Flood insurance civil money penalties are the one consumer-compliance sanction with almost no discretion in it. Where examiners find a pattern or practice of violations of the Flood Disaster Protection Act, a penalty "shall be assessed", at up to $2,000 for each violation in the statute's words — a ceiling the agencies raise for inflation every year — for any violation occurring in the previous four years — and selling the loan afterwards does not end the liability. That makes the exposure arithmetic rather than judgement: a count, multiplied by a capped amount, over a window. Botminds' Collateral Insurance & Lien Tracking is built so that the count is small and the evidence for each item is already on the file, dated, before anyone asks for it.
The penalty rules, the published figures and the enforcement order quoted below are real and cited where they appear. The bank, loans and people in the sample screens are fictional sample data from the solution.
Flood insurance civil money penalties, as arithmetic
Three statutory sentences set the whole structure, and each one removes a degree of freedom a bank might hope for.
The first removes discretion about whether to assess. Any regulated lending institution "that is found to have a pattern or practice of committing violations under paragraph (2) shall be assessed a civil penalty by the appropriate Federal entity for lending regulation in the amount provided under paragraph (5)" (42 U.S.C. § 4012a(f)(1)). The second sets the unit: a civil monetary penalty "may not exceed $2,000 for each violation" (§ 4012a(f)(5)). The third sets the window: no penalty may be imposed "after the expiration of the 4-year period beginning on the date of the occurrence of the violation" (§ 4012a(f)(10)).
The exposure, term by term
Violations found
× the count
Each loan with a missed determination, a missing notice, a failure to place, or insufficient coverage is its own violation. One procedural weakness across a book produces a count, not an incident.
The examiner’s sample, extrapolated to the population
Amount per violation
≤ $2,000, adjusted for inflation
A cap, not a tariff: $2,000 in the statute, $2,730 in the Federal Reserve’s current inflation-adjusted table. Assessed amounts per violation are frequently below it, which is why a published total divided by the cap gives a floor on the count, not the count.
42 U.S.C. § 4012a(f)(5); 12 CFR § 263.65
The window
4 years back from each occurrence
Measured from the date of the violation, so a weakness that has run for three exam cycles is still live for the most recent four years of it.
42 U.S.C. § 4012a(f)(10)
What does not reduce it
− nothing for selling the loan
A sale or transfer after the violation does not affect the transferring lender’s liability.
42 U.S.C. § 4012a(f)(7)
What is a pattern or practice of flood violations, and who decides it?
The examining agency decides, and the statute does not define the phrase. In practice it is a supervisory judgement about whether what the examiners found is a repeated failure arising from how the institution operates, rather than isolated human error — and the signals are familiar: the same violation type appearing across unrelated loans, a weakness in a procedure rather than in one file, a finding repeated from a previous examination, or a control that was never designed at all.
An enforcement order shows the reasoning in its own words. In the Bank of Hawaii order, the Board recited that "where a pattern or practice of violations under section 102(f)(2) of the Act, 42 U.S.C. § 4012a(f)(2), is found, the Act requires that civil money penalties be imposed of up to $2,000 for each violation under section 102(f)(5) of the Act", and then: "the Bank is assessed and shall pay a civil money penalty in the amount of $15,500" (Order of Assessment, Docket No. 25-002-CMP-SM, February 2025).
Two things follow for a bank reading its own exam findings. A handful of flood exceptions is not automatically a pattern — but a handful that all share one cause usually is, because the cause is the pattern. And the way to argue the point is with evidence that the control exists and normally works: dated determinations, dated notices, dated placements across the population, not just corrected files for the exceptions found.
How much is the penalty per violation?
The statute says up to $2,000 per violation, and that is the figure the Bank of Hawaii order recites. The agencies are required to adjust their civil money penalty ceilings for inflation every year, so the working cap is higher: the Federal Reserve's table lists $2,730 for a flood violation under § 4012a(f)(5) (12 CFR § 263.65), and each agency publishes its own. The amount actually assessed is set by the agency on the facts and is often lower, which is why a published total tells you less than it appears to.
The sizes are instructive. In 2024, the Federal Reserve "issued four orders, assessing approximately $115,400 in civil money penalties against four state member banks to address flood insurance regulatory violations" (Federal Reserve Annual Report, Consumer and Community Affairs). Four orders, one agency, an average under $30,000: these are not headline enforcement actions. They are the ordinary cost of a desk that was not keeping its dates.
What a count is worth at the statutory cap
Since the count is the only variable a bank controls, the economics of fixing the desk are simple. Every month of a missing control adds loans to the population from which a count will one day be drawn, and the window means roughly four years of them are collectable at any moment.
