Stay updated with the latest insights, news, and best practices on data governance, regulatory compliance, and AI-powered solutions.
Scenario Imagine a mid‑size regional bank that has traditionally approached governance as code as a multi‑year, waterfall‑style project. Six months ago, the compliance team was still wrestling with spreadsheets to track data owners, while the risk office maintained a separate, manual inventory of cr…
by CoComply Team
Read More
Data Lineage Audit Crisis at a Mid‑Size Bank Data Lineage Audit is now a regulatory imperative for banks. Midwest Bank, a fictional $45 billion regional bank, recently faced an examiner’s “Data Lineage Gap” finding during its annual OCC‑conducted review. The examiner noted that the bank’s loan‑origi…
by CoComply Team
Read More
A Mid‑Size Bank’s Lineage Blind Spot Mid‑size regional bank Riverbank Trust recently faced an OCC examination that highlighted a glaring gap in its data governance program. The examiner noted that while the bank had documented data classifications, it could not produce a real‑time lineage map for it…
by CoComply Team
Read More
A Mid‑Size Bank’s Midnight Alert On a rainy October night, a mid‑size regional bank in the Midwest discovered that a laptop used by a loan officer had been stolen from a parking garage. The device contained unencrypted spreadsheets with borrower PII and a copy of the bank’s recent risk‑assessment re…
by CoComply Team
Read More
The Hidden Cost of Manual Workflows in Modern Banking Consider a mid‑size regional bank that still relies on a patchwork of Excel spreadsheets, shared network drives, and endless email threads to track loan approvals, risk assessments, and compliance checks. An analyst receives a CSV attachment from…
by CoComply Team
Read More
A Day in the Life of a Mid‑Size Bank’s Data Team On a crisp Tuesday morning in early October 2026, the data certification team at a hypothetical mid‑size regional bank with $45 billion in assets opened a spreadsheet that listed every critical data asset used in its consumer‑loan underwriting model.…
by CoComply Team
Read More
A real‑world wake‑up call at a mid‑size regional bank Mid‑size Bank X, with $45 billion in assets and a growing retail footprint, received a formal request from the Consumer Financial Protection Bureau (CFPB) on September 15, 2026. 112), which expands consumer‑right‑to‑data obligations to include ex…
by CoComply Team
Read More
Overlapping Third‑Party Risk Tools Alarm Mid‑size regional lender Meridian Bank, with $45 billion in assets, woke up on a chilly October morning to a stark email from its examiner. The OCC’s latest bulletin, released on September 30, 2026, warned that banks relying on overlapping third‑party risk to…
by CoComply Team
Read More
A Mid‑Size Bank’s Vendor Overload Mid‑size regional bank First Horizon Bank (approximately $45 B in assets) recently faced an OCC examination that highlighted a critical weakness: the bank relied on seven distinct third‑party risk platforms across its enterprise. Each platform required separate data…
by CoComply Team
Read More
, a $5 billion institution in the Midwest, recently faced a $12 million supervisory assessment penalty after an OCC examiner discovered that its quarterly data‑validation checks had not captured a material error in its loan‑loss‑reserve calculations. The examiner’s report, released on October 3 2026…
by CoComply Team
Read More
Manual Workflow Risk: A Day in the Life of a Mid‑Size Bank’s Data Team Manual workflow risk is illustrated by Midwest Bank, a $45 billion regional lender, which recently faced an OCC examination that highlighted a surprisingly common problem. The examiners noted that the bank’s data‑ownership matrix…
by CoComply Team
Read More
A Real‑World Wake‑Up Call for a Mid‑Size Regional Bank Midwest Bank, a hypothetical mid‑size regional lender with $45 billion in assets, recently faced a surprise examiner finding that its loan‑originations system could not provide a clear, end‑to‑end map of data flow from customer intake to final r…
by CoComply Team
Read More
Opening Scenario: A Data Request That Stalls Imagine a mid‑size regional bank that has built a robust online banking platform, a mobile app, and a suite of third‑party budgeting tools. On a Monday morning, the bank’s compliance officer receives a request from a customer who wants a portable copy of…
by CoComply Team
Read More
Opening Scenario: A Mid‑Size Bank’s AI‑Driven Credit Model Consider a hypothetical mid‑size regional bank that recently deployed an AI‑driven credit scoring model to speed loan approvals. The model ingests hundreds of data fields, from traditional credit bureau scores to alternative data such as uti…
by CoComply Team
Read More
2 million on three separate data‑lineage platforms, three identity‑access tools, and two separate AI‑model‑risk suites. The decision seemed sensible – each vendor promised best‑in‑class coverage of a narrow piece of the bank’s governance puzzle. Yet during the OCC’s August 15 2024 “Vendor Oversight…
by CoComply Team
Read More
A Mid‑Size Bank Faces an Unexpected AI Exam Finding The OCC AI governance framework is at the heart of this story. On June 12, 2024, the Office of the Comptroller of the Currency (OCC) sent a supervisory letter to a mid‑size regional bank in the Midwest after an on‑site examination uncovered gaps in…
by CoComply Team
Read More
Critical Data Asset Identification: Protect Core Data A Bank Faces an Unexpected Exam Finding Mid‑size lender Riverbank Trust, with $45 billion in assets, was preparing for its annual OCC examination when examiners flagged a glaring omission. The exam team cited OCC Bulletin 2024‑57, released on Sep…
by CoComply Team
Read More
A Real‑World Wake‑up Call Mid‑size regional bank Riverbank Financial (assets $42 billion) was preparing for its annual OCC supervisory examination in early November 2024. Data lineage readiness became the central focus when examiners cited the newly issued OCC Bulletin 2024‑45, “Data Lineage and Tra…
by CoComply Team
Read More
