Compliance - Part I Flashcards
How does the FDIC promote compliance? [II-1.1 Overview of Compliance Examinations]
The Federal Deposit Insurance Corporation (FDIC) promotes compliance with federal consumer protection laws, fair lending statutes and regulations, and the Community Reinvestment Act through supervisory and outreach programs.
What are the three types of supervisory activities that the FDIC conducts? [II-1.1 Overview of Compliance Examinations]
- compliance examinations
- visitations
- investigations
What is the compliance examination review period scope? [II-1.1 Overview of Compliance Examinations]
The compliance examination review period or
scope typically covers bank activities conducted over a
discrete period of time from the start date of the prior
examination through the start date of the current examination.
Why does the FDIC conduct visitations? [II-1.1 Overview of Compliance Examinations]
The FDIC conducts visitations for a variety of reasons: to 1) review the compliance posture of newly-chartered institutions or those converting to state non-member status; 2) to review progress on corrective actions or compliance with an enforcement action in the interval between examinations; or 3) to investigate problems brought to the attention of the FDIC. Visitations are usually targeted events aimed at specific operational areas, or an entire compliance management system (CMS) previously identified as significantly deficient (within corrective action/compliance?) Compliance examinations and visitations may also be considered during the review of an application submitted to the FDIC (e.g., application for deposit insurance or establishing a branch).
When are investigations conducted? [II-1.1 Overview of Compliance Examinations]
Finally, investigations are conducted primarily to follow-up on particular consumer inquiries or complaints, including fair lending complaints.
What are the purposes of compliance examinations? [II-1.1 Overview of Compliance Examinations]
1) assess the quality of an FDIC-supervised institution’s CMS (see “Evaluating the Compliance Management System”) for
implementing federal consumer protection statutes and regulations;
2) • review compliance with relevant laws and regulations; and
3) • initiate effective supervisory action when elements of an institution’s CMS are deficient and/or when violations of
law are found.
What examination approach do FDIC compliance exams take? [II-1.1 Overview of Compliance Examinations]
Examination Approach FDIC compliance examinations blend 1) risk-focused and 2) process-oriented approaches. Risk-focusing involves using
information gathered about a financial institution to direct FDIC examiner resources to those operational areas where compliance errors present the greatest potential risks of having a negative impact on bank customers, resulting in consumer harm (See the Evaluating Impact of Consumer Harm section
of this manual at page II-2.1 for additional information.) Concentrating on the institution’s internal control
infrastructure and methods, or the “process” used to ensure compliance with federal consumer protection laws and regulations, both acknowledges that the ultimate responsibility for compliance rests with the institution and encourages examination efficiency.
What does risk-focusing involve? [II-1.1 Overview of Compliance Examinations]
Risk-focusing involves:
• developing a compliance risk profile for an institution using various sources of information about its products, services, markets, organizational structure, operations, and past supervisory performance;
• assessing the quality of an institution’s CMS in light of the inherent risks associated with the level and complexity of its business operations and product and service offerings; and (wouldn’t this be the process portion?)
• testing selected transactions based on risk such as when an operational area is determined to have a high risk of consumer harm and the institution’s compliance management efforts appear weak.
How is an institution’s CMS evaluated? [II-1.1 Overview of Compliance Examinations]
Compliance examinations start with a top-down, risk focused process to comprehensively analyze and review an institution’s CMS.
What factors does an examiner review when evaluating an institution’s CMS? [II-1.1 Overview of Compliance Examinations]
Board and management oversight:
-Oversight and commitment
-Change management
-Comprehension, identification, and management of risk
-Corrective action and self-identification
Compliance Program:
-Policies and Procedures
-Monitoring and or Audit
-Training
-Consumer Complaint Response
Third Party Relationship Program Management (never seen this before?)
