When Should I Tell Our Board About a Potential Compliance Concern?

In the course of conducting business, you discover a potential compliance concern. As you dig a little deeper, you realize that it more extensive than you had first hoped. Now the question facing you is when should you tell the board? The quick answer to that question is you should definitely tell them before your regulator does. That might sound like the flip answer, but I’ve seen more than a few financial institutions pursue this oft ill-fated strategy.

One key word in the question is “potential.” Surely, the Board cannot possibly deal with every potential concern. That is why it has management. So there is a need to assess the degree of the potential concern. In our hypothetical case, you’ve identified a concern, but haven’t definitively confirmed the “concern.” What do you do?

Regulators have identified three levels on violations that we believe can provide insight into assessing the potential concern issue. We’ve changed the terms and context to fit our situation, but feel it provides valuable insight into the question. Here are the three levels:

1. Level 3/High Severity: Potential concerns identified that may result in significant harm to consumers or members of a community. These concerns, if proven, typically result in a request or a requirement that the institution provide restitution in excess of $10,000 (in aggregate), or may have a basis, a pattern or practice of anti-discrimination issues, including redlining or widespread discouragement.
2. Level 2/Medium Severity: Potential concerns identified that may reflect systemic, recurring, or repetitive issues,  and, if proven, represent a failure of the bank/credit union to meet a key purpose of the underlying regulation or statute. These concerns, if validated, may prove to have had a small, but negative, impact on consumers/members or have the potential to have a negative impact if uncorrected. Level 2/Medium Severity issues, if proven, may also include those issues that could result in potential restitution in an amount below the Level 3 threshold.
3. Level 1/Low Severity: Potential concerns identified are likely isolated or sporadic, or systemic concerns that are unlikely to affect consumers/members or the underlying purposes of the regulation or statute. These concerns, if proven, are typically due to individual instances of failure to follow established procedures or minor errors in the implementation of reasonable procedures to meet obligations of the regulation or statute.