Model Risk Data Inputs Overview Midwest Bank, a hypothetical $45 billion regional lender, recently rolled out a next‑generation credit‑risk model to price mortgages faster. Model risk data inputs are at the heart of this effort, as the model ingests billions of loan‑application records each month fr…
by CoComply Team
Read More
Opening Scenario Mid‑size Bank X has spent decades building its core banking system on a mainframe that was state‑of‑the‑art in the early 2000s. Over the past three years the bank has launched a suite of digital products, real‑time payments, open‑banking APIs, and AI‑driven credit underwriting, that…
by CoComply Team
Read More
Opening Scenario Imagine a mid‑size regional bank that recently completed a routine OCC examination. The examiner asks to see who can view or edit the bank’s loan‑portfolio data in its new cloud‑based analytics platform. The compliance team scrambles through spreadsheets, IAM dashboards, and ad‑hoc…
by CoComply Team
Read More
Opening Scenario Imagine a midsize regional bank that has just launched a new mobile app feature allowing customers to link their accounts to third‑party budgeting tools. ” Behind the scenes, the bank must capture Maria’s consent in a way that satisfies the Consumer Financial Protection Bureau’s (CF…
by CoComply Team
Read More
Opening Scenario: A Mid‑Size Bank’s Data Dilemma Imagine a mid‑size regional bank that has just completed a merger. The new entity inherits three legacy data warehouses, each with its own cataloging conventions, access controls, and data‑stewardship assignments. The bank’s Chief Data Officer (CDO) r…
by CoComply Team
Read More
Opening Scenario: A Day in the Life of a Mid‑Size Bank Consider a hypothetical mid‑size regional bank that has recently merged with a fintech startup. The combined organization now runs legacy core banking software, a modern cloud‑based payments platform, and a separate data‑warehouse environment fo…
by CoComply Team
Read More
Opening Scenario: A Day in the Life of a Mid‑Size Bank’s Risk Team Consider a hypothetical mid‑size bank that recently closed a $3 billion acquisition. The integration team relies on a patchwork of Excel workbooks, shared network folders, and endless email threads to track data‑migration milestones,…
by CoComply Team
Read More
Opening Scenario Imagine a mid‑size regional bank that recently completed a merger. The new entity now holds disparate customer, loan, and transaction datasets across legacy core systems, a cloud‑based analytics platform, and a third‑party risk‑management vendor. The CDO is tasked with answering an…
by CoComply Team
Read More
Opening Scenario Mid‑morning on September 13, 2023, the compliance office of a regional bank in the Midwest receives an urgent memo from the Office of Foreign Assets Control (OFAC). The memo, titled “Updated Guidance on Name‑Matching for Sanctions Screening”, announces a shift in the agency’s expect…
by CoComply Team
Read More
Opening Scenario: The Unexpected Request On a crisp October morning in 2024, the Chief Data Officer of a mid‑size regional bank receives a terse email from the OCC’s Office of Supervision. The examiner is scheduled to perform a routine compliance examination next week, but the letter includes a new…
by CoComply Team
Read More
Opening Scenario Consider a hypothetical mid‑size regional bank, Riverbank Trust, that has just launched a new mobile app allowing customers to link external financial accounts for budgeting insights. ” The app records her click, stores a timestamp, and forwards the data to the bank’s analytics plat…
by CoComply Team
Read More
46). The rule obligates covered financial institutions to honor consumer requests for access, correction, deletion, and data portability of their personal financial data. For a midsize bank that processes millions of loan applications, credit‑card transactions, and mortgage records each year, the ru…
by CoComply Team
Read More
Opening Scenario Consider a hypothetical mid‑size regional bank that has built its core banking and data warehouse on a legacy mainframe platform purchased in the early 2000s. The bank recently launched a suite of digital‑first products, instant‑issue credit cards, real‑time payments, and a consumer…
by CoComply Team
Read More
A Hypothetical Mid-size Bank Faces New Data Classification Demands On June 11 2026 the Office of the Comptroller of the Currency (OCC) together with the Federal Reserve, FDIC, CFPB, and the NCUA released a joint final rule to implement the Financial Data Transparency Act of 2022 (FDTA). Financial Da…
by CoComply Team
Read More
Opening Scenario Consider a hypothetical mid‑size fintech that launches a buy‑now‑pay‑later (BNPL) product aimed at New York consumers. Within weeks, the company sees rapid adoption, but the NYDFS BNPLA risk scoring framework looms large. The firm must embed a machine‑learning model that evaluates e…
by CoComply Team
Read More
Opening Scenario Consider a hypothetical mid‑size regional bank that has just received an OCC supervisory exam notice. The examiner’s checklist highlights a new focus area: examiner evidence readiness. The bank’s compliance officer flips through spreadsheets, finds fragmented logs, and worries that…
by CoComply Team
Read More
A Real‑World Wake‑Call Mid‑size regional Bank X, with $45 billion in assets, recently faced an OCC examiner who uncovered a troubling flaw in its credit‑scoring models. The examiner noted that the bank’s models depended on source data feeds that were not regularly validated, leading to occasional mi…
by CoComply Team
Read More
Opening Scenario: A Hypothetical Mid‑Size Bank Faces a Merger Deadline Imagine a mid‑size regional bank, Riverbend Bank, that has just completed a $3 billion acquisition of a neighboring community bank. The deal closed on August 1, 2024, and the integration team is racing to combine core banking sys…
by CoComply Team
Read More
A Real‑World Scenario On April 17, 2026, the Office of the Comptroller of the Currency released Bulletin 2026‑13, a joint revision of inter‑agency model risk management guidance. The bulletin rescinded earlier OCC handbooks and bulletins, then laid out a risk‑based framework that explicitly calls ou…
by CoComply Team