What will examiners determine as a result of their evaluation of an institution’s CMS? [II-1.1 Overview of Compliance Examinations]
Based on the results of this review, the examiner may
conclude that weaknesses in the institution’s CMS may result in current or future noncompliance with federal consumer protection laws, regulations, or policy statements, thereby resulting in potential consumer harm. The examiner must determine, based on this analysis, whether transaction testing is warranted to further study particular risk in an entire operational area or regulation, or only a limited aspect of an area or regulation.
current or future non-compliance –> potential consumer harm –> TT –> overall operational area –> limited access of area of Reg
What do risk and process focused exams promote? [II-1.1 Overview of Compliance Examinations]
Managing the examination based on risk maximizes examiner efficiency and may reduce the on-site examination presence or examination timeframe, while emphasizing areas requiring elevated supervisory attention. By focusing on the CMS, examiners will be able to identify the root causes of deficiencies and suggest appropriate corrective actions designed to address the problem and prevent recurrence.
What must conclusions about a bank’s CMS be based on? [II-1.1 Overview of Compliance Examinations]
Conclusions about the adequacy of a bank’s CMS
must be based on the effectiveness of those elements that are in place, taken as a whole, for that bank’s particular operations.
For example, assume two institutions – a large, complex bank and a small, non-complex bank – each has a record of strong compliance with all regulations that apply to the products and services it offers. Because of the complex nature of its operations, the large bank’s CMS includes comprehensive external audits and formalized training from third-party
vendors. The smaller bank’s CMS includes no internal or external audits and no formalized training except for the compliance officer, who trains bank staff individually when needed. After reviewing all relevant material available, the examiner finds no significant deficiencies in the small bank’s
CMS and no reason to believe that the adoption of an audit function or formalized training is necessary to e ensure ongoing compliance. The examiner would not criticize the small bank for the absence of audit (or formal training). Nor should the examiner feel obliged to assign a higher rating to the larger bank simply because its CMS has more elements than the
smaller bank. This is because each bank has a CMS that is adequate for the compliance responsibilities that are incumbent upon it due to its operating environment.
What is the purpose of the CMS elements in the Manual? [II-1.1 Overview of Compliance Examinations]
The descriptions of CMS elements provided in the Manual will assist the examiner in evaluating the element if one exists and in suggesting content if he or she determines that management should consider adopting an element.
What is the role/importance of a compliance examiner? [II-1.1 Overview of Compliance Examinations]
Importance: Compliance examiners play a crucial role in the supervisory process. The compliance examination, and follow-up supervisory attention to an institution’s compliance program deficiencies and violations, helps to ensure that consumers and businesses obtain the benefits and protections afforded them under federal law. To this end, an examiner’s efforts should help the financial institution improve its compliance posture and prevent future violations.
Role:
-establish an examination scope focused on areas of highest consumer harm risk;
-evaluate an institution’s CMS;
-conduct transaction testing where risks intersect with
weaknesses in the CMS or uncertainties about aspects of that system; and
- report findings to the Board of Directors and management of the institution.
What are other expectations of examiners during the examination process? [II-1.1 Overview of Compliance Examinations]
- take a reasoned, common sense approach to examining and use sound judgment when making decisions;
- maintain ongoing communication with financial institution management throughout an examination;
- assist an institution to help itself improve performance by providing management with sound recommendations for enhancing its CMS;
- share experiences and knowledge of a successful CMS; and
- provide guidance regarding the various consumer protection and fair lending laws and regulations.
What is the bank’s consumer compliance exam approach based on? [II-2.1 Evaluating Consumer Harm]
The FDIC has a risk-focused consumer compliance
examination approach, based on the potential for compliance errors to have an adverse impact on banking customers.
Why is the FDIC’s consumer compliance exam process risk-focused? [II-2.1 Evaluating Consumer Harm]
The FDIC’s consumer compliance examination process is risk focused based on the potential for consumer harm.
