FFIEC GUIDANCE ON THE UNIFORM INTERAGENCY CONSUMER COMPLIANCE 

RATING SYSTEM

Uniform Interagency Consumer Compliance Rating System 

The Federal Financial Institutions Examination Council (FFIEC) member agencies 

(Agencies) promote compliance with federal consumer protection laws and regulations through 

supervisory and outreach programs.

1

 The Agencies engage in consumer compliance supervision 

to assess whether a financial institution is meeting its responsibility to comply with these 

requirements. 

This Uniform Interagency Consumer Compliance Rating System (CC Rating System) 

provides a general framework for assessing risks during the supervisory process using certain 

compliance factors and assigning an overall consumer compliance rating to each federally

regulated financial institution.2

 The primary purpose of the CC Rating System is to ensure that 

regulated financial institutions are evaluated in a comprehensive and consistent manner, and that 

supervisory resources are appropriately focused on areas exhibiting risk of consumer harm and 

on institutions that warrant elevated supervisory attention. 

The CC Rating System is composed of guidance and definitions. The guidance provides 

examiners with direction on how to use the definitions when assigning a consumer compliance 

 1 The FFIEC members are the Board of Governors of the Federal Reserve System, the Consumer Financial 

Protection Bureau (CFPB), the Federal Deposit Insurance Corporation, the National Credit Union Administration, 

the Office of the Comptroller of the Currency, and the State Liaison Committee. 2 The Federal Financial Institutions Examination Council Act of 1978 (12 U.S.C. 3302(3)) defines financial 

institution. Additionally, as a member of the FFIEC, the CFPB will also use the CC Rating System to assign a 

consumer compliance rating, as appropriate for nonbanks, for which it has jurisdiction regarding the enforcement of 

Federal consumer financial laws as defined under the Dodd-Frank Wall Street Reform and Consumer Protection Act 

(Dodd-Frank Act) (12 U.S.C. 5481 et seq.).
2

2

rating to an institution. The definitions consist of qualitative descriptions for each rating 

category and include compliance management system (CMS) elements reflecting risk control 

processes designed to manage consumer compliance risk and considerations regarding violations 

of laws, consumer harm, and the size, complexity, and risk profile of an institution. The

consumer compliance rating reflects the effectiveness of an institution’s CMS to ensure 

compliance with consumer protection laws and regulations and reduce the risk of harm to 

consumers. 

Principles of the Interagency CC Rating System

The Agencies developed the following principles to serve as a foundation for the CC 

Rating System.

Risk-based. Recognize and communicate clearly that CMS vary based on the size, 

complexity, and risk profile of supervised institutions. 

Transparent. Provide clear distinctions between rating categories to support consistent 

application by the Agencies across supervised institutions. Reflect the scope of the 

review that formed the basis of the overall rating. 

Actionable. Identify areas of strength and direct appropriate attention to specific areas of 

weakness, reflecting a risk-based supervisory approach. Convey examiners’ assessment 

of the effectiveness of an institution’s CMS, including its ability to prevent consumer 

harm and ensure compliance with consumer protection laws and regulations. 

Incent Compliance. Incent the institution to establish an effective consumer compliance 

system across the institution and to identify and address issues promptly, including self-
3

3

identification and correction of consumer compliance weaknesses. Reflect the potential 

impact of any consumer harm identified in examination findings.

Five-Level Rating Scale

The CC Rating System is based upon a numeric scale of 1 through 5 in increasing order 

of supervisory concern. Thus, 1 represents the highest rating and consequently the lowest degree

of supervisory concern, while 5 represents the lowest rating and the most critically deficient level 

of performance, and therefore, the highest degree of supervisory concern.3 Ratings of 1 or 2

represent satisfactory or better performance. Ratings of 3, 4, or 5 indicate performance that is 

less than satisfactory. Consistent with the previously described Principles, the rating system 

incents a financial institution to establish an effective CMS across the institution, to self-identify 

risks, and to take the necessary actions to reduce the risk of non-compliance and consumer harm. 

• The highest rating of 1 is assigned to a financial institution that maintains a strong 

CMS and takes action to prevent violations of law and consumer harm. 

• A rating of 2 is assigned to a financial institution that maintains a CMS that is 

satisfactory at managing consumer compliance risk in the institution’s products and 

services and at substantially limiting violations of law and consumer harm. 

