The Consumer Financial Protection Bureau (CFPB) recently issued a final rule § 1033.121(c) supporting open banking and personal financial data rights. Under this ruling, banks, credit unions, credit card issuers, and other financial service providers must enhance consumer access to personal financial data.

The first compliance deadline of April 1, 2026, impacts the largest organizations.

• The ruling demands action from all non-depository firms (e.g., institutions that issue credit cards, hold transaction accounts, issue devices to access an account, or provide other types of payment facilitation products or services). The compliance deadline, however, depends on the firm’s total receipts from calendar years 2023 and 2024.
  • April 1, 2026: $10B+ total receipts in either calendar year
  • April 1, 2027: <$10B total receipts in both calendar years
• The ruling also impacts depository institutions that hold at least $850 million in total assets. Compliance deadlines follow a staggered rollout based on total assets.
  • April 1, 2026: $250B+ total assets
  • April 1, 2027: $10B to <$250B total assets 
  • April 1, 2028: $3B to <$10B total assets
  • April 1, 2029: $1.5B to <$3B total assets
  • April 1, 2030: $850M to <$1.5B total assets

Accelerating the shift to open banking with 1033 

Open banking changes how financial data is shared and accessed, giving customers more control of their information. The 1033 Personal Financial Data Rights rule ensures that:

• Personal financial data is made available to consumers and agents at no charge
• Data is exchanged through a safe, secure, and reliable digital interface
• Consumers aren’t surprised with hidden or unexpected charges when accessing their personal financial data
• Consumers can walk away from bad financial services and products
• Safeguards protect consumers and financial firms from surveillance, data misuse, and risky data practices

Open banking is going to do for the banking industry what the introduction of the Apple smart phone did for cell phones.

CFPB 1033 open banking requires financial firms to ease personal financial data access for consumers 

CFPB first proposed the rule in the Federal Register on October 31, 2023, accepted public comments on the regulation though December 29, 2023, then issued its final rule November 18, 2024. This effort carries out the personal financial data rights established by the Consumer Financial Protection Act of 2010 (CFPA).

The final rule § 1033.121(c) “requires banks, credit unions, and other financial service providers to make consumers’ data available upon request to consumers and authorized third parties in a secure and reliable manner; defines obligations for third parties accessing consumers’ data, including important privacy protections; and promotes fair, open, and inclusive industry standards.”  

The implications of the CFPB’s regulation on open banking will be enormous for consumers, banks, and data providers.

Impact on consumers 

Without open banking, consumers struggle to switch between bank deposit and lending offerings. For example, switching checking accounts to one with a better interest rate involves resetting direct deposits and recurring bill-paying, printing new checks, and obtaining a new ATM card. Mistakes resulting in overdrafts are costly, both financially and to one’s credit score and reputation.   

As a result, larger banks have a much smaller net interest margin, as shown in the chart below:

In addition, the stickiness of deposits causes a considerable lag between when a bank raises deposit rates and when deposit balances increase proportionately. 

As open banking, mandated by Rule 1033, takes effect, consumers will be able to:

• Switch credit cards within seconds while retaining terms and rewards of their current account
• Transfer deposits and multiple years of transaction history into a new checking account  

Impact on data providers 

Data providers, including digital wallet providers, will be able to move on from “screen scraping” and instead provide API-driven real-time balances, transaction history, and reward balances to their retail customers. Of course, providing this “new and improved” service will require re-writing front ends and processing engines to provide the necessary data in a timely manner. 

Impact on banks 

Banks and their affiliates must look toward building an open, larger ecosystem as part of continued digital transformation efforts.

While challenging, this work is necessary for banks that aim to grow revenue through collaboration and cooperation. Ultimately, banks that don’t satisfy their borrowers or lenders will be hard-pressed to compete in the ever-challenging financial landscape.

Navigate 1033 open banking compliance deadlines with confidence 

We encourage leaders to identify mandates’ silver lining opportunities. After all, to remain competitive and compliant, financial services firms must innovate in ways that add business value, meet consumers’ evolving expectations, and build trust. Achieving transformative outcomes and experiences requires a digital strategy that not only satisfies mandates but also aligns the enterprise around a shared vision and actionable KPIs, ultimately keeping customers at the heart of progress.