What is consumer harm? [II-2.1 Evaluating Consumer Harm]
“Consumer Harm” is an actual or potential injury or loss to a consumer, whether such injury or loss is economically quantifiable (e.g., overcharge) or non-quantifiable (e.g., discouragement).
What can lead to (actual or potential; economically quantifiable or not) consumer harm? [II-2.1 Evaluating Consumer Harm]
It may be caused by a financial institution’s violation of a federal consumer protection law or regulation directly or through a third party or reflects weaknesses in a financial institution’s compliance management system.
In what way can consumer harm occur? [II-2.1 Evaluating Consumer Harm]
-Quantifiable harm
-Non-quantifiable harm
-Potential harm (actual)
What is quantifiable consumer harm? [II-2.1 Evaluating Consumer Harm]
Economic harm to a consumer where the injury or loss can be measured.
i.e. pricing discretion
What is non-quantifiable consumer harm? [II-2.1 Evaluating Consumer Harm]
Injury or loss to the consumer that cannot be measured, or is very difficult to measure, yet the consumer may suffer some form of economic or other harm.
i.e. denied or discouraged applications
What is potential consumer harm? [II-2.1 Evaluating Consumer Harm]
Involves financial institution activities (or failure to take action) that create the possibility that a consumer may be harmed.
i.e. flood violations before a flood actually occured
What are some key points related to consumer harm? [II-2.1 Evaluating Consumer Harm]
Consumer harm is a broad concept and the examples provided here are not exhaustive. Among key points are that consumer harm is not limited to monetary loss, can be quantifiable or non-quantifiable, can be actual harm or potential harm, and may be caused by activities conducted through third-party relationships.
How is the FDIC’s mission best-served? [II-2.1 Evaluating Consumer Harm]
The FDIC’s mission of promoting public confidence in the financial system is best served through a supervisory approach focused on identifying, addressing, and preventing consumer harm
What are supervisory and examination activities driven by? [II-2.1 Evaluating Consumer Harm]
Supervisory and examination activities are
driven by a focus on identifying the inherent risk of
consumer harm that may occur in a financial institution’s
business activity
What is inherent risk (identified during the supervisory stage)? [II-2.1 Evaluating Consumer Harm]
Inherent risk is the compliance risk associated with product and service offerings, practices, or other activities that could directly or indirectly result in
significant consumer harm or noncompliance with
consumer protection rules and regulations. For example, a new loan product, a change to deposit account terms, or a third party relationship all represent inherent risk.
How do examiners address identified inherent risk? [II-2.1 Evaluating Consumer Harm]
When inherent risks of consumer harm are identified, examiners will ensure the institution takes appropriate action to address or mitigate these risks. Corrective action for violations of law and regulations should remediate consumer harm when it occurs and remove underlying incentives to engage in practices harmful to consumers. Where there is a violation of law or regulation, the extent and severity of consumer harm informs the type and scope of enforcement action sought to correct the violation.
How can management prevent (and examiners recommend that management prevent) [II-2.1 Evaluating Consumer Harm]
Mitigating factors are the strength of the compliance management system (CMS) to mitigate inherent risk. Examples of mitigating factors include strong management controls, effective training programs, and on-going monitoring efforts. Supervisory efforts should encourage institutions to have an effective CMS to avoid and mitigate risks of consumer harm. To support that effort, examination and other staff communicate information and best practices in a variety of settings to assist institutions in managing risks of consumer harm when conducting their business. Identifying, addressing, and preventing consumer harm is an important consideration in all examination and enforcement activities, as identified in the following diagram and discussed below.
What do the FDIC’s supervisory strategies do? [II-2.1 Evaluating Consumer Harm]
The FDIC’s supervisory strategies are designed to promote compliance with consumer protection laws and regulations in FDIC-supervised institutions.
