By Carl Pry, CRCM, CRP
Benefits of the CRCM
The CRCM is the banking compliance industry’s premier credential that sets the standard of professional expertise in the field. Obtaining and maintaining the CRCM designation benefits not only you and your career but also your employer.
The CRCM is clear evidence that you have attained the skills and possess the knowledge to stay current in the increasingly complex banking compliance field. It demonstrates that you have taken the time necessary to study, prepare, and maintain a level of expertise that sets you apart from others in the field.
It is also a career enhancer. Many job listings in the compliance field either require or strongly prefer CRCMs, so your next career move could certainly be enhanced by those four letters after your name. It shows potential employers that you are not new to the field and that you have a strong grasp of an extremely broad field of expertise in banking laws and regulations, as well as how those issues are applied in real life. It also shows your current employer that you’re dedicated to achieving a recognized level of excellence in compliance, which can’t hurt when it comes to future opportunities.
There are many instances where regulators are interested in how many CRCMs are employed within a bank’s compliance-related functions, and in some cases, they have recommended that the institution look into pursuing certification for more of its employees. It’s not only the quantity of individuals within a bank’s compliance function but also the level of expertise they bring. Having CRCMs in critical compliance functions validates the bank’s dedication to employing expert, qualified professionals dedicated to mitigating compliance risk.
There are other perks of being a CRCM, including a free digital subscription to ABA Risk and Compliance magazine (great if you’re presently paying for it as a non-CRCM!) and discounts to certain conferences like the ABA Risk and Compliance Conference (which also has a certifications reception, by the way) and the ABA AML and Fraud Conference.
If this all sounds like a commercial for the CRCM, it should. Better than nine out of ten CRCMs state that the certification is valuable to them and their careers. So, if you’re not presently a CRCM but are interested in becoming one, what’s the next step?
What does it take to join the party?
First of all, it’s important to note that all the information you’ll need to understand what it will take to obtain (and maintain) the CRCM designation is located on the ABA’s CRCM-dedicated web page at aba.com/crcm. This is the page to bookmark and return to whenever you have questions about qualifications, information about the exam, testing sites, and ongoing requirements to maintain your certification.
Not just anyone can up and decide to become a CRCM. Two distinct requirements must be met before an individual can become a CRCM: relevant professional experience and passing the CRCM examination.
Relevant career experience. Compliance professionals seeking to sit for the CRCM exam must have relevant and appropriate experience in U.S.-based consumer banking laws and regulations. This experience demonstrates that the person has worked in the field for a while; the exam is not a “Rain Man”-style exam where someone could simply memorize all the laws and regulations and expect to pass. They wouldn’t. The exam, as we’ll discuss later, is scenario-based, meaning it doesn’t contain simple questions drawn directly from the laws and regulations that someone who has memorized them could answer correctly. Presenting scenarios is meant to test the individual’s knowledge and skill in handling compliance situations—as anyone who has spent more than about a week in a compliance role can attest, it’s not just about book knowledge; it’s about doing the job. Of course, knowledge of the relevant laws and regulations is essential, but it’s the demonstrated ability of the individual to apply those rules to situations compliance professionals encounter every day that evidences the value of the CRCM certification. You might know the law, but if you have no experience in how to apply it, that’s only half the battle. Banks want to hire compliance professionals who can effectively and accurately apply their knowledge to situations and problems. Anyone can look up a law or regulation online.
The career experience requirements must be fulfilled by the time the individual takes the exam. ABA will accept applications for the exam provided the requirements are met by the time the individual is scheduled to take the exam.
