Creating a Culture of Compliance

Everywhere we turn, there is compliance, compliance,
and more compliance required across the board.[i]
Donald J. Frommeyer, CRMS
President of NAMB

The ancient Greek philosophers knew the fundamental distinction between theory and practice. For them “theory” (or theoria) differed from “practice” (or praxis) in that the former meant examining things and the latter meant doing things! In other words, theory was a sort of spectators’ sport, while practice was playing the sport itself. Advanced mathematics is somewhat similar: there is pure (or theoretical) mathematics and then there is applied mathematics. Some theories remain theories forever, and others are extrapolated into practice. So, as it happens, some cogent theories simply do not need to have applied applications to be cohesive theories. Practical applications, however, must be experimentally valid all of the time.

The requirements of implementing a theory can be daunting, especially when the consequences of its practical applications are not sufficiently understood. To put a fine point on this observation: what may seem perfectly acceptable in theory can be entirely unacceptable in practice. Thus, some things are possible theoretically and other things are not possible practically. In compliance, I have learned to approach the notion of something being ‘theoretically possible’ with extreme caution!

So, given the challenges of regulations (theories) and compliance requirements (practices), (1) how should a financial institution accomplish evaluations of its loan origination risks and, most importantly, (2) how to go about embedding such assessments into a culture of compliance? In this article, I am going to provide ways and means by which the management of a financial institution will be able to create a culture of compliance that serves as the foundation upon which to manage risk associated with mortgage loan originations. I will provide an extensive set of questions, the answers to which should call forth the ways and means to establish compliance solutions.*

If you have ten thousand regulations,
you destroy all respect for the law.
Winston Churchill

So, how to create a culture of compliance?

Begin at the beginning!

When was the last time that a risk assessment was performed to identify all the loan products, which departments were affected in originating them, and what staff are responsible to effectuate the origination? That is where to begin. Residential mortgage lenders and originators may offer some, or all, of the loan products subject to the Ability-to-Repay (ATR) and Qualified Mortgage (QM) rule promulgated by the Consumer Financial Protection Bureau (Bureau). But originating those loan products starts with identifying the loan flow process itself.

Furthermore, any new origination requirements will affect a number of parts of business systems and processes. For instance, a very short list of affected areas are the forms and processes used to communicate internally and externally that are subject to verification requirements; systems and processes used to underwrite loans must be considered; secondary marketing and servicing processes and systems need risk evaluation metrics, especially with respect to ATR provisions related to the refinancing of non-standard loans into a standard loans.

Specifically, are the various integrated processes and procedures set up to identify loans on the transaction systems with their definitional status under such regulations as the ATR and QM rule, which may involve creating new data element(s) within those very processing systems? Likewise, if the loan is a QM, is a formal consideration undertaken to determine levels of liability exposure and liability protection that a loan is receiving as it moves through the origination process?

To insure peace of mind
ignore the rules and regulations.  

George Ade

The American humorist, George Ade, may have found a way to peace of mind by ignoring rules and regulations. Perhaps he intuitively knew something about the stress involved in originating residential mortgage loans! If you have problems with rules and regulations, I suggest you choose another line of work, for happiness will forever elude you.

Consider this: the ATR and QM rule is just one component of the Bureau’s Dodd-Frank Act Title XIV rulemakings! Here are a few other rules that are now the law of the land:

• 2013 HOEPA Rule
• ECOA Valuations Rule
• TILA Higher-Priced Mortgage Loans Appraisal Rule
• Loan Originator Rule
• RESPA and TILA Mortgage Servicing Rules
• TILA Higher-Priced Mortgage Loans Escrow Rule

Some of these rules are directly and indirectly intersected, interlocked, overlapped, interfaced, and cross-tabulated; they are correlated, tabularized and re-tabularized, re-ordered, enumerated and re-enumerated, re-codified, and, generally, comprehensively systematized.[ii] Each of these rules affects one or more aspects of the loan origination process, organizational structure, and risk exposure. So maybe the great American humorist was on to something!

Nevertheless, if we are going to play, we will have to play within the rules. This means not only considering the compliance implications internally but also the interaction between the financial institution and third-parties upon which the institution relies for verifications, credit and other borrower information, disclosures, underwriting software, compliance and quality-control systems and processes, records management. Notwithstanding the foregoing third-parties, also to be considered are software providers, various vendors, and business partners. Training may also be necessary for these service providers and agents!

All the starting-point reviews in the world will lead to little or no action throughout an organization where certain training needs are not being met. Therefore, from the outset, it is critical to consider what training will be necessary for loan officers, secondary marketing, processing, compliance, and quality control personnel. Any staff involved at critical junctures in the loan flow process should receive training, certainly anyone who approves, processes, or monitors credit transactions.

For the remainder of this article, I will outline the key questions that should be asked, the answers to which will determine the extent, depth, and integrity of a culture of compliance. I am going to take you through a set of questions that will form the basis of a self-assessment. This type of internal review should be undertaken in order to set a baseline and determine progress towards compliance with mortgage acts and practices, and certainly the new mortgage rules.[iii] During any such evaluation, keep in mind that this is a due diligence process which is subject to an institution’s size, products offered, risk mitigation, complexity, and overall strength of the existing compliance management system.