Read More
Opening Scenario By Jane Doe, Head of Data Governance, 15 years experience in banking data compliance. html). The bulletin, now a binding supervisory expectation for all nationally‑chartered banks, requires each institution to maintain an auditable, query‑able graph that records the origin, transfor…
by CoComply Team
Read More
A Day in the Life of a Mid‑Size Bank’s Data Officer Maya Patel, Chief Data Officer at a hypothetical mid‑size regional bank, begins her Thursday reviewing a backlog of data‑subject requests. Proof of consent is at the heart of today’s work. A consumer has asked the bank to revoke a previously grante…
by CoComply Team
Read More
Breach Notification Rule Overview Imagine a mid‑size regional bank discovering that a phishing attack has compromised personal data of thousands of customers. The security team scrambles to contain the intrusion, assess the scope, and determine whether the breach meets the definition of a reportable…
by CoComply Team
Read More
Scenario Imagine a mid‑size regional bank that has just deployed a machine‑learning model to flag suspicious transactions in real time. The model pulls data from the core banking system, enriches it with external watch‑list feeds, and delivers alerts to the fraud team within seconds. The risk‑manage…
by CoComply Team
Read More
Opening Scenario On August 15, 2026, the Federal Trade Commission (FTC) released its final rule “Data Breach Notification” (FR 2026‑38), cutting the required notification window for covered entities from 60 days to a strict 30 days after discovering a breach. Imagine a mid‑size regional bank that st…
by CoComply Team
Read More
Opening Scenario On a rainy Tuesday morning in August 2026, a senior data officer at a mid‑size regional bank receives an urgent email from the bank’s legal counsel. The Consumer Financial Protection Bureau (CFPB) has just released its final Consumer Financial Data Rights (CFDR) Rule, set to take ef…
by CoComply Team
Read More
S. bank that has built a solid regional presence but faces pressure from megabank competitors, tighter regulatory expectations, and the relentless push for digital innovation. S.
by CoComply Team
Read More
Scenario Huntington Bank, now a $284 billion institution, is on the cusp of entering the Federal Reserve's Category III tier. The Cadence acquisition will push its average total assets above the $250 billion threshold by Q4 2026, triggering a cascade of new liquidity‑risk requirements. This mirrors…
by CoComply Team
Read More
A Mid‑Size Bank Faces an Unexpected Audit Trigger Mid‑size lender Horizon Bank announced a $12 million loan award to a regional tech startup last week. The deal was celebrated as a win for the community, but the deal sheet also included a footnote that caught the attention of the bank’s compliance o…
by CoComply Team
Read More
Multi-Agency Data Governance: Managing Overlapping Regulatory Requirements Banks increasingly face a difficult data governance challenge: different regulators can require overlapping information, but each may define, structure, or report that information differently. Without a coordinated framework,…
by CoComply Team
Read More
A real‑world audit‑trail crisis at a regional bank Mid‑size Bank XYZ, a $12 billion regional lender, was surprised during its March 2026 OCC examination. The examiner requested immediate proof of transaction‑level evidence for a set of high‑risk loan approvals. Bank XYZ could only produce scattered…
by CoComply Team
Read More
A Real‑World Scenario: The Pacific Bank Data Leak Pacific Bank, a midsize regional lender with $45 billion in assets, recently discovered that a routine transfer of customer transaction data to a cloud provider in Singapore had bypassed its internal privacy safeguards. S. security standards.
by CoComply Team
Read More
Opening Scenario A regional bank has launched a payment stablecoin that attracts thousands of users within weeks. The FDIC’s new GENIUS Act standards require the issuer to demonstrate that each token is fully backed by eligible reserve assets and that redemption can occur instantly. The regulator’s…
by CoComply Team
Read More
Opening Hook On June 5, 2024 the Consumer Financial Protection Bureau (CFPB) issued its final Personal Financial Data Rights rule, mandating that banks, credit unions, and other financial service providers make consumer‑level data available to both the data subject and authorized third parties in a…
by CoComply Team
Read More
Opening Hook On June 25 2026 the FDIC Board of Directors approved a notice of proposed rulemaking to amend the agency’s disclosure requirements, calling for modernized, data‑driven transparency for consumers and investors. The proposal specifically urges institutions to adopt automated audit‑trail c…
by CoComply Team
Read More
Opening Hook On June 30 2026 the SEC announced a proposal to rescind its climate‑related disclosure rules and revert to a materiality‑focused approach. The agency argued that the existing requirements imposed “excessive costs” on financial institutions while offering limited investor benefit. For a…
by CoComply Team
Read More
Opening Hook On June 30 2026 the SEC announced a proposal to rescind its climate‑related disclosure rules and revert to a materiality‑focused approach under its existing authority. The agency argued that the prior rules were “overly burdensome” and that a return to materiality would better align dis…
by CoComply Team
Read More
Opening Hook On March 30 2026 the CFPB issued a final rule to implement personal financial data rights under the Consumer Financial Protection Act of 2010, requiring banks, credit unions, and other financial service providers to make consumers’ data available upon request to consumers and authorized…
by CoComply Team
Read More
Opening Hook In a surprise filing released on June 30 2026, the SEC announced a proposal to rescind its climate‑related disclosure rules and revert to a materiality‑focused approach under its existing authority. The agency argued that the prior rules were “overly burdensome” and that a return to mat…
by CoComply Team
Read More
