Blogs and News

When First‑State Bank, a mid‑size regional lender, tried to onboard its newly‑launched mobile‑pay product, examiners from the Office of the Comptroller of the Currency (OCC) halted the rollout. The OCC cited a Data‑Volume Stress Test finding in its July 2026 exam report: the bank’s legacy core‑banking platform could not ingest the projected 2.4 billion new transaction rows per month without breaking data lineage controls. The examiner warned that any mis‑alignment between product data and the bank’s critical‑asset certification could trigger enforcement under the OCC’s interim rule on data governance.

by CoComply Team

Read More

In early July 2026, the Office of the Comptroller of the Currency (OCC) released Bulletin 2026‑07 — Data Lineage and Knowledge Graph Requirements for Regulated Institutions. The bulletin mandates that all OCC‑regulated banks maintain query‑able, graph‑based lineage for every critical data asset used in risk, compliance, and lending decisions. For a bank CDO, the focus keyword knowledge graph metadata instantly surfaces as the practical solution to a regulatory hammer‑like requirement.

by CoComply Team

Read More

Banks must maintain auditable evidence of data provenance, transformation, and storage for any data element used in risk‑weighted asset calculations, irrespective of the originating system,” the OCC wrote in its press release (see source below). The regulator highlighted a recent supervisory exam where a large national bank failed to trace loan‑origination data that spanned a legacy underwriting platform and a newer cloud‑based credit‑risk engine, leading to a $3.2 million corrective action fee.

by CoComply Team

Read More

As banks continue expanding their digital operations, many have adopted multiple data governance solutions to manage compliance, risk, and reporting. While these specialized tools can improve oversight individually, they often create overlapping responsibilities that complicate regulatory compliance.

by CoComply Team

Read More

A Chief Data Officer can own every data outcome in the enterprise and control none of the levers that produce them. Accountability without authority is just exposure with a name attached.

by CoComply Team

Read More

A bank's exposure to a single borrower can read dangerously low — not because the math is wrong, but because the customer exists in its systems six different times. You cannot aggregate what you cannot identify.

by CoComply Team

Read More

A healthcare enterprise can run encryption, access tooling, and monitoring on data it can't actually locate. Every protective control is only as good as the classification underneath it.

by CoComply Team

Read More

Every record an organization keeps past its purpose is something it must secure, search, and answer for. Storage is cheap; unbounded retention is not.

by CoComply Team

Read More

A bank can produce a perfectly accurate regulatory figure and still fail the exam — because it can't show, on demand, how the number was built. A figure you can't trace is a figure you can't defend.

by CoComply Team

Read More

An AI model can be retrained, drift, and start making biased decisions in the time it takes a governance committee to schedule its next meeting. The approval was a moment; the risk is continuous.

by CoComply Team

Read More

A bank can pass every internal security review and still end up defending a class action because a vendor got breached. When customer data moves through a third party, the liability doesn't move with it.

by CoComply Team

Read More

A $60 billion commercial bank went into its annual internal audit confident. Its data governance policy was mature, board-approved, and well documented. Every control had an owner. Every standard had a threshold. Then the auditors pulled the exception log.

by CoComply Team

Read More

When banks consolidate risk data manually, regulators no longer just flag it in an exam letter. They price it directly into how much capital the bank has to hold. A data governance gap quietly becomes a balance sheet problem.

by CoComply Team

Read More

Wells Fargo's 2022 consent order for data governance deficiencies included a specific citation that most banks overlooked: the bank could not demonstrate, through auditable records, that its risk data aggregation met BCBS 239 standards during stress events. The fine made headlines. The specific failure did not. But that specific failure is the one that should concern every Tier 2 bank right now, because it signals what regulators are actually testing for.

by CoComply Team

Read More

In 2022, a $35 billion-asset Midwest bank launched a data stewardship program with great fanfare. Forty-five stewards were appointed across business lines. Training was delivered. A stewardship council was formed. Eighteen months later, 31 of the 45 stewards had either left the role or stopped participating. The council had not met in six months. The program was functionally dead, and the bank's CDO was back at square one explaining to the board why governance was still "maturing."

