1

FEDERAL RESERVE 

COMMUNITY BANK RISK-FOCUSED

CONSUMER COMPLIANCE SUPERVISION PROGRAM

EXECUTIVE SUMMARY

Effective January 1, 2014

The Board of Governors of the Federal Reserve System is publishing this Community Bank 

Risk-Focused Consumer Compliance Supervision Program (“Program”) to promote strong 

compliance risk management practices and consumer protection within state member banks with 

assets of $10 billion or less and their subsidiaries. The Program provides a framework that 

allows examiners to evaluate whether a financial institution is effectively controlling compliance 

risk. This framework is founded on the following principles of successful supervision:

• Risk-Focused. Evaluates a financial institution’s compliance culture and processes for 

identifying, measuring, monitoring, and controlling risks and practices regarding the 

treatment of consumers, the potential for consumer harm, and compliance with consumer 

protection laws and regulations.

• Proactive and Scalable. Balances the nature and breadth of supervision with the level of 

risk to consumers and financial institutions. 

• Efficient. Incorporates procedures and processes to ensure good stewardship of 

examiner resources.

• Clear. Provides guidance, policies, procedures, and examination findings clearly.

• Collaborative. Engages other disciplines and supervisory agencies, as appropriate, to 

ensure a coordinated supervisory approach.

Understanding the Institution

The starting point for risk-focused supervision is developing an understanding of the institution, 

taking into account environmental factors and the legal and regulatory landscape in which it 

operates. Information on a financial institution’s business model and strategy, major business 

activities, and risk tolerance serves as the foundation for assessing its associated risks and 

supports the examiner’s observations captured in an institutional profile. The consumer 

compliance examiner will develop an institutional profile to provide a concise portrait of an

organization’s structure and business activities and allow the examiner to understand the scope 

of activities that give rise to potential consumer harm and consumer compliance risk. 

Examiners will contact bank management to develop and maintain an understanding of the 

institution and the market(s) in which it operates. Such contact typically involves a specific 

information request that provides the opportunity to learn about any changes that would affect 

the profile. These changes might include changes in management personnel, organizational 
2

structure, or the institution’s strategic direction, including any new products, markets, or delivery 

channels the institution has introduced or entered or is considering introducing or entering. 

The Program discusses in detail the processes depicted in the diagram below:

Assessing the Institution’s Risk

The institutional profile serves as the primary source of information for developing the risk 

assessment, a vital part of the supervisory process. The risk assessment presents a 

comprehensive view of the financial institution, delineating the areas of supervisory concern, and 

serves as a platform for the supervisory plan. While the risk assessment process evaluates a

financial institution’s compliance management program as a whole, the process also evaluates

the effectiveness of the institution’s compliance risk controls for individual products, services, 

and business activities.

Inherent risk considers the likelihood and impact of noncompliance with consumer laws and 

regulations prior to considering any mitigating effects of risk management processes. Risk 

management and controls are evaluated in the context of their likely effectiveness in achieving 

compliance with laws and regulations. Residual risk is determined by balancing the overall level 
3

of inherent risk of an activity (product or service) with the overall strength of risk controls for 

that activity. 

The goal of the risk assessment is to allow supervisory staff to establish reasonable assurance 

that material residual consumer compliance risks are identified. The risk assessment can then be 

relied upon as the determinant of the scope of examination activities. As a result, examination 

resources will be focused on areas of elevated residual risk and not on those areas where inherent 

risk is well controlled and residual risk is limited or low.

The risk assessment process requires the examiner to determine: (1) products, services, and 

activities that are considered material to the organization; (2) the level of inherent risk associated 

with these products, services, and activities; (3) the adequacy of management systems used to

measure, monitor, and control associated risks; and (4) the residual consumer compliance risk

associated with each material product, service, and activity, as well as for the institution overall, 

based on the level of inherent risk and the adequacy of risk controls. The examiner will 

aggregate the residual risk determined for each of the financial institution’s material products to 

capture the residual risk for the institution as a whole.