Opening Hook On July 6 2026 the CFPB published its 2026 regulatory agenda, flagging a pre‑rule initiative to clarify Dodd‑Frank §§ 1031 and 1036 that govern unfair, deceptive, or abusive acts and practices (UDAAP). The bureau warned that “clearer statutory guidance” could soon lead to formal rulemak…
by CoComply Team
Read More
Opening Hook On August 7 2026, FinCEN issued a final rule pushing the effective date for the new investment adviser AML reporting obligations from January 1 2026 to January 1 2028. ” For a mid‑size registered investment adviser that processes $750 million in client transactions annually, the postpon…
by CoComply Team
Read More
Opening Hook When First‑State Bank, a mid‑size regional lender, tried to onboard its newly‑launched mobile‑pay product, examiners from the Office of the Comptroller of the Currency (OCC) halted the rollout. 4 billion new transaction rows per month without breaking data lineage controls. The examiner…
by CoComply Team
Read More
On July 25, 2026 the Office of the Comptroller of the Currency (OCC) released Bulletin 2026‑08 titled “Data Lineage and Metadata Standards for Model‑Risk Management.” The bulletin mandates that banks with $10 billion + in assets maintain a machine‑readable knowledge graph of all critical data assets, capturing lineage, provenance, and business semantics. Failure to demonstrate a complete, auditable graph can trigger supervisory findings, as the OCC warned that “incomplete metadata will be treated as a material weakness in model‑risk compliance.”
by CoComply Team
Read More
The bulletin follows the recent $1.2 billion acquisition of First Capital Bank by MetroBank—a deal that triggered examiner findings that legacy data‑quality controls were no longer valid after the reorg. The OCC’s language was stark: “Failure to recertify exposes the surviving institution to material compliance risk and may result in enforcement action.” This real‑world regulator push makes the often‑overlooked step of post‑merger data recertification an urgent, actionable priority for CDOs, CROs, and compliance leads.
by CoComply Team
Read More
When First‑State Bank, a mid‑size regional lender, tried to onboard its newly‑launched mobile‑pay product, examiners from the Office of the Comptroller of the Currency (OCC) halted the rollout. The OCC cited a Data‑Volume Stress Test finding in its July 2026 exam report: the bank’s legacy core‑banking platform could not ingest the projected 2.4 billion new transaction rows per month without breaking data lineage controls. The examiner warned that any mis‑alignment between product data and the bank’s critical‑asset certification could trigger enforcement under the OCC’s interim rule on data governance.
by CoComply Team
Read More
In early July 2026, the Office of the Comptroller of the Currency (OCC) released Bulletin 2026‑07 — Data Lineage and Knowledge Graph Requirements for Regulated Institutions. The bulletin mandates that all OCC‑regulated banks maintain query‑able, graph‑based lineage for every critical data asset used in risk, compliance, and lending decisions. For a bank CDO, the focus keyword knowledge graph metadata instantly surfaces as the practical solution to a regulatory hammer‑like requirement.
by CoComply Team
Read More
Banks must maintain auditable evidence of data provenance, transformation, and storage for any data element used in risk‑weighted asset calculations, irrespective of the originating system,” the OCC wrote in its press release (see source below). The regulator highlighted a recent supervisory exam where a large national bank failed to trace loan‑origination data that spanned a legacy underwriting platform and a newer cloud‑based credit‑risk engine, leading to a $3.2 million corrective action fee.
by CoComply Team
Read More
As banks continue expanding their digital operations, many have adopted multiple data governance solutions to manage compliance, risk, and reporting. While these specialized tools can improve oversight individually, they often create overlapping responsibilities that complicate regulatory compliance.
by CoComply Team
Read More
A Chief Data Officer can own every data outcome in the enterprise and control none of the levers that produce them. Accountability without authority is just exposure with a name attached.
by CoComply Team
Read More
A bank's exposure to a single borrower can read dangerously low — not because the math is wrong, but because the customer exists in its systems six different times. You cannot aggregate what you cannot identify.
by CoComply Team
Read More
A healthcare enterprise can run encryption, access tooling, and monitoring on data it can't actually locate. Every protective control is only as good as the classification underneath it.
by CoComply Team
Read More
Every record an organization keeps past its purpose is something it must secure, search, and answer for. Storage is cheap; unbounded retention is not.
by CoComply Team
Read More
A bank can produce a perfectly accurate regulatory figure and still fail the exam — because it can't show, on demand, how the number was built. A figure you can't trace is a figure you can't defend.
by CoComply Team
Read More
An AI model can be retrained, drift, and start making biased decisions in the time it takes a governance committee to schedule its next meeting. The approval was a moment; the risk is continuous.
by CoComply Team
Read More
A bank can pass every internal security review and still end up defending a class action because a vendor got breached. When customer data moves through a third party, the liability doesn't move with it.
by CoComply Team
Read More
A $60 billion commercial bank went into its annual internal audit confident. Its data governance policy was mature, board-approved, and well documented. Every control had an owner. Every standard had a threshold. Then the auditors pulled the exception log.
by CoComply Team
Read More
When banks consolidate risk data manually, regulators no longer just flag it in an exam letter. They price it directly into how much capital the bank has to hold. A data governance gap quietly becomes a balance sheet problem.