by CoComply Team

Read More

In September 2024, a $68 billion-asset bank with operations in the US, UK, and EU received simultaneous examination requests. The OCC wanted proof that its US consumer lending data met BCBS 239 accuracy standards. The FCA wanted evidence that the same data, processed through its UK entity, complied with Consumer Duty reporting requirements. The EBA wanted assurance that the data flowing into its European stress test models had complete lineage documentation back to source systems.

by CoComply Team

Read More

Technical debt has a seat at the table now. CIOs track it. CFOs budget for it. Boards ask about it. Governance debt does not have a seat anywhere. It accumulates in the spaces between audits, in the gaps between policy and practice, in the decisions that were made once and never revisited. And it is compounding inside Tier 2 banks at a rate that would terrify any CFO who actually measured it.

by CoComply Team

Read More

First Republic was acquired by JPMorgan in May 2023. Within weeks, the OCC issued guidance about governance continuity during absorption. What got less attention: the acquired bank's data governance certifications, some less than six months old, became instantly invalid. New ownership structures meant new data domain owners. New system integrations meant new lineage paths. New risk tolerances meant new thresholds. Every certification the bank had earned was void, not because the content was wrong, but because the context had changed.

by CoComply Team

Read More

A $38 billion-asset bank restructured in 2023 to push data governance accountability into the business lines. Each line of business, commercial lending, retail banking, wealth management, and treasury, got its own certification authority.

by CoComply Team

Read More

A $26 billion-asset bank deployed an AI-powered data governance monitoring tool in mid-2023. The tool ingested metadata from across the bank's data estate and produced a daily governance health score. For six months, the score showed green. Then an OCC examination found that 12 critical data elements had quality scores below threshold, three key lineage paths were undocumented, and five certification cycles had lapsed without renewal.

by CoComply Team

Read More

Through the first three quarters of 2024, the FDIC issued 14 consent orders against banks with assets between $20 billion and $250 billion. Eleven of those orders included specific language about data governance deficiencies: incomplete data lineage, insufficient quality monitoring, inadequate governance of third-party data, and failure to demonstrate risk data aggregation capabilities. The pattern is unmistakable. Data governance is no longer a secondary concern in enforcement actions. It is a primary finding.

by CoComply Team

Read More

When PacWest Bancorp was acquired by Banc of California in 2023, the deal documents included extensive analysis of credit risk, deposit stability, and capital adequacy. What they did not include was any assessment of the target's data governance maturity. Eighteen months post-merger, the combined entity was still untangling data lineage gaps, recertifying data domains, and reconciling governance frameworks. The integration cost attributed to data governance restructuring exceeded $4 million, a number that never appeared in any pre-deal analysis.

by CoComply Team

Read More

In 2023, the FDIC issued a consent order against a $31 billion-asset bank that included a finding most governance leaders missed: the bank's data governance dashboard showed green across all domains, but underneath, three critical data elements had quality scores below threshold for over six months. The dashboard was not lying. It was averaging. Aggregated metrics hid domain-level failures. The examiner saw the detail that the aggregation concealed.

by CoComply Team

Read More

In Q1 2024, a $44 billion-asset regional bank lost its VP of Data Governance to a competitor. Within 30 days, the bank received an examination notice. The VP had been the sole owner of 23 critical data domain certifications, the only person who understood the lineage mapping for the bank's stress testing data, and the keeper of the informal escalation paths that actually made the governance program function.

by CoComply Team

Read More

In March 2024, the OCC cited a $42 billion-asset regional bank not for having an incident, but for having no auditable record of how it responded. The bank had suffered a data feed corruption that inflated commercial lending exposures for 11 days. Operations fixed it. Risk was notified. But the governance trail, the who-decided-what-when, simply did not exist in any system. The examiner's write-up was blunt: the bank could not demonstrate that its incident response followed its own policy.

