Compliance testing services, in-house or agents: the total cost

Compliance testing services are outside firms, usually audit, accounting or consulting practices, that test a bank's compliance with consumer rules on a sample of transactions, typically once a year or on a rotating schedule, and deliver workpapers and a report. Their price is rarely published, so the useful comparison is not fee against fee but total cost against what each option tests: an outside firm, a team of in-house analysts, or agents doing the reading with the bank's own analysts deciding. For deposit and payment rules the total includes a cost nobody invoices: the quarters an error keeps running before anyone finds it. Botminds' Consumer Compliance Testing is built for that third option, testing every Regulation CC, E and DD item the data allows.

What do compliance testing services do, and what do they cost?

An outside firm brings people who have tested many banks, a work program kept current with the rules, and independence from the business it tests. Typical deliverables are a scope letter, sampled transaction testing by regulation, workpapers, a findings report and an exit meeting. The FDIC's examination manual allows the work to be "contracted to an outside firm or individual, such as a consultant or accountant", provided the firm is well-versed in consumer compliance and the program is "based on current law and regulation" (FDIC Consumer Compliance Examination Manual II-3, June 2019).

What it costs depends on scope, the number of regulations, branches and products, and how many items are tested, and firms quote per engagement. No government or academic source publishes a price list, and this page does not invent one. The St. Louis Fed study does show where the money sits: of five cost categories (data processing, accounting and auditing, consulting and advising, legal and personnel), personnel was by far the largest, and consulting and legal the smallest shares of noninterest expense (St. Louis Fed, 2016). Most banks already pay for testing mainly in salaries.

Three ways to run a testing program

The three options are not substitutes in every respect, and the comparison only works if each is described by what it actually produces. The rows below set them side by side for the high-volume deposit tests: exception holds, Regulation E claims and Regulation DD notices.

What does compliance testing cost per item?

Per tested item, the arithmetic is simple and almost nobody does it. Add up what a quarter of testing costs: the people hours at a loaded rate, any outside fees, and any platform. Divide by the items actually tested. Then add the term most budgets leave out, the cost of what the program missed or found late.

A worked example shows how the first term behaves. Take the fictional sample bank: two analysts, 14 scripts and 840 sampled items in a quarter, of which the estimate puts 10 business days on reading alone. At the federal median wage for compliance officers, $38.81 an hour in 2025 (O*NET OnLine, 13-1041.00), if both analysts read full time for those ten days, that is about $6,200 in wages before benefits, or about $7.40 for each item read. It looks cheap until it is divided by what the items found: four exceptions in the second quarter's 840 items, against nineteen in the third quarter, when 9,012 items were tested.

The cost nobody invoices: a finding a quarter late

The fourth term is usually the largest, and it grows with time. At the sample bank, two branches printed a retired hold notice form from July 1, 2025. Every large-deposit hold there held the whole deposit instead of the excess over $6,725. When every hold was finally tested in the third quarter of 2026, the look-back found 27 customers over five quarters, roughly five a quarter, each with $6,725 held past the day it was due. Three paid a $34.00 overdraft fee while their funds were held: $102.00 to refund.

The refund is small. The duration is not. The interagency rating system weighs every violation's root cause, severity, duration and pervasiveness, and treats a violation that ran for a long time as more serious than one that was brief (FFIEC Uniform Interagency Consumer Compliance Rating System, 81 FR 79473). A 60-item sample, quarterly or annual, would most likely have drawn none of the affected holds, and an annual review that missed them would not have looked again for a year.

Found with its cause, its reach and its cost to customers

Regulators currently put the weight on getting customers paid. The CFPB's 2025 statement of priorities says the Bureau will put getting money back to harmed consumers ahead of penalties (CFPB, Supervision and Enforcement Priorities, April 2025), and FDIC-supervised banks paid $4.7 million in voluntary restitution to 47,902 consumers in 2025, separately from about $1.2 billion ordered by the FDIC (FDIC Consumer Compliance Supervisory Highlights, March 2026). Every quarter an error runs undetected adds names to that kind of list.