• A rating of 3 reflects a CMS deficient at managing consumer compliance risk in the 

institution’s products and services and at limiting violations of law and consumer 

harm. 

 3 The Agencies do not consider an institution’s record of performance under the Community Reinvestment Act 

(CRA) in conjunction with assessing an institution under the CC Rating System since institutions are evaluated 

separately under the CRA.
4

4

• A rating of 4 reflects a CMS seriously deficient at managing consumer compliance 

risk in the institution’s products and services and/or at preventing violations of law 

and consumer harm. “Seriously deficient” indicates fundamental and persistent 

weaknesses in crucial CMS elements and severe inadequacies in core compliance 

areas necessary to operate within the scope of statutory and regulatory consumer 

protection requirements and to prevent consumer harm. 

• A rating of 5 reflects a CMS critically deficient at managing consumer compliance 

risk in the institution’s products and services and/or at preventing violations of law 

and consumer harm. “Critically deficient” indicates an absence of crucial CMS 

elements and a demonstrated lack of willingness or capability to take the appropriate 

steps necessary to operate within the scope of statutory and regulatory consumer

protection requirements and to prevent consumer harm. 

CC Rating System Categories and Assessment Factors

CC Rating System – Categories

The CC Rating System is organized under three broad categories: 

1. Board and Management Oversight, 

2. Compliance Program, and 

3. Violations of Law and Consumer Harm. 

The Consumer Compliance Rating Definitions below list the assessment factors 

considered within each category, along with narrative descriptions of performance.

The first two categories, Board and Management Oversight and Compliance Program, 

are used to assess a financial institution’s CMS. As such, examiners should evaluate the 
5

5

assessment factors within these two categories commensurate with the institution’s size, 

complexity, and risk profile. All institutions, regardless of size, should maintain an effective 

CMS. The sophistication and formality of the CMS typically will increase commensurate with 

the size, complexity, and risk profile of the entity. 

Additionally, compliance expectations contained within the narrative descriptions of 

these two categories extend to third-party relationships into which the financial institution has 

entered. There can be certain benefits to financial institutions engaging in relationships with 

third parties, including gaining operational efficiencies or an ability to deliver additional 

products and services, but such arrangements also may expose financial institutions to risks if not 

managed effectively. The prudential agencies, the CFPB, and some states have issued guidance 

describing expectations regarding oversight of third-party relationships. While an institution’s 

management may make the business decision to outsource some or all of the operational aspects 

of a product or service, the institution cannot outsource the responsibility for complying with 

laws and regulations or managing the risks associated with third-party relationships. 

As noted in the Consumer Compliance Rating Definitions, examiners should evaluate 

activities conducted through third-party relationships as though the activities were performed by 

the institution itself. Examiners should review a financial institution’s management of thirdparty relationships and servicers as part of its overall compliance program.

The third category, Violations of Law and Consumer Harm, includes assessment factors 

that evaluate the dimensions of any identified violation or consumer harm. Examiners should 

weigh each of these four factors – root cause, severity, duration, and pervasiveness – in 

evaluating relevant violations of law and any resulting consumer harm. 
6

6

Board and Management Oversight – Assessment Factors

Under Board and Management Oversight, the examiner should assess the financial 

institution’s board of directors and management, as appropriate for their respective roles and 

responsibilities, based on the following assessment factors:

• oversight of and commitment to the institution’s CMS; 

• effectiveness of the institution’s change management processes, including responding 

timely and satisfactorily to any variety of change, internal or external, to the 

institution;

• comprehension, identification, and management of risks arising from the institution’s 

products, services, or activities; and

• self-identification of consumer compliance issues and corrective action undertaken as 

such issues are identified.

Compliance Program – Assessment Factors

Under Compliance Program, the examiner should assess other elements of an effective 

CMS, based on the following assessment factors:

• whether the institution’s policies and procedures are appropriate to the risk in the 

products, services, and activities of the institution; 

• the degree to which compliance training is current and tailored to risk and staff 

responsibilities; 

• the sufficiency of the monitoring and, if applicable, audit to encompass compliance 

risks throughout the institution; and 

• the responsiveness and effectiveness of the consumer complaint resolution process.
7

7

Violations of Law and Consumer Harm – Assessment Factors

Under Violations of Law and Consumer Harm, the examiner should analyze the 

following assessment factors: 

• the root cause, or causes, of any violations of law identified during the examination;

• the severity of any consumer harm resulting from violations; 

• the duration of time over which the violations occurred; and

• the pervasiveness of the violations.

