Certified Regulatory Compliance Manager (CRCM) — Questions and Answers

Question 1: A compliance reporting system has an External Output that retrieves data from two ILFs and formats a regulatory report. The report contains 12 unique data fields. What complexity level does the FTR and DET combination suggest?

Low complexity, because only two files are referenced
Low complexity, because regulatory reports default to low
High complexity, based on 2 FTRs and more than 5 DETs (Correct answer)
Medium complexity, because 12 DETs always yields medium

Correct answer: High complexity, based on 2 FTRs and more than 5 DETs

An EO referencing 2 FTRs and more than 5 DETs falls into the High complexity cell of the IFPUG EO complexity matrix.

Question 2: Which rule requires banks to collect and verify beneficial ownership information for legal entity customers?

UDAAP Rule
FinCEN Beneficial Ownership Rule (Correct answer)
Regulation CC
Volcker Rule

Correct answer: FinCEN Beneficial Ownership Rule

FinCEN's Customer Due Diligence Final Rule requires banks to collect beneficial ownership information for legal entity customers.

Question 3: Under 12 CFR Part 30 (OCC Safety and Soundness Standards), banks are required to maintain:

A compliance management system sufficient to ensure compliance with applicable laws and regulations (Correct answer)
An independent board compliance committee with a majority of outside directors
Separate compliance and risk management departments in all cases
A minimum of five compliance officers

Correct answer: A compliance management system sufficient to ensure compliance with applicable laws and regulations

OCC safety and soundness standards require national banks to have compliance management systems adequate to identify, manage, and control compliance risks.

Question 4: The CRA strategic plan option allows a bank to:

Be exempt from the lending test if it commits to community investment targets
Use peer bank benchmarks instead of assessment-area-specific targets
Defer CRA compliance for up to three years while developing internal systems
Set its own measurable CRA goals, subject to public comment and regulatory approval (Correct answer)

Correct answer: Set its own measurable CRA goals, subject to public comment and regulatory approval

Under the strategic plan option, a bank may develop its own CRA goals, make the plan available for public comment, and then submit it to its regulator for approval, providing a customized compliance framework.

Question 5: Congress limited financial organizations' ability to share consumer information with other parties. By the law, financial institutions must also provide disclosures when starting a client relationship and then once a year after that.

Gramm-Leach-Billey Act of 2001
Gramm-Leach Act of 2000
Gramm-Billey Act of 1998
Gramm-Leach -Billey Act of 1999 (Correct answer)

Correct answer: Gramm-Leach -Billey Act of 1999

The correct answer is the Gramm-Leach-Bliley Act of 1999. Congress enacted the Gramm-Leach-Bliley Act (GLBA) in 1999 to address various aspects of the financial services industry, including the disclosure of customer information by financial institutions.

Question 6: A bank employee who knowingly assists a customer in structuring transactions to avoid reporting requirements may be charged with:

Federal criminal violations including conspiracy (Correct answer)
Negligence only
A minor compliance infraction
A civil violation only

Correct answer: Federal criminal violations including conspiracy

Bank employees who assist in structuring can face federal criminal charges including conspiracy and aiding and abetting.

Question 7: In IFPUG function point counting, what does the term 'application boundary' define?

The regulatory jurisdiction governing the software
The physical server infrastructure hosting the compliance system
The conceptual interface between the application being measured and the external world (Correct answer)
The maximum number of users permitted to access the system

Correct answer: The conceptual interface between the application being measured and the external world

The application boundary separates the application being measured from its users and other applications, determining what is counted inside versus outside.

Question 8: Under the Dodd-Frank Act, the CFPB has supervisory authority over which institutions without regard to asset size?

All community banks
Mortgage brokers operating only in one state
Non-bank financial companies offering consumer financial products (Correct answer)
Only credit unions with federal charters

Correct answer: Non-bank financial companies offering consumer financial products

The CFPB has supervisory authority over non-bank entities (e.g., payday lenders, mortgage companies) offering consumer financial products regardless of size.

Question 9: Under the USA PATRIOT Act, banks must implement a Customer Identification Program (CIP) verifying identity for which customers?

Only commercial business accounts
Only accounts with balances over $50,000
Only non-US citizens
All new account holders (Correct answer)

Correct answer: All new account holders

CIP requirements apply to all new account holders regardless of account type or balance.

Question 10: What is 'redlining' in fair lending?

Requiring cosigners based on the applicant's age
Charging higher interest rates to low-income borrowers
Offering credit only through preferred brokers
Refusing to lend or imposing unfavorable terms in minority neighborhoods (Correct answer)

Correct answer: Refusing to lend or imposing unfavorable terms in minority neighborhoods

Redlining is the illegal practice of denying credit or imposing worse terms based on the racial or ethnic composition of a neighborhood.

Question 11: Which of the following is an 'exception hold' permitted under Regulation CC?

