So you want to be a CRCM?

By Carl Pry, CRCM, CRP

Many of you loyal readers of ABA Risk and Compliance magazine have obtained the Certified Regulatory Compliance Manager, or CRCM, designation at some point in your careers. And congratulations for doing so—you’ve joined an exclusive club of over 6,200 of your fellow CRCMs who benefit from the banking compliance industry’s premier compliance designation.

But those of you who are not yet CRCMs may be interested in what it is all about. What are the benefits? What does it take to become one? And what about the CRCM examination? Is it really difficult? Here, we’ll explore the answers to all those questions so you can confidently pursue your CRCM with all the tools you’ll need to succeed.

Benefits of the CRCM

The CRCM is the banking compliance industry’s premier credential that sets the standard of professional expertise in the field. Obtaining and maintaining the CRCM designation benefits not only you and your career, but also your employer.

The CRCM is clear evidence that you have attained the skills and possess the knowledge to stay current in the increasingly complex banking compliance field. It is evidence that you have taken the time necessary to study, prepare, and maintain a level of expertise that sets you apart from others in the field.

It is also a career enhancer. Many job listings in the compliance field either require or strongly prefer CRCMs, so your next career move could certainly be enhanced by those four letters after your name. It shows potential employers that you are not new to the field, and that you have a strong grasp on an extremely broad field of expertise in banking laws and regulations. It also shows your current employer that you’re dedicated to achieving a recognized level of excellence in compliance, which can’t hurt when it comes to future opportunities.

There are many instances where regulators are interested in how many CRCMs are employed within a bank’s compliance-related functions, and in some cases, they have recommended the institution look into pursuing certification for more of its employees. It’s not only the quantity of individuals within a bank’s compliance function, but the level of expertise they bring. Having CRCMs in critical compliance functions validates the bank’s dedication to employing expert, qualified professionals dedicated to mitigating compliance risk.

There are other perks of being a CRCM, including a free electronic subscription to this magazine (great if you’re presently paying for it as a non-CRCM!) and discounts to certain conferences like the ABA Risk and Compliance Conference (which also has a CRCM-only reception, by the way) and the ABA/ABA Financial Crimes Enforcement Conference.

If this all sounds like a commercial for the CRCM, it should. Better than nine out of ten CRCMs state the certification is valuable to them and their careers. So, if you’re not presently a CRCM but are interested in becoming one, what’s the next step?

What does it take to join the party?

First of all, it’s important to note that all the information you’ll need to understand what it will take to obtain (and maintain) the CRCM designation is located on the ABA’s CRCM-dedicated web page, at aba.com/crcm. This is the page to bookmark and return to whenever you have questions about qualifications, information about the exam, testing sites, and ongoing requirements to maintain your certification.

Not just anyone can up and decide to become a CRCM. There are two distinct requirements that must be met before an individual can become a CRCM: relevant professional experience and passing the CRCM examination.

Relevant career experience. Compliance professionals seeking to sit for the CRCM exam must have relevant and appropriate experience in U.S.-based consumer banking laws and regulations. This experience demonstrates that the person has worked in the field for a while; the exam is not a “Rain Man”-style exam where someone could simply memorize all the laws and regulations and expect to pass. They wouldn’t. The exam, as we’ll discuss later, is scenario-based, meaning it doesn’t contain simple questions drawn directly from the laws and regulations that someone who has memorized them could answer correctly. Presenting scenarios is meant to test the individual’s knowledge and skill in handling compliance situations—as anyone who has spent more than about a week in a compliance role can attest, it’s not just about book knowledge. It’s about doing the job. Of course, knowledge of the relevant laws and regulations is essential, but it’s the demonstrated ability of the individual to apply those rules to situations compliance professionals encounter every day that evidences the value of the CRCM certification. You might know the law, but if you have no experience in how to apply it, that’s only half the battle. Banks want to hire compliance professionals that can effectively and accurately apply their knowledge to situations and problems. Anyone can look up a law or regulation online.