The necessary career experience generally includes “direct compliance risk program management and/or validation of compliance risk control effectiveness,” as stated on ABA’s website. This means the person should have primary responsibility for a full range of compliance risk functions. Typical compliance risk functions may include, for example:
- Performing compliance risk assessments
- Analysis of regulatory-related data (such as HMDA or BSA-related data)
- Management of regulatory audits or examinations
- Developing, implementing, and/or managing aspects of a compliance risk management program to ensure compliance
Typical responsibilities in these sorts of roles must be focused on compliance risk management, and could include (among others):
- Program design, implementation, and/or oversight
- Consultation as a subject-matter expert in compliance matters
- Administration, enforcement, or audit of compliance-related policies, procedures, and processes to manage compliance risk
- Examination of a bank’s compliance program
There is a wide variety of jobs that include these responsibilities. Job titles are not definitive; it is not necessary to have “compliance officer” in your title, for instance. Qualifying positions are typically found within corporate compliance, legal, and/or audit departments, regulatory agencies, or dedicated compliance practices within consulting, audit, or accounting firms. The key is the primary function of the position and its responsibilities rather than the employer.
However, it is important to understand that the individual’s primary role must be managing compliance risk. Executing and working with operational business processes that incorporate compliance risk controls is not considered a function or duty generally performed by a compliance manager as a normal and customary job responsibility and thus does not qualify towards meeting the experience requirement. Tellers, marketing personnel, and loan officers, for example, handle many functions that a wide range of laws and regulations cover, but their primary responsibilities do not involve managing compliance risk, and therefore, experience in those types of positions would not count toward meeting the requirement.
How much career experience do I need? There are two options to meet the experience requirement:
(1) Six or more years of qualifying experience within the last ten years, where three of these six years must be within the last five years; or (2) three years of qualifying experience, plus completion of two of the following compliance-related training options, all within the last five years:
- ABA Foundational Compliance School
- ABA Intermediate Compliance School
- Compliance Professionals Certificates, where the Compliance Essentials, Deposit Compliance, and Lending Compliance Core Concepts OR the Mortgage Lending Compliance certificates must be completed.
- CRCM Exam Online Prep
- ABA In-Bank Compliance School
- Thirty credits (where 1 credit equals 50 minutes) of compliance training directly related to U.S. laws and regulations on the CRCM Examination Outline. These credits may be obtained by attending live or online compliance conferences, seminars, webinars and schools that are directly related to the laws and regulations on the CRCM Examination Outline (more on this later). Training can be sponsored by ABA, other associations, or outside training providers that have had the training approved for CRCM credit, or even your employer.
There are many ways to obtain sufficient credits. For example, attendance at the ABA Risk and Compliance Conference or the ABA AML and Fraud Conference provides up to 20 credits each. Information on ABA’s compliance training opportunities (and credits) is located on ABA’s website.
The exam
The one qualification to become a CRCM that usually causes the most stress is the certification exam. Information about the fee to take the exam is found on ABA’s website. First things first—the basics about the exam are as follows:
It consists of 200 multiple choice questions. Each question has four options, and only one of them is correct (meaning there won’t be any options where two potential answers, or “all of the above,” is the correct answer).
Four hours are provided to complete the exam (but most people don’t need that long. It isn’t a speed-reading exercise).
The topics are randomized within the exam. In other words, questions aren’t grouped by regulation or even subject (e.g., all the deposit questions first, then loans, etc.). After all, this is how your job works, right? You don’t necessarily finish all your deposit work before turning to loans, privacy, BSA, or anything else. Compliance positions typically involve dealing with different topics and issues at different times, just like the exam.
Calculators are provided, but this isn’t a math test; you won’t have to calculate annual percentage rates or solve complicated mathematical equations. In truth, almost all of the math can be done in your head. Remember: Each question has four answer options. If the answer you come up with isn’t one of the choices, you did something wrong!
You’ll find out right away how you did. Instant “pass/fail” outcomes are provided for almost all the computer-based exams taken at test sites (more on the test sites later). Occasionally, instant outcomes may not be provided while statistical analysis is conducted.
Official score reports are delivered via email within six weeks after the close of the window within which you took the exam. You will not receive a report disclosing precisely which questions you got right or wrong.
When can I take the exam? There are six one-month-long windows during which you can sit for the exam: February, April, June, August, and October. The sixth window in December is a partial month. If, in the rare instance, you would need to retake the exam (but that won’t be you since you’ll be more than ready), there must be a minimum of three months between the start date of your most recent window and the start date of your retake window. (This three-month waiting time is based on the start date of the exam window and not the actual date of when you previously took the test.)