A holistic approach could include:

• Strategy + Transformation: current-state assessment, future-state roadmap, change management
• Platforms + Technology: pragmatically scalable, composable architecture and automations to accelerate progress
• Data + Intelligence: well-governed “golden source of truth” data and secure integrations/orchestration
• Innovation + Product Development: engineering and design for what’s now, new, and next
• Customer Experience + Digital Marketing: human-centered, journey-based engagement
• Optimized Delivery: Agile methodologies, deep domain expertise, and scalable global teams

Our financial services experts continuously monitor the regulatory landscape and deliver pragmatic, scalable solutions that meet the mandate and more. Discover why we’ve been trusted by 18 of the top 20 banks, 16 of the 20 largest wealth and asset management firms, and are regularly recognized by leading analyst firms.

Ready to explore your firm’s compliance with Rule 1033? Contact us to discuss your specific risk and regulatory challenges.  

On June 6, Acting Comptroller of the Currency, Michael J. Hsu, addressed the 2024 Conference on Artificial Intelligence (AI) and Financial Stability, providing critical regulatory insights on AI. Hsu discussed the systemic risk implications of AI in banking and finance using a “tool or weapon” approach. He noted that while both tools and weapons pose threats to financial stability, they do so in different ways, necessitating distinct analyses. 

In his speech, Hsu emphasized that the rapid adoption of technology during periods of change, without corresponding adjustment in controls, allows risks to grow undetected until they culminate in financial crises. Learning from history, he referenced the lack of regulatory controls in derivatives and financial engineering before the 2008 financial crisis, and more recently, the unregulated growth of cryptocurrencies leading to the “Crypto Winter” of 2022. 

Toll Gates Are Needed 

To avoid repeating such scenarios, of that rather dire history, Hsu advocated for regulators and the industry to proactively identify points where growth and development should pause to ensure responsible innovation and build trust. He argued that well-designed checkpoints could help balance the need for innovation with necessary safeguards to prevent runaway growth. 

The evolution of electronic trading provides a valuable case study to consider. Traditionally, trading was manual. Market making eventually transitioned to phone-based systems, with computers providing real-time information, valuations and forecasts for traders. In time, computers took on a more active role, not only providing information but also assisting and guiding traders’ actions, supporting faster execution and more complex strategies. Eventually, algorithms took over entirely, automatically buying and selling securities according to pre-determined instructions without the need for human intervention.  

Using the evolution of electronic trading as a reference, Hsu outlined three phases in its history:   

1. Inputs: Computers provided information for human traders to consider. 
2. Co-pilots: Software supported and enabled traders to operate more efficiently and swiftly.  
3. Agents: Computers executed trades autonomously based on algorithms programmed by software developers.  

Understanding the Different AI Phases 

Hsu highlighted that each phase requires different risk management strategies and controls. For example, mitigating the risk of flash crashes—exacerbated by algorithmic trading—demands more sophisticated controls than those needed when traders are simply receiving information on a computer screen and execute trades manually. 

Artificial Intelligence (AI) is following a similar evolutionary path: initially producing inputs for human decision-making, then acting as a co-pilot to enhance human actions, and finally becoming an agent that makes decisions independently on behalf of humans. As AI progresses from an input provider to a co-pilot and ultimately to an autonomous agent, the risks and potential negative consequences of weak controls increase significantly. 

For banks interested in adopting AI, establishing clear and effective gates between each phase can help ensure that innovations are beneficial rather than harmful. Before advancing to the next phase of development, banks should ensure that proper controls are in place and accountability is clearly established for the new phase being entered.  

Your Expert Partner

Acting Comptroller Hsu’s advocacy for a robust control environment mirrors the guidance provided in the 2021 Supervisory Letter from the OCC, which we discussed in our blog OCC Provides Roadmap for National Banks and Savings Associations To Conduct Crypto Activities.

If you are interested in establishing a new relationship with Perficient or strengthening an existing one, our financial services regulatory, risk and controls, and AI subject matter experts are available to help. We can work with you to enhance your control environment and design checkpoints to ensure your firm remains well-regulated.   

Contact us today to discuss your specific needs. 

YOU MAY ALSO ENJOY:  

Azure GPT-4 Analysis of the New CRA: Part 1 

Azure GPT-4 Analysis of the New CRA: Part 2 

Our banking risk and regulatory experts are excited to attend the upcoming XLoD Global event in New York on June 11th.  

What is XLoD Global? 

The world’s leading financial institutions and regulators come together at XLoD to discuss the future of non-financial risk and control. Representatives from all three lines of defense—operational management, risk management/compliance, and internal audit—attend to present, discuss, and learn about industry shifts that are impacting risk and regulatory compliance.