The career experience requirements must be fulfilled by the time the individual sits for the exam. ABA will accept applications for the exam provided the requirements are met by the time the individual is scheduled to take the exam.

The necessary career experience generally includes “direct compliance risk program management and/or validation of compliance risk control effectiveness,” as stated on ABA’s website. This means the person should have primary responsibility for a full range of compliance risk functions. Typical compliance risk functions may include, for example:

• Performing compliance risk assessments
• Analysis of regulatory-related data (such as HMDA or BSA-related data)
• Management of regulatory audits or examinations
• Developing, implementing, and/or managing aspects of a compliance risk management program to ensure compliance

Typical responsibilities in these sorts of roles must be focused on compliance risk management, and could include (among others):

• Program design, implementation, and/or oversight
• Consultation as a subject-matter expert in compliance matters
• Administration, enforcement, or audit of compliance-related policies, procedures, and processes to manage compliance risk
• Examination of a bank’s compliance program

There is a wide variety of jobs that include these responsibilities. Job titles are not definitive; it is not necessary to have “compliance officer” in your title, for instance. Qualifying positions are typically found within corporate compliance, legal, and/or audit departments, regulatory agencies, or dedicated compliance practices within consulting, audit, or accounting firms. The key is the primary function of the position and its responsibilities rather than the employer.

However, it is important to understand the individual’s primary role must be managing compliance risk. Executing and working with operational business processes that incorporate compliance risk controls is not considered a function or duty generally performed by a compliance manager as a normal and customary job responsibility, and thus does not qualify towards meeting the experience requirement. Tellers, marketing personnel, and loan officers, for example, handle many functions that a wide range of laws and regulations cover, but their primary responsibilities do not involve managing compliance risk, and therefore experience in those types of positions would not count toward meeting the requirement.

How much career experience do I need? There are two options to meet the experience requirement:

(1) Six or more years of qualifying experience within the last ten years, where three of these six years must be within the last five years; or (2) three years of qualifying experience, plus completion of two of the following compliance-related training options, all within the last five years:

• ABA Foundational Compliance School
• ABA Intermediate Compliance School
• Compliance Professionals Certificates, where the Compliance Essentials, Deposit Compliance, and Lending Compliance Core Concepts OR the Mortgage Lending Compliance certificates must be completed.
• CRCM Exam Online Prep
• ABA In-Bank Compliance School
• Thirty credits (where 1 credit equals 50 minutes) of compliance training directly related to U.S. laws and regulations on the CRCM Examination Outline. These credits may be obtained by attending live or online compliance conferences, seminars, webinars and schools that are directly related to the laws and regulations on the CRCM Examination Outline (more on this later). Training can be sponsored by ABA, other associations, or outside training providers that have had the training approved for CRCM credit, or even your employer.

There are many ways to obtain sufficient credits. For example, attendance at the ABA Risk and Compliance Conference or the ABA/ABA Financial Crimes Enforcement Conference provides up to 20 credits each. Information on ABA’s compliance training opportunities (and credits) is located on ABA’s website.

The exam

The one qualification to become a CRCM that usually causes the most stress is the certification exam. Information about the fee to take the exam is found on ABA’s website. First things first—the basics about the exam are as follows:

It consists of 200 multiple choice questions. Each question has four options, and only one of them is correct (meaning there won’t be any options where two potential answers, or “all of the above,” is the correct answer).

Four hours are provided to complete the exam (but most people don’t need that long. It isn’t a speed-reading exercise).

The topics are randomized within the exam. In other words, questions aren’t grouped by regulation or even subject (e.g., all the deposit questions first, then loans, etc.). After all, this is how your job works, right? You don’t necessarily finish all your deposit work before turning to loans, privacy, BSA, or anything else. Compliance positions typically involve dealing with different topics and issues at different times, just like the exam.

Calculators are provided (but this isn’t a math test; you won’t have to calculate annual percentage rates or solve complicated mathematical equations. In truth, almost all the math can be done in your head). Remember: Each question has four answer options. If the answer you come up with isn’t one of the choices, you did something wrong!