Where do I take the exam? Candidates normally take the test at physical test sites located across the country. When you select the date to take the exam, you will also select the test site based on your zip code. The ABA website links to the exam test sites available by state. The test sites are normally open from 8 am to 5 pm during the week, so there is flexibility as to when and where you take the exam.
Candidates must bring a valid form of identification, along with a copy of the confirmation notice (which is emailed to you at the time of registration). It is a closed-book exam, so no notes or other study aids (including your phone or writing crib notes on your hand!) are permitted in the test site itself.
If taking the exam at a test site isn’t feasible, there is a remote option. ABA offers an option of testing at home or another location via live remote proctoring (LRP). But there are important requirements that must be met to utilize this option. You must use a personal computer where you have full administrative access and an internet connection that is not behind a firewall (so a computer connected to your bank’s secure network won’t work). This option is selected at the time of scheduling the exam date, usually 30 days before the start of the exam window. More detailed information about this is available on the ABA website.
How is the exam scored? The exam is a pass/fail endeavor, and the passing score is calculated by using a predetermined cutoff score based on CRCM Advisory Board analysis of the degree of difficulty for each question. This means exams are scored based on your personal performance and are not graded on a curve (since the passing score is predetermined).
The CRCM Advisory Board is made up of experienced industry professionals who volunteer their time to work with ABA to determine the topics and issues to be covered on the exam. They also author many of the questions on the exam, and they vet each one to ensure its validity.
Exam scores are based on the total number of items answered correctly. (In the examination profession, test questions are called “items.”) This means never leave a question blank! Your score is not lowered by incorrect answers, so if you have no idea, at least take a guess. If you leave it blank, you have zero chance of getting the right answer. The total number of items correct is then converted to a scaled score. Since some items are more difficult than others, it’s not just a “get this many right, and you’ll pass” type of test. The exam is scored on a scale ranging from 200 to 800, with the passing score set at 500.
Each exam contains a few randomly embedded questions included for statistical research purposes. These questions do not count against your score. They are “piloting questions,” which are evaluated as part of ABA’s efforts in continuous quality improvement.
How are the exam questions structured?
The CRCM exam is designed to reflect the real‑world responsibilities of compliance professionals, focusing not just on regulatory knowledge, but on how that knowledge is applied in practice. The outline emphasizes how compliance managers assess risk, interpret regulatory requirements, and make informed decisions in support of the organization. The exam is not merely knowledge regurgitation. This is why the experience requirement is so critical. Most questions are phrased in the form of scenarios; your job is to determine the best action to take based on what is presented in the scenario by using your knowledge of the compliance point being tested.
Domains and tasks. The test covers the types of functions and tasks a compliance professional typically does to do the job. These are grouped into three “Domains,” which are as follows, along with the percentage of the exam each Domain covers:
Domain 1: Core Compliance (deep, role critical expertise) 37%
Domain 2: Foundational Compliance (broad, cross-disciplinary knowledge) 37%
Domain 3: Compliance Management System (CMS) 26%
The CRCM exam outline distinguishes between core regulations requiring deeper, scenario‑based expertise and foundational rules and guidance that require broad working knowledge. This structure reflects how compliance managers typically encounter and prioritize regulatory issues in practice
Domain 1 reflects the nine regulations that are most central to a compliance manager’s role. These are rules that compliance professionals encounter frequently and that carry significant regulatory risk and are vital to daily operations. Candidates are expected to demonstrate a deeper understanding of these areas. You can expect to see approximately 74 (of the 200 total) questions focused on these regulations.
Domain 2 is divided into primary rules and regulations (18) and ancillary rules and regulations (28). These represent the broader regulatory landscape that compliance professionals must navigate. While these rules may not arise as frequently or carry the same level of institutional risk as core laws and regulations, they remain an important part of a compliance manager’s knowledge base. You should expect to see approximately 74 (of the 200 total) questions in this area as well.
