ÀÖÓ㣨Leyu£©ÌåÓý¹ÙÍø

• Scope: An expanded scope of regulatory scrutiny will include reporting and other key data outputs  (e.g., models, risk metrics, and compliance reports pertaining to fair lending, consumer protection,  and financial crimes).
• Traceability: Demonstrable ability to trace and report on the relationship between data outputs and  business processes, systems of record, and systems of origin.
• Heightened Standards: Increasing scrutiny of effective data risk management and compliance  program standards across business lines and key functions, and with clear roles, responsibilities, and  accountabilities for board, management and across 1st, 2nd, and 3rd lines.
• Classification: Data classifications, tiering, and risk ratings based on the level of sensitivity, integrity,  and availability, as well as the value and criticality of the data to the firm.
• Third-Party Data: Understanding of data sourced from, or shared with, third parties, as well as data  risk management and governance requirements embedded into third-party service agreements.

In 2024 firms should look for continuing regulatory focus on the following capabilities:

• Data Risk: Data risk defined through the risk taxonomy (e.g., data protection, data integrity,  and data resiliency) and metrics and processes to identify, measure, manage, and monitor  risk established at both the line-of-business and enterprise levels.
• Data Controls: Standardized data controls established around access and authorization, use,  privacy and security, and sharing with third-parties or other data aggregators. These controls  should align to the data risk taxonomy and show sustainability through a regular and robust  control testing function.
• Reporting: Holistic reporting on data risk and controls at the line-of-business, regional/  country, and enterprise levels.

Expect regulatory examinations to consider:

• Data collection: Prioritization of effective risk management and oversight of information  systems, data, controls, and procedures, including when data is:
  • Initially captured and processed, especially if the data is sensitive consumer information (e.g.,  biometric, genetics or health, demographic) or manipulated or altered (e.g., conversion from  structured to unstructured forms).
  • Acquired from, shared with, or sold to new data sources, including external third-parties or  data aggregators.
  • Migrated to new internal systems from old systems (e.g., legacy or decommissioned) or to  external (third-party) systems (e.g., cloud, part of an M&A transaction).
• Data Retention and Disposal: Scrutiny of data retention and recordkeeping, including  collection, storage, retention, and disposal practices under existing data retention, privacy, and  risk management regulations and guidance. Continuing supervision and enforcement focus on data associated with decommissioned systems/IT assets (e.g., end-of-life practices) and  recordkeeping associated with unauthorized channels or devices (e.g., SEC Regulation S-P)  will continue.