Jump to a Section
How We Support Regulatory Compliance, Risk, and Controls
Whether you need consulting on regulatory requirements, a review of your compliance program, or targeted assessments, we tailor each engagement to your needs and we do it with clear next steps.
Compliance Management System (CMS) Consulting Services
Management and the board of directors have ultimate responsibility for compliance oversight. Ensuring the effectiveness and sustainability of the CMS through essential program elements from policies and procedures to consumer complaints is key to that oversight. CrossCheck’s compliance consulting services address these key program elements for banks, fintechs, mortgage companies, and credit unions.
CrossCheck’s consulting services address the following regulatory compliance program elements:
- Compliance Policy & Procedure Review/Development – Establish and incorporate compliance requirements and responsibilities into business processes.
- Compliance Risk Assessment – Identify and risk-rate compliance risks and controls for a refined focus.
- Monitoring, Audit, or Targeted Loan or Deposit Compliance Reviews – Review the institution’s operations and compliance with regulatory requirements to ensure responsibilities are carried out, legal requirements met, corrective action taken, and procedure and systems updates are made.
- Training – Communicate compliance responsibilities and guidance to all employees, management, and the board.
- Compliance Investigations & Remediation – Research and understand the root cause of identified issues and the persons impacted to ensure the corrective action and remediation addresses the issue and not the symptoms.
- Consumer Complaint Handling – Establish procedures to categorize, risk-rate, escalate, and address the root causes of consumer complaints. Ensure corrective actions are taken to prevent complaints from recurring.
Anti-Money Laundering/Combatting the Financing of Terrorism (AML/CFT) Services
CrossCheck performs AML/CFT audits and risk assessments required by the FFIEC, prudential, and state regulators for institutions every 12-18 months, or when changes to products/services occur.
Meet Your Regulatory Compliance Experts
Regulatory Compliance FAQs
How should boards measure the effectiveness and sustainability of a compliance management system over time?
Boards should look beyond policy approval and track whether compliance expectations are consistently executed across business lines. Key indicators include the quality and timeliness of issue remediation, repeat findings, trends in complaints, results of independent testing, and how effectively management responds to emerging risks. Periodic independent assessments provide boards with objective insight into whether the CMS remains effective as the organization evolves.
How often should a compliance risk assessment be refreshed, and what events should trigger an interim update?
An annual compliance risk assessment is typical; however, interim updates are warranted when material changes occur such as new products, servicing transfers, acquisitions, system implementations, or shifts in regulatory expectations, etc. Independent reviews can help recalibrate risk ratings and ensure emerging risks are identified and monitored before issues surface in internal testing, exams or supervisory actions.
How can compliance monitoring and internal audit functions be structured to avoid duplication while maintaining independence?
Clear delineation of roles is essential. Monitoring should be management-owned and conducted in real time, while internal audit provides independent assurance over control effectiveness at a point in time. Internal audit’s mandate includes verifying that management controls, including compliance monitoring, are operating as intended. External consultants are often engaged to benchmark structure and confirm that responsibilities align with supervisory expectations.
What role should complaint data play in shaping compliance risk assessments and testing plans?
Complaint data is a critical leading indicator of compliance risk and should directly inform risk assessments, scope, and testing priorities. Trends in root causes of complaints, effective solutions, timely resolution, and proper escalation will mitigate control gaps before they become problematic. Analysis of complaint data can help institutions validate conclusions and strengthen governance oversight.
How can compliance training be tailored to ensure accountability at the business-line level rather than treated as a checkbox exercise?
Effective training is role-specific, risk-based, and tied to actual operational responsibilities. Business-line ownership improves when training incorporates real scenarios, reinforces escalation expectations, and aligns with performance accountability. Independent review of the training program can assess whether training programs meaningfully support compliance objectives or require refinement.
What are regulators’ expectations around independent review versus management self-testing within a compliance program?
Regulators expect management to own compliance through ongoing monitoring and self-testing, supplemented by an independent review. Independent testing—whether performed by internal audit or an external party—should challenge assumptions, validate conclusions, and assess overall program effectiveness. Compliance consultants are frequently used to reinforce independence and objectivity.
How should institutions assess AML/CFT program changes following new products, services, or technology adoption?
AML/CFT programs should be reassessed whenever risk profiles change due to new offerings, delivery channels, or systems. This includes updating risk assessments, policies, monitoring rules, and training. Independent validation helps ensure that program changes adequately address new risks and align with FFIEC and FinCEN expectations.
When should an institution engage an independent compliance consultant rather than rely solely on internal resources?
Independent compliance consultants are most effective when an institution is navigating elevated risk, organizational change, regulatory attention, or capacity constraints that limit internal teams’ ability to provide objective assurance. External consultants bring specialized subject matter expertise, an unbiased perspective, and current benchmarking across peer institutions and regulatory expectations. Many organizations engage independent consultants to complement internal resources, including strengthening governance, validating management’s conclusions, and providing boards and senior leadership with defensible, independent insight at critical decision points.
Representative Engagements
