CCB Compliance Technology & RegTech 2 — Questions and Answers
Question 1: A compliance officer wants to use natural language processing (NLP) to monitor employee communications. What is the PRIMARY regulatory concern with this approach?
- Cost of implementation
- Data privacy and employee surveillance laws (Correct answer)
- Lack of NLP accuracy
- System integration complexity
Correct answer: Data privacy and employee surveillance laws
NLP-based communication monitoring must comply with data privacy regulations and employee surveillance laws such as GDPR and the Electronic Communications Privacy Act.
Question 2: Which RegTech capability is MOST useful for automating the mapping of internal controls to multiple regulatory frameworks simultaneously?
- Robotic process automation
- Regulatory change management software with cross-framework tagging (Correct answer)
- Blockchain ledger systems
- Cloud-based document storage
Correct answer: Regulatory change management software with cross-framework tagging
Regulatory change management software with cross-framework tagging allows a single control to be mapped to multiple regulations, reducing duplication and effort.
Question 3: A bank deploys an AI model to make credit decisions. Under the Equal Credit Opportunity Act (ECOA), what must the bank be able to provide to a denied applicant?
- The model's source code
- Specific reasons for the adverse action (Correct answer)
- A manual review option only
- The full dataset used to train the model
Correct answer: Specific reasons for the adverse action
ECOA requires creditors to provide specific reasons for adverse action, which means AI credit models must be explainable enough to generate meaningful reason codes.
Question 4: What is 'regulatory sandboxing' in the context of RegTech?
- A method to isolate legacy compliance systems
- A controlled testing environment where regulators allow firms to test innovations with reduced regulatory burden (Correct answer)
- An encryption standard for regulatory data
- A sandbox game used for compliance training
Correct answer: A controlled testing environment where regulators allow firms to test innovations with reduced regulatory burden
Regulatory sandboxes are controlled environments where regulators permit fintech and RegTech firms to test innovative products with relaxed regulatory requirements under supervision.
Question 5: Which metric is MOST important when evaluating a transaction monitoring system's effectiveness in an AML program?
- Number of alerts generated per day
- False positive rate and false negative rate balance (Correct answer)
- System uptime percentage
- Cost per alert investigated
Correct answer: False positive rate and false negative rate balance
Balancing false positives (unnecessary investigations) and false negatives (missed suspicious activity) is the key measure of a transaction monitoring system's effectiveness.
Question 6: A firm uses robotic process automation (RPA) to file regulatory reports. Who retains ultimate accountability for the accuracy of those filings?
- The RPA software vendor
- The IT department that deployed the bots
- The firm and its designated compliance officer (Correct answer)
- The regulator who receives the filing
Correct answer: The firm and its designated compliance officer
Automation does not transfer regulatory accountability; the firm and its compliance officer remain responsible for the accuracy and timeliness of all regulatory submissions.
Question 7: What does 'data lineage' mean in a compliance data management context?
- The historical ownership chain of a dataset
- Tracking the origin, movement, and transformation of data throughout its lifecycle (Correct answer)
- The age of data stored in a compliance system
- The family tree of a database schema
Correct answer: Tracking the origin, movement, and transformation of data throughout its lifecycle
Data lineage documents where data comes from, how it moves, and how it changes, which is critical for audit trails and regulatory reporting accuracy.
CCB Compliance Technology & RegTech 2
A compliance officer wants to use natural language processing (NLP) to monitor employee communications.
What is the PRIMARY regulatory concern with this approach?