ABA · CRCM
Certified Regulatory Compliance Manager (CRCM) Practice Test
The ABA CRCM certifies banking and financial services professionals in U.S. regulatory compliance, validating expertise in consumer protection laws, anti-money laundering, Bank Secrecy Act, lending regulations, and risk management. It is recognized as the premier compliance credential for professionals in the financial industry.
Exam Details
Questions
700
Duration
240 minutes
Passing Score
500/800
Difficulty
ProfessionalLast Updated
Mar 2026
Topics Covered
Consumer Protection Laws & RegulationsAnti-Money Laundering & Bank Secrecy ActLending ComplianceDeposit ComplianceOperations & Risk ManagementEthics & Compliance Management
Certified Regulatory Compliance Manager (CRCM) Practice Exam Preparation
Use this CRCM practice exam to prepare for Certified Regulatory Compliance Manager (CRCM) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 700 questions for ABA CRCM, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Consumer Protection Laws & Regulations, Anti-Money Laundering & Bank Secrecy Act, Lending Compliance, Deposit Compliance, and Operations & Risk Management. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Domain Breakdown
Assessment and Management of Compliance Risk28%
Compliance Monitoring25%
Regulatory Change Management15%
Regulator and Auditor Compliance Management11%
Compliance Analysis and Internal/External Reporting11%
Governance and Oversight10%
Exam Overview
The Certified Regulatory Compliance Manager (CRCM) is the premier compliance credential in the U.S. banking and financial services industry, awarded by the American Bankers Association (ABA). It validates a professional's mastery of the broad and complex landscape of federal banking regulations, including consumer protection laws, anti-money laundering requirements under the Bank Secrecy Act, lending and deposit compliance, and enterprise risk management. The designation is federally registered with the United States Patent and Trademark Office and is recognized by banks, financial institutions, regulatory agencies, and consulting firms as the benchmark of compliance expertise.
The exam tests not only knowledge of applicable laws and regulations but also their practical application — assessing candidates as if they were the chief compliance officer of a midsize bank. With over 6,200 active CRCM holders nationwide, the designation signals to employers and regulators alike that the holder possesses current, verified expertise across more than 50 federal laws and regulations organized in tiered importance. Nearly 90% of certified professionals report the designation as valuable to their careers.
Who Should Take This Exam
The CRCM is designed for experienced banking and financial services compliance professionals who hold a primary role in managing compliance risk. Ideal candidates include Compliance Officers, Compliance Directors, Compliance Analysts, Internal Auditors focused on regulatory compliance, Risk Managers, and regulatory agency examiners. The certification is also well-suited for professionals in compliance consulting practices serving the banking sector.
Candidates typically come from corporate compliance, legal, audit departments, or dedicated compliance practices within consulting firms. The exam is not intended for those whose work involves only executing operational processes with embedded compliance controls — eligible experience must center on program management, monitoring, testing, auditing, or policy administration within U.S. consumer banking regulation.
Prerequisites
Candidates must meet one of two experience pathways before sitting for the exam. The first pathway requires a minimum of six years of qualifying U.S. compliance experience within the last ten years, with at least three of those years occurring within the last five years. The second pathway requires three years of qualifying U.S. compliance experience within the last five years, plus completion of two approved compliance training options — such as ABA Compliance Schools or a minimum of 30 credits (where 1 credit equals 50 minutes) of directly relevant compliance training.
All qualifying experience must be U.S.-based and directly related to the federal consumer banking laws and regulations covered on the CRCM Examination Outline. Experience in unrelated industries does not qualify. Eligible roles include examining a bank's compliance program, analyzing data for compliance risk identification, managing compliance monitoring and testing activities, and issue escalation. Execution of operational business processes that incorporate compliance controls does not meet the eligibility threshold.
Exam Format
The CRCM exam consists of 200 questions to be completed within a four-hour (240-minute) time limit. Questions are formatted as multiple-choice (single best answer) and multi-response (select all that apply), and are randomized by topic rather than grouped by regulation or domain. The exam is delivered in English only.