What the published orders show, and what they do not
Enforcement orders are public, dated and specific about the amount, and silent about almost everything a bank would like to know. The Federal Reserve's four 2024 flood orders totalled approximately $115,400 across four state member banks. The next year's Bank of Hawaii order, dated 24 February 2025, was $15,500 against a state member bank under Regulation H. Neither the annual report nor the order states how many violations sat behind the figure, how they were distributed across the four violation types, or how many loans the examiners sampled to get there.
The FDIC's own figures for 2025 show the other end of the range and the care needed in reading it: the agency reports civil money penalty orders "totaling approximately $150 million against institutions to address violations of the FDPA and Section 5 of the Federal Trade Commission Act for Unfair or Deceptive Acts or Practices" (FDIC Consumer Compliance Supervisory Highlights, March 2026). That aggregate covers two very different statutes in one sentence, and it would be wrong to present it as a flood number.
What the orders are good for is calibration of a different kind. They establish that these penalties are routine rather than exceptional, that they land on banks of ordinary size, and that the unit of account is the violation. A committee paper arguing for a second flood analyst is better built on the count the bank itself can estimate — how many loans a four-year look-back would put in scope, and how many of them have a date missing — than on somebody else's published total.
How far back can an examiner go?
Four years from the date of each violation. That is a rolling window, not a window that opens at the exam: a violation that occurred five years ago has dropped out, and one that occurred last quarter will still be live at the next two examinations. It has an uncomfortable consequence for a bank that has just discovered a weakness — the population at risk is not the loans booked since the last exam, it is four years of them.
A four-year look-back against one loan's flood history
- Year 1 · origination determination (outside the window)dropped out
- Years 2–5 · renewals, a map change, a lapse and a placementall collectable
- The determination form and the record of notice: for as long as the institution owns the loanlife of ownership
The violation examiners cite most often, and why it is the easiest to prevent
Flood is a small share of all consumer-compliance findings and a large share of the ones with a mandatory penalty attached. The FDIC's most recent supervisory highlights put the numbers in one place: "the FDIC cited 1,155 violations of consumer protection statutes and regulations in 2025", of which the Flood Disaster Protection Act and 12 CFR part 339 "represented 131 violations" (FDIC Consumer Compliance Supervisory Highlights, March 2026).
Flood in the 2025 examination findings
1,155
consumer protection violations cited by the FDIC in 2025, across all statutes
131≈11%
of them under the Flood Disaster Protection Act and 12 CFR part 339
41%
of those flood violations were the same failure: no flood insurance when it was required
The concentration is the useful part. "The most cited FDPA/Part 339 violation related to institutions' failure to provide flood insurance, when required," the FDIC reports: adequate cover must be in place when a loan secured by a building in a special flood hazard area "is made, increased, extended, or renewed", and "this section represented 41 percent of the total FDPA violations cited in 2025."
Two in five flood violations, in other words, are a single check at a single moment — a check with a known trigger, a known test and a documented answer. Working out the required amount is the hard half of that check; noticing that a renewal or an increase has happened is the half that automation removes entirely, because the trigger is an event in the loan system rather than a document in an inbox.
Does selling the loan end the exposure?
No. The statute closes that door explicitly: any sale or other transfer of a loan by an institution that has committed a violation, occurring after the violation, "shall not affect the liability of the transferring lender with respect to any penalty under this subsection" (§ 4012a(f)(7)).
"Any sale or other transfer of a loan by a regulated lending institution that has committed a violation … that occurs subsequent to the violation, shall not affect the liability of the transferring lender with respect to any penalty under this subsection."
42 U.S.C. § 4012a(f)(7)
This matters more than it reads. A bank that originates and sells, or that exits a portfolio, carries its flood history with it for the rest of the four-year window — and will be asked for files on loans it no longer services. The retention duty tracks ownership, so a bank that disposes of a portfolio and then disposes of the files has kept the liability and lost the evidence. Agreeing at the point of sale how determination forms and notice records will be preserved is cheap; reconstructing them is not possible.
The flood file an examiner asks for, item by item
Flood examination is document-led, and the documents are specified. The regulation requires the institution to "retain a copy of the completed standard flood hazard determination form, in either hard copy or electronic form, for the period of time the … institution owns the loan" (12 CFR § 339.6(b)), and to "retain a record of the receipt of the notices by the borrower and the servicer for the period of time the … institution owns the loan" (§ 339.9(d)).