Sessions include a keynote interview with former FBI director James B. Comey as well as topical discussions spanning regulatory risk, market abuse, and leveraging technology in automation (RPA), data analytics and ML/AI.

Understanding the Industry: Risk & Regulatory Themes We’re Tracking

LinkedIn | Blogs

Carl Aridas, a seasoned compliance expert and leader of Perficient’s Banking Risk and Regulatory Center of Excellence (CoE), remembers when a couple risk policies—mandatory two consecutive weeks away from the office and basic dual control procedures—were cutting-edge. The landscape has evolved, and organizations must maintain pace.

Many banking firms that are operating with multiple legacy systems are curious about implementing new AI technologies. They want to know how AI and machine learning can enhance the capabilities of compliance, legal, and risk professionals in managing non-financial risk. 

He looks forward to the session, “Harnessing AI & Cutting-edge Technology for Enhanced Risk Detection,” and also plans to attend “Harmonization and Integration of NFR frameworks.” With extensive experience designing and implementing NFR frameworks for major banks, Aridas is going to be a keenly attuned to this discussion. 

LinkedIn

Chandni Patel, one of our financial services digital assets team leaders, is also eager for the conference. As a risk expert, Patel is especially excited about attending the keynote address by Mihaela Nistor, chief risk officer at the Federal Reserve Bank of New York. 

Throughout her career, Patel has been approached by many financial services executives facing fines and regulatory issues related to monitoring trading activities. She is excited to attend “Surveillance of WhatsApp and Social Media,” and hear how technology data insights and sentiment analysis can mitigate conduct risk and enable proactive market abuse management. 

She also looks forward to the panel discussion, “Innovations in Conduct Surveillance and Monitoring Practices,” to hear about the future technology and surveillance solutions that banks are exploring.

Meet Our Banking Risk and Regulatory Experts at XLoD

If you’ll be at the XLoD Global conference in New York, our team would love to connect and discuss the challenges and opportunities that are top of mind in your organization. 

Leading financial institutions count on our financial services expertise to solve complex digital challenges and compliantly drive growth. Contact us today to learn more about our digital solutions.  

This blog was co-authored by Chandni Patel and Carl Aridas.

Recent news shook the financial services space on Friday, April 26th, as Pennsylvania state banking regulators, in collaboration with the Federal Deposit Insurance Corporation (FDIC), took decisive action by closing Republic First Bank. 

With assets totaling approximately $6 billion and deposits reaching $4 billion across its 32 branches as of January 31, the closure marked the inaugural bank failure of 2024 in the United States. Notably, the last recorded bank failure prior to this was Citizens Bank in Sac City, Iowa on November 3, 2023. 

Operating as a Pennsylvania state-chartered regional lender, Republic First Bank held a significant presence in the tri-state area encompassing Pennsylvania, New Jersey and New York. 

Learn More: 7 Possible Causes of SVB Failure and Predicting the Impact on Regulatory Reporting 

Post Bank Closure

In the aftermath of the closure, Fulton Bank, headquartered in Lancaster, Pennsylvania, emerged as a key player. Boasting assets exceeding $27 billion as of March 31, 2024, Fulton Bank stepped in to absorb a substantial portion of Republic First Bank’s deposits and acquired nearly all its assets as reported by the FDIC. 

For depositors of Republic Bank’s 32 branches, swift action was taken to ensure access to their funds. ATMs remained operational, and checks were honored on Friday evening. By Saturday morning, these branches were re-opened under the banner of Fulton Bank, ensuring continuity and service to customers.  

However, this transition comes at a cost. The FDIC estimates the fallout from Republic First Bank’s failure will amount to a staggering $667 million for the deposit insurance fund. This fund, established by Congress in 1933 and managed by the FDIC, serves as a crucial safeguard for depositors across the nation’s banking institutions.  

Read More: Lessons Learned From the Fourth United States Bank Failure of 2023 

Causes of the Bank Failure 

The roots of Republic First Bank’s demise trace back to warning signs that emerged in 2022. Identified weakness in internal controls over financial reporting, highlighted in an 8-K Report filed with the Securities and Exchange Commission (SEC), underscored underlying vulnerabilities.  

Subsequent events, including a decline in deposits and the erosion of the mortgage loan portfolio’s value in a rising interest rate environment, further exacerbated the situation. In August 2023, the parent company of Republic Bank, Republic First Bankcorp, was delisted by Nasdaq, after the bank failed to file its fiscal year 2022 report with the Securities and Exchange Commission. Republic First claimed the report was not filed because of its “former executive team’s failure to maintain adequate internal controls.”  

