POSITION SUMMARY:

Under the direction of the Chief Legal & Compliance Officer and with day-to-day guidance from the CMS Manager, the CMS (Compliance Management System) Analyst supports the administration and continuous improvement of the Company’s consumer Compliance Management System. The position has primary responsibility for complaint administration, compliance training coordination, and performing risk-based compliance testing for assigned regulatory oversight areas.

The position supports all CMS elements, including policies and procedures, risk assessments, monitoring and testing, complaint management, marketing and advertising review, third-party compliance oversight, regulatory change management, issue tracking, corrective action, training, and management reporting. The Analyst also supports enterprise oversight of GLBA and Regulation P privacy requirements, CAN-SPAM, COPPA, and UDAP/UDAAP requirements.

OBJECTIVES OF THIS ROLE:

• Supports the CMS Manager in maintaining a risk-based CMS tailored to the Bank’s size, complexity, products, services, delivery channels, markets, and third-party relationships.

• Administers the complaint-management and compliance-training programs and performs compliance testing for assigned laws, regulations, products, processes, and control areas.

• Helps verify that regulatory requirements are incorporated into business processes, employees understand their responsibilities, controls operate as intended, and identified deficiencies are corrected and tracked to resolution.

• Provides practical, timely support to business lines while maintaining appropriate independence, documentation, and escalation as part of the second-line compliance function.

• Supports enterprise oversight of privacy, commercial email, children’s online privacy, and unfair, deceptive, or abusive acts or practices.

RESPONSIBILITIES:

• Assist the CMS Manager and Chief Legal & Compliance Officer with the administration, documentation, and continuous improvement of the Company’s CMS and consumer compliance program.

• Administer the consumer complaint process, including intake, logging, categorization, assignment, aging, investigation follow-up, response tracking, quality review, escalation, closure documentation, and record retention.

• Review complaint responses for completeness, consistency, professionalism, and compliance risk. Escalate complaints involving potential legal violations, discrimination, UDAP/UDAAP, privacy, significant consumer harm, systemic issues, threatened litigation, regulators, or material reputation risk.

• Perform periodic complaint trend and root-cause analysis across products, channels, locations, customer segments, business units, and third parties. Prepare reports identifying recurring themes, control weaknesses, potential consumer harm, and recommended corrective action.

• Coordinate the compliance training program, including annual and event-driven training plans, training-needs assessments, course assignments, invitations, materials, attendance and completion tracking, overdue follow-up, exceptions, acknowledgments, testing of understanding, and retention of training records.

• Assist in developing and updating enterprise, role-based, regulation-specific, and Board compliance training. Review training content for accuracy and support assessments of training effectiveness.

• Perform risk-based compliance testing for assigned regulatory oversight areas in accordance with approved testing plans and procedures. Define or apply testing populations, samples, attributes, evidence requirements, exception criteria, and documentation standards.

• Document testing work in a clear and reproducible manner. Prepare testing memoranda that identify scope, methodology, results, exceptions, potential violations or consumer harm, root causes, and recommended corrective action.

• Communicate testing results to the CMS Manager and accountable business leaders. Enter findings into the Bank’s issue-tracking process and monitor corrective actions, due dates, supporting evidence, validation, and closure.

• Support development and maintenance of the annual risk-based compliance monitoring and testing plan using risk assessments, complaints, regulatory changes, new products, system changes, prior findings, audit and examination results, and other risk indicators.

• Support enterprise and regulation-specific compliance risk assessments by gathering data, interviewing process owners, documenting controls, evaluating supporting evidence, recording ratings and rationale, and tracking resulting action plans.

• Assist with compliance policy and procedure governance, including inventories, review calendars, drafting, routing, approvals, version control, implementation evidence, employee communication, and archival or retirement of superseded materials.

• Assist with compliance review of marketing, advertising, websites, social media, commercial email, direct mail, scripts, disclosures, promotions, and other customer-facing materials. Maintain review records, approvals, conditions, and re-review dates.

• Support compliance oversight of third-party service providers by gathering due-diligence materials, reviewing assigned compliance documentation, monitoring complaints and performance, tracking issues, and confirming that applicable providers are incorporated into risk assessments, monitoring, testing, training, and regulatory change activities.

• Provide support and research concerning GLBA and Regulation P privacy, CAN-SPAM, COPPA, and UDAP/UDAAP. Assist with privacy notices and opt-out processes, information-sharing reviews, commercial email controls, online data-collection reviews, and identification of potentially unfair, deceptive, or abusive practices.

• Support regulatory change management by monitoring assigned developments, documenting applicability and impact, identifying affected policies, procedures, systems, controls, training, marketing, and vendors, and tracking implementation tasks through completion.

• Assist with new products, services, delivery channels, marketing initiatives, system conversions, process changes, mergers and acquisitions, and significant vendor engagements by gathering information, documenting compliance requirements, and tracking pre-implementation conditions and validation.