Domain 3 focuses on how compliance professionals operationalize regulatory requirements within an organization. These areas include Governance and Oversight, Compliance Program Components, and Managing Regulatory Expectations. Candidates are expected to demonstrate how they would apply compliance requirements and frameworks in real-world situations, including evaluating risk, communicating findings, and supporting the organization’s overall compliance strategy. Expect to see approximately 52 (of the 200 total) questions in this domain.
Detailed information about the Domains, including the specific laws and regulations covered by each, is found on the CRCM Exam Content Outline, found online on ABA’s website.
What laws and regulations are covered? In total, there are 55 compliance topics referenced in the Outline and thus covered on the exam. They consist of statutes, regulations, bulletins, and guidance from the federal banking agencies. What this also means is that if a topic is not listed on the Outline, it’s not subject to being tested. You won’t be tested on anything having to do with Regulation J, for example. This helps narrow your focus when studying.
Only laws and regulations that are both issued in final form and for which compliance is required are subject to being tested. Exams taken during the February and April windows cover only those laws and regulations with mandatory compliance dates on or before Dec. 31 of the prior year. Exams taken after the April window cover current laws and regulations with mandatory compliance dates on or before March 31 of the current year.
Old rules that have gone away (few as they are!) are also not subject to being tested (so no questions about Regulation Q, for example). Also, only federal laws and regulations are subject to testing. No state laws are included, meaning no Uniform Commercial Code (UCC), California Consumer Privacy Act, or anything similar will be on the exam.
Details like regulatory citations or year enacted also won’t be tested (so you don’t need to know that Regulation Z is 12 CFR 1026, and that it was enacted by the Federal Reserve in 1969). Additionally, banking laws and regulations are full of numbers. Do we need to memorize all of those? Mostly, no, especially those that change every year due to inflation. However, there are some important numbers to remember; for example, Regulation Z’s right of rescission provides for three business days within which to rescind a loan. That is an important number to remember. Think of it this way: is this a number you’d normally be expected to know off the top of your head? If so, you should know it for the exam.
Generally speaking, the content of disclosures is not tested, especially since most banks use document preparation software to produce disclosures. Plus, that would be an incredible amount of material to memorize. But you should know the essential purpose of a particular disclosure as well as its basic makeup. However, timing rules around disclosures are very important, so those are certainly subject to being tested.
Examples of exam questions and a suggested approach
Question: Results of a recent regulatory exam include instances when Regulation E disclosures were not provided within a timely manner. When recommending how to solve this issue, which of the following represents the proper time by which Regulation E disclosures MUST be provided? At the time of account opening, or:
- Before the first EFT occurs
- Along with the first periodic statement
- Within three business days of account opening
- Within three business days of a customer’s request for the EFT service
How might this question be considered? Here is a suggested strategy: first, determine what compliance knowledge is being tested. In this example, the question is asking about timing rules of Regulation E disclosures. As you no doubt recall, Regulation E provides that disclosures must be provided either at the time of account opening or before the first electronic funds transfer (EFT) occurs. Once you identify the compliance fact being tested, you then apply that knowledge to the question being asked. In this example, that’s all it takes; answer “a” is correct.
But exam questions may utilize more detailed scenarios that ask what action(s) should be taken based on applying that compliance knowledge. Here’s another example:
Question: A branch manager finds an unexplained $7,000 cash shortage in Teller #1’s cash drawer. Which of the following actions MUST the bank take?
- File a currency transaction report (CTR) with the IRS
- Discharge teller #1 immediately
- Send a notice of adverse action to the bank’s federal regulator
- File a suspicious activity report (SAR)
Step 1: What compliance knowledge is being tested? We can identify that this is a Bank Secrecy Act (BSA) question, as we see references to CTRs and SARs. The knowledge needed to answer this question is to discern which BSA requirement is applicable in this instance. We know that an unexplained cash shortage is an example of suspicious activity, and the bank should consider whether to file a SAR as a result.