What activities are used to implement supervisory strategies? [II-2.1 Evaluating Consumer Harm]
Activities used to implement FDIC supervisory strategies include examinations, targeted reviews, visitations, investigations, and offsite analysis of how
the bank manages its consumer compliance responsibilities. The timing and frequency of these activities can be adjusted based upon indications of risk of consumer harm, such as consumer complaints, referral from other divisions or agencies, changes in the institutions’ products, services, or markets, or
reliance on third parties to offer products and services to consumers. Supervisory strategies should be flexible to respond to indications of increasing or decreasing risk of consumer harm.
What does the risk-scoping process consider? [II-2.1 Evaluating Consumer Harm]
All applicable federal consumer compliance laws and
regulations are considered in connection with any bank compliance examination through the risk scoping process. However, the FDIC’s supervisory approach apportions resources to areas of higher risk for consumer harm rather than to uncovering technical issues in meeting regulatory requirements. This approach also results in the identification of
the most serious violations of federal consumer compliance laws and regulations during the examination. If financial institutions understand the potential for consumer harm and choose to develop and implement institution-specific plans, policies, and processes to prevent and mitigate consumer harm
based on their risk profiles, it may assist institutions in avoiding risk and promoting compliance with the federal consumer protection regulations.
What do examiners consider when identifying risks of consumer harm? [II-2.1 Evaluating Consumer Harm]
Examiners have several tools available to assist them in
identifying risks of consumer harm. Examiners evaluate risks of consumer harm through an analysis of an institution’s historical CMS, the products and services currently offered, the markets served, and existing and new third-party relationships.
What is the most critical aspect of properly evaluating an institution’s risk profile? [II-2.1 Evaluating Consumer Harm]
Examiner judgment is the most critical aspect of properly evaluating an institution’s risk profile. The FDIC’s approach tailors the examination to focus primarily on those areas that present the highest risk of consumer harm, as examiners are unable to review all aspects of an institution’s CMS at any given examination. The pre-examination planning process,
which includes review of the pre-exam questionnaire with bank management and preparation of the automated Compliance Information and Document Request (CIDR), guides examiners in requesting
the information necessary to identify areas of the greatest risk of potential consumer harm
What does inherent risk refer to? [II-2.1 Evaluating Consumer Harm]
Inherent risk refers to the risk that a product, service, practice, or other activity would pose if no controls or other mitigating factors were in place.
When is residual risk present? [II-2.1 Evaluating Consumer Harm]
Examiners also focus on whether a bank is effectively and independently managing or mitigating the risk of consumer harm that comes from the products and
services the institution offers and markets in which they serve. After considering an institution’s inherent risks, and the strength of its CMS, residual risk exposure may remain.
What is residual risk? [II-2.1 Evaluating Consumer Harm]
Residual risk refers to the risk exposure that remains after identifying the level of inherent risk and factoring in the strength of the mitigating factors to control that risk. The guiding principle is a risk scoping formula: inherent risk – mitigating factors = residual risk. For example, a bank introduces a new overdraft program with no due diligence, no monitoring or auditing, and numerous customer inquiries. This example represents a high risk product without effective CMS
elements to mitigate inherent risk; therefore, a higher level of residual risk remains, and this product warrants review and transaction testing during an examination. As part of the examination scoping process, examiners focus on areas where residual risk is elevated and not on areas where risk is well controlled and residual risk of consumer harm is low.
How are examination procedures drafted and implemented? [II-2.1 Evaluating Consumer Harm]
Examination procedures are drafted and implemented in a manner to guide examiners in assessing the risk of consumer harm in the conduct of the examination. Well-crafted examination procedures that are focused on risks and potential for consumer harm promote the efficient use of resources, identification of root causes of deficiencies, and allocation of resources to areas presenting the highest risk, while avoiding unnecessary review of areas with little or no risk of consumer harm. As an example, examination procedures regarding overdraft programs differentiate the type and extent of review
based on the type of overdraft program offered (e.g.,
automated versus ad hoc) and further reserves more detailed transaction testing to situations where examiners have identified specific risks or weaknesses.