The culmination of declining asset values and deposits with weak internal controls led to the inevitable collapse.  

Resources Mentioned:  

• REPUBLIC FIRST BANCORP INC (Form: 8-K, Received: 02/27/2024 16:52:40) (d18rn0p25nwr6d.cloudfront.net) 
•  Republic First Bancorp Investor Presentation (q4cdn.com) 

Unlock Regulatory + Risk Management Expertise  

For deeper insights into the dynamics of recent bank failures and their implications, our team of experts offers valuable resources and analysis. In the wake of Republic First Bank’s closure, it’s imperative for institutions to assess their risk and regulatory landscape.  

Contact us today to engage in tailored discussions addressing your specific challenges.  

At the core of our business’s successes lie the brilliant minds and unwavering dedication of our workforce—individuals who consistently prioritize delivering industry insights and pioneering digital solutions. Today, we’re spotlighting one exceptional individual: Carl Aridas. As the visionary leader of our Financial Services Risk and Regulatory Center of Excellence (CoE), Aridas personifies excellence and innovation in every endeavor.

Professional and Industry Background

Since joining the team four years ago, Aridas has been instrumental in bringing immense value to his projects. As a seasoned project manager and business compliance specialist, he brings to the table expert industry knowledge and a deep understanding of the intricacies of the risk and regulatory compliance space.

Aridas’ passion for risk and regulatory matters dates back to his early career with the FDIC during the Savings & Loan Crisis of the early ’90s. It was during this time that Carl dedicated himself to working as a regulator and conducting financial analysis.

Our Financial Services Risk and Regulatory CoE: Adding Business Value

As he reflects on the journey to establish the Risk and Regulatory Center of Excellence (CoE), it becomes evident that its creation stemmed from a genuine need within Perficient.

“I had been pushing for the establishment of the CoE for some time. Sellers had approached me with questions about risk and regulatory matters, making me realize the need for a centralized hub of expertise within Perficient. I wanted to go beyond project management and wanted to hold regular meetings and write blog posts. Collaborating with other fellow CoE members, we compiled a portfolio of successful risk and regulatory projects that Perficient had been able to deliver. By analyzing project outcomes, we were able to create an understanding of our capabilities within risk and regulatory. Today, our sales staff is able to gather useful information from many blogs and other content spanning various aspects of risk and regulatory reporting; they have the tools now to effectively engage with our clients.”

Learn More: 6 Reasons Financial Institutions Are Embracing Risk and Regulation Tactics

Fostering Inclusion Within the Financial Services CoE

Describing the environment within the CoE, Aridas emphasizes openness, collaboration, and diversity.

“As the leader of the CoE, what I like so much about it, and I try to foster it very very much, is the openness of the group. That new people are able to join. That new ideas are welcomed. If a blog needs to be rewritten or re-thought, if someone has a new idea, individuals can speak up and the work gets done.”

Aridas goes on to mention how each individual in the CoE contributes to continued shared knowledge and professional development saying “We have a fairly large group of 12 to 20 people who show up when and if they can; it is a diverse group. A group of people all over the globe with different backgrounds. When you get different people with different backgrounds in banking, risk, in data management together, it allows for a tremendous amount of cross-training. You can’t help but learn more during the weekly sessions. It allows us to always understand what’s happening in the market space.”

Driving Innovation

Without a doubt, Aridas’ invaluable contributions as a leader have not only propelled the success of the CoE but have also produced new opportunities within various business units. As he puts it: “I, as a leader, have already learned an immense amount and I’m grateful and thankful for that opportunity. I think by the end of the year we’re going to be 10 times better than where we are now. I’m looking forward to it.”

Unlock Our Expertise

Perficient’s Risk and Regulatory CoE was established to confront potential compliance issues. This proactive approach enables our clients to mitigate legal and financial risks while upholding a positive reputation and maintaining stakeholder trust.

Our unparalleled financial services expertise and digital leadership across platforms and businesses empower the largest organizations to overcome complex challenges and foster growth.

Contact us today to navigate the evolving landscape of risk and regulatory compliance successfully.

See More People Of Perficient

Learn more about what it’s like to work at Perficient at our Careers Page and see how our employees are transforming their industry’s landscape. We also invite you to see our open jobs or  join our Talent Community for more career tips, company updates, and more.