Step 2: Apply that knowledge to the scenario and answer the question posed: what action MUST the bank take? Answer “d,” filing a SAR, is the appropriate action here.
Just to make sure, take a look at the other answer choices and try to eliminate them. There is no need to file a CTR (there is no reportable cash-in or cash-out), and thus, answer “a” is incorrect. The BSA does not require that tellers be fired for shortages (although the bank may do just that; the BSA does not require it), so “b” is incorrect. There is no adverse action requirement applicable here; we’re not dealing with a credit transaction or a consumer report, so “c” is also wrong.
Even if you can only eliminate two of the four choices, your odds increase from 25 percent to 50/50 if you’re simply guessing.
Preparing for and taking the exam: Suggestions
Everyone has their own best practices for studying and preparing for an intense test like the CRCM exam. What might work for one person may not be the best for another. But the following are some suggestions on ways to approach the exam, as well as advice during the test itself.
Put yourself in the proper mindset. Since the CRCM exam covers such a wide variety of topics across the spectrum of compliance, a common concern is that compliance professionals from larger banks may have an advantage over those from smaller banks, or vice versa. Large bank compliance officers may focus on a narrow part of the compliance universe, whereas small bank compliance officers often have responsibility over a wider variety of topics. Which is better? The answer is neither. The exam is not structured, nor the questions phrased, to benefit individuals coming from any size institution (or even necessarily a bank at all). When preparing for the exam, think of yourself as the chief compliance officer of a midsize bank (such as a large community bank, for instance). That way, you’ll be in the mindset of a compliance professional who has oversight responsibility over the broad range of topics tested, as well as being responsible for the bank’s compliance management system, or CMS.
Suspend your reality. It says suspend your reality, not suspend reality! What’s the difference? Everyone’s background and experiences are different, and banks are notorious for using different terms and names for various products, services, and processes. For example, your bank may have a preapproval program for home mortgage loans. Does that mean these preapprovals are always HMDA-reportable? It depends; HMDA defines a reportable preapproval in a very specific way. Just because your bank calls its program a “preapproval” doesn’t automatically make it HMDA-reportable. Be sure you understand terminology used in the laws and regulations, and don’t assume your bank always uses the same meaning.
Coverage and definitions. Speaking of terminology, one of the best uses of your study time is to understand the coverage of each law and regulation, and definitions within them. Each law or regulation has its own specific coverage rules (product, service, customer, etc.) and exemptions. Knowing these inside and out goes a long way to knowing what applies in what situation. It’s a great baseline. For example, if a question is asking about a commercial loan and an answer or two refers to a Regulation Z requirement, you know those are wrong right away, since Regulation Z applies only to consumer credit. You’ll discover knowledge about coverage goes a long way.
Similarly, definitions are often the bane of a compliance professional’s existence. The same term can mean something quite different in various rules. Take the terms “consumer,” “transaction,” “business day,” “dwelling,” “interest,” and many others. Knowing what these terms mean within the context of each individual rule helps greatly to get it right.
Consider supplemental training. There are a number of sources out there to assist with studying for the exam. If you’ve attended an ABA compliance school (especially the Foundational School), those materials are an excellent source of information about many of the topics. The ABA also offers the Reference Guide to Regulatory Compliance, which is an extremely detailed treatise on all matters of compliance, in outline form. There are also questions and answers about each topic. (Note that the Reference Guide is not intended as a specific CRCM study aid; there are many topics in the Reference Guide that are not subject to being tested on the exam.
ABA offers the CRCM Exam Online Prep course, which helps exam candidates prepare by building the knowledge and skills required across all three domains of the CRCM exam. Aligned to the current exam content outline, the course combines in-depth instruction on key regulations, foundational compliance concepts, and practical compliance management system (CMS) applications. Candidates can reinforce their learning through review questions, flashcards, interactive games, and full-length practice exams designed to assess knowledge, identify study gaps, and build exam-day confidence. This resource provides a comprehensive and efficient path to preparing for the CRCM exam while strengthening the expertise needed to succeed in today’s complex regulatory environment. One note of caution: there are third-party firms that purport to sell CRCM study courses, but they are in no way affiliated with ABA, and they should be treated as such.