by CoComply Team

Read More

A $52 billion-asset bank on the East Coast completed 2,400 data governance certifications last year. By its own metrics, the program was a success. By its examiners' assessment, it was a liability. The OCC's 2024 findings noted that certifications were being produced mechanically, with renewal rates above 98 percent, a statistical impossibility if any genuinely critical review was occurring. The bank was certifying motion, not mastery.

by CoComply Team

Read More

A $28 billion-asset regional bank discovered in late 2023 that its commercial lending team had built 340 separate dashboards in its self-service analytics platform. Each dashboard pulled from slightly different data cuts, applied different filters, and used different definitions of "exposure." When the CRO asked for the bank's total commercial exposure across three risk categories, she got six different answers from six different dashboards, all built by smart analysts who trusted the data they were working with.

by CoComply Team

Read More

Data ownership is one of the most discussed and least resolved topics in data governance. Every framework calls for it. Every policy document references it. Every organization says they've defined it.

by CoComply Team

Read More

If you want to know whether your data governance works, don't wait for the examination. Run the 72-hour stress test. Here's the scenario: you receive a notification that examiners will arrive in three days. They've asked for complete data lineage documentation for your top 20 critical data elements, current certification status for data feeding regulatory reports, and evidence of ownership and attestation for the past 12 months.

by CoComply Team

Read More

Metadata has a branding problem. It sounds technical and optional, like something database administrators care about but executives don't. It's the kind of word that makes eyes glaze over in boardrooms.

by CoComply Team

Read More

Banks have gotten serious about model risk management. SR 11-7 gave them no choice. Model validation is now a mature discipline. Model inventory is a standard practice. Model risk committees meet regularly and challenge assumptions.

by CoComply Team

Read More

Most banks view privacy regulation as a cost center. Compliance overhead. Legal review cycles. Cookie consent banners that nobody reads. It's an obligation to manage, not an opportunity to exploit.

by CoComply Team

Read More

Banks outsource. That's not a surprise. What is a surprise to examiners, to risk committees, and sometimes to the banks themselves, is how many governance obligations travel with that outsourcing and never arrive at the destination.

by CoComply Team

Read More

Every CFO trusts their numbers. That's the problem. Not because CFOs are gullible; it is because the systems feeding them numbers are quietly decaying, and nobody owns the decay. A data quality issue in a trading book doesn't show up as a data problem. It shows up as a P&L variance. A stale reference rate in a loan portfolio doesn't flag itself as "bad data." It registers as an unexpected margin compression. By the time the numbers look wrong, the data has been wrong for weeks.

by CoComply Team

Read More

The Uncomfortable Truth About Governance Theater Most governance programs aren't failing. They're performing. If you sat through your last data governance committee meeting and walked away thinking "that went well," you might be the problem. Not because you're doing something wrong, but because "going well" is exactly what governance theater feels like. The slides were polished. The stakeholders nodded. Someone even used the phrase "mature data culture" without irony. Andnothing will change.

by CoComply Team

Read More

The Uncomfortable Truth About Attestation Most governance programs have an attestation process. Few have an attestation problem they are willing to admit. Here is how it typically works. Once a quarter, or maybe once a year, an email goes out. It asks someone, usually a vice president or a director, to affirm that the data under their domain is accurate, complete, fit for purpose, and compliant with policy.

by CoComply Team

Read More

Most enterprises have thousands of data elements across hundreds of systems. Trying to govern all of them equally is how you end up governing none of them well. The concept of Critical Data Elements (CDEs) is supposed to solve this. In theory, you identify the data that drives your most important decisions, feeds your regulatory reports, and underpins your risk calculations. You apply higher standards to that data and accept lower rigor for everything else.

by CoComply Team

Read More

The OCC is proposing a massive threshold jump for Heightened Standards from $50B to $700B. But smart banks aren’t walking off the field. Here is why this shift from prescriptive checklists to supervisory judgment means your evidence trail matters more than ever—and how to right-size your governance to win.