by CoComply Team
Read More
Wells Fargo's 2022 consent order for data governance deficiencies included a specific citation that most banks overlooked: the bank could not demonstrate, through auditable records, that its risk data aggregation met BCBS 239 standards during stress events. The fine made headlines. The specific failure did not. But that specific failure is the one that should concern every Tier 2 bank right now, because it signals what regulators are actually testing for.
by CoComply Team
Read More
In 2022, a $35 billion-asset Midwest bank launched a data stewardship program with great fanfare. Forty-five stewards were appointed across business lines. Training was delivered. A stewardship council was formed. Eighteen months later, 31 of the 45 stewards had either left the role or stopped participating. The council had not met in six months. The program was functionally dead, and the bank's CDO was back at square one explaining to the board why governance was still "maturing."
by CoComply Team
Read More
In September 2024, a $68 billion-asset bank with operations in the US, UK, and EU received simultaneous examination requests. The OCC wanted proof that its US consumer lending data met BCBS 239 accuracy standards. The FCA wanted evidence that the same data, processed through its UK entity, complied with Consumer Duty reporting requirements. The EBA wanted assurance that the data flowing into its European stress test models had complete lineage documentation back to source systems.
by CoComply Team
Read More
Technical debt has a seat at the table now. CIOs track it. CFOs budget for it. Boards ask about it. Governance debt does not have a seat anywhere. It accumulates in the spaces between audits, in the gaps between policy and practice, in the decisions that were made once and never revisited. And it is compounding inside Tier 2 banks at a rate that would terrify any CFO who actually measured it.
by CoComply Team
Read More
First Republic was acquired by JPMorgan in May 2023. Within weeks, the OCC issued guidance about governance continuity during absorption. What got less attention: the acquired bank's data governance certifications, some less than six months old, became instantly invalid. New ownership structures meant new data domain owners. New system integrations meant new lineage paths. New risk tolerances meant new thresholds. Every certification the bank had earned was void, not because the content was wrong, but because the context had changed.
by CoComply Team
Read More
A $38 billion-asset bank restructured in 2023 to push data governance accountability into the business lines. Each line of business, commercial lending, retail banking, wealth management, and treasury, got its own certification authority.
by CoComply Team
Read More
A $26 billion-asset bank deployed an AI-powered data governance monitoring tool in mid-2023. The tool ingested metadata from across the bank's data estate and produced a daily governance health score. For six months, the score showed green. Then an OCC examination found that 12 critical data elements had quality scores below threshold, three key lineage paths were undocumented, and five certification cycles had lapsed without renewal.
by CoComply Team
Read More
Through the first three quarters of 2024, the FDIC issued 14 consent orders against banks with assets between $20 billion and $250 billion. Eleven of those orders included specific language about data governance deficiencies: incomplete data lineage, insufficient quality monitoring, inadequate governance of third-party data, and failure to demonstrate risk data aggregation capabilities. The pattern is unmistakable. Data governance is no longer a secondary concern in enforcement actions. It is a primary finding.
by CoComply Team
Read More
When PacWest Bancorp was acquired by Banc of California in 2023, the deal documents included extensive analysis of credit risk, deposit stability, and capital adequacy. What they did not include was any assessment of the target's data governance maturity. Eighteen months post-merger, the combined entity was still untangling data lineage gaps, recertifying data domains, and reconciling governance frameworks. The integration cost attributed to data governance restructuring exceeded $4 million, a number that never appeared in any pre-deal analysis.
by CoComply Team
Read More
In 2023, the FDIC issued a consent order against a $31 billion-asset bank that included a finding most governance leaders missed: the bank's data governance dashboard showed green across all domains, but underneath, three critical data elements had quality scores below threshold for over six months. The dashboard was not lying. It was averaging. Aggregated metrics hid domain-level failures. The examiner saw the detail that the aggregation concealed.
by CoComply Team
Read More
In Q1 2024, a $44 billion-asset regional bank lost its VP of Data Governance to a competitor. Within 30 days, the bank received an examination notice. The VP had been the sole owner of 23 critical data domain certifications, the only person who understood the lineage mapping for the bank's stress testing data, and the keeper of the informal escalation paths that actually made the governance program function.
by CoComply Team
Read More
In March 2024, the OCC cited a $42 billion-asset regional bank not for having an incident, but for having no auditable record of how it responded. The bank had suffered a data feed corruption that inflated commercial lending exposures for 11 days. Operations fixed it. Risk was notified. But the governance trail, the who-decided-what-when, simply did not exist in any system. The examiner's write-up was blunt: the bank could not demonstrate that its incident response followed its own policy.
by CoComply Team
Read More
A $52 billion-asset bank on the East Coast completed 2,400 data governance certifications last year. By its own metrics, the program was a success. By its examiners' assessment, it was a liability. The OCC's 2024 findings noted that certifications were being produced mechanically, with renewal rates above 98 percent, a statistical impossibility if any genuinely critical review was occurring. The bank was certifying motion, not mastery.
by CoComply Team
Read More
A $28 billion-asset regional bank discovered in late 2023 that its commercial lending team had built 340 separate dashboards in its self-service analytics platform. Each dashboard pulled from slightly different data cuts, applied different filters, and used different definitions of "exposure." When the CRO asked for the bank's total commercial exposure across three risk categories, she got six different answers from six different dashboards, all built by smart analysts who trusted the data they were working with.
