Compliance Testing

Compliance testing is the work a firm's compliance function does to confirm, with evidence, that a rule is actually being followed. Testers take a sample of real items, such as customer files, disclosures, complaints, payments or screening results, compare each against the legal requirement and the firm's procedure, and record any exceptions. Banks, payment companies, lenders, broker-dealers and insurers all run testing programs, and examiners expect to see the results.

Testing is one part of a compliance management system. Its plan is driven by the compliance risk assessment, so higher-risk rules are tested more often. It is related to, but different from, ongoing monitoring by the business and the independent AML audit or other internal audits carried out by the third line.

A chef does not wait for a food critic to find out whether the soup is right. During service, someone tastes a spoonful from the pot, checks the recipe, and adjusts the salt before more bowls go out. Tasting a spoonful tells you about the whole pot without eating all of it.

Compliance testing is that spoonful. Instead of checking every one of thousands of loans or transfers, the compliance team checks a sample against the rulebook. If the sample is right, the process is probably working; if several items are wrong, the team knows to fix the recipe before a regulator tastes it.

1. Pick the requirement. State the rule precisely, for example the error-resolution deadlines in Regulation E.
2. Define the population. Identify every item the rule applies to in the review period, such as all disputed transfers in a quarter.
3. Write test attributes. List yes/no questions each item must pass: acknowledged in time, investigated, provisional credit given where required, customer notified.
4. Select a sample. Choose items at random or with a risk-weighted method, and record how they were chosen.
5. Test and document. Check each item, keep screenshots or copies as evidence, and note exceptions.
6. Report and remediate. Share results with the business owner, agree fixes, and retest later.

Results are usually expressed as an exception rate:

• $E$ is the number of sampled items that failed at least one test attribute.
• $n$ is the number of items in the sample.

For example, a tester reviews 60 new business accounts for know your business (KYB) checks and finds 3 where beneficial ownership was not verified. The exception rate is $3 \div 60 \times 100 = 5\%$. If the firm's tolerance for this rule is 2%, the result fails, the business must fix the process and the affected files, and compliance retests in a later quarter. Firms set sample sizes and tolerances in their testing methodology; there is no single legal standard, and a single serious exception, such as a missed sanctions match, can fail a test on its own.

• Financial-crime controls. Customer due diligence file completeness, sanctions screening against test names, transaction monitoring alert handling and on-time SAR filing, with samples weighted by the AML risk assessment.
• Consumer protection. Disclosures, fees, complaint handling, advertising and fair treatment in collections.
• Reporting and records. Accuracy of regulatory reporting and compliance with recordkeeping requirements.
• Data and privacy. Consent records and handling of access requests under laws such as the GDPR.
• Third parties. Controls performed by agents, program managers or fintech partners, which feed third-party risk reviews.

The US Consumer Financial Protection Bureau's examination manual lists monitoring and/or audit as a component of an effective compliance program. In the securities industry, FINRA Rule 3120 requires broker-dealers to test and verify their supervisory procedures and give senior management an annual report on the results, and Rule 3130 requires the chief executive to certify each year that processes exist to establish, maintain, review, test and modify compliance policies. Testing results also feed the reports of the chief compliance officer to the board. Automated testing tools from RegTech providers now allow some tests to cover every item rather than a sample, though human review is still needed to judge borderline cases.

• FINRA Rule 3120: Supervisory Control System
• FINRA Rule 3130: Annual Certification of Compliance and Supervisory Processes