by CoComply Team

Read More

The Real Cost of a Governance Gap Isn't the Fine Most organizations can tell you what their last regulatory fine was. Fewer can tell you what it actually cost. The fine is the headline. The real damage is everything that comes after: the consent order that constrains strategy for three years, the remediation program that eats your best people, the board conversations that shift from growth to survival, and the quiet erosion of trust that makes your next audit harder before it even begins. Governance gaps are expensive. But not in the way most risk reports capture. The problem isn't that organizations underestimate the cost. The problem is they measure the wrong costs.

by CoComply Team

Read More

The Regulatory Squeeze on Tier 2 Banks: What Happens When Exemptions Expire Here is what nobody tells you about being a Tier 2 bank right now: the regulatory patience is running out. For years, smaller and mid-sized financial institutions operated under a simple assumption. The big rules, the ones with teeth, were written for the global systemically important banks. BCBS 239, the OCC heightened standards, the FDIC expectations around data risk governance, these were Tier 1 problems. Tier 2 banks watched from a comfortable distance, tweaking their frameworks just enough to stay off the supervisory radar. That distance is gone.

by CoComply Team

Read More

You Can't Hire Your Way Out of a Governance Problem Most organizations respond to governance failures the same way: they hire more people. Another data steward. Another policy analyst. Another layer of oversight in the middle office. It feels like the right thing to do. The regulator wants to see commitment. The board wants to see action. The audit finding says "insufficient resources," and so resources get added. But here is what nobody tells you about scaling governance through headcount: it works exactly until it doesn't. And the point where it stops working arrives faster than you think.

by CoComply Team

Read More

The Uncomfortable Truth About Certification: Most of It Is Just Documentation If your compliance team left tomorrow, what would remain of your data governance program? The dashboards? The policy documents? The attestation records signed by people who haven't looked at a data lineage diagram in three quarters? Here is what most organizations get wrong. They think documentation is certification. It is not. The difference between the two is the difference between a photograph of a building and the building itself. One describes. The other stands on its own.

by CoComply Team

Read More

The Difference Between Proving and Describing Every bank has documentation. Data dictionaries. Policy manuals. Stewardship matrices. Lineage diagrams that look impressive on a projector. Rows and rows of metadata, neatly organized in governance tools that cost six figures to implement. And when an examiner asks, "How do you know this data is right?" someone opens the documentation and points to the page. That's not certification. That's description. And the difference between the two is where regulatory risk lives.

by CoComply Team

Read More

If Your Data Steward Left Today, Would Anything Change? Most organizations think governance lives in the governance team. They're wrong. Go into any mid-size bank and ask who owns data quality for the trade reporting pipeline. You'll get pointed to a data steward, probably someone in operations who inherited the role three years ago, keeps the rules in a spreadsheet, and answers questions on Slack when someone's unsure about a field mapping. That person is doing important work. But the organization has confused a person with a system.

by CoComply Team

Read More

The Uncomfortable Truth About BCBS 239 Compliance Most Tier 2 banks think they have their risk data under control. They don't. If you sit in a governance meeting at a mid-size bank, you will hear the same reassuring chorus: "We're BCBS 239 compliant. We passed our last assessment. The regulators signed off." And technically, maybe they did. The checklist was completed. The documentation was filed. The attestation was signed. But here is what nobody tells you about BCBS 239 compliance at Tier 2 banks: the gap between passing an assessment and actually having reliable risk data is wider than anyone wants to admit. And the regulators know it.

by CoComply Team

Read More

The Uncomfortable Truth About Data Lineage: You Can't Certify What You Can't See Most organizations think they know where their data comes from. They're wrong. Ask any CDO to sketch the journey of a single critical data element from source system to regulatory report, and you'll get one of three responses: a confident answer that falls apart under follow-up questions, a vague wave toward a wiki page that hasn't been updated since the last reorg, or an honest admission that nobody really knows. The third response is the most dangerous because it's the rarest. The first two are where real risk lives.

by CoComply Team

Read More

Most organizations treat data certification like a merit badge. You earn it once, pin it to a slide deck, and move on. The certificate sits in a shared drive somewhere, the attester has already rotated to a new role, and six months later nobody can tell you what was actually certified or whether it still holds. That is not certification. That is decoration.