Testing is administered through Meazure Learning at authorized test centers across the United States, or via Live Remote Proctoring (LRP) through the ProctorU platform, which allows candidates meeting technical requirements to test from a private location with a live remote proctor. The scoring scale runs from 0 to 800, with a passing score of 500. Candidates receive an instant pass/fail result at most computer-based test sites. The exam fee is $750 USD, with a retake fee of $450 USD. A minimum of three months must elapse between exam window start dates before a retake is permitted.
Skills Measured
- 1.Assessment and Management of Compliance Risk (28%): Covers identifying, assessing, and managing compliance risks across the institution. Includes acting as a compliance subject matter expert on projects and committees, reviewing first-line monitoring results, administering complaint management programs, and validating remediation of identified issues within required timelines.
- 2.Compliance Monitoring (25%): Focuses on defining the scope of monitoring and testing activities, executing or overseeing compliance testing, reviewing operational processes for regulatory adherence, and developing action plans in response to monitoring findings. Covers testing across Tier 1 regulations such as TILA, RESPA, ECOA, HMDA, BSA/AML, and UDAAP.
- 3.Regulatory Change Management (15%): Addresses tracking, analyzing, and implementing changes to federal laws and regulations. Includes reporting on regulatory changes and their implementation status to appropriate stakeholders, and ensuring the institution's policies and procedures reflect current mandatory compliance requirements.
- 4.Regulator and Auditor Compliance Management (11%): Encompasses managing interactions with external regulators and auditors, preparing for and responding to regulatory examinations, facilitating information requests, and ensuring findings and corrective actions are tracked and resolved appropriately.
- 5.Compliance Analysis and Internal/External Reporting (11%): Covers developing and presenting compliance reports to internal governance bodies and external parties, analyzing compliance data and trends, and escalating issues to senior management or the board as required by the compliance program.
- 6.Governance and Oversight (10%): Addresses developing, conducting, and tracking enterprise-wide and job-specific compliance training programs, maintaining the compliance management framework, and establishing or supporting board and management-level compliance oversight structures.
Study Tips
- Download and follow the official ABA CRCM Examination Outline PDF available at aba.com — it lists all six domains with their exact percentage weights and the 59 tested topics organized by tier of importance. Allocate study time proportionally, prioritizing the Assessment and Management of Compliance Risk (28%) and Compliance Monitoring (25%) domains.
- Use the ABA Reference Guide to Regulatory Compliance as your primary study text — it is updated annually (released in late June) and is the only ABA-authorized reference resource. Avoid third-party guides sold on platforms like Amazon or eBay, which are not authorized by the ABA.
- Enroll in the ABA's official CRCM Online Prep course, which includes presentations, videos, and practice examinations aligned to the current exam outline. Supplement with ABA Foundational Compliance School materials and sample questions available at aba.com.
- Approach scenario-based questions from the mindset of a chief compliance officer at a midsize bank. The exam tests application of knowledge, not just recall — practice working through multi-step regulatory scenarios and avoid overthinking questions where your professional experience provides a clear answer.
- Build proficiency with computer-based test-taking mechanics. Practice flagging difficult questions to return to later, answer straightforward questions first to bank time for complex scenarios, and simulate timed sessions to pace yourself across 200 questions in four hours.
- Focus your review on Tier 1 regulations, which carry the heaviest question weighting. Key federal regulations include TILA/Regulation Z, RESPA, ECOA/Regulation B, HMDA, BSA/AML, CRA, FDCPA, UDAAP provisions under Dodd-Frank, and flood insurance requirements. Only regulations with a mandatory compliance date are eligible for testing.
- Network with recent CRCM designees through ABA forums, state banking associations, LinkedIn, and the Bankers Online compliance community. Recent passers can provide current insights on question style, domain emphasis, and test-day logistics that supplement official study materials.
Career Benefits
The CRCM designation substantially enhances career prospects in the banking compliance field, where many senior roles either require or strongly prefer the credential. Common positions held by CRCM holders include Chief Compliance Officer, Compliance Director, VP of Compliance, Risk Manager, and Compliance Consultant. The certification signals demonstrated expertise to both employers and regulators, and CRCM holders report being recognized as authoritative resources during regulatory examinations — with bank management citing certified staff as a positive indicator in regulator meetings.