Read More: Driving Innovation: Inside Perficient’s Risk and Regulatory Center of Excellence

A top-leading bank, grappling with business and regulatory challenges, faced scrutiny after failing the Federal Reserve’s annual stress test. Addressing these deficiencies required a comprehensive approach, leading to the establishment of critical programs like the US Bank Holding Company (BHC) regulatory and comprehensive capital analysis and review (CCAR) program.

To bolster its capabilities and ensure compliance, the bank sought assistance from Perficient in delivering exceptional project and program management services to tackle its significant hurdles.

Perficient’s Project and Program Initiatives

Our involvement encompassed various facets of project and program management, including:

• Establishing foundational capabilities to foster smart, effective, and compliant business practices.
• Supporting the change management team in building a robust governance structure for program PMO activities.
• Partnering with stakeholders across risk, finance, technology, and operations, Perficient ensured seamless execution of capital and risk transformation (CART) PMO governance and oversight.

Another key initiative was implementing the OCC Heightened Standards guidelines, which our team utilized as a means to strengthen the bank’s governance and risk management practices.

Perficient provided invaluable support toward:

• Managing plan development and execution through to completion
• Aligning and prioritizing internal initiatives with OCC guidelines for enhanced governance across the three lines of defense (Management, Risk and Regulatory Compliance, Internal/External Audit)

Perficient was also pivotal in coordinating and supporting oversight of the CCAR process by:

• Conducting review and challenge sessions
• Developing forecasting models
• Facilitating process improvements to enhance execution efficiency

In addition to regulatory compliance efforts, Perficient spearheaded initiatives to address operational risks, enhance fraud risk management, and optimize software development life cycle processes. By conducting gap assessments, prioritizing remediation actions, and implementing comprehensive project plans, Perficient ensured the bank was well-equipped to mitigate risks effectively going forward.

Tangible Outcomes

The success of Perficient’s engagements is evident in the tangible outcomes achieved. Following our work, the bank was able to reap the benefits of:

• Improved risk measurement
• Enhanced capital allocation
• Effective responses to regulatory requirements

Ultimately, our team’s diligent project oversight and subject matter expertise enabled the bank to anticipate, evaluate, and mitigate risks proactively, thereby safeguarding its reputation and ensuring long-term resilience.

Interested in how Perficient can transform your business? 

Contact us today to learn more or visit our Financial Services page to discover other ways we provide our expertise. 

Protecting financial institutions from the perils of high-level embezzlement requires a proactive approach rooted in ethical conduct and stringent compliance measures. To fortify defenses against such threats, financial entities must implement proactive measures aimed at ensuring ethical conduct and compliance within their organizations.  

This blog outlines five key strategies to safeguard your business and mitigate the risks associated with senior-level embezzlement. 

SEE ALSO: A Guide to Fortify Your Institution Against Senior-Level Embezzlement Risks

1. Code of Conduct and Ethics Training

Regularly educate employees, especially senior management, on ethical conduct and the consequences of fraudulent activities.

Foster a strong ethical culture within the organization by addressing topics such as:  

• Ethical decision-making 
• Compliance with laws and regulations 
• Role-specific training 
• Continuous educational resources and updates 
• Leadership and culture examples from senior management 
• Online sources and support

2. Whistleblower Mechanisms

Encourage and support the reporting of suspicious activities through anonymous whistleblower hotlines or platforms. Create a culture that values transparency and integrity through implementing mechanisms like:

• Hotlines 
• Internal reporting systems 
• Legal protections 
• Third-party reporting services 
• Policy awareness and continuous training

3. Background Checks and Screening

Conduct thorough background checks on employees, particularly those handling sensitive financial information or holding senior positions.

These checks help in making informed decisions around the following:  

• Hiring 
• Partnerships

4. Rotation of Responsibilities

Implement periodic rotation of job responsibilities to prevent any single individual from having prolonged, unchecked control over financial matters.

This helps in: 

• Facilitates cross-training among employees 
• Aids in early detection of anomalies 
• Risk mitigation of fraud or errors 

5. Regular Audits and External Reviews

Conduct both internal and external audits regularly to detect irregularities or discrepancies in financial records. Engage independent third-party auditors to provide an unbiased perspective and valuable insights into areas of improvement.

Regular audits and reviews can:  

• Identify weaknesses  
• Provide compliance assurance 
• Mitigate risks and other gaps  

Periodically seeking the expertise of external auditors or consultants to review internal controls can offer additional assurance and recommendations for enhancing your institution’s overall security and compliance framework.  