by CoComply Team

Read More

Financial institutions spend billions every year on governance, compliance, audit remediation, regulatory reporting, data & model management, and risk operations.

by CoComply Team

Read More

Most organizations do not have a governance problem. They have a presentation problem. Walk into any Tier 2 bank's risk committee meeting and you will see it. Beautiful heat maps. Color-coded RACI charts. Dashboards that pulse with green, amber, and red like a functioning traffic system. Data quality scores trending upward. Attestation coverage above 90 percent. Everything looks under control.

by CoComply Team

Read More

When your best data person leaves, institutional knowledge walks out the door. Certification turns tribal knowledge into governance that survives turnover.

by CoComply Team

Read More

Banks are beginning to automate governance and compliance across the three lines of defense by focusing AI on operational verification and trust in data and models.

by Patrick Jacolenne

Read More

Many banks approaching the $50B asset threshold discover that governance at scale requires more than policies and frameworks - it requires verifiable data and certification.

by Patrick Jacolenne

Read More

CoComply announces the appointment of Justin Heller as Strategic Advisor, a seasoned financial services executive with more than 30 years of experience in data strategy, governance, AI, and risk management.

by CoComply

Read More

AI can help institutions move from static governance frameworks to measurable, asset-level operational certification across regulations, policies, controls, and evidence.

by Patrick Jacolenne

Read More

CoComply announces the appointment of Jane Sorenson Herthel as Strategic Advisor, bringing more than 25 years of experience designing and executing scalable enterprise B2B revenue strategies across high-growth startups and Fortune 500 companies, including leadership roles at Oracle, SAP, Salesforce, Microsoft, and Guidewire.

by CoComply

Read More

CoComply announces the appointment of Malcolm Hicks as Strategic Advisor, a seasoned technology executive with 30 years driving business transformation and revenue growth across Financial Services, Commercial Real Estate, Hospitality, and Investment Management industries.

by CoComply

Read More

CoComply announces the appointment of Jason Sisack as Strategic Advisor, bringing 25+ years of experience helping organizations strengthen risk management, navigate complex regulatory environments, and operate with confidence under supervisory and policy expectations.

by CoComply

Read More

The OCC offered buyouts drawing nearly 800 employees, raising pressing questions about how this shake-up will affect banks. From examiner standards under review to MRAs potentially becoming law, here are the key regulatory shifts banks need to watch.

by CoComply

Read More

Discover how AI is not just a challenge in compliance but a powerful tool that can create strategic advantages for organizations. Learn key strategies for effective implementation.

by cocomply

Read More

Explore the unseen expenses related to data governance that can impact your organization’s bottom line and decision-making processes. Learn why understanding these costs is crucial.

by cocomply

Read More

Explore the key principles of data governance and how they empower leaders to harness data effectively for strategic decision-making.

by cocomply

Read More

Explore the shift to virtual bank branches, understanding their impact on banking services and customer experience, and how to prepare for this transformation.

by cocomply

Read More

Explore the essential strategies for effective data governance to avoid the pitfalls of data swamps and leverage the true potential of data lakes.

by cocomply

Read More

Explore the often-overlooked costs of compliance in businesses and learn effective strategies to track and manage these expenses.

by cocomply

Read More

Discover how artificial intelligence is transforming compliance in the fintech industry, paving the way for more efficient and secure financial services.

by cocomply

Read More

Explore the evolving landscape of digital banking and examine if traditional banks can adapt to the rapid changes in technology and customer expectations.

by cocomply

Read More

Explore how prioritizing data ethics can set fintech companies apart in a crowded market, fostering trust and driving innovation.

by cocomply

Read More

Explore how organizations can shift their compliance narrative from viewing it as a burden to leveraging it as a strategic opportunity for growth and innovation.

by cocomply

Read More

Explore the transformative impact of open banking on the financial sector and find out if your bank is ready to embrace this revolution.