A hold placed on a deposit because the depositor has a repeatedly overdrawn account (Correct answer)
A hold placed on all payroll deposits regardless of amount
A hold on cashier's checks for first-time account holders only
A hold on all deposits made after 3 p.m.

Correct answer: A hold placed on a deposit because the depositor has a repeatedly overdrawn account

Regulation CC allows exception holds for accounts with repeated overdrafts, among other exceptions, extending the standard availability schedule.

Question 12: Under GLBA, which sharing arrangement does NOT require customer opt-out rights?

Sharing customer data with affiliated companies (Correct answer)
Sharing with nonaffiliated insurance companies for cross-selling
Sharing with a nonaffiliated data broker for marketing purposes
Sharing with nonaffiliated credit card processors under a joint marketing agreement

Correct answer: Sharing customer data with affiliated companies

Sharing customer information with affiliated companies (companies under common control) does not require an opt-out right under the GLBA Privacy Rule, though customers may be given a limit right.

Question 13: Under the Electronic Fund Transfer Act (EFTA), consumers have how many business days to report an unauthorized electronic fund transfer to limit liability to $50?

2 business days (Correct answer)
10 business days
60 days
30 days

Correct answer: 2 business days

Consumers must report unauthorized EFTs within 2 business days of learning of the loss to limit liability to $50.

Question 14: Which type of bank is evaluated solely under a community development test rather than the standard lending, investment, and service tests?

Large retail bank
Intermediate small bank
Small bank
Wholesale or limited purpose bank (Correct answer)

Correct answer: Wholesale or limited purpose bank

Wholesale and limited purpose banks do not offer retail products to the general public, so they are evaluated only on a community development test rather than the standard three-part test.

Question 15: Which of the following BEST describes a 'community development loan' for CRA purposes?

A personal loan made directly to an LMI individual for home improvement
A loan to any nonprofit organization, regardless of its stated mission
A loan whose primary purpose is community development, such as financing affordable housing or supporting LMI-serving community organizations (Correct answer)
Any loan with an interest rate at or below the current prime rate

Correct answer: A loan whose primary purpose is community development, such as financing affordable housing or supporting LMI-serving community organizations

Community development loans are defined by their primary purpose: supporting affordable housing, community services for LMI individuals, economic development for small businesses, or revitalization of LMI areas.

Question 16: Which of the following would MOST likely qualify as a CRA investment under the investment test?

Investing in a Low-Income Housing Tax Credit (LIHTC) partnership in the assessment area (Correct answer)
Buying AAA-rated commercial mortgage-backed securities on the secondary market
Acquiring stock in a large regional competitor bank with strong earnings
Purchasing U.S. Treasury bills for the bank's investment portfolio

Correct answer: Investing in a Low-Income Housing Tax Credit (LIHTC) partnership in the assessment area

Investments in LIHTC projects that benefit LMI populations or areas in the bank's assessment area are a classic example of qualified CRA investments, satisfying the primary community development purpose requirement.

Question 17: Under IFPUG's Counting Practices Manual, which component is classified as a Data Function rather than a Transaction Function?

External Output (EO)
External Input (EI)
External Inquiry (EInq)
Internal Logical File (ILF) (Correct answer)

Correct answer: Internal Logical File (ILF)

Internal Logical Files are Data Functions because they represent user-identifiable groups of logically related data maintained within the application boundary.

Question 18: A compliance officer reviewing an IFPUG count finds that the counting team included the same data group as both an ILF and an EIF. Which IFPUG rule does this violate?

A data group maintained by the application cannot simultaneously be counted as an EIF for the same application (Correct answer)
The CPM permits dual-counting when regulatory data is involved
An ILF can also be counted as an EIF if referenced by more than one transaction
EIFs and ILFs may share the same data group if they have different RET structures

Correct answer: A data group maintained by the application cannot simultaneously be counted as an EIF for the same application

IFPUG rules state that if data is maintained by the application being counted, it is an ILF for that application and cannot also be an EIF within the same count.

Question 19: Under Regulation E, a financial institution must resolve an error investigation within how many business days for most transactions?

90 business days
10 business days (Correct answer)
5 business days
45 business days

Correct answer: 10 business days

Under Regulation E, institutions generally have 10 business days to investigate and resolve EFT error claims.

Question 20: A principal in municipal securities must directly supervise municipal securities activities. This entails going through all but one of the items below. What activity DOES NOT directly entail the direct supervision of municipal securities operations?

Handling a municipal securities transaction
Handling customer complaints
Opening the customer’s account
Providing quotations to customers (Correct answer)

Correct answer: Providing quotations to customers

Providing quotations to customers is a customer-facing sales activity, not a supervisory function, so it is not part of directly supervising municipal securities operations. Opening accounts, handling customer complaints, and overseeing transactions are oversight and compliance duties that a principal must directly supervise.

