1. Regulatory Requirements & Compliance: Ensuring Effective Outcomes Presented By: John E. Palmer, CPA Managing Director/Principal

2. Agenda Compliance Management System Risk-Based Approach Compliance Training Monitoring and Internal Audit Communication Recommended Steps

3. Compliance Management System

4. CMS Compliance Management System Reflect the bank’s business, culture, vision Identify and quantify compliance risks Build compliance into business processes and culture – who is responsible? Supported by a risk – based compliance program Demonstrate strong communication and accountability

5. CMS Interdependent Elements Board and Management oversight Compliance program Compliance monitoring and audit

6. Management Responsibilities Clear and unequivocal expectations Clear policy statements Authority and accountability Adequate resources Periodic compliance audits Reports to the Board Issue tracking and resolution

7. Board Responsibilities Understand Requirements Delegate Authority, but not Responsibility Ensure Qualified Management Provide Adequate Resources Supervise Management –Establish policies –Monitor implementation –Provide for independent reviews –Address supervisory reports Maintain Independence

8. Risk-Based Approach

9. Compliance Risk-Based Program Risk Matrix/Applicability Risk Assessments Risk Assessment Concepts/Methods Success Factors

10. Regulator Institution Type Applicable Universe of Laws, Regulations, and Guidance Business Lines, Delivery Channels, Products/Services, and Practices Applicability Matrix REQUIREMENTS Policies and Procedures Internal ControlsMonitoringTraining Risk Assessment Self - Assessment Internal Audit

11. Risk Assessments Compliance BSA/OFAC/Customer Risk Rating Information Security - GLBA ACH (Cash Management/Electronic Banking) Red Flag Assessment

12. Risk Assessment Terms and Concepts Inherent Risk vs. Residual Risk Exposure – Extent of Possible Damage Likelihood- Probability of an Event Occurring Risk Tolerance Measurements Risk Controls Risk Ranking and Heat Map

13. Risk Tolerance Measurements Events that Establish Managements Tolerance for Risk. Examples: –Regulatory Violations and fines –Customer Complaint Letters –Regulatory Exam Criticism

14. Risk Controls Risk controls relate to activities that are implemented to reduce the likelihood of an exposure event occurring. These activities include both preventive and detective controls: Preventive measure –Training/automated system Detective measure –Review after the fact. Can also mean audit and monitoring activities

16. Success Factors Measurable outcomes from a risk – based compliance program should include: –Risks are identified, measured and subject to a control structure –Supported by tailored policies procedures and functional controls at the business level –The compliance monitoring schedule and testing program has been set around the risk profile –Results are reported effectively and tracked

17. Compliance Training

18. Board, Management, Staff Job-specific, Role-based Blended learning –Online –Classroom Recordkeeping

19. Compliance Monitoring and Auditing

20. Compliance Monitoring Risk-based, proactive testing Self-monitoring at the department level Monitoring by the Compliance Department –New products, services, delivery channels –New or amended regulations –New staff Tracking corrective actions

21. Compliance Auditing Integrated Audits –Test compliance with high-risk laws and regulations during operational audits Targeted Compliance Audits Compliance Function Audit –Evaluate the effectiveness of the compliance function

22. Communication

23. The biggest challenge in communication is to first think through the following basic concepts: –Audience –Purpose of the communication –How do you need the audience to respond –Level of detail needed for the purpose –Risk level of content –Importance of timing and frequency

24. Types of Communication Risk Assessments Program and Scope overviews Monitoring/Audit reports Board/Management reports Open issue tracking reports Program status and progress reports Business unit monitoring results

25. Recommended Steps Take a deep breath Sit back and relax Review where you are Consider is your message heard Does your program have the right risk based balance Write down 5 action steps to improve your program results

26. Thank You John E. Palmer, CPA Managing Director/Principal jpalmer@icscompliance.com Office: (954) 489-2712 Cell: (954) 806-1863