<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

What Does the Federal Reserve Look for in a CMS?

author Michael Berman
2 min read
Nov 12, 2019

The Federal Reserve defines a compliance management system (CMS) as a credit union’s overall approach to managing compliance risk.

Compliance risk is the potential for violating any of the laws and regulations that govern bank operations, including those related to federal consumer financial protection. From the Bank Secrecy Act to the SAFE Act, it seeks to determine how well a bank is managing the risk of compliance violations.

The Fed’s CMS approach is identical to the first two categories of principles of the FFIEC’s Consumer Compliance Rating System.

They are:

  1. Board & management oversight
  2. The compliance program

The Fed recognizes that different institutions will have different CMS implementations based upon the size, complexity, or individual risk profile of the institution.

Board & Management Oversight

Fed examiners are looking for four elements:

Oversight and commitment. The board and management must demonstrate knowledge of and commitment to the CMS. Examiners assess this by looking for communication, the allocation of appropriate capital and human resources, and a staff that is well trained and accountable for compliance. Management due diligence and oversight of third-party vendors’ commitment to consumer compliance is a must.

Change management. When laws, regulations, and market conditions change, management needs to have a process in place to promptly evaluate the impact of the change and respond accordingly. Similarly, if a credit union considers introducing a new product or service or changing an existing one, it should consider the product’s life cycle and review whether the product or service has performed as expected.

Comprehension, identification, and management of risk. A bank should have systems in place to identify and manage both existing and emerging risks. It should have a strong culture of compliance with risk management that minimizes the potential for serious compliance violations. Comprehensive self-assessments are an important element of risk management.

Corrective action and self-identification. Management should be able to proactively identify compliance deficiencies, including violations of law or regulation, and then take prompt corrective action.

Compliance Program

The effectiveness of a compliance program is assessed by the following elements:

Policies and procedures. These should be strong, comprehensive and provide standards both internally and for third-party relationship management to manage compliance risk.

Training. From the board and management to staff, compliance training should be comprehensive, timely and tailored to staff job duties. Training should be updated along with new consumer protection laws or regulations or when new products are introduced.

Monitoring and/or audit. A bank should have comprehensive, timely, and successful systems for identifying and measuring compliance risk. Adjustments should be made when weaknesses are identified.

Consumer complaint response. Examiners want to see prompt and thorough complaint responses and for management to assess complaints for consumer harm.

Specific Examples of What the Fed Is Looking at in a CMS Exam

Each of the assessment factors will be reviewed for strengths and weaknesses by examiners and will depend on the size, complexity and risk profile of the bank. Examiners will look at the control environment for each product, service, and activity and identify weaknesses.

For example, if an institution has introduced a new third-party lending relationship or product, examiners may place more attention on change management or risk management than if nothing had changed since the last exam. That’s because change and risk management are especially important in a dynamic environment.

To learn more about compliance management and how to construct a CMS, tune in to Ncontracts’ webinar, What Is A CMS And Why You Should Have One.

 

Related: What Is A Compliance Management System And Why Your FI Needs One

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
What Jason Bateman Taught Me About Money Laundering & Other BSA Lessons
Banks

What Jason Bateman Taught Me About Money Laundering & Other BSA Lessons

Nov 7, 2018 3 min read
7 Ways to Cut Compliance Costs & Still Stay Compliant
Banks

7 Ways to Cut Compliance Costs & Still Stay Compliant

Sep 17, 2020 3 min read
4 Common Characteristics of the Best Compliance Officers
Banks

4 Common Characteristics of the Best Compliance Officers

Aug 27, 2015 3 min read