Studying for the exam. Again, there is no right way that works best for everyone. Some (but not many) people learn best from reading laws and regulations. Others would rather listen to recordings, and still others learn best from taking sample test questions. Maybe a small study group would be beneficial to quiz each other and bounce ideas off your fellow test-takers. Figure out what works best for you and don’t worry if it’s not the same for someone else. Understand your weaknesses, or those topics you might not have had much exposure to during your career and focus on those topics.
Taking the exam. It may have been a long time since you took a standardized test like this one, and the thought of it can be intimidating. There are 200 questions on the exam, which is a lot, and four hours doesn’t seem like enough time, right? You may be surprised to know that the vast majority of test-takers do not need the entire time. But there has to be a limit, or some people would take all day if you gave it to them. Others will take every last available minute reviewing and re-reviewing their answers. If this is your strategy, that’s perfectly fine. Do what’s best for you. The sample questions above are representative of the length of a typical question, so as you can see, you shouldn’t have to worry about getting through them all in the time allotted.
Even though the question topics are randomized, you can skip around from question to question. You don’t have to answer one question to move on to the next. If you want to skip question #78 and come back to it later, you can do that. You can also change your answers before you submit them all; you don’t have only one chance to submit an answer.
If you are the type to review and re-review your answers, remember the old test-taking adage: your first instinct is often the correct one. Try not to overthink things. Believe it or not, the CRCM exam is not filled with trick questions designed to fool the test-taker. Important terms within the questions are often CAPITALIZED so you won’t miss them. And don’t worry about acronyms; those that aren’t very common will be spelled out, but at this point if you don’t know what HMDA, RESPA, BSA and others like this mean, you shouldn’t be taking the exam in the first place!
One other note: don’t leave your common sense at the door. Some questions ask what you should do FIRST when presented with a scenario, or what is the BEST next step. Again, don’t overthink it: what would you really do first? Trust your instincts and experience, and don’t always go with what sounds like the most complex answer (so therefore it must be the right one!).
Lastly, get a good night’s sleep the night before the exam. By that time, you’ll have expended many hours studying and preparing. One more all-nighter isn’t going to make the difference; in fact, it might make it worse if you show up at the test center on 5 cups of coffee just to stay awake.
Maintaining your CRCM
The CRCM certification is not just a one-time qualification and test. To maintain your CRCM, there are ongoing requirements:
- Sixty continuing education (CE) credits every three years
- Payment of an annual fee (annual fee notices are emailed each October)
- Adherence to the Professional Code of Ethics.
There are various ABA programs that have been pre-approved for CRCM CE credits, including certificates, online courses, training shorts, webinars, and conferences/schools. But that is not the only way to obtain CE credits; in fact, many of the training options that fulfill the initial requirement to sit for the exam will also qualify for CE credit. Information about CE requirements is detailed on ABA’s website.
Ready to take the plunge? Obtaining your CRCM designation is one of the most beneficial steps you can take in your compliance career. Nearly 1,000 people each year take the CRCM exam; this is a testament to its value. If you feel it is right for you, determine if you meet the qualifications, then study hard and pass the exam. Good luck!
CARL PRY, CRCM, CRP, senior advisor for Asurity in Washington, D.C. and Founder of PryHart Compliance Services, Inc., advises clients on a wide variety of compliance, fair lending, corporate treasury, and risk management issues. Over the last 30-plus years, Pry has held senior leadership positions, including Managing Director at Treliant, LLC, senior vice president and compliance manager for compliance and control at KeyBank in Cleveland, Ohio; vice president of regulatory services at Kirchman Corp. in Orlando; and manager in the Finance and Performance Management Service Line at Accenture in Chicago, Ill. He also serves as co-chair of the Editorial Advisory Board for ABA Bank Compliance magazine. Reach him via email at [email protected] or by telephone at (440) 320-4662.
