when I write up a review with regulatory violations, do I refer to the OCC regulations or the CFPB regulations?

I hate saying the following words: That depends.

There are a lot of regulations that the OCC has issued that remain OCC regulations. One example is the requirement in 12 CFR 21.21, "Procedures for monitoring Bank Secrecy Act (BSA) compliance." That's not an area in which the CFPB has any rulewriting authority.

On the other hand, the CFPB does have rulewriting authority for most consumer protection laws, such as most parts of the Fair Credit Reporting Act, which are found in CFPB Regulation V. The pieces of the OCC's regulation at 12 CFR Parts 41 and 171 deal with parts of the FCRA that weren't transferred to the CFPB by the Dodd-Frank Act.

If there is a CFPB regulation, can I assume (yes, I know) that I should use it? And if there isn't one, I use the OCC?