• Prepare periodic CMS reports and dashboards covering complaints, training completion, testing status and results, findings, corrective actions, regulatory changes, marketing reviews, third-party compliance issues, and emerging risks.

• Maintain accurate, complete, organized, and retrievable CMS records that support the Bank’s risk assessments, testing, decisions, training, complaint handling, reporting, and corrective actions.

• Provide or coordinate documentation requested for internal audit, external audit, regulatory examinations, and other reviews. Assist with examination responses, finding remediation, and evidence of corrective action.

• Move across functional lines within the Compliance Department to assist with lending, deposits, fair lending, CRA, BSA/AML coordination, privacy, issues management, policy and procedure development, and third-party oversight.

• Perform other related duties as assigned.

QUALIFICATIONS:

Basic Qualifications:

• Bachelor’s degree in business, finance, accounting, risk management, law, public administration, or a related field.

• At least three (3) years of related experience in consumer compliance, bank operations, risk management, audit, complaint management, training administration, quality assurance, legal, or another highly regulated financial-services field.

• Direct experience with one or more CMS functions, such as compliance testing or monitoring, complaint administration, training coordination, risk assessments, policy governance, regulatory change management, or issue tracking.

• Working knowledge of consumer compliance principles, internal controls, testing methods, complaint management, root-cause analysis, corrective action, and regulatory examination expectations.

• Working knowledge of GLBA and Regulation P, CAN-SPAM, COPPA, UDAP/UDAAP, privacy and information sharing, marketing compliance, and third-party compliance risk.

• Ability to review transaction-level and process-level evidence, identify exceptions, document defensible conclusions, and communicate results clearly.

• Strong written and verbal communication, research, analytical, organizational, and critical-thinking skills.

• Ability to manage multiple assignments, meet deadlines, maintain accurate records, handle sensitive information, and follow issues through resolution.

Preferred Qualifications:

• Professional certification or specialized training such as Certified Regulatory Compliance Manager (CRCM), Certified Compliance & Ethics Professional (CCEP), Certified Information Privacy Professional/United States (CIPP/US), Certified Internal Auditor (CIA), or comparable compliance, audit, privacy, or risk-management training.

• Experience with governance, risk, and compliance systems; complaint-management platforms; learning-management systems; policy-management systems; issue tracking; testing software; or data-analysis tools.

• Experience preparing compliance testing workpapers, complaint trend reports, training metrics, risk assessments, or examination documentation.

• A Master’s degree, Juris Doctorate (JD), or other advanced degree

ADDITIONAL REQUIREMENTS:

LANGUAGE SKILLS

Ability to read, analyze, and interpret business publications, professional journals, legal documents, regulatory guidance, examination materials, contracts, policies, procedures, and governmental regulations. Ability to write reports, testing memoranda, complaint analyses, procedures, training materials, and business correspondence. Ability to present information and respond to questions from management, employees, auditors, and examiners.

MATHEMATICAL SKILLS

Ability to apply percentages, ratios, rates, sampling concepts, exception rates, trend analysis, risk scores, aging, and performance thresholds to compliance testing, complaints, training, and reporting.

REASONING ABILITY

Ability to define problems, collect and analyze relevant information, identify exceptions and root causes, assess control effectiveness and potential consumer harm, and draw well-supported conclusions. Ability to interpret technical instructions and address both abstract and concrete variables.

PHYSICAL DEMANDS

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to sit and frequently required to talk or hear. The employee is occasionally required to stand, walk, reach with hands and arms, and lift or move up to 10 pounds. Specific vision abilities include close vision and the ability to adjust focus.

WORK ENVIRONMENT

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. The noise level in the work environment is usually very quiet.

COMPLIANCE:

· As generally applicable to F&M Bank and commensurate with these job functions, this job role includes accountabilities for following Bank policies and related procedures, as well as regulatory requirements involving federal and state laws, regulations, and related guidance.

· Compliance with Bank Secrecy Act (BSA), including accurate completion of Currency Transaction Reports (CTR) when applicable, Anti-Money Laundering Act (AML), Office of Foreign Asset Control (OFAC) and the USA PATRIOT Act.  Adhere to Customer Identification, Customer Due Diligence and reporting of suspicious activities to the BSA Department.

EXEMPT/SALARIED COMPETENCIES:

· Job Knowledge: Understands duties and responsibilities, possesses necessary job knowledge and technical skills, maintains job knowledge current.

· Productivity: Manages a fair workload, volunteers for additional work, prioritizes tasks, develops good work procedures, manages time well, and handles information flow.

· Quality: Is attentive to detail and accuracy, is committed to excellence, looks for improvements continuously, monitors quality levels, finds root cause of quality problems, owns/acts on quality problems.

· Self-Development: Seeks out and accepts feedback, is a proactive learner, takes on tough assignments to improve skills, keeps knowledge and skills up to date, turns mistakes into learning opportunities.

· Adaptability: Ability to plan and organize work in new or changing situations, to apply self in emergencies and to respond to new procedures.