38.2 Legal Training Duties and Role-Based Curriculum

Regulatory Mandates for Compliance Training

Compliance training is not merely an operational best practice; it is a direct statutory obligation woven into federal banking law. Regulators expect every depository institution to maintain an ongoing educational program that is comprehensive, tailored to specific job responsibilities, and updated to reflect legal changes.

Statutory and Regulatory Training Requirements

Several cornerstone consumer financial protection and financial crimes statutes explicitly prescribe employee training as a required compliance component for covered activities:

1. Bank Secrecy Act (BSA) & Anti-Money Laundering (12 CFR § 21.21 [OCC], 12 CFR § 208.63 [FRB], 12 CFR § 326.8 [FDIC]): Explicitly establishes ongoing employee training as a required element of a compliant BSA program. Financial institutions should provide comprehensive, ongoing training for all relevant personnel tailored to their specific operational touchpoints.
2. Gramm-Leach-Bliley Act (GLBA) Safeguards Rule & Information Security Guidelines (12 CFR Part 30 / Part 208 App. B / Part 364 App. B): Depository institutions should train staff to implement the institution's information security program, recognize social engineering and phishing attacks, and safeguard customer Non-Public Personal Information (NPI).
3. FACTA Red Flags Rule (12 CFR Part 41 / 222 / 334 App. J): expects that financial institutions train relevant staff to detect, prevent, and mitigate identity theft red flags in connection with opening covered accounts and existing account activity.
4. Regulation Z MLO training: Section 1026.36(f)(3) requires periodic training for the relevant individual loan originators who are not required to be state licensed, appropriate to their origination activities. State-licensed originators have a separate SAFE continuing-education framework.
5. Fair lending: A role-appropriate curriculum helps prevent unlawful discrimination and supports an effective CMS. Examination guidance does not itself create a universal statutory training frequency for every listed role.
6. SCRA: Train affected servicing, collection and foreclosure staff on the actual duties. An enforceable order can impose additional particular training obligations; do not apply another bank’s order as a universal mandate.

The Three Tiers of Compliance Training

An enterprise compliance curriculum should not take a generic, one-size-fits-all approach. Instead, leading institutions structure training across three distinct tiers tailored to institutional responsibility.

Tier 1: General Bank-Wide Awareness Training

• Target Audience: 100% of bank employees, new hires within 30 days of onboarding, executive management, and long-term embedded contractors.
• Core Curriculum:
  • Fundamental BSA/AML concepts (recognizing unusual customer activity, internal SAR referral mechanisms, the strict criminal prohibition against tipping off customers);
  • Code of Conduct and Professional Ethics (conflicts of interest, reporting improper behavior);
  • Bank Bribery Act (18 U.S.C. § 215) prohibitions, allowable safe harbors, and policy gift reporting thresholds;
  • Information Security, Clean Desk Policy, and Phishing Defense;
  • Whistleblower Protections and Non-Retaliation Policies;
  • Foundational UDAAP principles (treating consumers fairly and eliminating deceptive representations);
  • Physical Facility Security and Robbery Conduct under the Bank Protection Act.

Tier 2: Targeted Role-Based Functional Training

Role-based training is customized directly to the transactional touchpoints of each operational department. Providing commercial wire room employees with mortgage disclosure training, or vice versa, wastes resources and fails supervisory muster.

1. Frontline Tellers and Customer Service Representatives

• Regulation CC (Expedited Funds Availability): Distinguishing next-day availability items (cash, government checks, cashier's checks) from standard local check availability schedules; proper invocation and documentation of statutory exception holds (large deposits over the statutory threshold, redeposited items, repeated overdrafts, reasonable cause to doubt collectibility, emergency conditions); delivering written hold notices containing all applicable statutory elements.
• Regulation E (Electronic Fund Transfers): Oral error notice intake workflows; strict prohibition against requiring customers to submit written affidavits as a condition of starting an error investigation; 10-business-day provisional credit rules; 45-day (or 90-day for new accounts, foreign transactions, or POS) investigation deadlines.
• BSA/AML Operational Reporting: Currency Transaction Reporting (CTR) $10,000 cash threshold; required aggregation when the same-person knowledge conditions are met; recognizing CTR structuring patterns; avoiding customer tipping-off; CTR Phase I and Phase II exemptions.
• Elder Financial Exploitation: Red flags of financial abuse (uncharacteristic wire transfers, sudden appearance of an aggressive third-party companion, unauthorized power of attorney additions, customer confusion); reporting protocols under the Senior Safe Act and state adult protective services (APS) laws.

2. Mortgage Loan Originators (MLOs) and Underwriters

• TRID (TILA-RESPA Integrated Disclosures): The statutory 6-piece application definition (Name, Income, Social Security Number, Property Address, Estimated Value, Mortgage Loan Amount); applicable three-business-day delivery window for the Loan Estimate; fee tolerance categories (0% zero tolerance, 10% cumulative tolerance, unlimited tolerance); valid changed circumstances rules permitting revised Loan Estimates; the applicable three-business-day waiting period between Closing Disclosure delivery and loan consummation.
• Regulation B (Equal Credit Opportunity Act): Rules against discouraging applicants; prohibited bases (race, color, religion, national origin, sex, marital status, age, public assistance income, CCPA exercise); strict spousal signature rules (prohibiting lenders from requiring a spouse's signature if the applicant independently qualifies); 30-day adverse action notification deadlines; valuation-copy delivery promptly upon completion and no later than three business days before consummation, subject to applicable timing-waiver provisions.
• Regulation C (Home Mortgage Disclosure Act): required demographic collection for covered applications (ethnicity, race, sex); visual observation and surname collection rules for face-to-face applications; accurate compilation of Loan Application Register (LAR) data fields.
• Fair Lending and Steering: Prohibitions against steering borrowers toward higher-cost loan products; discretionary pricing spread limits; redlining avoidance.
• Flood Disaster Protection Act (FDPA): the required Standard Flood Hazard Determination Form and insurance purchase for designated loans; tracking coverage and map changes; 45-day force-placement notice procedures.
• ATR/QM: Teach the applicable eight-factor ability-to-repay assessment and QM criteria, including loan-size-dependent points-and-fees caps and the applicable safe-harbor or rebuttable-presumption APR test.

3. Loan Servicing and Collections Personnel

• Mortgage servicing: Teach early-intervention and continuity-of-contact duties with exemptions, and loss-mitigation protections based on application completeness, foreclosure stage and the relevant timing thresholds. A single exclusive contact person and an unconditional prohibition on all foreclosure activity are not universal requirements.
• Escrow: For a current borrower, refund a surplus of fifty dollars or more within thirty days of the analysis. Apply Section 1024.17’s distinct smaller-surplus, shortage and deficiency options; a shortage-repayment plan can require at least twelve months rather than exactly twelve equal installments in every situation.
• Force-placed hazard insurance: Apply Section 1024.37’s evidence and notice requirements: the initial notice precedes assessment by at least forty-five days, and the reminder is sent at least thirty days after the first and at least fifteen days before assessment. Cancel and refund overlap under the rule when sufficient proof is received.
• SCRA: Apply qualifying written requests and service documentation for the pre-service six-percent cap, retroactive forgiveness and debt-type-dependent duration. Foreclosure and repossession protections have separate conditions, court-order and waiver provisions.
• Regulation F: Teach the applicable debt-collector scope and call-frequency presumptions, including the separate seven-day period after a conversation. These are not absolute limits applying identically to every first-party bank call.