The regulatory environment for small and mid-sized banks is becoming more demanding and complex. At the same time, bank executives are asking Risk and Compliance teams to accomplish more with fewer resources. Add shrinking IT budgets, increasing cybersecurity and technology demands, and the need for cross-functional collaboration, and Risk, Compliance, IT, and business teams face an ongoing uphill challenge.
For many institutions, the question is no longer simply, “How do we remain compliant?” The more important question is: How do we build a scalable framework that allows us to manage regulatory requirements while continuing to grow the bank?
The Regulatory Reality for Small and Mid-Sized Banks
In the United States, there are thousands of small and mid-sized financial institutions. While definitions vary, institutions with approximately $500 million to $20 billion in assets represent an important segment of the banking market. One of the challenges these institutions face is that many fundamental regulatory expectations apply regardless of whether an institution has $1 billion or $1 trillion in assets. The difference is often resources.
Large financial institutions typically have large Risk, Compliance, Legal, IT, Data, and Internal Audit organizations supporting regulatory requirements. Smaller institutions may have a handful of people responsible for many of the same processes. That resource imbalance creates a significant challenge.
Key Regulatory Challenges Facing Banks
Capital and Liquidity Requirements
Post-2008 regulatory reforms resulted in increased expectations around capital buffers, liquidity management, stress testing, risk monitoring, and reporting. For smaller institutions, many of the costs associated with compliance are relatively fixed. As a result, regulatory requirements can consume a larger percentage of available resources and operating budgets. Recent regulatory changes have provided some relief for community banks, including changes to the Community Bank Leverage Ratio. However, banks must continue to monitor evolving capital and liquidity requirements and determine how those changes affect their risk frameworks.
BSA and AML Compliance
Bank Secrecy Act and Anti-Money Laundering requirements remain significant areas of focus for financial institutions. Banks must maintain processes for transaction monitoring, customer due diligence, suspicious activity reporting, sanctions compliance, investigations, and regulatory reporting. For smaller institutions, the challenge is not simply understanding the regulations. It is building repeatable processes that can demonstrate to examiners that the bank’s controls are operating effectively. When those processes depend heavily on spreadsheets, email, manual reviews, and disconnected systems, maintaining consistency becomes increasingly difficult.
CFPB Open Banking and Section 1033
The CFPB’s Section 1033 rule represents another significant technology and compliance consideration for financial institutions. Data sharing introduces questions around data availability, consumer authorization, third-party access, cybersecurity, privacy, governance, and the technology required to support secure data exchange. For institutions with legacy systems and limited IT resources, implementing new data-sharing requirements can become a substantial undertaking.
Community Reinvestment Act Uncertainty
The regulatory framework surrounding the Community Reinvestment Act continues to evolve. Changes to asset-size thresholds and differences among the federal banking regulators can create additional uncertainty for institutions trying to understand which requirements and supervisory expectations will apply to them. For Risk and Compliance teams, regulatory change itself becomes another workload that must be monitored, assessed, documented, and incorporated into the bank’s existing framework. Read more about the evolving CRA discussion.
Third-Party and Fintech Risk
Banks are increasingly partnering with fintech companies and other third-party providers to deliver new products and compete in a rapidly changing financial-services environment. Those partnerships can create significant business opportunities, but they also introduce additional risk. Regulators continue to emphasize effective third-party risk management, including vendor due diligence, ongoing monitoring, contractual controls, information security, business continuity, compliance oversight, and clear accountability. For a smaller institution, managing dozens or even hundreds of third parties manually can quickly become difficult to scale.
So How Can Risk and Compliance Keep Up?
You cannot solve an increasingly complex regulatory environment with increasingly complex spreadsheets.
Manual processes can work for a period of time. But as regulatory requirements, policies, controls, risks, vendors, issues, assessments, and reporting requirements increase, the limitations of disconnected spreadsheets and manual workflows become apparent.
Risk and Compliance teams need a framework that connects the different components of the bank’s risk and regulatory environment. That framework should help the organization:
- Centralize regulatory requirements and obligations
- Map regulations to risks, controls, policies, and procedures
- Automate workflows and approvals
- Track issues and remediation
- Manage regulatory changes
- Support assessments and testing
- Provide management with meaningful reporting
- Create an auditable record of compliance activities
- Improve collaboration between Risk, Compliance, IT, Legal, Internal Audit, and the business
- Scale as the institution grows
Ultimately, the objective should not simply be to create another compliance system. It should be to create a unified governance, risk, and compliance framework that supports the bank’s broader business strategy.
Can Smaller Banks Leverage Enterprise GRC Technology?
From my perspective, one of the more established platforms in this space is IBM OpenPages. IBM OpenPages has been in the Governance, Risk, and Compliance market for more than two decades. It is used by some of the largest financial institutions around the globe and has evolved into a broad platform for managing risk and compliance across an organization. The platform’s capabilities now include AI-powered functionality designed to help organizations automate and accelerate traditionally complex processes.
OpenPages has been adopted by large financial institutions around the world. But an important question for smaller institutions is: Can a community or mid-sized bank realistically take advantage of an enterprise-grade GRC platform without having the budget and resources of a large bank? The answer can be yes.
The SaaS Model Changes the Equation
With a SaaS deployment model, institutions can leverage enterprise GRC technology without having to build and maintain the same level of underlying infrastructure traditionally associated with large enterprise implementations. That can make sophisticated GRC capabilities more accessible to smaller organizations.
IBM OpenPages also provides a modular architecture, allowing organizations to select and implement capabilities based on their specific requirements rather than attempting to solve every GRC challenge at once. This creates an opportunity for smaller financial institutions to take a phased approach. For example, an institution could begin by addressing a specific regulatory or risk-management challenge and then expand its GRC framework as its needs mature.
Where DataHub Can Help
Technology alone, however, is not the entire solution. Implementing a GRC platform successfully requires an understanding of the institution’s regulatory obligations, business processes, risk framework, data, technology environment, and organizational objectives.
DataHub is an IBM Business Partner focused on IBM OpenPages and GRC solutions. Our teams are trained and certified on the technology and have experience designing, customizing, and implementing OpenPages solutions for financial institutions. Working alongside IBM’s Expert Labs team, DataHub can help organizations design and implement OpenPages solutions that align with their specific regulatory, risk, compliance, and business requirements. The goal is not simply to implement software. The goal is to help create a framework that can evolve with the institution.
The Future of GRC for Smaller Financial Institutions
Regulatory requirements are not going away. In many cases, they are becoming more interconnected. A regulatory change can affect policies, controls, risk assessments, technology, vendors, data, reporting, and ultimately the business. For smaller and mid-sized financial institutions, continuing to manage these relationships through disconnected spreadsheets and manual processes can create unnecessary operational complexity.
The opportunity is to move from managing compliance activities individually to managing risk and compliance as an integrated framework. Enterprise-grade GRC technology is no longer necessarily limited to the largest financial institutions. With the right platform, implementation strategy, and partner, smaller institutions can begin building a scalable GRC environment that supports today’s requirements while preparing for tomorrow’s challenges.
If your organization is evaluating how to modernize its Risk and Compliance program, DataHub can help you explore what IBM OpenPages can do for your institution.