by CoComply Team
Read More
Data ownership is one of the most discussed and least resolved topics in data governance. Every framework calls for it. Every policy document references it. Every organization says they've defined it.
by CoComply Team
Read More
If you want to know whether your data governance works, don't wait for the examination. Run the 72-hour stress test. Here's the scenario: you receive a notification that examiners will arrive in three days. They've asked for complete data lineage documentation for your top 20 critical data elements, current certification status for data feeding regulatory reports, and evidence of ownership and attestation for the past 12 months.
by CoComply Team
Read More
Metadata has a branding problem. It sounds technical and optional, like something database administrators care about but executives don't. It's the kind of word that makes eyes glaze over in boardrooms.
by CoComply Team
Read More
Banks have gotten serious about model risk management. SR 11-7 gave them no choice. Model validation is now a mature discipline. Model inventory is a standard practice. Model risk committees meet regularly and challenge assumptions.
by CoComply Team
Read More
Most banks view privacy regulation as a cost center. Compliance overhead. Legal review cycles. Cookie consent banners that nobody reads. It's an obligation to manage, not an opportunity to exploit.
by CoComply Team
Read More
Banks outsource. That's not a surprise. What is a surprise to examiners, to risk committees, and sometimes to the banks themselves, is how many governance obligations travel with that outsourcing and never arrive at the destination.
by CoComply Team
Read More
Every CFO trusts their numbers. That's the problem. Not because CFOs are gullible; it is because the systems feeding them numbers are quietly decaying, and nobody owns the decay. A data quality issue in a trading book doesn't show up as a data problem. It shows up as a P&L variance. A stale reference rate in a loan portfolio doesn't flag itself as "bad data." It registers as an unexpected margin compression. By the time the numbers look wrong, the data has been wrong for weeks.
by CoComply Team
Read More
The Uncomfortable Truth About Governance Theater Most governance programs aren't failing. They're performing. If you sat through your last data governance committee meeting and walked away thinking "that went well," you might be the problem. Not because you're doing something wrong, but because "going well" is exactly what governance theater feels like. The slides were polished. The stakeholders nodded. Someone even used the phrase "mature data culture" without irony. Andnothing will change.
by CoComply Team
Read More
The Uncomfortable Truth About Attestation Most governance programs have an attestation process. Few have an attestation problem they are willing to admit. Here is how it typically works. Once a quarter, or maybe once a year, an email goes out. It asks someone, usually a vice president or a director, to affirm that the data under their domain is accurate, complete, fit for purpose, and compliant with policy.
by CoComply Team
Read More
Most enterprises have thousands of data elements across hundreds of systems. Trying to govern all of them equally is how you end up governing none of them well. The concept of Critical Data Elements (CDEs) is supposed to solve this. In theory, you identify the data that drives your most important decisions, feeds your regulatory reports, and underpins your risk calculations. You apply higher standards to that data and accept lower rigor for everything else.
by CoComply Team
Read More
The OCC is proposing a massive threshold jump for Heightened Standards from $50B to $700B. But smart banks aren’t walking off the field. Here is why this shift from prescriptive checklists to supervisory judgment means your evidence trail matters more than ever—and how to right-size your governance to win.
by CoComply Team
Read More
The Real Cost of a Governance Gap Isn't the Fine Most organizations can tell you what their last regulatory fine was. Fewer can tell you what it actually cost. The fine is the headline. The real damage is everything that comes after: the consent order that constrains strategy for three years, the remediation program that eats your best people, the board conversations that shift from growth to survival, and the quiet erosion of trust that makes your next audit harder before it even begins. Governance gaps are expensive. But not in the way most risk reports capture. The problem isn't that organizations underestimate the cost. The problem is they measure the wrong costs.
by CoComply Team
Read More
The Regulatory Squeeze on Tier 2 Banks: What Happens When Exemptions Expire Here is what nobody tells you about being a Tier 2 bank right now: the regulatory patience is running out. For years, smaller and mid-sized financial institutions operated under a simple assumption. The big rules, the ones with teeth, were written for the global systemically important banks. BCBS 239, the OCC heightened standards, the FDIC expectations around data risk governance, these were Tier 1 problems. Tier 2 banks watched from a comfortable distance, tweaking their frameworks just enough to stay off the supervisory radar. That distance is gone.
by CoComply Team
Read More
You Can't Hire Your Way Out of a Governance Problem Most organizations respond to governance failures the same way: they hire more people. Another data steward. Another policy analyst. Another layer of oversight in the middle office. It feels like the right thing to do. The regulator wants to see commitment. The board wants to see action. The audit finding says "insufficient resources," and so resources get added. But here is what nobody tells you about scaling governance through headcount: it works exactly until it doesn't. And the point where it stops working arrives faster than you think.
by CoComply Team
Read More
The Uncomfortable Truth About Certification: Most of It Is Just Documentation If your compliance team left tomorrow, what would remain of your data governance program? The dashboards? The policy documents? The attestation records signed by people who haven't looked at a data lineage diagram in three quarters? Here is what most organizations get wrong. They think documentation is certification. It is not. The difference between the two is the difference between a photograph of a building and the building itself. One describes. The other stands on its own.
by CoComply Team
Read More
The Difference Between Proving and Describing Every bank has documentation. Data dictionaries. Policy manuals. Stewardship matrices. Lineage diagrams that look impressive on a projector. Rows and rows of metadata, neatly organized in governance tools that cost six figures to implement. And when an examiner asks, "How do you know this data is right?" someone opens the documentation and points to the page. That's not certification. That's description. And the difference between the two is where regulatory risk lives.
