Because compliance officers are
change leaders, change management
skills are important to continue
adding value to the organization and
support its compliance performance
and strategic objectives and goals.
New products/services, changes
to existing products/service,
and other business changes
Managing the implementation of products, services, or business
changes is primarily the responsibility of the business line. If the
change will introduce a new product or service, or materially
modify an existing internal process with direct consumer impact,
compliance should be consulted. Compliance will need to assess
potential compliance risks including the need to:
■■ ■ Understand how the change will impact the bank and its
■ ■ ■ Obtain a detailed understanding of the change to assess risks
related to consumer financial regulations, including Bank Secrecy Act/Anti-Money Laundering, fair lending, and unfair,
deceptive, or abusive acts or practices.
■ ■ ■ Review recent enforcement actions and regulatory hot buttons to ensure the change does not pose compliance risk to
customers and the bank.
■ ■ ■ Review product design to ensure the features and benefits of
the new product or business change do not pose unintended
risks to the consumer or unintended fair lending risk.
■■ ■ Review the marketing plan for the change and determine
whether any segments of the bank’s market area are being
excluded on a prohibited basis.
■ ■ ■ Ensure the sales team understands how to sell the new product
or service. Be sure to review sales scripts to ensure fair and
responsible presentation of the new product or service, and
make sure sales incentives do not potentially lead to undesired
■ ■ ■ Consider delivery channels (on-line, branch, loan production
offices, etc.). Access to the product or service should typically be
available across channels and not lead to potential steering risk.
■ ■ ■ Ensure the appropriate compliance due diligence and risk assessment has been performed on new third parties. Contracts
should include required adherence to consumer financial regulations, compliance training, and the right for the bank to audit
the third-party’s compliance program.
■ ■ ■ Review procedures for closing and onboarding new accounts
and ensure the operations function can accommodate the anticipated transaction volumes and understands how to set up
new customers. Pay attention to introductory rates and similar
features that require special instructions.
■ ■ ■ Ensure customer service and call center personnel are trained
and prepared to respond to questions regarding the new product, service, or change.
■ ■ ■ Understand system changes required to implement a new
product, service, or business change. Ensure necessary user
acceptance testing is performed prior to roll-out and system
changes do not cause other issues within the system that may
■ ■ ■ Ensure proper safeguarding of consumer non-public personal
information (NPPI) is addressed when applicable.
■ ■ ■ Identify compliance program changes required to monitor
compliance on the new product, service, or change.
■ ■ ■ Perform a post-implementation review of any related consumer
complaints to assess compliance performance related to the
■ ■ ■ Highlight compliance issues or lack thereof in compliance reports until the change and revised procedures become ingrained
in daily operations.
Compliance Evaluation of a Business
The examples on page 9 illustrate some of the specific questions
that compliance should consider when evaluating bank management’s decision to outsource lockbox processing.
Change Management Success Factors
Change is a process, and successful change is dependent on how
the change is communicated and implemented. It’s helpful to use
a framework to facilitate change since individuals go through the
stages of change differently and at their own pace. One framework
for managing business change is described by Jeffrey M. Hiatt in
ADKAR, A Model for Change in Business, Government and Our
Community. Hiatt uses the acronum ADKAR to describe a goal-oriented change management model that guides individual and
organizational change. ADKAR is an acronym that represents the
five tangible and concrete outcomes that people need to achieve for
Awareness of the need to change
Desire to participate and support the change
Knowledge about how to change
Ability to implement new skills and behaviors
Reinforcement to keep the change in place