As a result of a violation of law, consumer harm may occur. While many instances of 

consumer harm can be quantified as a dollar amount associated with financial loss, such as 

charging higher fees for a product than was initially disclosed, consumer harm may also result 

from a denial of an opportunity. For example, a consumer could be harmed when a financial 

institution denies the consumer credit or discourages an application in violation of the Equal 

Credit Opportunity Act,4 whether or not there is resulting financial harm. 

This category of the Consumer Compliance Rating Definitions defines four factors by 

which examiners can assess violations of law and consumer harm.

Root Cause. The Root Cause assessment factor analyzes the degree to which weaknesses 

in the CMS gave rise to the violations. In many instances, the root cause of a violation is tied to 

a weakness in one or more elements of the CMS. Violations that result from critical deficiencies 

in the CMS evidence a critical absence of management oversight and are of the highest 

supervisory concern.

 4 15 U.S.C. 1691 et seq.
8

8

Severity. The Severity assessment factor of the Consumer Compliance Rating 

Definitions weighs the type of consumer harm, if any, that resulted from violations of law. More 

severe harm results in a higher level of supervisory concern under this factor. For example, 

some consumer protection violations may cause significant financial harm to a consumer, while 

other violations may cause negligible harm, based on the specific facts involved.

Duration. The Duration assessment factor considers the length of time over which the 

violations occurred. Violations that persist over an extended period of time will raise greater

supervisory concerns than violations that occur for only a brief period of time. When violations 

are brought to the attention of an institution’s management and management allows those 

violations to remain unaddressed, such violations are of the highest supervisory concern.

Pervasiveness. The Pervasiveness assessment factor evaluates the extent of the 

violation(s) and resulting consumer harm, if any. Violations that affect a large number of 

consumers will raise greater supervisory concern than violations that impact a limited number of 

consumers. If violations become so pervasive that they are considered to be widespread or 

present in multiple products or services, the institution’s performance under this factor is of the 

highest supervisory concern.

Self-Identification of Violations of Law and Consumer Harm

Strong compliance programs are proactive. They promote consumer protection by 

preventing, self-identifying, and addressing compliance issues in a proactive manner. 

Accordingly, the CC Rating System provides incentives for such practices through the 

definitions associated with a 1 rating. 
9

9

The Agencies believe that self-identification and prompt correction of violations of law 

reflect strengths in an institution’s CMS. A robust CMS appropriate for the size, complexity and 

risk profile of an institution’s business often will prevent violations or will facilitate early 

detection of potential violations. This early detection can limit the size and scope of consumer 

harm. Moreover, self-identification and prompt correction of serious violations represents 

concrete evidence of an institution’s commitment to responsibly address underlying risks. In 

addition, appropriate corrective action, including both correction of programmatic weaknesses 

and full redress for injured parties, limits consumer harm and prevents violations from recurring 

in the future. Thus, the CC Rating System recognizes institutions that consistently adopt these 

strategies as reflected in the Consumer Compliance Rating Definitions.

Evaluating Performance Using the CC Rating Definitions

The consumer compliance rating is derived through an evaluation of the financial 

institution’s performance under each of the assessment factors described above. The consumer 

compliance rating reflects the effectiveness of an institution’s CMS to identify and manage 

compliance risk in the institution’s products and services and to prevent violations of law and 

consumer harm, as evidenced by the financial institution’s performance under each of the 

assessment factors. 

The consumer compliance rating reflects a comprehensive evaluation of the financial 

institution’s performance under the CC Rating System by considering the categories and 

assessment factors in the context of the size, complexity, and risk profile of an institution. It is 

not based on a numeric average or any other quantitative calculation. Specific numeric ratings 

will not be assigned to any of the 12 assessment factors. Thus, an institution need not achieve a 
10

10

satisfactory assessment in all categories in order to be assigned an overall satisfactory rating. 

Conversely, an institution may be assigned a less than satisfactory rating even if some of its 

assessments were satisfactory.