by CoComply Team
Read More
If Your Data Steward Left Today, Would Anything Change? Most organizations think governance lives in the governance team. They're wrong. Go into any mid-size bank and ask who owns data quality for the trade reporting pipeline. You'll get pointed to a data steward, probably someone in operations who inherited the role three years ago, keeps the rules in a spreadsheet, and answers questions on Slack when someone's unsure about a field mapping. That person is doing important work. But the organization has confused a person with a system.
by CoComply Team
Read More
The Uncomfortable Truth About BCBS 239 Compliance Most Tier 2 banks think they have their risk data under control. They don't. If you sit in a governance meeting at a mid-size bank, you will hear the same reassuring chorus: "We're BCBS 239 compliant. We passed our last assessment. The regulators signed off." And technically, maybe they did. The checklist was completed. The documentation was filed. The attestation was signed. But here is what nobody tells you about BCBS 239 compliance at Tier 2 banks: the gap between passing an assessment and actually having reliable risk data is wider than anyone wants to admit. And the regulators know it.
by CoComply Team
Read More
The Uncomfortable Truth About Data Lineage: You Can't Certify What You Can't See Most organizations think they know where their data comes from. They're wrong. Ask any CDO to sketch the journey of a single critical data element from source system to regulatory report, and you'll get one of three responses: a confident answer that falls apart under follow-up questions, a vague wave toward a wiki page that hasn't been updated since the last reorg, or an honest admission that nobody really knows. The third response is the most dangerous because it's the rarest. The first two are where real risk lives.
by CoComply Team
Read More
Most organizations treat data certification like a merit badge. You earn it once, pin it to a slide deck, and move on. The certificate sits in a shared drive somewhere, the attester has already rotated to a new role, and six months later nobody can tell you what was actually certified or whether it still holds. That is not certification. That is decoration.
by CoComply Team
Read More
Financial institutions spend billions every year on governance, compliance, audit remediation, regulatory reporting, data & model management, and risk operations.
by CoComply Team
Read More
Most organizations do not have a governance problem. They have a presentation problem. Walk into any Tier 2 bank's risk committee meeting and you will see it. Beautiful heat maps. Color-coded RACI charts. Dashboards that pulse with green, amber, and red like a functioning traffic system. Data quality scores trending upward. Attestation coverage above 90 percent. Everything looks under control.
by CoComply Team
Read More
When your best data person leaves, institutional knowledge walks out the door. Certification turns tribal knowledge into governance that survives turnover.
by CoComply Team
Read More
A data maturity assessment shows where your governance really stands. Here is how to scope one, score it honestly and turn results into a plan.
by CoComply Team
Read More
Certification is only as strong as its evidence. See what banks should keep for each critical data asset so audits and exams become lookups, not projects.
by CoComply Team
Read More
What do OCC risk governance expectations mean for data? A practical look at ownership, lineage, controls and evidence for banks.
by CoComply Team
Read More
SR 11-7 expects model data to be suitable and documented. Here is why certifying model inputs helps banks defend their models to validators and examiners.
by CoComply Team
Read More
Data quality measures how good data is. Data certification proves it, with ownership, controls and approval. Here is how the two fit together.
by CoComply Team
Read More
How banks can use AI to manage regulatory change, from monitoring to impact assessment, while keeping people accountable for decisions.
by CoComply Team
Read More
Regulatory intelligence is how banks find, understand and act on regulatory change. Learn what it involves and how automation changes it.
by CoComply Team
Read More
A practical checklist for turning the 11 BCBS 239 principles into certified data evidence a supervisor can review.
by CoComply Team
Read More
Not every data field deserves the same scrutiny. Learn how banks decide which critical data elements (CDEs) matter, and how to certify them.
by CoComply Team
Read More
Data certification is how a bank proves its most important data can be trusted. Here is what it means, what a certified data asset needs, and how to start.
by CoComply Team
Read More
Banks are beginning to automate governance and compliance across the three lines of defense by focusing AI on operational verification and trust in data and models.
by Patrick Jacolenne
Read More
Many banks approaching the $50B asset threshold discover that governance at scale requires more than policies and frameworks - it requires verifiable data and certification.
by Patrick Jacolenne
Read More
CoComply announces the appointment of Justin Heller as Strategic Advisor, a seasoned financial services executive with more than 30 years of experience in data strategy, governance, AI, and risk management.
by CoComply
Read More
AI can help institutions move from static governance frameworks to measurable, asset-level operational certification across regulations, policies, controls, and evidence.
by Patrick Jacolenne
Read More
CoComply announces the appointment of Jane Sorenson Herthel as Strategic Advisor, bringing more than 25 years of experience designing and executing scalable enterprise B2B revenue strategies across high-growth startups and Fortune 500 companies, including leadership roles at Oracle, SAP, Salesforce, Microsoft, and Guidewire.
by CoComply
Read More
CoComply announces the appointment of Malcolm Hicks as Strategic Advisor, a seasoned technology executive with 30 years driving business transformation and revenue growth across Financial Services, Commercial Real Estate, Hospitality, and Investment Management industries.
by CoComply
Read More
CoComply announces the appointment of Jason Sisack as Strategic Advisor, bringing 25+ years of experience helping organizations strengthen risk management, navigate complex regulatory environments, and operate with confidence under supervisory and policy expectations.
by CoComply
Read MoreThe OCC offered buyouts drawing nearly 800 employees, raising pressing questions about how this shake-up will affect banks. From examiner standards under review to MRAs potentially becoming law, here are the key regulatory shifts banks need to watch.