Salary data indicates that CRCM holders earn average annual compensation in the range of $85,000 to $125,000, with experienced professionals and senior leaders earning upward of $180,000 depending on institution size, geography, and role. In addition to compensation advantages, active CRCMs receive a complimentary electronic subscription to ABA Risk and Compliance magazine, discounted registration at ABA conferences, access to the Certification Manager tool for tracking continuing education, and annual renewal fee waivers for referring new certification candidates. The credential requires 60 continuing education credits every three years to maintain, keeping holders current with the evolving regulatory environment.
Sample Questions
5 sample questions with answers and explanations. Start a practice session to test yourself across all 700 questions.
Preview — answers shown1. Fabrikam Community Bank's board of directors is reviewing the institution's Compliance Management System. The board chair asks the compliance officer to explain the three pillars that regulators evaluate when assessing CMS effectiveness. Which three elements constitute the pillars of a Compliance Management System as evaluated by regulators? (Select one!)
APolicy development, employee training, and audit remediation
BBoard and management oversight, the compliance program itself, and consumer complaint response
CInternal controls, independent testing, and BSA compliance officer designation
DRisk assessment, vendor management, and regulatory change monitoring
Explanation
Regulators evaluate a Compliance Management System on three pillars: board and management oversight (setting tone, approving policy, allocating resources), the compliance program (which includes policies, procedures, training, monitoring/testing, and independent audit), and consumer complaint response (tracking, investigation, and resolution). Internal controls, independent testing, and BSA compliance officer designation are components of the five pillars of a BSA/AML compliance program, not the CMS framework. Risk assessment, vendor management, and regulatory change monitoring are important compliance activities but do not represent the three CMS pillars. Policy development, employee training, and audit remediation are sub-components within the compliance program pillar but do not represent the full three-pillar framework.
2. Adatum Federal Bank's chief compliance officer is presenting the annual compliance risk assessment to the board of directors. A board member asks for clarification on how the assessment framework distinguishes between different categories of risk exposure. Which statement correctly describes the relationship between inherent risk, residual risk, and risk appetite in the compliance risk management framework? (Select one!)
AInherent risk and residual risk both measure the same level of exposure at different points in time, while risk appetite determines when additional regulatory capital must be held
BInherent risk measures the exposure before mitigating controls are applied, residual risk measures the exposure remaining after controls are implemented, and risk appetite defines the level of residual risk the institution is willing to accept
CInherent risk quantifies potential regulatory penalties, residual risk quantifies potential reputational damage, and risk appetite sets the dollar threshold for acceptable losses
DResidual risk measures the exposure before mitigating controls are applied, inherent risk measures the exposure remaining after controls are implemented, and risk appetite defines the maximum inherent risk the institution can tolerate
Explanation
In a compliance risk management framework, inherent risk represents the level of risk present in a product, service, or activity before any mitigating controls are applied. Residual risk is the risk that remains after the institution has implemented its control environment, including policies, procedures, training, monitoring, and audit programs. The difference between inherent and residual risk reflects the effectiveness of the control environment. Risk appetite is the level of residual risk that the board and senior management determine is acceptable for the institution to carry. Reversing the definitions of inherent and residual risk is a fundamental conceptual error. Treating them as identical concepts ignores the critical role that controls play in reducing exposure. Limiting these concepts to specific categories of consequences such as penalties or reputational damage mischaracterizes their purpose as comprehensive measures of overall compliance exposure.
3. Northwind Federal Bank's internal audit team has completed a compliance audit and identified 15 exceptions in adverse action notice procedures. Eight notices were missing the name and address of the credit reporting agency, and seven notices failed to include the consumer's right to obtain a free credit report within 60 days. The compliance officer must determine the root cause. What should the compliance officer recommend as the MOST effective corrective action? (Select one!)