What do examiners consider this section as they assess
institutions’ compliance with the federal consumer protection laws and regulations. [II-2.1 Evaluating Consumer Harm]
The Federal Financial Institutions Examination Council’s Uniform Interagency Consumer Compliance Rating System (CC Rating System), which is a supervisory policy for evaluating financial institutions’ adherence to consumer compliance requirements, includes a section titled Violations of Law and Consumer Harm. The CC Rating System
emphasizes the importance of institution’ compliance
management systems, with emphasis on compliance risk management practices designed to manage consumer compliance risk, support compliance, and prevent consumer harm.
What role does the Report of Exam play? [II-2.1 Evaluating Consumer Harm]
The Report of Examination plays an important role in
communicating the FDIC’s assessment of the CMS to the institution. The FDIC classifies violations of federal consumer laws based, in part, on the level of risk of consumer harm. In the event violations are identified in the Report of Examination, this classification process serves to communicate to banks the FDIC’s conclusions about the severity, extent, or potential consumer harm caused by the violation. The
expectation is that FDIC-supervised institutions will prioritize corrective action and on-going management of their CMS to correct errors and mitigate risks of consumer harm.
What supervisory action does the FDIC take? [II-2.1 Evaluating Consumer Harm]
Effective supervision includes requiring institutions to take corrective action when weaknesses in the CMS or violations are identified. Appropriate corrective action considers the overall effectiveness of the institution’s CMS, the root cause(s) of the deficiencies as well as the extent and impact of consumer harm. When there is a violation of law or regulation
that results in consumer harm, the FDIC will seek corrective action, which may include restitution to consumers as part of an appropriate enforcement action. Civil money penalties (CMPs) may also be assessed to sanction an institution or an
institution-affiliated party according to the degree of
culpability. Other factors examiners consider include intent and severity of the violation of law or regulation, breach of fiduciary duty, and/or whether a practice is unsafe or unsound. CMPs are also assessed to deter future misconduct.
What is another important component in the FDIC’s supervisory approach in preventing consumer harm? [II-2.1 Evaluating Consumer Harm]
Communication and technical assistance to supervised institutions is an important component of the FDIC’s supervisory approach in preventing consumer harm by supporting institutions’ efforts to maintain an effective CMS. Communication is especially important during periods of regulatory change and transition. The FDIC communicates
through a number of channels, including national and regional bankers’ teleconferences on emerging topics; speaking engagements at national, regional, state, and local conferences and conventions; a web-based regulatory calendar; Supervisory Insights Journal articles; regional newsletters; banker and
bank director trainings and online technical assistance videos; meetings with industry trade groups; and issuance of guidance through Financial Institution Letters. Communicating the focus of FDIC examination efforts and supervisory priorities
through these diverse channels assists bankers in identifying and reviewing key areas of concern and addressing deficiencies promptly, prior to and unrelated to a specific examination activity. In addition, examiners can provide certain types of technical assistance to community bankers
during the course of an examination that may enable an institution to reduce the risk of consumer harm in the operation of its business. These communication and technical assistance efforts provide bankers with tools to address issues that may pose risk of consumer harm.
What forces combine to create inherent risk? [II-3.1 Compliance Management System]
Financial institutions operate in a dynamic environment influenced by industry consolidation, convergence of financial services, emerging technology, and market globalization. To remain profitable in such an environment, financial institutions continuously assess and modify their product and service offerings and operations in the context of a business strategy. At the same time, new legislation may be enacted to address developments in the marketplace. All these forces combine to create inherent risk.
What must a financial institution do to address inherent risk? [II-3.1 Compliance Management System]
To address this risk, a financial institution must develop and maintain a sound compliance management system (CMS) that is integrated into the overall risk management strategy of the institution. Ultimately, consumer compliance should be part of the daily routine of management and employees of a financial
institution.
