Introduction
Banking is one of the most regulated industries in the United States—and compliance failures carry consequences that go well beyond fines. Enforcement actions can trigger reputational damage, growth restrictions, and lasting loss of examiner confidence. The scale of recent AML and BSA enforcement makes the stakes concrete: in 2024, FinCEN assessed a record $1.3 billion penalty against TD Bank—the largest ever levied against a U.S. depository institution.
Penalties at that scale don't emerge from isolated missteps—they reflect systemic gaps in how institutions identify, prioritize, and act on compliance risk.
This guide is written for banking executives, board members, and risk leaders who need to understand what a compliance risk assessment actually is, how to conduct one that holds up under examiner scrutiny, and how to translate its findings into clear ownership, board-level reporting, and defensible remediation decisions.
TL;DR
- Bank compliance risk assessment maps exposure from regulatory failures—covering laws, internal policies, and supervisory expectations—then drives action to close gaps
- Three pillars structure the framework: inherent risk, the controls applied to manage it, and residual risk that remains after those controls
- Key risk categories include AML/BSA violations, CDD failures, cybersecurity gaps, UDAAP violations, and sanctions non-compliance
- Examiners evaluate program effectiveness relative to risk profile—not just program existence
- Boards own the outcome: reviewing assessments, setting risk appetite, and ensuring residual risk conclusions drive real follow-through
What Is Bank Compliance Risk Assessment?
Compliance risk is the likelihood of regulatory sanctions, financial penalties, or reputational harm arising from a bank's failure to comply with applicable laws, regulations, and standards—before and after controls are applied.
A compliance risk assessment is the structured process for managing that exposure. Specifically, it involves:
- Identifying high-risk products, services, and business activities
- Evaluating the likelihood and potential impact of noncompliance for each
- Comparing residual risk against the institution's board-approved risk appetite
- Developing targeted mitigation strategies with clear owners and deadlines
What distinguishes a compliance risk assessment from a general enterprise risk assessment is its focus on regulatory obligations. Where an enterprise risk assessment might address credit, market, or liquidity risks, a compliance risk assessment zeroes in on the specific regulatory frameworks that govern how the institution operates: AML/BSA, UDAAP, ECOA, GLBA, and similar obligations that directly shape how the bank serves its customers.
Key Categories of Compliance Risk in Banking
While banks face a broad spectrum of risk types, the compliance categories generating the most regulatory scrutiny fall into a distinct group. These are the risks most frequently cited in exam findings and enforcement actions.
AML and BSA Compliance
AML and BSA risk centers on a bank's obligation to prevent illegitimate funds from entering the financial system. The FFIEC BSA/AML Exam Manual requires institutions to calibrate AML controls to their specific products, customers, geographies, and transaction types. There's no one-size-fits-all approach.
The financial stakes are substantial. Beyond the $1.3 billion TD Bank penalty, FinCEN assessed $140 million against USAA Federal Savings Bank in 2022 for BSA violations, and the OCC assessed $65 million against City National Bank in 2024 for BSA/AML compliance risk management deficiencies.
Customer Due Diligence and KYC Failures
CDD failures—inadequate customer identification, insufficient transaction monitoring, or poor recordkeeping—directly elevate exposure to both financial crime and regulatory action. Under 31 CFR 1020.210, banks must maintain ongoing customer due diligence, develop customer risk profiles, monitor for suspicious transactions, and update beneficial ownership information for legal entity customers.
Beneficial ownership requirements are specific: institutions must identify individuals owning 25% or more of equity interests, plus one control person with significant management responsibility.
Cybersecurity and Data Privacy Risk
When banks fail to protect personally identifiable information or maintain sufficient cybersecurity controls, the exposure is both regulatory and reputational. For national banks, 12 CFR Part 30, Appendix B addresses the administrative, technical, and physical safeguards required.
The OCC's $80 million civil money penalty against Capital One in 2020 shows how quickly cybersecurity gaps become regulatory findings. The violation: failing to establish effective risk-assessment processes before migrating IT operations to the cloud.
Cybersecurity governance is no longer an IT function. As Tyson Martin frames it when advising boards: "Cyber risk isn't a cybersecurity IT problem. It's business risk that demands effective risk management." Examiners expect boards to own this accountability directly, not delegate it to a technology department and assume the work is done.
Consumer Protection and UDAAP Violations
Banks must deal fairly and transparently with consumers at every stage of the relationship. CFPA Section 1031 prohibits unfair, deceptive, or abusive acts or practices, and enforcement has been aggressive. The CFPB ordered Wells Fargo to pay $3.7 billion in 2022 for violations across auto loans, mortgages, and deposit accounts. Regions Bank paid $191 million for illegal surprise overdraft fees the same year.
