Unified data supports compliance reporting by holding every obligation, policy, control, test, issue and piece of evidence in one connected record with shared identifiers, so a bank’s board, management and examiner reports are produced as views of the same data and each figure traces to its source.
This article covers what compliance reporting includes, the data model behind it, how reports are built from that model, what supervisors expect of the result, and how Predict360 implements compliance management.
What Compliance Reporting Covers
Compliance reporting is the reporting a bank or credit union produces about its own compliance program, for three audiences:
- The board and its committees need program effectiveness
- Senior management needs operating detail
- Examiners need the underlying evidence
The CFPB’s supervision and examination manual names the compliance management system components that these reports draw on: board and management oversight, policies and procedures, training, monitoring and audit, and consumer complaint response.
The FDIC’s Consumer Compliance Examination Manual expects recurring reports from the compliance officer to the board.
The Data Model Behind Unified Reporting
The model follows one chain:
- Regulation to obligation
- Obligation to policy and control
- Control to test
- Test to finding and issue
- Issue to remediation evidence
When testing lives in spreadsheets, issues in a tracker and policies in a document library, the same question returns different counts depending on who answers it. In PwC’s Global Compliance Survey 2025, 63% of respondents across industries said the disaggregated nature of data across the organization made compliance more difficult.
Four common risk and compliance reporting questions show what unified data has to join:
| Report question | Records that must be joined | What a fragmented setup forces |
|---|---|---|
| Which obligations failed testing this quarter? | Obligation, control, test result | Manual matching of test spreadsheets to an obligation list |
| How old are open high-severity issues? | Issue, severity, owner, due date | Re-keying tracker exports and reconciling owners |
| Which policies changed after a new rule? | Regulation, obligation, policy version | Reconstructing the change from email |
| What evidence supports a closed finding? | Finding, issue, closure evidence, approver | Searching shared drives during the examination |
Building Reports from the Unified Record
Production follows a fixed sequence:
1. Fix the period and cut-off
Every figure in the report uses the same as-of date.
2. Snapshot the record
The report is generated from a frozen copy, so the figures do not move while the board reads them.
3. Generate each audience’s view
The board pack summarizes, and the management view breaks the same counts down by business line and owner.
4. Drill each figure to source
The compliance officer confirms that every number links to the records that produced it.
5. Record approval
The sign-off, the snapshot and any commentary are stored together.
The audit trail comes from the sequence itself: each step writes a dated record of who did what, which is the trail examiners ask for when they test the reporting process.
What Supervisors Expect from the Report
The CFPB manual expects findings from monitoring reviews to be escalated to management and the board and expects the audit program to report to the board or a board committee.
For banks with average total consolidated assets of $50 billion or more, the OCC’s heightened standards at 12 CFR Part 30, Appendix D require risk data aggregation and reporting capabilities appropriate to the bank’s size and complexity, and timely reporting of material risks to the board.
BCBS 239, the Basel Committee’s principles for effective risk data aggregation and risk reporting published in January 2013, sets 14 principles in four groups: overarching governance and infrastructure, risk data aggregation capabilities, risk reporting practices, and supervisory review, tools and cooperation. The Committee’s November 2023 progress report found only two of 31 assessed banks fully compliant with all the principles.
In July 2024 the OCC imposed a $75 million civil money penalty and the Federal Reserve a $60.6 million penalty on Citigroup over data quality management, with the OCC citing a lack of processes to monitor the impact of data quality concerns on regulatory reporting. The OCC terminated that amended order in December 2025.
Compliance Reporting in Predict360
The Compliance Management module in Predict360 provides a single system of record and a common calendar for compliance-related activities, and all of its capabilities and Ask Kaia agents share a unified data intelligence layer for risk, compliance, regulatory and agent data.
Dashboards show trends and tolerance breaches and track the actions addressing them. Issues Management assigns owners and due dates, collects evidence and tracks actions through resolution, so the board report and the examiner file draw on the same records.
Request a demo below to learn more.
Frequently Asked Questions
Does BCBS 239 Apply to Community Banks?
Not directly. The Basel Committee wrote the principles for global systemically important banks, which were expected to comply from the beginning of 2016, and suggested that national supervisors also apply them to domestic systemically important banks. Community banks and credit unions carry no BCBS 239 requirement, although its principles on accuracy, completeness and timeliness describe what any board report needs.
How Long Must Compliance Evidence Be Kept?
Each rule sets its own period. Regulation B requires creditors to keep consumer credit application records for 25 months after notifying the applicant of action taken. HMDA requires each loan application register to be retained for at least three years, and Bank Secrecy Act records must be kept for five years. A unified record applies each retention period to the evidence it governs.
The Predict360 Compliance Management Suite modernizes compliance monitoring, regulatory change management and document management.
Request Demo- Activity Management
- Document Management
- Compliance Monitoring
- Integrated Platform