42.1 Remediation Populations, Restitution and Closure Evidence

Core Components of a Regulatory-Grade CAP

Every CAP entered into the bank's GRC ledger should contain the following program components:

1. Designated Single Issue Owner: A single business unit executive identified by name and corporate title (e.g., Senior Vice President, Head of Loan Servicing) who holds personal operational accountability for delivering the remediation. Assign clear accountability even when several departments contribute.
2. Detailed Root Cause Explanation: A factual narrative documenting the diagnostic RCA findings, explaining why the control broke down.
3. Sequential Remediation Action Steps: A granular work breakdown structure detailing each corrective step:
   • prompt containment actions (e.g., halting affected fee assessments);
   • Policy and standard operating procedure revisions;
   • Information technology, core parameter, or document preparation software reprogramming;
   • Enterprise-wide training curriculum updates and completion tracking;
   • Customer restitution and account remediation steps.
4. Interim Compensating Controls: Recognizing that complex core software re-engineering or vendor updates may require several months to deploy, management should establish temporary manual controls (such as 100% secondary supervisory review of affected transactions) to mitigate compliance risk during the build period.
5. Firm Milestone Dates and Completion Target: Sequential target dates for each intermediate milestone and an overall completion date.

Interest and communications

Apply interest or lost-opportunity-cost adjustments where required by the governing rule, supervisory direction or order. There is no universal requirement to use an IRS interest rate for every bank refund. Validate the formula, periods and rounding. Communicate the correction clearly, avoid misleading releases, reconcile payments, and follow applicable state unclaimed-property requirements for unresolved funds.

---

4. Customer Remediation and Restitution Programs

When a compliance failure, regulatory violation, or operational glitch causes monetary injury to consumers, supervisory agencies require the institution to execute a comprehensive customer remediation and restitution program.

The "Make Whole" Restitution Principle

Under the Interagency Policy Statement on TILA Restitution and CFPB restitution examination principles, the fundamental doctrine governing remediation is full financial restitution—returning affected consumers to the exact financial position they would have occupied had the violation or error had not occurred. Institutions cannot retain ill-gotten gains or offset damages against general overhead.

• Scope and authority: Determine the full affected population and relevant dates, then apply the governing restitution law, limitation rules, examination direction and any enforceable order. Administrative authority is not universally unlimited. Document the selected lookback and explain exclusions; a convenient recent sample does not establish the proper restitution boundary.

---

5. Independent Validation and Formal Issue Closure

Validation and Closure Protocol

Under FFIEC examination principles, an issue cannot be marked closed in the enterprise GRC system until formal, independent validation is executed:

• Independent Testing Party: Validation should be performed by an independent second-line compliance monitoring team or third-line internal audit—not the business unit that owns the issue.
• Sustainability Testing: Validation does not simply verify that policies were rewritten or software deployed. The validator should conduct substantive transaction testing on live production files originated a risk-appropriate number of calendar days after the corrective controls were implemented to confirm that the fix is durable and operating effectively in daily operations.
• Formal Closure Sign-Off: The validator documents testing workpapers, sample sizes, and error-free results in a formal validation report. Following the approval authority specified in the issue process and any applicable supervisory communication is the issue formally classified as Closed.

FDIC CMS examination framework.

Establish the remediation population

Start with the actual violation and its legal basis. TILA reimbursement rules, a contractual overcharge, an examination direction and an enforceable order can have different scope and calculation rules. Preserve account and system records, identify when the defect began and ended, and obtain a reliable population from the affected products, versions, channels and dates. Reconcile extraction totals to source systems and explain exclusions. A sample can diagnose a defect but does not justify refunding only the sampled accounts or complainants. A legal limitation period and an administrative remediation direction are distinct questions to assess with the applicable authority.

Build an account-level calculation that separates principal overcharges, associated fees and any required interest. For example, three hundred eighty accounts with an average overcharge of one hundred fifteen dollars produce a preliminary principal refund estimate of forty-three thousand seven hundred dollars. The average is a planning estimate; actual account records determine each payment. Independently reproduce boundary cases, test rounding and reconcile the sum of calculated refunds to payment instructions. Check whether a fee error also caused another charge, a misleading statement or a credit-reporting problem that needs correction. Avoid counting an earlier refund twice.

Include former customers where within scope. An open-account credit can work when authorized and accurate; a closed account may require another lawful payment method. Explain the correction and preserve delivery and payment evidence. Follow applicable unclaimed-property requirements for undeliverable amounts and assess whether the governing order prescribes additional outreach. Do not condition a legally required refund on a broad release unless the applicable authority actually permits it.

Correct the underlying control alongside customer redress. A parameter change without data cleanup leaves old accounts wrong, while refunds without a control change leave new accounts exposed. Assign owners for both tasks, set milestones from the actual risk and any binding deadline, and use interim review where the permanent fix takes time. Validate live transactions and the historical correction separately. Document remaining exceptions and unresolved payments rather than declaring success from a completed training session.

Report facts needed for oversight: affected-account count, amounts calculated and paid, outstanding payments, root cause, interim controls, milestone status and validation results. A reconciled payment file demonstrates execution; sustained transaction evidence demonstrates control effectiveness. Retain records under applicable law, orders, policy and legal holds. A commercial GRC product or one prescribed committee signature is not necessary to achieve these objectives.