Fair lending risk under ECOA and the Fair Housing Act falls into this category as well, covering:
- Underwriting criteria and credit decisions
- Pricing disparities across protected classes
- Marketing and product targeting practices
- Steering borrowers toward less favorable terms
Sanctions and Regulatory Reporting Compliance
Banks must screen against OFAC sanctions lists and avoid transactions with sanctioned entities or countries. Reporting obligations are equally non-negotiable:
- SARs: Required for suspicious transactions of at least $5,000, generally within 30 calendar days of initial detection (31 CFR 1020.320)
- CTRs: Required for currency transactions exceeding $10,000 (31 CFR 1010.311)
- Records must be retained for five years
Failures in regulatory reporting rarely stand alone. Examiners treat them as indicators of a broader compliance management breakdown.
The Three Pillars: Inherent Risk, Risk Management, and Residual Risk
The Federal Reserve's CA Letter 13-19, which established the Community Bank Risk-Focused Consumer Compliance Supervision Program, uses a three-pillar framework as its foundational structure. Banks can adopt this same framework for their own assessments—applying it across product lines, services, and business units.
Inherent Risk
Inherent risk is the likelihood and potential impact of noncompliance before any controls are applied. Key factors that influence inherent risk levels:
- Complexity of applicable regulations
- Potential for consumer harm
- Volume and growth trajectory of the product or service
- Maturity of the product (new vs. established)
- Reliance on third-party vendors
- Known industry-wide issues (such as deposit overdraft risk patterns)
Consider residential mortgage lending. A new TRID implementation involves complex disclosure requirements, high transaction volume, significant consumer harm potential, and often vendor-embedded processes: all factors that push inherent risk higher. Inherent risk ratings are typically categorized as high, moderate, or low, and regulators increasingly expect documented narrative support for those conclusions, not just numeric scores.
Risk Management (Controls)
Once inherent risk is scored, the next question is whether controls are strong enough to offset it. Risk management in this context means the adequacy of board and management oversight—including policies and procedures, training programs, monitoring systems, internal controls, and complaint management processes.
The formality required scales with institution size. Smaller community banks may rely on less formal processes, while larger institutions require comprehensive written policies and layered monitoring systems. Assessment of risk management should also consider:
- Frequency and severity of past examination findings
- Compliance audit results
- Whether root causes of prior issues have been addressed
- Change management processes when launching new products or engaging new vendors
That last point matters more than most institutions appreciate. New product launches and new vendor relationships are among the highest-risk moments in a bank's operating cycle.
Residual Risk
Residual risk is what remains after controls are applied. Identifying it drives a specific decision: compare it against the board-approved risk appetite, then choose a response path:
- Enhance controls to bring residual risk within appetite
- Reduce inherent risk by modifying a product feature or exiting a high-risk business line
- Accept the remaining exposure with formal board acknowledgment
Effective compliance risk assessments go beyond calculating residual risk—they produce a clear action log with specific control enhancements, responsible owners, and target timeframes. Without that log, the assessment answers the question but doesn't drive the work.
How to Conduct a Bank Compliance Risk Assessment: Step-by-Step
Step 1: Identify Material Products, Business Lines, and Activities
Structure assessments around products, services, and business units—not solely around applicable regulations. This matters because regulatory requirements cut across business lines in ways that create distinct risks. ECOA applies to both commercial and consumer lending, but the processes, exposures, and appropriate controls differ significantly.
Product categories that should always be assessed:
- Residential real estate lending
- Consumer lending and deposit products
- Commercial and agricultural lending
- Fintech partnerships and vendor-embedded products
- Any new or rapidly growing service lines
Step 2: Assess Inherent Risk for Each Area
For each product or service, evaluate inherent risk across these dimensions:
- Complexity of applicable laws
- Volume and growth trends
- Product maturity
- Third-party reliance
- Known industry risk patterns
Fair lending risk indicators—underwriting disparities, redlining, pricing, marketing, and steering—should be embedded in this assessment, whether integrated or standalone.
Step 3: Evaluate the Adequacy of Risk Management Controls
Assess whether existing controls are sufficient relative to the inherent risk identified. This includes policies, training, monitoring reports, internal audit findings, and complaint data.
The review should cover both automated system controls (such as disclosure generation systems) and manual checkpoints. Gaps in either category should trigger specific, documented remediation actions.