You’ll find out right away how you did. Instant “pass/fail” outcomes are provided for almost all of the computer-based exams taken at test sites (more on the test sites later). Occasionally, instant outcomes may not be provided while statistical analysis is conducted.

Official score reports are delivered via email within six weeks after the close of the window within which to take the exam. You will not receive a report disclosing precisely which questions you got right or wrong.

When can I take the exam? There are six windows of time, each a month long, available each year in which to take the exam: February, April, June, August, October and December (note: Only from Dec. 1 to 16). If, in the rare instance that you would need to retake the exam (but that won’t be you since you’ll be more than ready), there must be a minimum of three months between the start date of your most recent window and the start date of your retake window. (This three-month waiting time is based on the start date of the exam window and not the actual date of when you previously took the test.)

Where do I take the exam? Candidates normally take the test at physical test sites located across the country. When you select the date to take the exam, you will also select the test site based on your zip code. A listing of test sites is located on ABA’s website. There are hundreds of these sites across the country; it’s highly likely you’ll be able to find one that is so not far away that you’d have to take a flight or drive for ten hours just to take the test. The test sites are normally open from 8 am to 5 pm during the week, so there is flexibility as to when and where you take the exam.

Candidates must bring a valid form of identification, along with a copy of the confirmation notice (which is emailed to you at the time of registration). It is a closed-book exam, so no notes or other study aids (including your phone or writing crib notes on your hand!) are permitted in the test site itself.

If taking the exam at a test site isn’t feasible, there is a remote option. ABA offers an option of testing at home or another location via live remote proctoring (LRP). But there are important requirements that must be met to utilize this option. You must use a personal computer where you have full administrative access and an internet connection that is not behind a firewall (so a computer connected to your bank’s secure network won’t work). This option is selected at the time of scheduling the exam date, usually 30 days before the start of the exam window. More detailed information about this is available on the ABA website.

How is the exam scored? The exam is a pass/fail endeavor, and the passing score is calculated by using a predetermined cutoff score based on CRCM Advisory Board analysis of the degree of difficulty for each question. This means exams are scored based on your personal performance and are not graded on a curve (since the passing score is predetermined).

The CRCM Advisory Board is made up of experienced industry professionals who volunteer their time to work with ABA to determine the topics and issues to be covered on the exam. They also author many of the questions on the exam, and they vet each one to ensure its validity.

Exam scores are based on the total number of items answered correctly. (In the examination profession, test questions are called “items.”) This means never leave a question blank! Your score is not lowered by incorrect answers, so if you have no idea, at least take a guess. If you leave it blank, you have zero chance of getting the right answer. The total number of items correct is then converted to a scaled score. Since some items are more difficult than others, it’s not just a “get this many right and you’ll pass” type of test. The exam is scored on a scale ranging from 200 to 800, with the passing score set at 500.

Each exam contains a few randomly embedded questions included for statistical research purposes. These questions do not count against your score. They are “piloting questions,” which are evaluated as part of ABA’s efforts in continuous quality improvement.

How are the exam questions structured?

As emphasized above, the exam is not merely about knowledge regurgitation. This is why the experience requirement is so critical. Most questions are phrased in the form of scenarios; your job is to determine the best action to take based on what is presented in the scenario by using your knowledge of the compliance point being tested.

Domains and tasks. The test covers the types of functions and tasks a compliance professional typically does to do the job. These are grouped into six “Domains,” which are as follows:

• Assessment and Management of Compliance Risk
• Compliance Monitoring
• Governance and Oversight
• Regulatory Change Management
• Regulator and Auditor Compliance Management
• Compliance Analysis and Internal/External Reporting

Each of these six domains is made up of a number of tasks. For example, one of the tasks under the Assessment and Management of Compliance Risk domain is “Act as a compliance subject matter expert on projects and committees.” One of the tasks within the Regulatory Change Management domain is “Monitor and validate action plans for confirmed regulatory impacts to ensure timely adherence to the mandatory compliance date.” In all, there are 30 tasks within these six domains. These tasks and domains serve to encompass what a compliance professional typically does, and thus also serve as the basis for the scenarios you’ll see in the exam. Detailed information about these domains and tasks, along with the knowledge required to perform the tasks, is found on the CRCM Examination Outline, found online on ABA’s website.