What is the CMS? [II-3.1 Compliance Management System]
A CMS is how an institution:
learns about its consumer compliance responsibilities;
• ensures that employees understand these responsibilities;
• ensures that requirements are incorporated into business processes;
• reviews operations to ensure responsibilities are carried out and requirements are met; and
• takes corrective action and updates materials as necessary.
Who is ultimately responsible for administering the CMS? [II-3.1 Compliance Management System]
The Board of a financial institution is ultimately responsible for developing and administering a CMS that ensures compliance with federal consumer protection laws and regulations. To a large degree, the success of an institution’s CMS is founded on the actions taken by its Board and management.
What are key actions that Board and management may take to demonstrate their commitment to maintaining an effective CMS and to set a positive climate for compliance? [II-3.1 Compliance Management System]
• demonstrating clear and unequivocal expectations about consumer compliance, not only within the institution, but also to third-party providers;
• adopting clear policy statements;
• appointing a compliance officer with authority and
accountability;
• allocating resources to compliance functions commensurate with the level and complexity of the institution’s operations;
• anticipating and evaluating changes in the institution’s operating environment and implementing responses across impacted lines of business;
• identifying compliance risk in the institution’s products, services, and other activities, and responding to deficiencies and violations;
• conducting periodic compliance audits; and
• providing for recurrent reports by the compliance officer to the Board.
What is the expectation surrounding leadership on Compliance by the Board and management of an institution? [II-3.1 Compliance Management System]
Leadership on consumer compliance by the Board and management sets the tone in an organization. The Board and management should discuss compliance topics during their meetings. They should include compliance matters in their communications to institution personnel and the general
public. Institution management and staff should have a clear understanding that compliance is important to the Board and management, and that they are expected to incorporate compliance in their daily operations.
What is the first step Board and management should take in providing for the administration of the compliance program regardless of size or institution complexity? [II-3.1 Compliance Management System]
Regardless of size or institution complexity, the first step
Board and management should take in providing for the
administration of the compliance program is the designation of a compliance officer.
What must must the Board and management grant a compliance officer sufficient authority and independence to do? [II-3.1 Compliance Management System]
• cross departmental lines;
• have access to all areas of the institution’s operations; and
• effect corrective action.
Describe the role of a compliance committee? [II-3.1 Compliance Management System]
A compliance committee, as an alternative to or in addition to a full-time compliance officer, could be formed consisting of the compliance officer, representatives from various departments, and member(s) of management or the Board. However, the ultimate responsibility of overall compliance
with all statutes and regulations resides with the Board.
Describe the role of the compliance officer? [II-3.1 Compliance Management System]
A qualified compliance officer will have knowledge and understanding of all consumer protection laws and regulations that apply to the business operations of the financial institution. The compliance officer should also have general knowledge of the overall operations of the institution and interact with all of the departments and branches to keep abreast of changes (e.g., new products, services or business
practices; personnel turnover) that may require action to manage perceived risk. In larger or more complex institutions the compliance officer may devote all of his or her time to compliance activities. In smaller or less complex institutions, where staffing is limited, a full-time compliance officer may not be necessary; instead, the compliance responsibilities may
be divided between various individuals by type of regulation, such as loan-related or deposit-related regulations. In some instances, several banks may share a compliance officer.
What do a compliance officer’s general responsibilities include? [II-3.1 Compliance Management System]
A compliance officer’s general responsibilities, regardless of the size or complexity of the institution’s operations, include:
• developing compliance policies and procedures;
• training management and employees in consumer protection
laws and regulations;
• reviewing policies and procedures for compliance with applicable laws and regulations and the institution’s stated
policies and procedures;
• assessing emerging issues or potential liabilities;
• coordinating responses to consumer complaints;
• reporting compliance activities and audit/review findings to the Board; and
• ensuring that corrective actions are implemented in a timely fashion and are effective at preventing recurrence.