AReport the exceptions to the board of directors as informational items and note them in the next regulatory exam response
BDiscipline the individual employees who issued the deficient notices and require them to retake compliance training
CDiscontinue the use of consumer reports in credit decisions to eliminate the risk of FCRA adverse action notice violations
DSend corrected adverse action notices to the affected consumers and update the notice template to include all required FCRA elements, then provide training on the updated procedures
Explanation
The most effective corrective action addresses both the immediate deficiency and the systemic root cause. Sending corrected notices to affected consumers remedies the harm, while updating the notice template ensures that future notices automatically include all required FCRA elements such as the CRA name, address, and phone number, the statement that the CRA did not make the decision, and the consumer's right to a free report within 60 days. Training on the updated procedures ensures staff understand the requirements. Disciplining individual employees without fixing the template does not address the systemic issue since the errors occurred across multiple employees, suggesting a template or process problem. Simply reporting to the board without corrective action fails to meet compliance management expectations. Discontinuing the use of consumer reports is an extreme and impractical response that would undermine the bank's lending operations.
4. Fabrikam Federal Bank's compliance officer is conducting a review of the institution's SAFE Act compliance. A loan officer at the bank takes residential mortgage loan applications from consumers and discusses available interest rates and repayment terms. The loan officer asks the compliance officer whether NMLS registration is required. What is the correct determination under Regulation G? (Select one!)
ARegistration is not required because employees of federally regulated depository institutions are exempt from all SAFE Act requirements
BRegistration is required only if the loan officer originates more than five residential mortgage loans per calendar year
CThe loan officer must register with the Nationwide Multistate Licensing System and Registry because taking applications and negotiating loan terms constitutes mortgage loan originator activity
DRegistration is not required because the SAFE Act registration mandate applies exclusively to employees of non-depository mortgage companies and brokers
Explanation
Under the SAFE Act and its implementing Regulation G (12 CFR Part 1007), any individual employed by a depository institution who takes residential mortgage loan applications or offers or negotiates terms of a residential mortgage loan must register as a mortgage loan originator with the Nationwide Multistate Licensing System and Registry. Bank employees who perform MLO activities are subject to federal registration requirements administered through the NMLS, including fingerprinting, an FBI background check, obtaining a unique NMLS identification number, and annual renewal between November 1 and December 31. Employees of depository institutions are not exempt from the SAFE Act; they follow the federal registration pathway rather than state licensing. There is no volume threshold that triggers registration; the requirement is based on the activities performed, specifically taking applications and offering or negotiating loan terms. The SAFE Act applies equally to employees of banks, credit unions, and non-depository mortgage companies, though the registration pathway differs. Only individuals performing purely administrative or clerical tasks, such as collecting documents for processing, are excluded from the MLO definition.
5. Litware National Bank is implementing new procedures to comply with the TCPA after recent regulatory changes. The bank's marketing department wants to send promotional text messages to existing customers who provided their cell phone numbers on account applications. What must the bank obtain before sending telemarketing text messages? (Select one!)
ANo additional consent is needed because the customers voluntarily provided their cell phone numbers
BConsent from the customers' wireless carrier authorizing the bank to send text messages
CPrior express written consent from each customer specifically authorizing telemarketing text messages
DOral consent from customers during their next branch visit or phone interaction
Explanation
Under the TCPA, telemarketing calls and text messages to cell phones require prior express written consent. Simply having a customer's cell phone number from an account application does not constitute consent for telemarketing communications. Prior express written consent must be in writing, signed by the consumer, clearly authorize telemarketing calls or texts, include the telephone number to be contacted, and cannot be a condition of purchasing any property, goods, or services. Oral consent is insufficient for telemarketing communications. Carrier authorization is not a TCPA requirement. The FCC has confirmed that DNC protections explicitly apply to text messages as of March 2024, and consumers may revoke consent in any reasonable manner, which must be honored within 10 business days. An established business relationship provides limited exemption from Do Not Call requirements but does not substitute for the PEWC requirement for telemarketing via autodialer or prerecorded messages to cell phones.
More ABA Practice Exams
Certified AML and Fraud Professional (CAFP)
CAFP · 750 questions
Certified Financial Marketing Professional (CFMP)
CFMP · 750 questions
Certified Enterprise Risk Professional (CERP)
CERP · 749 questions
Certified IRA Services Professional (CISP)
CISP · 700 questions
Certified Trust and Fiduciary Advisor (CTFA)
CTFA · 699 questions
$17.99
One-time access to this exam
Full access to all 700 questions
Or $15/mo for all 253 exams
Detailed explanations
Free preview stays available