By implementing these proactive measures, institutions can effectively mitigate risks associated with senior-level embezzlement while supporting a culture of accountability, transparency, and integrity across all levels of the organization. 

Reach out today to discuss your compliance efforts with our regulatory and risk services experts.  

Our Expertise 

Perficient’s Risk and Regulatory CoE was established to confront potential compliance issues. This proactive approach enables our clients to mitigate legal and financial risks while upholding a positive reputation and maintaining stakeholder trust. 

Understanding the intricacies of the risk and regulatory landscape is fundamental to our team members within the Risk and Regulatory CoE. With over 500 financial institutions relying on Perficient’s expertise, we equip them software and technologies to navigate these challenges seamlessly. 

Learn More: Risk and Reputation Matter  

On December 13, 2023, the Securities and Exchange Commission (SEC) made a landmark decision by voting to adopt significant rule changes mandating central clearing of certain secondary market transactions within the U.S. Treasury market.

These transactions include repurchases (repos), reverse repurchases (reverse repos) and U.S. Treasury securities. The rule change, one of the most substantial reforms in decades, aims to reduce risk and increase efficiency in the U.S. Treasury markets by introducing a clearinghouse to facilitate transactions between buyers and sellers.  

Changing Treasury Market Regulations

According to an SEC press release, The Treasury Market, valued at  $26 trillion, serves as the backbone of our capital markets. However, only a small portion—20% of repos, 30% of reverse repos, and 13% of Treasury cash transactions—are centrally cleared via the Fixed Income Clearing Corporation (FICC), the only Covered Clearing Agency (CCA) offering clearing services for such transactions.  

Covered Clearing Agencies (CCA) act as an intermediary between buyers and sellers, ensuring efficient transaction settlement by netting transactions on behalf of each counterparty and requiring margin from both parties to mitigate the risk of default. The low percentage of Treasury securities cleared through CCAs underscores significant industry-wide risk, which centralized clearing requirements aim to mitigate. 

To support the migration, the Fixed Income Clearing Corporation (FICC) must: 

• Establish policies and procedures outlining how participants will clear all eligible transactions.  
• Develop policies and procedures to calculate, collect, and hold a participant’s margin, separating proprietary and customer transactions. 
• Implement policies and procedures to facilitate access to clearance and settlement services.  
• Propose rule amendments for Rule 15c3-3 (the Customer Protection Rule) to permit margin required and on deposit to be included as a debit in the customer reserve formula. 

Important Compliance Dates 

The SEC will enforce the new requirements using a phased approach: 

• By March 31, 2025, the FICC must propose necessary rule changes regarding the separation of house and customer margin, the broker-dealer customer protection rule, and access to central clearing.  
• By December 31, 2025, direct participants must clear eligible cash transactions through a CCA. 
• By June 30, 2026, direct participants must clear eligible repurchase and reverse repurchase transactions through a CCA. 

Your Expert Partner

For organizations navigating risk and regulatory challenges, our financial services expertise coupled with digital leadership across platforms equips the largest organizations to solve complex challenges and drive growth compliantly.  

Contact us today to discuss your specific needs. 

This blog was co-authored by Perficient Risk and Regulatory CoE Member: Alicia Lawrence

The announcement of significant amendments to the New York State Department of Financial Services (NYSDFS) regulations on December 1, 2023, represents a pivotal moment for entities operating within New York’s financial sector.

The NYSDFS Part 500 amendments signal a crucial shift in the financial services regulatory landscape and underscore the importance of robust governance, risk management, and compliance frameworks.

Embracing these changes enables entities to:

1. Fortify operations
2. Safeguard stakeholders
3. Instill trust within the broader financial community

NYSDFS Part 500 Enforcement Commences April 29, 2024

Enforcement of the new NYSDFS Part 500 amendments is slated to commence on April 29, 2024, marking the dawn of a new era in compliance, particularly in domains such as risk assessments and asset inventory management for information systems.

Impacted institutions are subject to significant fines relative to the level of non-compliance identified by the regulators. 

Compliance Requirements

Institutions falling under the purview of the NYSDFS Part 500 amendments encompass a diverse spectrum, all mandated to adhere to these regulations.