What laws and regulations are covered? In total, there are 59 total topics on the Outline, and thus covered on the exam. They consist of statutes, regulations, bulletins, and guidance from the federal banking agencies. They are grouped into three tiers, which correspond to their relative importance (Tier 1 is more critical than Tier 2, which is more critical than Tier 3, etc.). This means to expect more questions about topics in Tier 1 than in Tier 2, and so forth. (See important resource links at the top of this article.] What this also means is that if a topic is not listed on the Outline, it’s not subject to being tested. You won’t be tested on anything having to do with Regulation J, for example. This helps narrow your focus when studying.

Only laws and regulations that are both issued in final form and where compliance is required are subject to being tested. For example, even though the regulatory agencies issued new Community Reinvestment Act (CRA) regulations in October 2023, compliance is not required until 2026 at the earliest; thus, there won’t be questions on the exam about them in 2024 or 2025. Exams taken during the February and April windows cover only those laws and regulations with mandatory compliance dates on or before Dec. 31 of the prior year. Exams taken after the April window cover current laws and regulations with mandatory compliance dates on or before March 31 of the current year.

Old rules that have gone away are also not subject to being tested (so no questions about Regulation Q, for example). Also, only federal laws and regulations are subject to testing. No state laws are included, meaning no Uniform Commercial Code (UCC), California Consumer Privacy Act, or anything similar will be on the exam.

Details like regulatory citations or year enacted also won’t be tested (so you don’t need to know that Regulation Z is 12 CFR 1026, and it was enacted by the Federal Reserve in 1969). Additionally, banking laws and regulations are full of numbers. Do we need to memorize all those? Mostly, no, especially those that change every year due to inflation. However, there are some important numbers to remember; for example, Regulation Z’s right of rescission provides for three business days within which to rescind a loan. That is an important number to remember. Think of it this way: is this a number you’d normally be expected to know off the top of your head? If so, you should know it for the exam.

Generally speaking, the content of disclosures is not tested, especially since most banks use document preparation software to produce disclosures. Plus, that would be an incredible amount of material to memorize. But you should know the essential purpose of a particular disclosure as well as its basic makeup. However, timing rules around disclosures are very important, so those are certainly subject to being tested.

Examples of exam questions and a suggested approach

Question: Results of a recent regulatory exam include instances when Regulation E disclosures were not provided within a timely manner. When recommending how to solve this issue, which of the following represents the proper time by which Regulation E disclosures MUST be provided? At the time of account opening, or:

A. Before the first EFT occurs

B. Along with the first periodic statement

C. Within three business days of account opening

D. Within three business days of a customer’s request for the EFT service

How might this question be considered? Here is a suggested strategy: first, determine what compliance knowledge is being tested. In this example, the question is asking about timing rules of Regulation E disclosures. As you no doubt recall, Regulation E provides that disclosures must be provided either at the time of account opening or before the first electronic funds transfer (EFT) occurs. Once you identify the compliance fact being tested, you then apply that knowledge to the question being asked. In this example, that’s all it takes; answer “a” is correct.

But exam questions may utilize more detailed scenarios that ask what action(s) should be taken based on applying that compliance knowledge. Here’s another example:

Question: A branch manager finds an unexplained $7,000 cash shortage in Teller #1’s cash drawer. Which of the following actions MUST the bank take?