by CoComply
Read More
Discover how AI is not just a challenge in compliance but a powerful tool that can create strategic advantages for organizations. Learn key strategies for effective implementation.
by cocomply
Read More
Explore the unseen expenses related to data governance that can impact your organization’s bottom line and decision-making processes. Learn why understanding these costs is crucial.
by cocomply
Read More
Explore the key principles of data governance and how they empower leaders to harness data effectively for strategic decision-making.
by cocomply
Read More
Explore the shift to virtual bank branches, understanding their impact on banking services and customer experience, and how to prepare for this transformation.
by cocomply
Read More
Explore the essential strategies for effective data governance to avoid the pitfalls of data swamps and leverage the true potential of data lakes.
by cocomply
Read More
Explore the often-overlooked costs of compliance in businesses and learn effective strategies to track and manage these expenses.
by cocomply
Read More
Discover how artificial intelligence is transforming compliance in the fintech industry, paving the way for more efficient and secure financial services.
by cocomply
Read More
Explore the evolving landscape of digital banking and examine if traditional banks can adapt to the rapid changes in technology and customer expectations.
by cocomply
Read More
Explore how prioritizing data ethics can set fintech companies apart in a crowded market, fostering trust and driving innovation.
by cocomply
Read More
Explore how organizations can shift their compliance narrative from viewing it as a burden to leveraging it as a strategic opportunity for growth and innovation.
by cocomply
Read More
Explore the transformative impact of open banking on the financial sector and find out if your bank is ready to embrace this revolution.
by cocomply
Read More
Discover how banks can enhance their agility to effectively respond to regulatory changes and ensure compliance in a fast-paced financial environment.
by cocomply
Read More
Discover how organizations can effectively navigate compliance challenges by adapting strategies that ensure success in an ever-evolving regulatory landscape.
by cocomply
Read More
Explore the growing landscape of digital-only banks, their benefits, challenges, and what it means for the future of banking.
by cocomply
Read More
Discover how leaders can adapt their skills to thrive in the age of artificial intelligence, fostering innovation and collaboration in their teams.
by cocomply
Read More
Explore how robust data governance frameworks can unlock hidden value and drive significant growth for businesses.
by cocomply
Read More
Explore effective strategies for maintaining financial transparency in your organization with sound data practices. Learn how to safeguard your financial data today!
by cocomply
Read More
Learn how poor data governance can lead to catastrophic failures and discover effective strategies to improve your organization's data management practices.
by cocomply
Read More
Explore the resilience of the fintech industry by examining recent failures and the lessons learned that can foster innovation and sustainability.
by cocomply
Read More
Discover how organizations can build a strong culture of compliance that promotes ethical behavior and regulatory adherence.
by cocomply
Read More
Discover how insights from industries outside of banking can help build financial resilience in uncertain times.
by cocomply
Read More
Explore the critical interplay between business growth and regulatory compliance. Learn strategies for achieving success without sacrificing integrity.
by cocomply
Read MoreIn today's rapidly changing financial landscape, fintech startups have emerged as agile and innovative powerhouses, disrupting traditional banking models. Their fresh approaches to customer engagement, technology integration, and problem-solving have caught the attention of consumers and established institutions alike.
by Editorial Team
Read More
Explore the critical role of data quality in achieving compliance and how it can drive your business success.
by cocomply
Read More
Explore effective strategies for overcoming resistance to digital transformation within organizations. This post delves into actionable insights for seamless transitions.
by cocomply
Read More
Explore how to ensure your data strategy is resilient and adaptable for future challenges. This guide covers essential tips and insights for organizations.
by cocomply
Read More
Explore how organizations can foster a strong compliance culture that goes beyond mere compliance checkboxes. Learn the strategies for embedding compliance into the corporate ethos.
by cocomply
Read More
Explore how to effectively manage overwhelming data while leveraging its potential for decision-making.
by cocomply
Read More
Discover how the finance industry can tackle the dual challenges of trust and transparency in the age of artificial intelligence. Explore strategies, benefits, and best practices for integrating AI responsibly.
by cocomply
Read More
Explore how corporate agility can revolutionize financial services, driving innovation and meeting customer needs in a fast-paced environment.
by cocomply
Read More
Explore the hidden crisis of tech debt in the banking sector, understand its impacts, and discover strategies to mitigate it.
by cocomply
Read More
Explore essential strategies to bridge the compliance gap in the fintech industry and ensure regulatory success.
by cocomply
Read More
Discover the extensive hidden costs of non-compliance that go beyond just financial penalties. Learn how neglecting regulations can impact your business in unexpected ways.
by CoComply Team
Read More
Explore innovative risk management strategies from outside the banking industry, highlighting key lessons that can enhance resilience and decision-making.
by cocomply
Read More
Discover how to improve your data governance strategies for increased agility and responsiveness in today's fast-paced business environment.
by cocomply
Read More
Explore how to create a compliance culture that empowers employees instead of stifling them. Discover tips and strategies for fostering an environment of trust and support.
by cocomply
Read More
Explore how transparency can close the trust gap in fintech, boosting user confidence and industry growth.
by cocomply
Read More
Explore how transparency fosters trust in fintech, key strategies for companies, and the importance of effective communication with customers.
by cocomply
Read More
Explore the vital concept of data governance maturity and learn how to assess your institution's standing in today's data-driven landscape.
by cocomply
Read More
Explore how the shift to AI in data management is revolutionizing compliance and what you need to know to adapt effectively.
by cocomply
Read More