These regulations impact entities operating within New York’s financial sector:

• State Chartered Banks
• Licensed Lenders
• Private Bankers
• Foreign Banks (licensed to operate in New York)
• Mortgage Companies
• Insurance Companies
• Service Providers

Recommended Next Steps From Our Risk and Regulatory Experts

Perficient’s risk and regulatory experts have deciphered the Governance, Risk, and Compliance (GRC) requirements outlined in the new NYSDFS Part 500 amendments.

We recommend that impacted organizations prioritize the following actions as part of a holistic approach to the regulation:

• Risk Assessments: Conduct comprehensive risk assessments, comparing existing processes, policies, and standards to industry benchmarks while identifying emerging risks and potential gaps.
• Control Testing and Gap Analysis: Evaluate controls to gauge their effectiveness in mitigating risks. By aligning with recognized frameworks such as NIST, COBIT, ISO, and FFIEC CAT, institutions ensure that all controls meet regulatory standards and address identified weaknesses.
• Issues and Findings Management: Document issues and gaps identified during risk assessments and control testing, crucial for compliance. Diligently manage issue remediation plans, monitor progress, and validate closure to ensure adherence to regulatory mandates.
• Reporting: Have access to comprehensive reports showcasing ongoing compliance efforts. These reports will provide insights into regulatory compliance, summarize remediation activities, and offer trend analysis to facilitate informed decision-making.

Looking Ahead

With the enforcement deadline of April 29, 2024, fast approaching, financial institutions subject to NYSDFS Part 500 amendments must accelerate their compliance initiatives.

Our Risk and Regulatory Center of Excellence (CoE) remains at the forefront of evolving financial rules and regulations, ensuring readiness to tackle emerging challenges and safeguard financial institutions and their customers. Perficient’s CoE guidance underscores the significance of aligning with regulatory requirements to uphold the integrity and security of New York’s financial ecosystem.

Learn more about our Risk and Regulatory Solutions and discover how Perficient can fortify your business against regulatory challenges today.

Our success at Perficient emanates from the dedication of our team. We take immense pride in recognizing that our committed individuals propel innovation and drive change within our industry. Every voice within our organization holds significance, none more so than Carolyn Lee, a Project Manager (PM) in our Financial Services business unit and a leader in Perficient’s Risk and Regulatory Center of Excellence (CoE).

The CoE Background

Perficient’s Risk and Regulatory CoE was established to confront potential compliance issues. This proactive approach enables our clients to mitigate legal and financial risks while upholding a positive reputation and maintaining stakeholder trust.

Understanding the intricacies of the risk and regulatory landscape is fundamental to our team members within the Risk and Regulatory CoE. With over 500 financial institutions relying on Perficient’s expertise, we equip them with cutting-edge software and technologies to navigate these challenges seamlessly.
Learn More: Risk and Reputation Matter

Meet Carolyn

Introduce yourself and provide an overview of your role at Perficient:
I am a project manager within Financial Services (FS). I have worked in consulting for the last six years before coming to Perficient. I joined Perficient through the Management Consulting business unit and started with FS a year ago. As a PM in FS, I support delivery oversight of two of our biggest accounts to ensure we are meeting and beating client expectations and that our team members are supported to succeed. I also enable recruiting and onboarding for both accounts, help manage the client relationship, and support sales cycles and account strategy.
What drew you to risk and regulatory matters?
I was the PM on a project supporting risk and control assessment (RCSA) testing and formed deep relationships with the team members who are special matter experts (SMEs) in the space. I am always looking at ways I can drive action for Perficient using my project management and communication skills and this is one area I have focused on. I understand the value of the relationship and have used my knowledge of greater Perficient and my relationships with our SMEs to enable Perficient to support our client’s risk and regulatory needs.
How do you see the Center of Excellence contributing to Perficient’s overall success and client satisfaction?
I see the Risk & Regulatory Center of Excellence playing a crucial role in enhancing client satisfaction in a variety of ways:

• Expertise and Specialization: The CoE is a team of experts who specialize in risk management and regulatory matters. This expertise can lead to a deeper understanding of client needs and challenges, resulting in more effective and targeted solutions.
• Best Practices & Standards: We can leverage the CoE to establish and promote the best risk and regulatory practices within Financial Services. This ensures that the services provided to clients adhere to the highest quality and standards, instilling confidence and trust.
• Knowledge Sharing: The CoE is a knowledge hub, and we can leverage our various experiences and insights to educate not only each other but the greater company. This will help ensure that everyone is aligned with the latest information, which can result in more informed decision-making and improved service delivery.
• Collaboration: The CoE is a collaborative space that fosters communication and cooperation. Improved collaboration can lead to an integrated approach to client service. It can help enable our sales teams to understand where we can best serve our clients from a risk and regulatory perspective.
• Innovation: By staying at the forefront of risk and regulatory trends, we can drive the development of new and improved services or solutions, meeting evolving client demands and expectations.