Step 4: Determine Residual Risk and Compare to Risk Appetite
Calculate residual risk by weighing inherent risk against the strength of mitigating controls. Then compare that result against the board's established risk appetite. If residual risk exceeds appetite, the institution must act—either by strengthening controls or reducing inherent risk exposure.
Risk appetite is a board-level decision. Management prepares the analysis; the board sets the threshold.
Step 5: Document, Assign, and Review
The most effective assessments produce a clear action log:
- Specific control enhancements required
- Responsible parties (named, not departments)
- Target completion timeframes
- Both quantitative data (complaint counts, audit findings) and qualitative narrative (business line context, examiner observations)
Assessments should be updated at minimum annually, and whenever material changes occur in products, regulations, or third-party relationships.
What the Board Needs to Know About Compliance Risk Assessment
Board and management oversight is one of the explicit factors evaluated in the Uniform Interagency Consumer Compliance Rating System. A rating of 1 means board oversight is strong, resources are adequate, and management demonstrates commitment sufficient to prevent violations. A rating of 3 indicates deficient oversight.
Ratings of 4 and 5 reflect seriously to critically deficient oversight. A rating of 5 means management is unwilling or incapable of operating within consumer protection laws.
The difference between a well-rated institution and a poorly rated one often comes down to how credibly the board can articulate its understanding of the institution's risk posture.
The board's specific responsibilities in the compliance risk assessment process:
- Review and approve the risk assessment
- Set and enforce the institution's risk appetite
- Ensure residual risk conclusions produce action, not just documentation
- Receive regular updates on emerging risks and control effectiveness
Boards need compliance reporting that communicates trend and direction, not just point-in-time snapshots. The reporting format Tyson Martin uses with board clients includes:
- A plain-English summary of residual risk by business line
- Changes since the prior assessment (what got better, what got worse)
- Specific open action items with named owners and deadlines
- Emerging regulatory risks on the horizon
When boards lack the governance infrastructure to translate complex risk outputs into clear decisions, engaging an experienced board advisor or fractional CISO can close that gap. That engagement provides the structured decision rights, escalation thresholds, and board-ready reporting formats that regulators expect to see in practice.
Common Mistakes Banks Make in Compliance Risk Assessments
Three patterns show up repeatedly in examiner findings and internal audit observations:
- Organizing by regulation, not by business line. Structuring assessments around laws (TILA, RESPA, ECOA) rather than the products and processes that carry the risk misses business-unit nuances and creates a false sense of completeness. Examiners have flagged this pattern consistently.
- Using numeric scores without narrative context. A spreadsheet of 1-to-5 ratings tells examiners very little about how an institution actually understands and manages its risks. Inconsistent rating scales across business lines make assessments impossible to compare or defend.
- Treating the assessment as a compliance department exercise. When business unit staff disengage, the assessment loses the operational insight that only they can provide. Business line owners own the risk — the compliance team facilitates the process, not the accountability.
Frequently Asked Questions
What are risk assessments in banking?
A banking risk assessment is the structured process of identifying, evaluating, and prioritizing risks—including compliance, credit, operational, and cybersecurity risks—that could affect a bank's ability to operate safely and meet its regulatory obligations. Most institutions conduct separate assessments for each risk domain.
What is a compliance risk matrix for banks?
A compliance risk matrix maps identified risks against two dimensions—likelihood and potential impact, each rated high, moderate, or low—to show which risks need the most urgent attention and whether current controls are sufficient to meet the board's approved risk appetite.
What is an example of compliance risk in banking?
Failing to file Suspicious Activity Reports for transactions meeting reporting thresholds is a primary example. That failure risks regulatory sanctions, fines, and reputational damage. CDD failures—such as inadequate beneficial ownership identification—and consumer protection violations like unauthorized fees are also frequently cited in enforcement actions.
What is the $3,000 rule in banking?
The $3,000 rule refers to the BSA Travel Rule under 31 CFR 1010.410(f), which requires banks to collect and transmit sender and recipient details on funds transfers of $3,000 or more, with records retained for five years as part of AML compliance obligations.
How often should banks conduct compliance risk assessments?
Most institutions conduct formal assessments at least annually, per OCC guidance that monitoring plans and schedules be documented and updated on that basis. Assessments should also be triggered by material changes: new product launches, regulatory updates, significant transaction volume increases, or new third-party vendor relationships.
What is residual risk in banking compliance?
Residual risk is the compliance exposure that remains after existing controls have been applied to mitigate inherent risk. If residual risk exceeds the board's approved risk appetite, the institution must either strengthen controls or reduce the underlying inherent risk.
