporting only the favorable metric conceals the risk leaders must address.

Reference: [1]

58. Control examination requests

Examination production is an evidence-control process. For each request, record the examiner's wording, relevant period, owner, due date, source system, version and final delivery. Clarify ambiguous scope early, such as whether “policy” means the current document or the version operating during examined transactions. Reconcile counts before submission: ten requested loan files should produce ten complete files or a documented explanation for any gap. Check that related records tell a consistent story without altering originals to make them match. Protect customer information through the approved transfer method and retain an exact copy of what was supplied. A central log prevents duplicate, contradictory or missing responses and supports later follow-up. If a record is unavailable, state that fact and the search performed rather than silently substituting another document.

Worked example: An examiner requests one policy, training records for the reviewed period and ten loan files. The coordinator logs three request lines, confirms which policy version governed that period, and reconciles the ten file identifiers to the production package. A second reviewer checks completeness and secure delivery. The bank retains the package, source references and delivery confirmation.

Watch the distinction: Sending the newest policy alone may misrepresent what operated during the examination period. An untracked document dump also makes omissions and later contradictions harder to detect.

Reference: [1]

59. Respond to examination findings

An examination finding is a starting point for a controlled response, not merely a letter to acknowledge. Translate it into the failure, affected rule or customer outcome, suspected cause, population and period at risk. Assign an accountable owner and milestones for containment, customer remedy, permanent repair and independent validation. Expand beyond the examiner's sample when the same channel or system may have failed elsewhere. Document how the population was found, how each case was resolved and why any exceptions remain. A deadline should reflect required actions and dependencies, with overdue risks escalated. Before reporting closure, test new transactions under ordinary conditions and preserve evidence that the corrected process works. If the fix addresses only one channel, state whether other channels were reviewed or why they were outside scope.

Worked example: An exam finds missed adverse-action notices in the online channel. The bank identifies all declined online applications from the affected release period, checks which notices were absent, and determines required customer remedies. It repairs the missing trigger, reconciles later decisions to delivered notices, and provides the examiner an action plan with owner, milestones and validation evidence.

Watch the distinction: Correcting only the sampled files does not establish the finding's full scope. A promise to retrain staff is also weak when a system trigger caused the missed notices.

Reference: [1]

60. Preserve independent assurance

Assurance depends on who operates a control and who evaluates it. The business owns the process, handles exceptions and fixes defects. Compliance provides subject expertise, monitors obligations and challenges weak results, while remaining clear about any control work it performs itself. Independent audit assesses whether governance and controls are designed and operating effectively, using its own scope, evidence and reporting path. Independence is impaired when a team evaluates work it designed or operated and presents that review as objective assurance. The solution is not to silence that team's useful self-checks; label them accurately and arrange separate testing where assurance is needed. Audit findings should feed management action plans, but audit should not become the owner of remediation. Preserve distinct records of operation, compliance challenge and independent conclusions.

Worked example: The complaints team designs a fee-escalation rule and checks ten of its own cases. That is a useful self-check, so it documents the results and fixes errors. Compliance separately challenges the rule's coverage and customer impact. Independent audit later selects its own sample and evaluates both the control and compliance oversight, reporting conclusions through its assurance channel.

Watch the distinction: A team cannot make its own review independent by naming it an audit. Self-checking, compliance challenge and independent assurance serve different purposes and require clear ownership.

Reference: [1]

Official references and further reading

All study guides

Core Compliance

1. Classify an electronic transfer error

2. Separate transfer authorization from overdraft consent

3. Test deposit yield claims

4. Recognize a credit application

5. Resolve adverse action

6. Investigate a fair lending disparity

7. Apply flood insurance coverage

8. Build the finance charge

9. Decide whether rescission applies

10. Map mortgage disclosure stages

11. Evaluate ability to repay

12. Handle an open-end billing dispute

13. Test HMDA reportability

14. Validate HMDA data fields

15. Define CRA assessment areas

16. Evaluate CRA activity

17. Recognize unfair, deceptive and abusive conduct

18. Trace a UDAAP issue across a product

19. Use the BSA program pillars

20. Verify customers and understand ownership

21. Separate reporting from suspicious-activity analysis

22. Resolve a sanctions alert

Foundational Compliance

23. Obtain valid electronic consent

24. Explain a check hold

25. Use and furnish consumer-report data

26. Respond to identity-theft signals

27. Identify debt-collection coverage

28. Apply housing and accessibility protections

29. Examine settlement-service referrals

30. Track mortgage servicing and insurance

31. Control disclosure of customer information

32. Protect information through vendors

33. Distinguish military borrower protections

34. Protect federal benefits from garnishment

35. Screen insider and affiliate transactions

36. Classify leasing and investment sales

37. Review payment-network obligations

38. Classify securities-linked banking activity

39. Explain deposit classification and coverage

40. Validate mortgage personnel and valuation

41. Control outbound customer messages

42. Map special privacy regimes

43. Manage branch and community commitments

44. Respond to integrity and security events

Compliance Management System (CMS)

45. Assign CMS accountability

46. Assess inherent and residual risk

47. Maintain an applicability inventory

48. Turn rules into operating controls

49. Target training to decisions

50. Oversee a third-party lifecycle

51. Distinguish monitoring from testing

52. Interpret an exception sample

53. Read complaints as risk signals

54. Find the control failure

55. Close an issue with evidence

56. Manage regulatory change status

57. Report risk without hiding context

58. Control examination requests

59. Respond to examination findings

60. Preserve independent assurance

Official references and further reading

Frequently Asked Questions

Related Study Guides

Certified Government Financial Manager (CGFM)

Certified Property Manager (CPM)

Association of Chartered Certified Accountants Qualification (ACCA)