Compliance FAQ

More than most founders expect. The bank holds the charter, but your sponsor bank’s regulators expect it to apply its own program to your product, so its obligations become your contract requirements. Some rules also reach you directly, regardless of the bank. UDAAP is one. Depending on how your program is set up, Reg E and state money transmission laws can be others.

The practical answer is a regulatory applicability matrix, which ties every rule to a product flow, an owner, and evidence.

If you’re a bank or credit union, yes. If you’re a money transmitter or other money services business, yes, and you likely need to register with FinCEN. If you’re a fintech whose sponsor bank holds the accounts, the BSA applies to the bank, but the bank will push most of the day-to-day work onto you by contract: customer identification, monitoring, and escalating suspicious activity. Either way, you need an AML program you can explain to an examiner.

CIP (Customer Identification Program) is the account-opening requirement. You collect a name, date of birth, address, and ID number, verify them, and keep records. For banks, it’s at 31 CFR 1020.220.

CDD (Customer Due Diligence) goes further. It covers understanding the nature and purpose of the relationship, ongoing monitoring, and identifying and verifying the beneficial owners of legal entity customers under 31 CFR 1010.230.

KYC is the industry term for all of it together. It isn’t a separate regulation.

Not the core obligation. FinCEN’s final rule, effective August 14, 2026, made the March 2025 interim rule permanent, so U.S. companies no longer file beneficial ownership reports under the CTA.

Banks and other covered financial institutions still identify and verify the beneficial owners of legal entity customers under the CDD Rule (31 CFR 1010.230). A February 2026 FinCEN order narrowed when that is required. It now applies at the customer’s first account opening, when you learn facts that call the earlier information into question, and when your risk-based ongoing due diligence calls for it. Update your CIP and CDD procedures to match, and keep a record of any customer certification you rely on. Read more: The CTA Got Gutted. Your CDD Obligations Didn’t.

A CTR is required for cash transactions of more than $10,000 in one business day. Multiple transactions by or for the same person count together. File within 15 days.

A SAR is required when you know or suspect a transaction involves illegal funds, is designed to evade BSA reporting, or has no apparent lawful purpose. For banks, the general threshold is $5,000. For money services businesses, it’s $2,000. You have 30 calendar days from initial detection to file, or up to 60 if you haven’t identified a suspect. Document your decision either way. Examiners look for the alerts you closed as closely as the SARs you filed.

Partly. CCPA exempts personal information collected under GLBA, but the exemption covers the data, not your company. Marketing data, website visitor data, and employee data often fall outside GLBA, so CCPA can still apply to those. Map which data falls under which law before you write your privacy notices.

Separate the two. A complaint is a signal. Log it, categorize it, and look for patterns, because complaint trends are one of the first things examiners and sponsor banks review. A dispute is often a legal obligation with a deadline. Under Reg E, for example, an electronic fund transfer error generally has to be investigated within 10 business days, or within 45 days if you give provisional credit (12 CFR 1005.11). Longer timeframes apply to new accounts and some transaction types. Missed Reg E deadlines are one of the most common findings in fintech programs.

Not much. The CFPB withdrew dozens of guidance documents in 2025, but the UDAAP prohibition in the Dodd-Frank Act is still law, and state attorneys general enforce consumer protection on their own. Read more: The CFPB Is Down. Your Compliance Obligations Aren’t.

Fair lending is similar. Regulation B no longer recognizes disparate impact as of July 21, 2026, but disparate treatment is still illegal under ECOA. Disparate impact still applies to housing-related credit under the Fair Housing Act, and state laws vary. Re-scope your program by product and state. Don’t turn it off.

The same things the bank’s examiner expects from the bank. That means a compliance program with named owners, written policies and procedures, transaction monitoring and complaint data the bank can see, testing, and fast answers when the bank asks. Banks that were hit with BaaS enforcement actions are now asking for much more before launch and during the relationship. Read more: State Regulators Just Entered the BaaS Chat

Test it before the examiner does. Start with a current risk assessment that drives what you monitor and test. Then check whether your policies match what your staff actually does. Examiners find gaps between the two more often than missing policies. Finally, make sure your board is getting reporting that shows whether the program works, not just activity counts. Read more: When Your Compliance Program Fails the Exam

An experienced compliance officer who fills the role part-time. It fits banks between full-time hires, and fintechs that need senior compliance leadership before they can justify a full-time salary. You get someone who owns the program, reports to your board or sponsor bank, and answers to examiners, for a fraction of the cost.

Most work falls into three types. One is a Tailored Policy Set, your policies written for your institution at a fixed fee. Another is a defined project, such as a program build, risk assessment, or exam prep, scoped and quoted up front. The third is ongoing fractional support on a monthly basis. Every engagement starts with a short call to understand what you need. Request a consult.

Community and regional banks, credit unions, fintechs, BaaS providers, and lending platforms, nationwide. Key Compliance Group is based in Utah and works with clients remotely.

Yes. All files are standard Word and Excel documents, and kits also include PDF copies of the Word documents. They contain no macros, scripts, or links to outside data sources, and are delivered from our site over a secure connection. Files may open in Protected View, and selecting “Enable Editing” is all that is needed. If your network blocks .zip downloads, write to info@keycompliancegroup.com and we will provide the files another way.

Your download page opens from the link in your order email. Each link works for 30 days and for up to five downloads.

Need the files again, or can’t find the email? Write to info@keycompliancegroup.com from the address you ordered with and include your institution’s name.

Updates: during your update period, when a regulatory change materially affects a kit file, we email the updated file to the address used for the order.

Automatic renewal: update your card or cancel your updates plan in the customer portal (opens in a new tab).