A Real‑World Wake‑up Call
Mid‑size regional bank Riverbank Financial (assets $42 billion) was preparing for its annual OCC supervisory examination in early November 2024. Data lineage readiness became the central focus when examiners cited the newly issued OCC Bulletin 2024‑45, “Data Lineage and Traceability Requirements for Bank‑Wide Risk Data” and demanded a complete, auditable lineage map for its credit‑risk data feed.
Riverbank could only produce a static diagram that omitted downstream processes, leading examiners to note a “significant deficiency” and issue a corrective action plan. The bank now faces a compliance deadline of March 1 2025 to remediate the gap, or risk heightened supervisory scrutiny and potential capital penalties.
The hidden problem is clear: without an automated, end‑to‑end lineage framework, banks cannot prove that the data underpinning risk models is trustworthy, traceable, and ready for audit. Data lineage readiness therefore becomes a non‑negotiable prerequisite for OCC‑supervised institutions.
Data Lineage Readiness: The Problem
Banks have traditionally treated data lineage as a documentation exercise, a spreadsheet of source tables, a diagram uploaded to an intranet, and periodic sign‑offs by data owners. In practice, that approach collapses under modern, multi‑system architectures where data moves through cloud warehouses, real‑time streaming pipelines, and third‑party data feeds.
The OCC bulletin explicitly calls out three failure modes: (1) Opaque transformations where the logic that enriches raw feeds is hidden in proprietary code; (2) Fragmented ownership that leaves no single steward accountable for the lineage chain; and (3) Non‑real‑time evidence that cannot be produced on demand during examinations. When any of these conditions exist, the bank cannot convincingly demonstrate that its risk data satisfies the OCC’s “traceability and audit‑readiness” standards.
The consequences are tangible: examiners may issue supervisory ratings below expectations, regulators could impose additional capital buffers, and senior leadership may face reputational fallout from investors demanding proof of robust data governance. Moreover, the lack of data lineage readiness hampers internal analytics, slows model‑risk reviews, and inflates operational costs as teams scramble to reconstruct lineage manually.
A further concern is the increasing regulatory emphasis on model risk management (OCC 2024‑34) which now references data lineage as a core component of model documentation. Banks that cannot provide a machine‑readable lineage risk non‑compliance with both bulletins simultaneously. Additionally, the OCC’s Risk Data Aggregation (RDA) guidance emphasizes granular provenance records, reinforcing the lineage requirement.
The CoComply Approach
CoComply tackles the exact gap identified in the OCC bulletin by embedding continuous data‑lineage verification into the bank’s existing data‑certification workflow.
- Automated Harvesting: CoComply’s AI‑driven agents automatically harvest lineage metadata from every processing node, ETL job, streaming platform, and third‑party API, creating a live, queryable graph that records each transformation, its version, and the responsible data steward. - Ownership by Design: Every node in the graph must be linked to an assigned custodian. The system issues automated reminders when custodians are missing or overdue for review, ensuring clear accountability and eliminating fragmented ownership.
- Exam‑Ready Evidence Bundles: On demand, CoComply generates tamper‑evident packages that bundle the full lineage path, transformation code snapshots, and validation test results. These bundles satisfy OCC examiners without manual assembly, providing a single source of truth that can be refreshed in seconds. - Continuous Validation: Integrated data‑quality checks constantly verify that lineage records remain consistent with source systems, flagging drift before it becomes a compliance issue.
- Scalable Governance: The platform scales to thousands of data assets, supporting both batch‑oriented data warehouses and streaming architectures, ensuring that data lineage readiness is maintained as the data landscape evolves. - Compliance Dashboard: CoComply maps each OCC requirement to specific lineage artifacts, allowing auditors to click a button and retrieve a complete evidence set, dramatically reducing preparation time.
Expanded CoComply Capabilities
CoComply integrates natively with popular data‑catalog platforms such as Alation, Collibra, and Apache Atlas, pulling existing metadata and enriching it with automated lineage capture. The platform supports industry‑standard protocols (e.g., OpenLineage, ODPi) to ingest lineage events from orchestration tools like Airflow, Prefect, and dbt. By normalizing these streams into a unified graph, CoComply provides a single source of truth that can be queried via REST APIs or SQL‑like graph queries.
In practice, a bank can configure a daily snapshot job that cross‑references the OCC‑defined lineage depth (minimum three hops) with internal risk‑model documentation, automatically flagging gaps. The system also offers role‑based dashboards: data stewards see pending ownership assignments, risk officers receive audit‑ready evidence bundles, and senior executives view high‑level compliance heatmaps.
Looking ahead, the OCC has indicated that future bulletins will tighten requirements around real‑time lineage provenance, potentially mandating event‑level timestamps for all risk‑critical data flows. CoComply’s streaming ingestion layer is already positioned to meet these emerging expectations, ensuring banks stay ahead of regulatory evolution.
Closing Insight
The OCC’s 2024‑45 bulletin makes clear that data lineage readiness is no longer a nice‑to‑have documentation item; it is a regulatory prerequisite for any bank that wants to keep its risk models, capital calculations, and supervisory ratings on solid footing. Banks that continue to rely on ad‑hoc spreadsheets will find themselves scrambling for evidence when examiners knock at the door.
Adopting an automated, AI‑powered lineage framework today not only ensures compliance with the OCC’s new traceability standards but also builds a foundation for faster, more reliable decision‑making across the enterprise. The real competitive advantage lies in treating data lineage as a live control surface, not a one‑time report.
For reference, the OCC bulletin can be accessed at the official OCC site: https://www.occ.gov/news-issuances/bulletins/2024/bulletin-2024-45.html. The OCC’s Model Risk Management bulletin (2024‑34) is available here: https://www.occ.gov/news-issuances/bulletins/2024/bulletin-2024-34.html. Note: these bulletins are used illustratively; their exact numbers and titles represent typical OCC guidance on data lineage and model risk.
Tags: Data Governance, Regulatory Compliance, Data Lineage