A. File a currency transaction report (CTR) with the IRS

B. Discharge teller #1 immediately

C. Send a notice of adverse action to the bank’s federal regulator

D. File a suspicious activity report (SAR)

Step 1: What compliance knowledge is being tested? We can identify that this is a Bank Secrecy Act (BSA) question, as we see references to CTRs and SARs. The knowledge needed to answer this question is to discern which BSA requirement is applicable in this instance. We know that an unexplained cash shortage is an example of suspicious activity, and the bank should file as SAR as a result.

Step 2: Apply that knowledge to the scenario and answer the question posed: what action MUST the bank take? Answer “d,” filing a SAR, is the appropriate action here.

Just to make sure, take a look at the other answer choices and try to eliminate them. There is no need to file a CTR (there is no reportable cash-in or cash-out), and thus answer “a” is incorrect. The BSA does not require that tellers be fired for shortages (although the bank may do just that, the BSA does not require it), so “b” is incorrect. There is no adverse action requirement applicable here; we’re not dealing with a credit transaction or a consumer report, so “c” is also wrong.

Even if you can only eliminate two of the four choices, your odds increase from 25 percent to 50/50 if you’re simply guessing.

Preparing for and taking the exam: Suggestions

Everyone has their own best practices for studying and preparing for an intense test like the CRCM exam. What might work for one person may not be the best for another. But the following are some suggestions on ways to approach the exam, as well as advice during the test itself.

Put yourself in the proper mindset. Since the CRCM exam covers such a wide variety of topics across the spectrum of compliance, a common concern is that compliance professionals from larger banks may have an advantage over those from smaller banks, or vice versa. Large bank compliance officers may focus on a narrow part of the compliance universe, whereas small bank compliance officers often have responsibility over a wider variety of topics. Which is better? The answer is neither. The exam is not structured, or the questions phrased, to benefit individuals coming from any size institution (or even necessarily a bank at all). When preparing for the exam, think of yourself as the chief compliance officer of a midsize bank (such as a large community bank, for instance). That way, you’ll be in the mindset of a compliance professional who has oversight responsibility over the broad range of topics tested, as well as being responsible for the bank’s compliance management system, or CMS.

Suspend your reality. It says suspend your reality, not suspend reality! What’s the difference? Everyone’s background and experiences are different, and banks are notorious for using different terms and names for various products, services, and processes. For example, your bank may have a preapproval program for home mortgage loans. Does that mean these preapprovals are always HMDA-reportable? It depends; HMDA defines a reportable preapproval in a very specific way. Just because your bank calls its program a preapproval doesn’t automatically make it HMDA-reportable. Be sure you understand terminology used in the laws and regulations, and don’t assume your bank always uses the same meaning.

Coverage and definitions. Speaking of terminology, one of the best uses of your study time is to understand the coverage of each law and regulation, and definitions within them. Each law or regulation has its own specific coverage rules (product, service, customer, etc.) and exemptions. Knowing these inside and out goes a long way to knowing what applies in what situation. It’s a great baseline. For example, if a question is asking about a commercial loan and an answer or two refers to a Regulation Z requirement, you know those are wrong right away, since Regulation Z applies only to consumer credit. You’ll discover knowledge about coverage goes a long way.

Similarly, definitions are often the bane of a compliance professional’s existence. The same term can mean something quite different in various rules. Take the terms “consumer,” “transaction,” “business day,” “dwelling,” “interest,” and many others. Knowing what these terms mean within the context of each individual rule helps greatly to get it right.

Consider supplemental training. There are a number of sources out there to assist with studying for the exam. If you’ve attended an ABA compliance school (especially the Foundational School), those materials are an excellent source of information about many of the Tier 1 topics. The ABA also offers the Reference Guide to Regulatory Compliance, which is an extremely detailed treatise on all matters of compliance, in outline form. There are also questions and answers about each topic. (The Reference Guide is not intended as a specific CRCM study aid; there are many topics in the Reference Guide that are not subject to being tested on the exam.)

