Security, data and compliance in Automated Call Report Filer

How Automated Call Report Filer protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; preparing, reviewing and approving are separate permissions.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every load, adjustment, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose; US institutions are hosted in the United States region.

Tested releases

Every release passes security testing gates before it ships, and a software bill of materials is maintained for the product.

Requirements it supports

• FFIEC Consolidated Reports of Condition and Income (FFIEC 031, 041 and 051) and their instructions
• Federal Deposit Insurance Act, 12 U.S.C. 1817(a) (reports of condition)
• NCUA Form 5300 Call Report and its instructions
• NCUA reporting requirement for insured credit unions (12 CFR 741.6)
• US generally accepted accounting principles, as the Call Report instructions apply them
• Interagency Guidance on Model Risk Management (SR 11-7), for mapping and calculation logic

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally supported by Moraph staff at quarter end for data loads, mapping maintenance and form updates.

Limitations

• The Filer does not submit reports itself. A person at your institution approves the report and submits it through the FFIEC Central Data Repository or NCUA's filing system.
• Accuracy depends on the completeness and quality of the source data you provide and on mapping rules your institution approves.
• Accounting judgments, such as classifications and allowance estimates, are your institution's decisions; the Filer records them but does not make them.
• It covers the FFIEC 031, 041 and 051 and the NCUA 5300. Other regulatory reports, such as FR Y-9C or reports to state regulators, are not included.
• It is not a general ledger or allowance model; it uses the figures those systems produce.
• Form changes published by the agencies are added to the product, but your team should review each revised quarter before filing.
• It is designed for US reporting requirements; prudential reporting in other countries is not included.
• Signing and attestation requirements in the form instructions remain with your officers and directors.