CMS Analyst

POSITION SUMMARY:

Under the direction of the Chief Legal & Compliance Officer and with day-to-day guidance from the CMS Manager, the CMS (Compliance Management System) Analyst supports the administration and continuous improvement of the Company’s consumer Compliance Management System. The position has primary responsibility for complaint administration, compliance training coordination, and performing risk-based compliance testing for assigned regulatory oversight areas.

The position supports all CMS elements, including policies and procedures, risk assessments, monitoring and testing, complaint management, marketing and advertising review, third-party compliance oversight, regulatory change management, issue tracking, corrective action, training, and management reporting. The Analyst also supports enterprise oversight of GLBA and Regulation P privacy requirements, CAN-SPAM, COPPA, and UDAP/UDAAP requirements.

OBJECTIVES OF THIS ROLE:

• Supports the CMS Manager in maintaining a risk-based CMS tailored to the Bank’s size, complexity, products, services, delivery channels, markets, and third-party relationships.

• Administers the complaint-management and compliance-training programs and performs compliance testing for assigned laws, regulations, products, processes, and control areas.

• Helps verify that regulatory requirements are incorporated into business processes, employees understand their responsibilities, controls operate as intended, and identified deficiencies are corrected and tracked to resolution.

• Provides practical, timely support to business lines while maintaining appropriate independence, documentation, and escalation as part of the second-line compliance function.

• Supports enterprise oversight of privacy, commercial email, children’s online privacy, and unfair, deceptive, or abusive acts or practices.

RESPONSIBILITIES:

• Assist the CMS Manager and Chief Legal & Compliance Officer with the administration, documentation, and continuous improvement of the Company’s CMS and consumer compliance program.

• Administer the consumer complaint process, including intake, logging, categorization, assignment, aging, investigation follow-up, response tracking, quality review, escalation, closure documentation, and record retention.

• Review complaint responses for completeness, consistency, professionalism, and compliance risk. Escalate complaints involving potential legal violations, discrimination, UDAP/UDAAP, privacy, significant consumer harm, systemic issues, threatened litigation, regulators, or material reputation risk.

• Perform periodic complaint trend and root-cause analysis across products, channels, locations, customer segments, business units, and third parties. Prepare reports identifying recurring themes, control weaknesses, potential consumer harm, and recommended corrective action.

• Coordinate the compliance training program, including annual and event-driven training plans, training-needs assessments, course assignments, invitations, materials, attendance and completion tracking, overdue follow-up, exceptions, acknowledgments, testing of understanding, and retention of training records.

• Assist in developing and updating enterprise, role-based, regulation-specific, and Board compliance training. Review training content for accuracy and support assessments of training effectiveness.

• Perform risk-based compliance testing for assigned regulatory oversight areas in accordance with approved testing plans and procedures. Define or apply testing populations, samples, attributes, evidence requirements, exception criteria, and documentation standards.

• Document testing work in a clear and reproducible manner. Prepare testing memoranda that identify scope, methodology, results, exceptions, potential violations or consumer harm, root causes, and recommended corrective action.

• Communicate testing results to the CMS Manager and accountable business leaders. Enter findings into the Bank’s issue-tracking process and monitor corrective actions, due dates, supporting evidence, validation, and closure.

• Support development and maintenance of the annual risk-based compliance monitoring and testing plan using risk assessments, complaints, regulatory changes, new products, system changes, prior findings, audit and examination results, and other risk indicators.

• Support enterprise and regulation-specific compliance risk assessments by gathering data, interviewing process owners, documenting controls, evaluating supporting evidence, recording ratings and rationale, and tracking resulting action plans.

• Assist with compliance policy and procedure governance, including inventories, review calendars, drafting, routing, approvals, version control, implementation evidence, employee communication, and archival or retirement of superseded materials.

• Assist with compliance review of marketing, advertising, websites, social media, commercial email, direct mail, scripts, disclosures, promotions, and other customer-facing materials. Maintain review records, approvals, conditions, and re-review dates.

• Support compliance oversight of third-party service providers by gathering due-diligence materials, reviewing assigned compliance documentation, monitoring complaints and performance, tracking issues, and confirming that applicable providers are incorporated into risk assessments, monitoring, testing, training, and regulatory change activities.

• Provide support and research concerning GLBA and Regulation P privacy, CAN-SPAM, COPPA, and UDAP/UDAAP. Assist with privacy notices and opt-out processes, information-sharing reviews, commercial email controls, online data-collection reviews, and identification of potentially unfair, deceptive, or abusive practices.

• Support regulatory change management by monitoring assigned developments, documenting applicability and impact, identifying affected policies, procedures, systems, controls, training, marketing, and vendors, and tracking implementation tasks through completion.

• Assist with new products, services, delivery channels, marketing initiatives, system conversions, process changes, mergers and acquisitions, and significant vendor engagements by gathering information, documenting compliance requirements, and tracking pre-implementation conditions and validation.

• Prepare periodic CMS reports and dashboards covering complaints, training completion, testing status and results, findings, corrective actions, regulatory changes, marketing reviews, third-party compliance issues, and emerging risks.

• Maintain accurate, complete, organized, and retrievable CMS records that support the Bank’s risk assessments, testing, decisions, training, complaint handling, reporting, and corrective actions.

• Provide or coordinate documentation requested for internal audit, external audit, regulatory examinations, and other reviews. Assist with examination responses, finding remediation, and evidence of corrective action.

• Move across functional lines within the Compliance Department to assist with lending, deposits, fair lending, CRA, BSA/AML coordination, privacy, issues management, policy and procedure development, and third-party oversight.

• Perform other related duties as assigned.