Fair lending (the Fair Housing Act, the Equal Credit Opportunity Act, and Regulation B) and 

UDAP (Section 5 of the Federal Trade Commission Act and Sections 1031 and 1036 of the 

Dodd-Frank Act) are two of the most significant risk areas for financial institutions. Violations 

in these areas often cause significant consumer harm as well as legal, financial, and reputational 

risk to the institution. Therefore, fair lending and UDAP will always be addressed during the 

risk assessment process. For fair lending, as with the examiner’s evaluation of the overall 

compliance management program, the level of examination intensity for a particular product will

generally be commensurate with the level of residual risk identified in the risk assessment 

process. However, in circumstances where inherent risk is high, examiners generally will test 

the risk controls before concluding that they effectively mitigate the high inherent risk.

Examination Scoping and Planning

Establishing a thorough knowledge of a financial institution’s inherent risk and an understanding 

of an institution’s compliance management program, including the risk controls used to mitigate 

inherent risk, is a critical part of examination scoping and planning. Ultimately, the risk 

assessment should drive the scope of activities that will be carried out during the examination.

The scoping process provides an opportunity to customize examination activities so that they are 

consistent with the size, complexity, and risk profile of the financial institution. In this way, it is 

expected that a broad range of examination activities will be considered for products, services, 

and business lines targeted for additional review. Moreover, it is expected that planned activities 

involve varying levels of intensity and be carried out in a way that helps the examination team 

draw reasonable conclusions about the adequacy of an institution’s compliance management 

program.
4

The examination work program and procedures used to assess the risk management practices of a 

financial institution with respect to a particular product or service or across business lines will be 

commensurate with the level of residual risk identified in the risk assessment process. Thus, the 

examination work program may include a range of examination activities, as depicted in the 

following diagram:

After assessing the financial institution’s risk and identifying the areas targeted for additional 

review, the examiner will develop a tailored, risk-focused work program for each product, 

service, or business line selected. In many cases, examination objectives for material products or 

for the overall institution may have been largely met as part of the risk assessment process. 

When the quality of compliance management systems is assessed as being at least satisfactory or

there is a reasonable basis for reliance on the institution’s controls, and residual risk is not 

elevated, examiners may need to conduct no additional work or only limited follow-up work 

during the examination. 

Management and policy-related examination analysis performed during the risk assessment 

process may result in the identification of procedural weaknesses or other risks that cannot be 

addressed simply through limited follow-up. In such cases, the examiner should document the 
5

need for transaction testing in the examination scope memorandum detailing the overall 

examination strategy.

The risk assessment and scoping processes will result in communication to the institution’s

management of a request for any additional information to be sent to the Reserve Bank or made 

available on site upon examiners’ arrival. To the extent possible, information requests will avoid 

asking for information already available.

Examination Work

The examiner in charge will meet with the financial institution’s senior management and the 

compliance officer to discuss the nature and scope of the examination. Because the issues 

identified in the scoping process and the suggested levels of review may differ from the previous 

examination, the examiner will provide bank management with an understanding of the riskfocused examination process and how it will be applied to the institution. The examiner in

charge will inform bank management of the examination’s progress and issues that may have 

arisen that could result or have resulted in a change to the scope of the examination. Bank 

management will be given an opportunity to respond to issues and resolve them if possible, as 

early in the examination process as is practical.

Formal final discussions are held to communicate examination findings and obtain, when 

necessary, management’s commitment for corrective action. The board of directors has the 

ultimate responsibility for operating the financial institution in compliance with the law and for 

ensuring that appropriate corrective action is taken. A meeting with the board of directors may 

be appropriate in certain circumstances, such as if the program weaknesses or legal violations 

involve the potential for significant administrative and civil liability or if the Reserve Bank is 

contemplating issuing a supervisory action. 

Supervisory findings are communicated in writing through formal reports and letters 

summarizing the results of reviews. These communications, including the Consumer Affairs 

Report of Examination for community banks, constitute the official record of the examination 

and are the primary tool for conveying examination findings to the institution’s board of 

directors and senior management.

Ongoing Supervision

Ongoing supervision of a financial institution between examinations, typically a supervisory 

contact close to the mid-cycle between consumer compliance examinations, is critical in 

identifying significant changes or deteriorating trends in a timely manner. Proactive monitoring 

also confirms whether the institution’s board and senior management have appropriately 

addressed previous examination findings and allows for identification of new product lines, 

business activities, or other organizational changes. In some cases when the institution’s risk 

profile is high or it changes materially as a result of the addition of more complex or higher-risk 

strategies, more frequent contacts may be appropriate.