Best practices for compliance reviews as regulators ramp up scrutiny of branch offices