by cocomply

Read More

Discover how banks can enhance their agility to effectively respond to regulatory changes and ensure compliance in a fast-paced financial environment.

by cocomply

Read More

Discover how organizations can effectively navigate compliance challenges by adapting strategies that ensure success in an ever-evolving regulatory landscape.

by cocomply

Read More

Explore the growing landscape of digital-only banks, their benefits, challenges, and what it means for the future of banking.

by cocomply

Read More

Discover how leaders can adapt their skills to thrive in the age of artificial intelligence, fostering innovation and collaboration in their teams.

by cocomply

Read More

Explore how robust data governance frameworks can unlock hidden value and drive significant growth for businesses.

by cocomply

Read More

Explore effective strategies for maintaining financial transparency in your organization with sound data practices. Learn how to safeguard your financial data today!

by cocomply

Read More

Learn how poor data governance can lead to catastrophic failures and discover effective strategies to improve your organization's data management practices.

by cocomply

Read More

Explore the resilience of the fintech industry by examining recent failures and the lessons learned that can foster innovation and sustainability.

by cocomply

Read More

Discover how organizations can build a strong culture of compliance that promotes ethical behavior and regulatory adherence.

by cocomply

Read More

Discover how insights from industries outside of banking can help build financial resilience in uncertain times.

by cocomply

Read More

Explore the critical interplay between business growth and regulatory compliance. Learn strategies for achieving success without sacrificing integrity.

by cocomply

Read More

In today's rapidly changing financial landscape, fintech startups have emerged as agile and innovative powerhouses, disrupting traditional banking models. Their fresh approaches to customer engagement, technology integration, and problem-solving have caught the attention of consumers and established institutions alike.

by Editorial Team

Read More

Explore the critical role of data quality in achieving compliance and how it can drive your business success.

by cocomply

Read More

Explore effective strategies for overcoming resistance to digital transformation within organizations. This post delves into actionable insights for seamless transitions.

by cocomply

Read More

Explore how to ensure your data strategy is resilient and adaptable for future challenges. This guide covers essential tips and insights for organizations.

by cocomply

Read More

Explore how organizations can foster a strong compliance culture that goes beyond mere compliance checkboxes. Learn the strategies for embedding compliance into the corporate ethos.

by cocomply

Read More

Explore how to effectively manage overwhelming data while leveraging its potential for decision-making.

by cocomply

Read More

Discover how the finance industry can tackle the dual challenges of trust and transparency in the age of artificial intelligence. Explore strategies, benefits, and best practices for integrating AI responsibly.

by cocomply

Read More

Explore how corporate agility can revolutionize financial services, driving innovation and meeting customer needs in a fast-paced environment.

by cocomply

Read More

Explore the hidden crisis of tech debt in the banking sector, understand its impacts, and discover strategies to mitigate it.

by cocomply

Read More

Explore essential strategies to bridge the compliance gap in the fintech industry and ensure regulatory success.

by cocomply

Read More

Discover the extensive hidden costs of non-compliance that go beyond just financial penalties. Learn how neglecting regulations can impact your business in unexpected ways.

by CoComply Team

Read More

Explore innovative risk management strategies from outside the banking industry, highlighting key lessons that can enhance resilience and decision-making.

by cocomply

Read More

Discover how to improve your data governance strategies for increased agility and responsiveness in today's fast-paced business environment.

by cocomply

Read More

Explore how to create a compliance culture that empowers employees instead of stifling them. Discover tips and strategies for fostering an environment of trust and support.

by cocomply

Read More

Explore how transparency can close the trust gap in fintech, boosting user confidence and industry growth.

by cocomply

Read More

Explore how transparency fosters trust in fintech, key strategies for companies, and the importance of effective communication with customers.

by cocomply

Read More

Explore the vital concept of data governance maturity and learn how to assess your institution's standing in today's data-driven landscape.

by cocomply

Read More

Explore how the shift to AI in data management is revolutionizing compliance and what you need to know to adapt effectively.

by cocomply

Read More