What must a compliance officer be provided with to be effective at the job? [II-3.1 Compliance Management System]
To be effective at overseeing compliance and maintaining a strong compliance posture, a compliance officer must be: provided with ongoing training, as well as sufficient time and adequate resources to do the job. The compliance officer may utilize third-party service providers or consultants to help administer the compliance program or audit functions. However, the compliance officer should perform sufficient due diligence to verify that the provider is qualified, because ultimately the institution’s Board and management are responsible for identifying and controlling compliance risks
arising from third-party relationships, to the same extent as if the third-party activity was handled within the institution.
What does third-party oversight entail? [II-3.1 Compliance Management System]
If an institution engages the services of a third party, the Board and management must ensure that the third-party operations, products, services, and activities are reviewed for compliance with consumer protection laws and regulations. An effective
compliance risk management process will vary depending on the complexity and risk potential of the third-party relationship, but generally includes risk assessment, due diligence in selecting the third-party provider, appropriate contract structuring and review, and sufficient oversight of third-party activities, including adequate quality control over products or services provided.
What is the objective of PEP?
The objective of the pre-examination planning process is to collect necessary information to understand an institution and the risks of consumer harm prior to the start of an examination. This information allows the Examiner-in Charge (EIC) and the examination team to plan and conduct the examination, to develop the scope of the examination, and to accomplish supervisory objectives in an efficient and
effective manner.
What are the three phases of PEP?
- Information Package (IP)
- Pre-Examination Planning Phase 1 (PEP-1)
- Pre-Examination Planning Phase 2 (PEP-2)
How does the examination process start?
The examination planning process begins with the Field Supervisor (FS) or the Supervisory Examiner (SE) calling the institution’s management to inform them of the projected start date of the examination, explain that an IP will be sent, and discuss how the IP will be provided .
What is the timing of the IP stage of PEP?
The FS or SE submits the IP to the institution no less than 90 calendar days before the projected start date of the examination.
What is the point of the IP?
The IP is designed to increase banker awareness of the examination process prior to the examination; to promote open communication with examination staff; and to ensure that the institution’s management team knows what to expect during the examination and where to go in the event their expectations are not met. The FS or SE explains that the IP includes a list of interview questions, which will help the EIC develop an examination plan and an information and
document request list tailored specifically to the institution’s activities. The interview questions are provided early so the institution’s management team can prepare to discuss them with the EIC and can invite the appropriate persons to participate in the pre-examination interview that occurs several weeks before the examination start date.
What is the guidance on requiring written responses to the IP?
The institution may elect to provide written responses to the pre-examination interview questions; however, the FS, SE, EIC, or other examination staff should not request or require written responses from the institution.
After calling the institution, what should the FS/SE do?
After contacting institution management, the FS, SE, or designee submits the IP to the institution according to the previously stated timing requirements. To facilitate efficient and secure exchange of information, the FS or SE should
determine the institution’s willingness to use applications, such as the Enterprise File Exchange (EFX), that provide a secure method for financial institutions to exchange information with the FDIC.
When the institution is willing to use such applications, the FS, SE, or designee should initiate a session and electronically submit the IP to the
institution. When the institution is unwilling to use secure applications for the electronic exchange of examination related information, the FS, SE, or designee should use an alternative delivery method (e.g., encrypted e-mail, express mail courier service) that meets the security measures discussed in the FDIC’s policies for the exchange, use, and
storage of information. Each field office will establish
procedures to ensure the FS, SE, or designee (1) provides the IP to the institution in a timely manner; (2) records the IP sent date in the System of Uniform Reporting of Compliance and CRA Examinations (SOURCE); and (3) if applicable, records any reasons for timing delays in SOURCE.
How is the IP produced?
The IP module in the PEP System is used to produce the IP, which includes a standardized introductory letter that provides an overview of the examination process; discusses various resources available that explain the examination process; identifies the appropriate communication channels for any concerns about the examination process or the
resultant ratings; and provides contact information for the FS and/or the SE.