Question 21: What is the purpose of a bank's AML risk assessment?

To determine the bank's capital adequacy ratio
To evaluate employee performance in compliance roles
To set customer credit limits
To identify and prioritize money laundering and terrorist financing risks (Correct answer)

Correct answer: To identify and prioritize money laundering and terrorist financing risks

The AML risk assessment identifies, measures, and prioritizes the institution's exposure to money laundering and terrorist financing.

Question 22: Under the Real Estate Settlement Procedures Act (RESPA), which section prohibits kickbacks and unearned fees in connection with federally related mortgage loans?

Section 8 (Correct answer)
Section 12
Section 10
Section 6

Correct answer: Section 8

RESPA Section 8 prohibits giving or accepting fees, kickbacks, or anything of value in exchange for referrals of settlement service business.

Question 23: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with a privacy notice:

Every two years
Only when sharing data with unaffiliated third parties
Only when the customer requests one
At account opening and annually thereafter (Correct answer)

Correct answer: At account opening and annually thereafter

GLBA requires an initial privacy notice at account opening and annual notices to all existing customers describing information-sharing practices.

Question 24: Under IFPUG guidelines, which scenario correctly describes when an External Inquiry (EInq) differs from an External Output (EO)?

An EInq always involves two or more ILFs; an EO references only one
An EInq retrieves data without transforming or deriving new values; an EO may derive or calculate output data (Correct answer)
An EInq is only triggered by external regulators; an EO is user-initiated
An EInq updates an ILF as a side effect; an EO does not

Correct answer: An EInq retrieves data without transforming or deriving new values; an EO may derive or calculate output data

The key distinction is that an EInq retrieves and displays data without mathematical derivation, while an EO processes, calculates, or transforms data to produce output.

Question 25: Which federal agencies are responsible for conducting CRA examinations?

The NCUA for all federally insured institutions
The SEC, FINRA, and the Treasury Department
Only the CFPB for all consumer compliance matters
The Federal Reserve, OCC, and FDIC (Correct answer)

Correct answer: The Federal Reserve, OCC, and FDIC

The three primary federal bank regulators — the Federal Reserve (state member banks), OCC (national banks and federal thrifts), and FDIC (state nonmember banks) — each conduct CRA examinations for their supervised institutions.

Question 26: A customer opens a new account and provides identification. Under the Customer Identification Program (CIP) rules, the bank must verify the customer's identity:

Before the account is opened
Only if the transaction exceeds $10,000
Within a reasonable time before or after account opening (Correct answer)
Within 30 days of account opening

Correct answer: Within a reasonable time before or after account opening

CIP rules require identity verification within a reasonable time before or after account opening, allowing flexibility for low-risk situations while ensuring due diligence.

Question 27: Under TILA's right of rescission, a borrower has how many business days to cancel a non-purchase home-secured loan?

5 business days
1 business day
7 business days
3 business days (Correct answer)

Correct answer: 3 business days

Borrowers have three business days to rescind (cancel) a non-purchase home-secured loan after consummation, delivery of the rescission notice, or delivery of required disclosures.

Question 28: A bank's BSA/AML compliance program must include which four pillars as required by federal regulation?

Internal controls, independent testing, designated BSA officer, and customer due diligence (Correct answer)
Board oversight, risk assessment, monitoring, and reporting
Policies, procedures, training, and audit
Customer identification, due diligence, enhanced due diligence, and SAR filing

Correct answer: Internal controls, independent testing, designated BSA officer, and customer due diligence

The four required BSA/AML program pillars are internal controls, independent testing (audit), a designated BSA compliance officer, and training.

Question 29: Under the Bank Secrecy Act, financial institutions must file a Currency Transaction Report (CTR) for cash transactions exceeding what threshold?

$5,000
$25,000
$50,000
$10,000 (Correct answer)

Correct answer: $10,000

The BSA requires CTR filing for cash transactions exceeding $10,000 in a single business day.

Question 30: Which of the following BEST qualifies as a community development service under CRA?

Providing free financial literacy workshops to low- and moderate-income individuals (Correct answer)
Developing mobile banking features targeted at business customers
Installing ATMs exclusively in high-income shopping districts
Offering premium interest rates to attract high-net-worth depositors

Correct answer: Providing free financial literacy workshops to low- and moderate-income individuals

Financial literacy education and counseling services targeted to LMI individuals qualify as community development services under CRA.

Certified Regulatory Compliance Manager (CRCM)

The CRCM, administered by the American Bankers Association (ABA), validates expertise in bank regulatory compliance across consumer protection regulations, foundational banking rules, and compliance management systems. It is the premier compliance certification for banking professionals.

Questions

36 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

aba.com — Score validity, test delivery, fees, registration deadline, retake fee, retake policy, test dates, exam format, passing score, score release · verified Oct 2026