The relative importance of each category or assessment factor may differ based on the 

size, complexity, and risk profile of an individual institution. Accordingly, one or more category 

or assessment factor may be more or less relevant at one financial institution as compared to 

another institution. While the expectations for compliance with consumer protection laws and 

regulations are the same across institutions of varying sizes, the methods for accomplishing an 

effective CMS may differ across institutions. 

The evaluation of an institution’s performance within the Violations of Law and 

Consumer Harm category of the CC Rating Definitions considers each of the four assessment 

factors: Root Cause, Severity, Duration, and Pervasiveness. At the levels of 4 and 5 in this 

category, the distinctions in the definitions are focused on the root cause assessment factor rather 

than Severity, Duration, and Pervasiveness. This approach is consistent with the other categories 

where the difference between a 4 and a 5 is driven by the institution’s capacity and willingness to 

maintain a sound consumer compliance system. 

In arriving at the final rating, the examiner must balance potentially differing conclusions 

about the effectiveness of the financial institution’s CMS over the individual products, services, 

and activities of the organization. Depending on the relative materiality of a product line to the 

institution, an observed weakness in the management of that product line may or may not impact 

the conclusion about the institution’s overall performance in the associated assessment factor(s). 

For example, serious weaknesses in the policies and procedures or audit program of the 

mortgage department at a mortgage lender would be of greater supervisory concern than those 
11

11

same gaps at an institution that makes very few mortgage loans and strictly as an 

accommodation. Greater weight should apply to the financial institution’s management of 

material products with significant potential consumer compliance risk.

An institution may receive a less than satisfactory rating even when no violations were 

identified, based on deficiencies or weaknesses identified in the institution’s CMS. For example, 

examiners may identify weaknesses in elements of the CMS in a new loan product. Because the 

presence of those weaknesses left unaddressed could result in future violations of law and 

consumer harm, the CMS deficiencies could impact the overall consumer compliance rating, 

even if no violations were identified.

Similarly, an institution may receive a 1 or 2 rating even when violations were present, if 

the CMS is commensurate with the risk profile and complexity of the institution. For example, 

when violations involve limited impact on consumers, were self-identified, and resolved 

promptly, the evaluation may result in a 1 or 2 rating. After evaluating the institution’s 

performance in the two CMS categories, Board and Management Oversight and Compliance 

Program, and the dimensions of the violations in the third category, the examiner may conclude 

that the overall strength of the CMS and the nature of observed violations viewed together do not 

present significant supervisory concerns.

Assignment of Ratings by Supervisor(s)

The prudential regulators will continue to assign and update, as appropriate, consumer 

compliance ratings for institutions they supervise, including those with total assets of more than 

$10 billion.5

 As a member of the FFIEC, the CFPB will also use the CC Rating System to assign 

 5 Section 1025 of the Dodd-Frank Act (12 U.S.C. 5515) applies to federally insured institutions with more than $10 

billion in total assets. This section granted the CFPB exclusive authority to examine insured depository institutions 

and their affiliates for compliance with Federal consumer financial laws. The prudential regulators retained authority 

for examining insured depository institutions with more than $10 billion in total assets for compliance with certain 
12

12

a consumer compliance rating, as appropriate, for institutions with total assets of more than $10 

billion, as well as for nonbanks for which it has jurisdiction regarding the enforcement of 

Federal consumer financial laws as defined under the Dodd-Frank Act.6 The prudential 

regulators will take into consideration any material supervisory information provided by the 

CFPB, as that information relates to covered supervisory activities or covered examinations.7 

Similarly, the CFPB will take into consideration any material supervisory information provided 

by prudential regulators in appropriate supervisory situations. 

State regulators maintain supervisory authority to conduct examinations of statechartered depository institutions and licensed entities. As such, states may assign consumer 

compliance ratings to evaluate compliance with both state and federal laws and regulations. 

States will collaborate and consider material supervisory information from other state and federal 

regulatory agencies during the course of examinations.

 

other laws related to consumer financial protection, including the Fair Housing Act, the Servicemembers Civil 

Relief Act, and section 5 of the Federal Trade Commission Act.

6 12 U.S.C. 5481 et seq. A financial institution with assets over $10 billion may receive a consumer compliance 

rating by both its primary prudential regulator and the CFPB. The rating is based on each agency’s review of the 

institution’s CMS and compliance with the federal consumer protection laws falling under each agency’s 

jurisdiction. 