Other Information on the IP
The IP letter has been standardized and automated within the PEP System and should be consistently used by all field offices without changes. A sample IP letter is included in this Manual (see Section III). If electronically submitting the IP to the institution, the FS, SE, or designee should convert the IP letter to an Adobe portable document format (.pdf). Supervisors should also follow any national or regional instructions governing the use of electronic signatures for examination-related documents. In the absence of such instructions, a supervisor can either use his or her typed name as an electronic signature, using the same font as the body of the letter, or use Adobe’s “Fill & Sign” feature.
Who schedules examiners for PEP 1 and PEP 2?
Lastly, as part of the examination planning process, the FS or SE schedules examiners for PEP-1 and PEP-2. In particular, the FS or SE will select the EIC and schedule sufficient dedicated time for the EIC to conduct all activities of PEP-1 and PEP-2 prior to the examination start date. As a general rule, the EIC (or Acting EIC) should conduct PEP activities to have sufficient time to learn about the institution and
prepare an examination plan tailored to the institution’s areas of highest risk. Other examiners may conduct PEP activities on a limited basis when scheduling conflicts arise or limited staffing resources exist. Additionally, if examiners other than the EIC will perform the CRA or fair lending reviews, then those staff members should be scheduled sufficient
dedicated time, when possible, to perform CRA- and fair lending-related examination planning activities so that the results are available for the EIC’s review and consideration.
Data Validations
For the largest Home Mortgage Disclosure Act (HMDA) reporters (over 500 LAR lines) and/or Community Reinvestment Act (CRA) reporters, validation testing should be conducted in advance of scheduled fair lending and CRA examinations. This
approach will allow the institution to resolve any data errors so the examination can proceed without significant delay. In addition, validation testing must be conducted for HMDA Outlier reviews prior to the start of the examination. For examinations of all other reporters, the validation testing will generally be conducted during the examination. However, a
field office has the option to perform a data validation prior to the examination start date for other institutions if the field office has sufficient resources to complete it. The HMDA validations should be conducted following the FDIC HMDA validation procedures, considering the scale and complexity
of the institution’s mortgage lending activities and an overall assessment of the institution’s prior practices and compliance risk profile.
HMDA/CRA Validation Letter
A HMDA/CRA Validation Letter is to be provided to
institutions when data validations occur prior to any
examination. A data validation letter has been standardized and included in the IP module of the PEP System and should be used consistently. This letter is either sent with or after the IP to allow sufficient time for the data validation process.
The letter should be sent using the same secure delivery method established for providing the IP. If HMDA Data Analysts will be used for the validation process, the FS or SE should communicate this with the institution, either verbally or in the letter.
When does the risk assessment of the institution begin?
The risk assessment of the institution begins during PEP-1.
Does every institution have inherent risk?
Every institution has inherent risk based on strategic plans, products and services offered, past supervisory actions, business activity, and other factors.
What does PEP 1 start the process of?
PEP-1 starts the process of identifying and documenting risk based on the institution’s structure, supervisory history, financial performance, and market area. The various activities performed during PEP-1 are meant to promote critical thinking about the possible inherent risks in the institution being examined.
What does PEP 1 consist of?
• 2) Gathering information about the institution from
both internal and external sources;
• 1) Contacting the institution to conduct the pre-examination interview (PEP interview); –> (3. conducting the PEP Interview)
• 4) Preparing and sending the Entry Letter to the
institution along with the Compliance Information
and Document Request (CIDR) that primarily
requests CMS-related information and documents;
and
• 5) Beginning Section 1 of the Assessment of Risk of
Consumer Harm (ARCH) and Section 1 of the Fair
Lending Scope and Conclusions memo (FLSC).
This activity is optional during PEP-1. The ARCH
and FLSC can be started to the extent possible and
when time or examination scheduling permits it;
however, most work on the ARCH will occur
during PEP-2 and most work on the FLSC will
occur during PEP-2 and the examination.
