You have the policies. You have training completion records showing 97% of staff finished the annual BSA module. Your compliance management system is documented in a framework that looks solid in a board presentation. The binder is thorough. The audit trail is clean.
And then the examiners show up.
They’re not reading the binder. They’re asking your teller supervisor what she does when a customer makes three cash deposits just under the reporting threshold in a week. They’re looking at your transaction monitoring system’s alert thresholds, asking when those thresholds were last reviewed and by whom. They’re going through 18 months of board compliance reports asking whether the board was actually informed of problems or just briefed on frameworks.
What they find, in a significant number of examinations, is a gap. Not a dishonest gap. A structural one. The compliance program that exists on paper is genuine, but it hasn’t been integrated into how the institution actually operates day to day.
What Examiners Are Actually Testing
The FFIEC’s compliance management system framework asks examiners to evaluate whether a bank’s CMS is “appropriate for the size, complexity, and risk profile of the institution.” That sounds like a documentation standard. It isn’t. The underlying examination question is whether the program actually works: whether compliance requirements are understood by the people responsible for meeting them, whether the institution’s monitoring is capable of detecting problems, and whether management uses the program’s outputs to make decisions.
That’s a fundamentally different evaluation than “does this policy exist.” The institutions that accumulate exam findings are almost never missing policies. What they’re missing is the operational connection between their written framework and the day-to-day reality of their institution.
The Policy-Procedure Gap
Policies and procedures are not the same document. A policy states what the institution’s position is. A procedure explains what someone actually does to give that policy effect. This distinction is basic compliance doctrine, but the gap between them is one of the most common examination findings.
If your BSA policy says customer risk ratings are reviewed annually, but there is no workflow defining who performs that review, no assignment mechanism, and no tracking system to confirm it happened, the policy is aspirational. An examiner who asks to see completed annual risk rating reviews and finds none, despite a policy saying they occur, will cite that as a CMS deficiency regardless of how well-written the policy is. The procedure is what banks actually get examined on, and in a surprising number of institutions the procedure simply hasn’t been written.
Training Completion Is Not Training Effectiveness
A 97% completion rate on an annual online compliance course tells an examiner that most employees clicked through a module. It doesn’t tell them whether anyone understood it. Examiners increasingly test this directly by asking front-line staff scenario-based questions about SAR filing thresholds, CDD documentation requirements, or what to do when a business customer can’t produce identification. If the answers are inconsistent or wrong, the training program has a documented problem regardless of what the completion report shows.
Effective compliance training has a clear, testable learning objective for each topic and some mechanism to verify that the objective was met. Not all banks need elaborate testing infrastructure to accomplish this. But click-through-to-completion modules with no knowledge check are a documented deficiency at many institutions, and the risk of relying on them is that the compliance function believes training is working while front-line staff are operating on outdated or incorrect understanding.
Monitoring That Runs but Doesn’t See
Transaction monitoring systems, complaint tracking programs, and audit sampling methodologies all need to be calibrated against the institution’s actual risk profile to be useful. A monitoring system implemented in 2019 with thresholds set based on the institution’s product mix and customer base at the time may be technically operational today while being functionally blind to the risks the institution actually faces.
This is a serious gap in a lot of community bank and mid-size institution programs. The system is running. The alerts are being reviewed. The documentation shows a functioning process. But if the thresholds haven’t been reviewed since implementation and documentation of that review doesn’t exist, an examiner will treat it as an unvalidated program. The OCC’s BSA/AML examination procedures explicitly require that monitoring systems be appropriate for the institution’s risk profile and that the rationale for alert thresholds be documented. That’s not a technical requirement. It’s an operational one.
Board Reporting That Informs vs. Board Reporting That Reassures
Boards receive compliance reports at most institutions. Whether those reports are informative is a separate question. If the board’s quarterly compliance report consistently shows green indicators, no escalations, no meaningful trend data, and no emerging risk items across multiple years, an examiner will ask whether the reporting pipeline is actually surfacing problems or filtering them out before they reach the board.
Examiners sometimes interview board members directly on this point. A board member who can’t speak to any specific compliance concern raised in the past two years, despite being on the receiving end of quarterly reports, tells the examiner something important about whether management’s reporting is designed to inform or to reassure. Boards are supposed to provide oversight. That requires them to have information that is actually actionable, not just a formatted summary of what went right.
Consumer Complaints Are a Window Into the Gap
Complaint management is often the clearest indicator of whether a compliance program is operational or ceremonial. Institutions with functional complaint management programs document complaints when they’re received, route them to the right function, track resolution, and look for patterns that might signal a systemic issue. Institutions with formal programs on paper but informal practices on the floor often have front-line staff resolving concerns in the moment without creating records, with the best intentions but with the effect of hiding the institution’s actual complaint experience from compliance oversight.
When examiners find complaints that should have been documented but weren’t, or find that the institution’s formal complaint data doesn’t reflect what branch staff describe as common customer concerns, it’s a significant finding, even if the underlying customer issues were minor. The CFPB’s supervisory examination procedures have consistently flagged complaint management as a window into whether an institution’s CMS is working in practice, and that lens doesn’t change with enforcement posture.
Closing the Gap Before the Exam
Three things are worth doing before the next examination cycle.
Walk a process the way an examiner would. Pick a high-risk compliance area like BSA/AML customer risk rating, UDAAP complaint handling, or Reg Z disclosure delivery, and trace the process from front-line execution back to the compliance function. What does the documentation trail actually look like? What would an examiner find if they asked the same question you just asked? Doing this internally, without the framing of an audit, surfaces operational reality rather than documented intent.
If your transaction monitoring or sampling methodologies haven’t had a documented threshold review in the past 18 months, schedule one. The review doesn’t need to result in changes. It needs to result in a documented record that the institution assessed whether its monitoring approach remains appropriate for its current risk profile. That document is what separates a functional monitoring program from an unvalidated one in an examiner’s eyes.
Look at your board compliance reports with the question: would these reports allow a board member to identify a specific compliance problem? If the answer is no, if the reports are summaries of frameworks rather than actual findings, trends, and action items, that’s the thing to fix before an examiner asks the same question of your board members.
The gap between a documented compliance program and an effective one is almost always operational rather than intentional. It doesn’t reflect bad faith; it reflects the normal pressure to move quickly, staff thinly, and treat documentation as the endpoint rather than the starting point. Closing that gap before an exam is always cheaper than explaining it after one.
Sources
FFIEC Compliance Management Systems | FFIEC Examination Procedures
FFIEC BSA/AML Examination Manual | FFIEC
OCC Comptroller’s Handbook: Compliance Management Systems | OCC