7 The prudential regulators and the CFPB signed a Memorandum of Understanding on Supervisory Coordination 

dated May 16, 2012 (MOU) intended to facilitate the coordination of supervisory activities involving financial 

institutions with more than $10 billion in assets as required under the Dodd-Frank Act. 
13

13

Consumer Compliance Rating Definitions

ASSESSMENT 

FACTORS TO BE 

CONSIDERED

1 2 3 4 5

Board and Management Oversight

Board and management oversight factors should be evaluated commensurate with the institution’s size, complexity, and risk profile. 

Compliance expectations below extend to third-party relationships.

Oversight and 

Commitment

Board and 

management 

demonstrate strong 

commitment and 

oversight to the 

financial institution’s 

compliance 

management system. 

Substantial 

compliance 

resources are 

provided, including 

systems, capital, and 

human resources 

commensurate with 

the financial 

institution’s size, 

complexity, and risk 

profile. Staff is 

knowledgeable, 

empowered and held 

accountable for 

compliance with 

consumer laws and 

regulations. 

Management 

conducts 

comprehensive and 

ongoing due 

diligence and 

oversight of third 

parties consistent 

with agency 

expectations to 

ensure that the 

financial institution 

complies with 

consumer protection 

laws, and exercises 

strong oversight of 

third parties’ 

policies, procedures, 

internal controls, and 

training to ensure 

consistent oversight 

of compliance 

responsibilities.

Board and 

management provide 

satisfactory oversight 

of the financial 

institution’s 

compliance 

management system. 

Compliance 

resources are 

adequate and staff is 

generally able to 

ensure the financial 

institution is in 

compliance with 

consumer laws and 

regulations. 

Management 

conducts adequate 

and ongoing due 

diligence and 

oversight of third 

parties to ensure 

that the financial 

institution complies 

with consumer 

protection laws, and 

adequately oversees 

third parties’ policies, 

procedures, internal 

controls, and training 

to ensure 

appropriate 

oversight of 

compliance 

responsibilities. 

Board and 

management 

oversight of the 

financial institution’s 

compliance 

management system 

is deficient. 

Compliance 

resources and staff 

are inadequate to 

ensure the financial 

institution is in 

compliance with 

consumer laws and 

regulations. 

Management does 

not adequately 

conduct due 

diligence and 

oversight of third 

parties to ensure 

that the financial 

institution complies 

with consumer 

protection laws, nor 

does it adequately 

oversee third parties’ 

policies, procedures, 

internal controls, and 

training to ensure 

appropriate 

oversight of 

compliance 

responsibilities. 

Board and 

management 

oversight, resources, 

and attention to the 

compliance 

management system 

are seriously deficient. 

Compliance resources 

and staff are seriously 

deficient and are 

ineffective at ensuring 

the financial 

institution’s 

compliance with 

consumer laws and 

regulations. 

Management 

oversight and due 

diligence over thirdparty performance, as 

well as management’s 

ability to adequately 

identify, measure, 

monitor, or manage 

compliance risks, is 

seriously deficient.

Board and 

management 

oversight, 

resources, and 

attention to the 

compliance 

management 

system are 

critically deficient. 

Compliance 

resources are 

critically deficient 

in supporting the 

financial 

institution’s 

compliance with 

consumer laws 

and regulations, 

and management 

and staff are 

unwilling or 

incapable of 

operating within 

the scope of 

consumer 

protection laws 

and regulations. 

Management 

oversight and due 

diligence of thirdparty performance 

is critically 

deficient.

Change 

Management

Management 

anticipates and 

responds promptly 

to changes in 

applicable laws and 

Management 

responds timely and 

adequately to 

changes in applicable 

laws and regulations, 

Management does 

not respond 

adequately and/or 

timely in adjusting to 

changes in applicable 

Management’s 

response to changes 

in applicable laws and 

regulations, market 

conditions, or 

Management fails 

to monitor and 

respond to 

changes in 

applicable laws 
14

14

ASSESSMENT 

FACTORS TO BE 

CONSIDERED

1 2 3 4 5

regulations, market 

conditions and 

products and 

services offered by 

evaluating the 

change and 

implementing 

responses across 

impacted lines of 

business. 

