 |
|
||||||||||||||||||
|
|||||||||||||||||||
 |
|||||||||||||||||||
 |
|||||||||||||||||||
Compliance Management Is Focus of New FDIC Exam ProceduresBy James T. Bork, J.D., LL.M., editor, CCH BANKING COMPLIANCE LIBRARY. Bork has practiced banking law and served as in-house bank counsel. He also has written articles and spoken on bank regulatory and compliance issues.The FDIC has revised its compliance exam focus for FDIC-supervised financial institutions. Beginning on June 30, 2003, FDIC examiners will combine the risk-based examination process it now employs with an in-depth evaluation of an institution’s compliance management system. The result, which will not affect fair lending or CRA compliance, will be a top-down, risk-focused approach to examinations.The new procedures shift some exam focus away from transaction testing for specific violations and toward the evaluation of a bank’s compliance management system. With this shift of focus, the FDIC hopes to increase examiner efficiency and reduce its on-site exam presence without compromising the effectiveness of the exams it conducts. COMPLIANCE MANAGEMENT SYSTEMS The new compliance exam procedures highlight the need for each bank to think through the compliance risks associated with its own business model and to implement a compliance management system that effectively addresses those risks. This is not a task to be left to the compliance officer or others who have day-to-day, front-line responsibility for compliance. The board of directors and management have ultimate responsibility for an institution’s regulatory compliance. The FDIC, therefore, expects the board and management to have a viable system in place to manage its compliance risk, consistent with the institution’s size and product mix. COMPONENTS OF A GOOD SYSTEM A good compliance management system includes board and management oversight, an effective compliance program, and periodic compliance audits. The FDIC is revising its Compliance Examination Manual to address each of these. Board and Management OversightThe FDIC emphasizes that the success of a compliance management system arises from actions taken by an institution’s board and senior management. Such actions should demonstrate strong commitment to establishing and maintaining an effective compliance management system. Typical actions might include:In order to be an effective part of an institution’s compliance management system, the board must grant to the compliance officer sufficient authority and independence to cross departmental lines, access all areas of operations, and implement corrective action when necessary. EFFECTIVE COMPLIANCE PROGRAM An effective compliance program should include clear policies and procedures, periodic training, a means of responding to consumer complaints, and periodic audits or some other procedures for measuring compliance. An institution’s compliance program generally should be written out, though this is not required of all banks. A written program, however, establishes an organized guide for the institution’s compliance activities and has the added benefit of providing an essential source document that will serve as a training and reference tool for employees. Policies and ProceduresCompliance policies and procedures are the means by which an institution communicates specific compliance standards to operations personnel. They should be in written form and should be reviewed and updated as is necessary to address changes in the business and regulatory environment.Policies and procedures do not obey a one-size-fits-all rule. For some activities, it may be sufficient to establish a compliance goal and outline the procedures that are sufficient to meet that goal. For other activities, however, an institution may want to include: applicable regulation cites and definitions; sample forms with instructions; and directions for routing, reviewing, retaining and destroying transaction documents. TrainingMany people believe that training is required only for a bank’s operations personnel. That is important, but it is only part of the picture. A bank’s compliance officer should arrange sufficient training for an institution’s directors, management and staff, as well as for third-party service providers when necessary.MonitoringAn institution uses the monitoring function to identify procedural or training weaknesses. An effective monitoring system should include regularly scheduled reviews of all matters relevant to the institution’s regulatory compliance, as well as reviews at the transaction level during the normal, daily activities of employees in every operating unit of the institution.Response to Consumer ComplaintsConsumer complaints are evidence of an immediate problem. They also can act as an early warning of deeper compliance problems with a particular function or department within an institution.Because of this, institutions should not treat complaints as mere customer relations problems. A compliance officer should be aware of the complaints received and should make a judgment about whether a complaint or a series of complaints indicates a weakness related to the institution’s compliance posture. Periodic Compliance AuditsA compliance audit is a review of how well an institution complies with consumer protection laws and regulations and adheres to internal policies and procedures. It may be performed by bank personnel or may be contracted to an outside firm or individual. Although compliance exams do not stress transaction testing, the FDIC believes that a strong compliance audit will incorporate vigorous transaction testing.Each audit should result in a written report that specifies the scope of the audit, the nature and circumstances of any deficiencies found and other information sufficient to allow the institution to determine the cause of problems and formulate corrective action. |