Eight items that make one loan's flood file defensible
- The standard flood hazard determination form
For each building, retained for as long as the institution owns the loan. Required by § 339.6(b), and the first thing requested.
- The notice of special flood hazards, and proof the borrower received it
A record of receipt by the borrower and the servicer, kept for the same period. Required by § 339.9(d).
- The required-amount working, per building
Loan balance, structure type, statutory limit and insurable value, with the source of the insurable value named.
- Evidence of cover in force, at each trigger
At making, increase, extension and renewal — the four moments where 41 per cent of cited violations occur.
- The lapse date, the determination date and the notice date
Three different dates. The spread between the first two is what an examiner measures, and an unexplained gap is the finding.
- The force-placement decision, with who approved it
Amount, effective date, approval, and the reasonable explanation if the purchase fell after day 45.
- The termination and refund, where cover was later proved
The confirmation received, its date, and the termination and refund inside 30 days of it.
- Map changes affecting the collateral, with their effective dates
A remapping makes the map’s effective date the determination date; a file without it cannot show the bank acted on time.
Building the record as the work is done, not after the letter
The difference between a bank that handles a flood examination well and one that does not is rarely the quality of its procedures document. It is whether the dates exist. A desk that works from diaries and email produces an exam file by reconstruction: someone searches mailboxes for the notice, finds the certificate, infers the determination date from a note, and writes a memo explaining the rest. That file is slow to produce, incomplete in predictable places, and weakest exactly where the examiner looks hardest — the gap between lapse and determination.
The alternative is to make each step record itself as it happens, because each step is already a transaction: a determination is read, a required amount is computed, a notice is approved and sent, a placement is approved, a confirmation arrives. On the sample bank's desk that produces a flood examination file for a period — 1 January 2026 to 12 April 2027 in the sample — containing the loans in special flood hazard areas and every determination, notice and force-placement with its date, downloadable as one document with its history attached. Every change to the bank's own rules is kept as a new version with a date, so a reviewer can see which rule was in force when a decision was made.
Every running clock and dated step, in Collateral Insurance & Lien Tracking
Notices and placements, each waiting for a named approver
One loan, every requirement and every dated step
When the share of flood findings goes into a committee paper, use the current edition: 131 of 1,155 FDIC citations in 2025, about 11 per cent, and say which year the figure describes. To see determinations, clocks, placements and the dated file in one place, start from Collateral Insurance & Lien Tracking. The equivalent discipline on the lien side is taking every UCC lapse date from the state's own acknowledgment.
Questions people ask
What are civil money penalties for flood insurance violations?
They are penalties assessed by a bank's federal regulator when examiners find a pattern or practice of violations of the Flood Disaster Protection Act — missed determinations, missing notices, insufficient coverage, or a failure to force-place. The statute says such a penalty "shall be assessed", so the agency has discretion over the amount but not over whether to act once the finding is made.
How much is the penalty per flood insurance violation?
The statute says no more than $2,000 for each violation, and the agencies raise that ceiling for inflation every year — $2,730 in the Federal Reserve's current table. Agencies commonly assess less per violation, so a published total is a floor on the count rather than a guide to it. Totals in practice run from a few thousand dollars to the low hundreds of thousands: the Federal Reserve's four flood orders in 2024 came to approximately $115,400 in aggregate.
How far back can regulators look at flood violations?
Four years from the date each violation occurred. The window rolls, so violations age out individually rather than all at once at an examination. Retention duties run longer: the determination form and the record that the borrower and servicer received their notices must be kept for as long as the institution owns the loan.
What is the most common flood insurance violation?
Failing to have adequate flood insurance in place when required. The FDIC reports that this single requirement — cover in place when a loan secured by a building in a special flood hazard area is made, increased, extended or renewed — accounted for 41 per cent of all flood violations it cited in 2025. It is also the easiest to prevent, because the trigger is an event in the loan system rather than a document that has to arrive.
What records does an examiner ask for in a flood review?
The standard flood hazard determination form for each building, evidence that the borrower received the notice of special flood hazards, the working behind the required amount, evidence of cover at each trigger event, the lapse, determination and notice dates, and the approval and dates behind any force-placement, termination and refund. Two of those — the determination form and the record of notice receipt — are explicit retention requirements in the regulation.
Does selling the loan end the liability?
No. A sale or transfer occurring after a violation does not affect the transferring lender's liability for a penalty. The practical trap is evidence rather than liability: a bank that sells a portfolio keeps the exposure for the rest of the four-year window, so it needs to settle at the point of sale how determination forms and notice records will remain available to it.