Management 

conducts due 

diligence in advance 

of product changes, 

considers the entire 

life cycle of a product 

or service in 

implementing 

change, and reviews 

the change after 

implementation to 

determine that 

actions taken have 

achieved planned 

results.

market conditions, 

products and 

services offered by 

evaluating the 

change and 

implementing 

responses across 

impacted lines of 

business. 

Management 

evaluates product 

changes before and 

after implementing 

the change. 

laws and regulations, 

market conditions, 

and products and 

services offered. 

products and services 

offered is seriously 

deficient. 

and regulations, 

market conditions, 

or products and 

services offered.

Comprehension, 

Identification 

and 

Management of 

Risk

Management has a 

solid comprehension 

of and effectively 

identifies compliance 

risks, including 

emerging risks, in the 

financial institution’s 

products, services, 

and other activities. 

Management 

actively engages in 

managing those 

risks, including 

through 

comprehensive selfassessments. 

Management 

comprehends and 

adequately identifies 

compliance risks, 

including emerging 

risks, in the financial 

institution’s 

products, services, 

and other activities. 

Management 

adequately manages 

those risks, including 

through selfassessments. 

Management has an 

inadequate 

comprehension of 

and ability to identify 

compliance risks, 

including emerging 

risks, in the financial 

institution’s 

products, services, 

and other activities. 

Management exhibits 

a seriously deficient 

comprehension of and 

ability to identify 

compliance risks, 

including emerging 

risks, in the financial 

institution. 

Management does 

not comprehend 

nor identify 

compliance risks, 

including 

emerging risks, in 

the financial 

institution. 

Corrective 

Action and SelfIdentification

Management 

proactively identifies 

issues and promptly 

responds to 

compliance risk 

management 

deficiencies and any 

violations of laws or 

regulations, including 

remediation.

Management 

adequately responds 

to and corrects 

deficiencies and/or 

violations, including 

adequate 

remediation, in the 

normal course of 

business. 

Management does 

not adequately 

respond to 

compliance 

deficiencies and 

violations including 

those related to 

remediation.

Management 

response to 

deficiencies, violations 

and examination 

findings is seriously 

deficient.

Management is 

incapable, 

unwilling and/or 

fails to respond to 

deficiencies, 

violations or 

examination 

findings.

Compliance Program 

Compliance Program factors should be evaluated commensurate with the institution’s size, complexity, and risk profile. Compliance 

expectations below extend to third-party relationships.

Policies and 

Procedures

Compliance policies 

and procedures and 

third-party 

relationship 

management 

Compliance policies 

and procedures and 

third-party 

relationship 

management 

Compliance policies 

and procedures and 

third-party 

relationship 

management 

Compliance policies 

and procedures and 

third-party 

relationship 

management 

Compliance 

policies and 

procedures and 

third-party 

relationship 
15

15

ASSESSMENT 

FACTORS TO BE 

CONSIDERED

1 2 3 4 5

programs are strong, 

comprehensive and 

provide standards to 

effectively manage 

compliance risk in 

the products, 

services and 

activities of the 

financial institution.

programs are 

adequate to manage 

the compliance risk 

in the products, 

services and 

activities of the 

financial institution. 

programs are 

inadequate at 

managing the 

compliance risk in 

the products, 

services and 

activities of the 

financial institution.

programs are 

seriously deficient at 

managing compliance 

risk in the products, 

services and activities 

of the financial 

institution.

management 

programs are 

critically absent.

Training Compliance training 

is comprehensive, 

timely, and 

specifically tailored 

to the particular 

responsibilities of the 

staff receiving it, 

including those 

responsible for 

product 

development, 

marketing and 

customer service. 

The compliance 

training program is 

updated proactively 

in advance of the 

introduction of new 

products or new 

consumer protection 

laws and regulations 

to ensure that all 

staff are aware of 

compliance 

responsibilities 

before rolled out.

Compliance training 

outlining staff 

responsibilities is 

adequate and 

provided timely to 

appropriate staff.

The compliance 

training program is 

updated to 

encompass new 

products and to 

comply with changes 

to consumer 

protection laws and 

regulations.

Compliance training 

is not adequately 

comprehensive, 

timely, updated, or 

appropriately 

tailored to the 

particular 

responsibilities of the 

staff. 

Compliance training is 

seriously deficient in 

its 

comprehensiveness, 

timeliness, or 

relevance to staff with 

compliance 

responsibilities, or has 

numerous major 

inaccuracies. 

