CRCM Cheat Sheet 2026

The 30 highest-yield CRCM facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which ISO standard formally recognizes IFPUG Function Point Analysis as a functional size measurement method? → ISO/IEC 20926
2. Which of the following would MOST likely qualify as a CRA investment under the investment test? → Investing in a Low-Income Housing Tax Credit (LIHTC) partnership in the assessment area
3. The cash drawer of Teller #1 has a mysterious $7,000 cash deficit, which the branch manager discovers. Which of the below activities is required of the bank? → File a Suspicious Activity Report (SAR)
4. Which of the following categories of workers needs to get instruction on how to utilize W-9 forms precisely? → New account officers
5. Regulation CC (Expedited Funds Availability Act) requires banks to make funds from local check deposits available no later than: → Second business day
6. The FTC's Safeguards Rule (updated 2023) requires covered financial institutions to designate: → A qualified individual to oversee the information security program
7. Regulation E disclosures MUST be given at the time of account opening when creating a deposit account online, or: → Before the first EFT occurs
8. What is the primary purpose of a 'correspondent banking' due diligence program under BSA? → To assess the AML risks of foreign financial institutions using the bank's services
9. A bank's fair lending self-assessment program should include: → Statistical analysis of lending data to detect potential disparities by protected class
10. Which of the following is an example of 'disparate treatment' in lending? → Charging minority applicants higher rates than similarly qualified non-minority applicants
11. A lender is required under ECOA to consider alimony and child support as income if the applicant chooses to disclose it. This protects primarily which group? → Divorced or separated women
12. Under GLBA, which sharing arrangement does NOT require customer opt-out rights? → Sharing customer data with affiliated companies
13. The CRA strategic plan option allows a bank to: → Set its own measurable CRA goals, subject to public comment and regulatory approval
14. Under the GLBA Safeguards Rule, covered institutions must test or monitor the effectiveness of their security controls: → Regularly, as part of the information security program
15. What does the term 'layering' refer to in the three stages of money laundering? → Moving funds through complex transactions to obscure their origin
16. Under the Bank Secrecy Act (BSA), what is the threshold amount that triggers a Currency Transaction Report (CTR)? → $10,000
17. Which IFPUG complexity level assigns the highest unadjusted function point value to an External Output? → High complexity
18. A notification to customers affected by a data breach is required under: → A combination of federal agency guidance and state data breach notification laws
19. The four CRA performance rating categories are: → Outstanding, Satisfactory, Needs to Improve, Substantial Noncompliance
20. Under OFAC regulations, what must a bank do when a transaction involves a specially designated national (SDN)? → Block or reject the transaction and report to OFAC
21. What deadline has the federal agency that oversees financial institutions set for the submission of their loan application registers? → March 1 of the year following the calendar year for which the data were compiled
22. The Military Lending Act (MLA) caps the Military Annual Percentage Rate (MAPR) for covered loans to active-duty servicemembers at: → 36%
23. Which of the following best describes 'structured transactions' or 'structuring' under BSA/AML regulations? → Breaking up large cash transactions specifically to evade CTR reporting requirements
24. The CFPB's UDAP authority under Dodd-Frank prohibits: → Unfair, deceptive, or abusive acts or practices (UDAAP)
25. Regulation DD, which implements the Truth in Savings Act, requires depository institutions to disclose: → Minimum balance requirements and fees for deposit accounts
26. Which of the following actions would constitute a violation of the Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) standard under Dodd-Frank? → Misrepresenting the cost of add-on products to obtain consumer consent
27. What is the primary purpose of the CAN-SPAM Act as it applies to financial institution marketing emails? → It sets standards for commercial email, including opt-out requirements
28. In a compliance risk assessment, 'inherent risk' is best defined as: → The level of risk present before any mitigating controls are considered
29. Which agency primarily enforces fair lending laws for national banks? → Office of the Comptroller of the Currency (OCC)
30. Which section of the GLBA covers the financial privacy provisions and requires initial and annual privacy notices? → Title V (Privacy of Consumer Financial Information)