ABA also offers a specific online CRCM prep course, which has short presentations and videos on each of the 59 topics (I’ve heard the presenter of those videos is fantastic, by the way … ), presentations on preparing and studying for the exam, as well as a number of practice questions and sample exams. You may have additional materials from other schools, conferences, and seminars that may be useful as well. One note of caution: there are third-party firms that purport to sell CRCM study courses, but they are in no way affiliated with ABA, and they should be treated as such.

Studying for the exam. Again, there is no right way that works best for everyone. Some (but not many) people learn best from reading laws and regulations. Others would rather listen to recordings, and still others learn best from taking sample test questions. Maybe a small study group would be beneficial, to quiz each other and bounce ideas off your fellow test-takers. Figure out what works best for you and don’t worry if it’s not the same for someone else. Understand your weaknesses, or those topics you might not have had much exposure to during your career, and focus on those.

Taking the exam. It may have been a long time since you took a standardized test like this one, and the thought of it can be intimidating. There are 200 questions on the exam, which is a lot, and four hours seems like not enough time, right? You may be surprised to know that the vast majority of test-takers do not need the entire time. But there has to be a limit or some people would take all day if you gave it to them. Others will take every last available minute reviewing and re-reviewing their answers. If this is your strategy, that’s perfectly fine. Do what’s best for you. The sample questions above are representative of the length of a typical question, so as you can see, you shouldn’t have to worry about getting through them all in the time allotted.

Even though the question topics are randomized, you can skip around from question to question. You don’t have to answer one question to move on to the next. If you want to skip question #78 and come back to it later, you can do that. You can also change your answers before you submit them all; you don’t have only one chance to submit an answer.

If you are the type to review and re-review your answers, remember the old test-taking adage: your first instinct is often the correct one. Try not to overthink things. Believe it or not, the CRCM exam is not filled with trick questions designed to fool the test-taker. Important terms within the questions are often CAPITALIZED so you won’t miss them. And don’t worry about acronyms; those that aren’t very common will be spelled out, but at this point if you don’t know what HMDA, RESPA, BSA and others like this mean, you shouldn’t be taking the test in the first place!

One other note: don’t leave your common sense at the door. Some questions ask what you should do first when presented with a scenario, or what is the best next step. Again, don’t overthink it: what would you really do first? Trust your instincts and experience and don’t always go with what sounds like the most complex answer (so therefore it must be the right one!).

Lastly, get a good night’s sleep the night before the exam. By that time, you’ll have expended many hours studying and preparing. One more all-nighter isn’t going to make the difference; in fact, it might make it worse if you show up at the test center on 5 cups of coffee just to stay awake.

Maintaining your CRCM

The CRCM certification is not just a one-time qualification and test. To maintain your CRCM, there are ongoing requirements:

• Sixty continuing education (CD) credits every three years
• Payment of an annual fee (annual fee notices are emailed each October)
• Adherence to the Professional Code of Ethics.

There are various ABA programs that have been pre-approved for CRCM CE credits, including certificates, online courses, training shorts, webinars, and conferences/schools. But that is not the only way to obtain CE credits; in fact, many of the training options that fulfill the initial requirement to sit for the exam will also qualify for CE credit. Information about CE requirements are detailed on ABA’s website.

Ready to take the plunge? Obtaining your CRCM designation is one of the most beneficial steps you can take in your compliance career. Close to 1,000 people each year take the CRCM exam; this is testament to its value. If you feel it is right for you, determine if you meet the qualifications, then study hard and pass the exam. Good luck!

CARL PRY, CRCM, CRP, senior advisor for Asurity in Washington, D.C., advises clients on a wide variety of compliance, fair lending, corporate treasury, and risk management issues. Over the last nearly 30 years, Pry has held senior leadership positions including senior vice president and compliance manager for compliance and control at Key Bank in Cleveland, Ohio; vice president of regulatory services at Kirchman Corp. in Orlando; and manager in the Finance and Performance Management Service Line at Accenture in Chicago, Ill. He also serves as chair of the Editorial Advisory Board for ABA Bank Compliance magazine. Reach him via email at [email protected] or by telephone at (440) 320-4662.