How would you describe the culture within Perficient, particularly within the Risk and Regulatory Center of Excellence?

Here at Perficient we believe in empowering our people and know that it is our people that make the difference. Perficient promises to challenge, champion, and celebrate our people. I see this culture in the CoE where each member brings their own experience and expertise to the table to enable Perficient to be at the forefront of risk management and regulatory capabilities and ultimately help drive solutions and results for our clients.

A Shining Example

Carolyn Lee’s journey within Perficient’s Financial Services division and Risk and Regulatory CoE exemplifies our commitment to fostering talent and driving excellence. Her innate ability to cultivate relationships and her astute understanding of risk and regulatory matters have significantly contributed to Perficient’s success – brava Carolyn!

SEE MORE PEOPLE OF PERFICIENT

Learn more about what it’s like to work at Perficient at our  Careers Page and see how our employees are transforming their industry’s landscape. We also invite you to see our open jobs or  join our talent community for more career tips, company updates, and more.

This post has been updated to reflect FINRA Regulatory Notice 24-02, issued January 23, 2024.

The COVID-19 pandemic prompted several unprecedented shifts in society, notably impacting the workplace and necessitating the adoption of innovative technologies that facilitate collaboration and efficiency in a work-from-home (WFH) environment.

For brokers, in the financial services sector, remote work became especially difficult due to the requirement for firms to register and supervise all home office “branches.” However, as remote work has become the new norm, the Securities Exchange Commission (SEC) has provided its approval to revise Rule 3110, easing the requirements for brokers choosing to work from home.

Work-From-Home (WFH) Background

Before the pandemic, firms were required to submit branch office applications on behalf of all the “branches.” Additionally, these branches underwent annual on-site inspections to ensure compliance with regulations.

Throughout the pandemic, the Financial Industry Regulatory Authority (FINRA) temporarily suspended the requirement for firms to submit applications for all office locations that were opened in response to the pandemic. FINRA also implemented a temporary rule (FINRA Rule 3110.17), which allowed member firms to conduct the annual inspections of their branch locations remotely.

Without action, this temporary relief would have expired on June 30, 2024, and would have significantly impacted the industry due to an estimated 75% increase in residential non-branch locations between December 2019 and December 2022.

What’s New?

Luckily, FINRA proposed two main revisions to Rule 3110:

1. Categorize residential home offices as “residential supervisory locations” (RSLs), which should be treated as non-branch locations, subject to safeguards and limitations.
2. Adopt a three-year “Pilot Program” for remote inspections.

Other key changes are as follows:

• • RSLs must be inspected by the member firm on a periodic schedule, assumed to be at least once every three years.
  • Member firms are responsible for ensuring surveillance and technology tools are suitable for remote locations.
  • Member firms are responsible for conducting and documenting a risk assessment for remote locations.
  • Member firms are responsible for establishing, maintaining, and enforcing written supervisory procedures for remote inspections.
  • Member firms are responsible for keeping written inspection records on file for a minimum of 3 years, or until the next inspection report has been completed.
  • Member firms are responsible for providing the FINRA with quarterly data, disclosing the number of inspections and any related findings.

The Benefits

FINRA anticipates the WFH model to endure, regardless of the state of the pandemic. The shift to remote work prompted significant lifestyle and work habit changes, fostering workplace flexibility.
This shift also led to technological advancements enabling firms to closely monitor broker activity to ensure full compliance at all times.

This approval indicates that the industry has gained the support of regulators to leverage technology for supervisory and surveillance purposes. Additional benefits brought by this change are:

• Workplace flexibility promotes diversity and attracts stronger talent.
• Increased employee satisfaction and retention.
• Elimination of registration costs associated with registering all RSLs as branches.
• Reduction in inspection frequency from annually to every three years.

The SEC approved FINRA’s revisions to Rule 3110 in November 2023 and, in January 2024, FINRA announced the following effective dates: 

• Rule 3110.19 (Residential Supervisory Location) becomes effective on June 1, 2024; and
• Rule 3110.18 (Remote Inspections Pilot Program) becomes effective on July 1, 2024.

Interested in exploring more of our financial services expertise?

Contact us today!