Compliance 

training is critically 

absent.

Monitoring 

and/or Audit

Compliance 

monitoring practices, 

management 

information systems, 

reporting, 

compliance audit, 

and internal control 

systems are 

comprehensive, 

timely, and 

successful at 

identifying and 

measuring material 

compliance risk 

management 

throughout the 

financial institution. 

Programs are 

monitored 

proactively to 

identify procedural 

or training 

weaknesses to 

preclude regulatory 

violations. Program 

modifications are 

Compliance 

monitoring practices, 

management 

information systems, 

reporting, 

compliance audit, 

and internal control 

systems adequately 

address compliance 

risks throughout the 

financial institution. 

Compliance 

monitoring practices, 

management 

information systems, 

reporting, 

compliance audit, 

and internal control 

systems do not 

adequately address 

risks involving 

products, services or 

other activities 

including, timing and 

scope.

Compliance 

monitoring practices, 

management 

information systems, 

reporting, compliance 

audit, and internal 

controls are seriously 

deficient in addressing 

risks involving 

products, services or 

other activities.

Compliance 

monitoring 

practices, 

management 

information 

systems, 

reporting, 

compliance audit, 

or internal 

controls are 

critically absent.
16

16

ASSESSMENT 

FACTORS TO BE 

CONSIDERED

1 2 3 4 5

made expeditiously 

to minimize 

compliance risk.

Consumer 

Complaint 

Response

Processes and 

procedures for 

addressing consumer 

complaints are 

strong. Consumer 

complaint 

investigations and 

responses are 

prompt and 

thorough. 

Management 

monitors consumer 

complaints to 

identify risks of 

potential consumer 

harm, program 

deficiencies, and 

customer service 

issues and takes 

appropriate action.

Processes and 

procedures for 

addressing consumer 

complaints are 

adequate. Consumer 

complaint 

investigations and 

responses are 

generally prompt and 

thorough. 

Management 

adequately monitors 

consumer complaints 

and responds to 

issues identified.

Processes and 

procedures for 

addressing consumer 

complaints are 

inadequate. 

Consumer complaint 

investigations and 

responses are not 

thorough or timely. 

Management does 

not adequately 

monitor consumer 

complaints. 

Processes and 

procedures for 

addressing consumer 

complaints and 

consumer complaint 

investigations are 

seriously deficient. 

Management 

monitoring of 

consumer complaints 

is seriously deficient.

Processes and 

procedures for 

addressing 

consumer 

complaints are 

critically absent. 

Meaningful 

investigations and 

responses are 

absent. 

Management 

exhibits a 

disregard for 

complaints or 

preventing 

consumer harm.

Violations of Law and Consumer Harm

Root Cause The violations are 

the result of minor 

weaknesses, if any, in 

the compliance risk 

management system. 

Violations are the 

result of modest 

weaknesses in the 

compliance risk 

management system. 

Violations are the 

result of material 

weaknesses in the 

compliance risk 

management system. 

Violations are the 

result of serious 

deficiencies in the 

compliance risk 

management system.

Violations are the 

result of critical 

deficiencies in the 

compliance risk 

management 

system. 

Severity The type of 

consumer harm, if 

any, resulting from 

the violations would 

have a minimal 

impact on 

consumers. 

The type of 

consumer harm 

resulting from the 

violations would 

have a limited impact 

on consumers. 

The type of 

consumer harm 

resulting from the 

violations would 

have a considerable 

impact on 

consumers. 

The type of consumer harm resulting from 

the violations would have a serious impact 

on consumers. 

Duration The violations and 

resulting consumer 

harm, if any, 

occurred over a brief 

period of time.

The violations and 

resulting consumer 

harm, if any, 

occurred over a 

limited period of 

time. 

The violations and 

resulting consumer 

harm, if any, 

occurred over an 

extended period of 

time. 

The violations and resulting consumer harm, 

if any, have been long-standing or repeated.

Pervasiveness The violations and 

resulting consumer 

harm, if any, are 

isolated in number.

The violations and 

resulting consumer 

harm, if any, are 

limited in number. 

The violations and 

resulting consumer 

harm, if any, are 

numerous. 

The violations and resulting consumer harm, 

if any, are widespread or in multiple 

products or services.