The work an outside review still leaves with the bank

An outside firm reads; the bank still fetches. Someone at the bank pulls each population, answers the sample request, finds the notice images and claim files, explains the systems and reviews the draft findings. On the sample bank's estimate for its own sampled quarter, nine of the 31 business days went on populations, sample draws and document requests before anyone read an item, and that share does not shrink when the reader is outside the building. Price it with the rest: the operations and IT hours spent serving a review are part of its cost, even though no invoice shows them.

The deliverable has its own standard. The FDIC expects a written compliance audit report to set out the scope, the deficiencies found, the transactions sampled by product type and the corrective actions with time frames, and the findings to go straight to the board or its committee (FDIC II-3). A testing service sold as monitoring rather than audit should still deliver that much, so that its work can be relied on later by audit and by examiners.

Should a bank outsource compliance testing?

Outsource independence; keep the routine. An outside firm is the natural choice for the independent compliance audit, for rules the bank tests rarely, and for a small bank without anyone to run a program. It is a poor fit for the quarterly, high-volume deposit tests, where the value is in testing soon after the quarter and finding causes while they are still running.

Whatever is outsourced, the responsibility is not. The Federal Reserve's examiners put it plainly: "an institution has a nondelegable duty to maintain an effective consumer compliance program" (Consumer Compliance Outlook, 2013). The same article lists what an outsourcing contract should settle, drawn from the interagency policy on outsourced internal audit: that reports belong to the bank, where the workpapers are kept, how long the vendor keeps them ("for example, seven years"), and that examiners get full and timely access. The FDIC adds due diligence: the compliance officer should verify that the provider is qualified, because the board and management stay as responsible for the outsourced testing as if their own staff had done it (FDIC II-3).

How many analysts does a testing program need?

Fewer than the reading would suggest, if the reading is not theirs. The FDIC accepts that small banks may not need a full-time compliance officer and may split duties by regulation, as long as responsibility is clear and resources match the size and complexity of the bank's operations (FDIC II-3). The sample bank runs 14 deposit scripts with two analysts and a compliance manager.

What changes with agents is not the headcount floor but what the analysts' days are for. On the sample bank's third quarter, the agents tested 9,012 items and the two analysts decided 19 exceptions, each laid out beside its evidence, plus one disagreement between the two agents. Their weeks went to calls, causes and conversations with branches. A compliance testing manager's quarter, week by week follows those weeks in detail.

Can agents replace outsourced testing?

They can replace the sampled, periodic testing of high-volume deposit rules. They cannot replace the independent audit, because agents run by compliance are part of compliance's own monitoring. The OCC expects the audit function to be staffed by independent, qualified auditors who test controls and validate management's corrective actions (OCC Comptroller's Handbook, Compliance Management Systems, June 2018). A bank that moves its routine testing to agents should keep an independent audit, and will find it easier to run: every result already has its evidence and every decision its signer. Compliance testing and audit are two jobs, and examiners judge them separately.

The fix has an owner, a due date and a re-test before it closes

Budgeting for the agents option

Four lines cover it. The platform itself. Read-only connections to the core, document imaging, the dispute system, the contact center's call notes and teller platform settings, which is usually the longest lead item for IT. Set-up from the bank's own material: its testing program, its scripts and a quarter of past populations and notices, which also become the first back-test. And validation: internal audit, and model risk where the bank has the function, will want to see how the agents' results are checked before relying on them.

Against those lines sit the savings and the gains. The saving is the analysts' reading time and the days to findings; the gain is coverage, which is where the fourth term of the formula above, the cost of late or missed findings, falls. A buyer should insist on seeing all three on its own data before signing.

What to ask any testing provider or platform

The same questions work for an outside firm and for software, because both are answers to one problem: proving, item by item, that the rules were followed. Ask for each answer on a quarter of your own data.

The buying case for Botminds' Consumer Compliance Testing rests on those questions rather than on a price comparison: every item tested where the data allows, populations reconciled before testing, notices read beside the core record, a blind re-test, and findings in days rather than weeks. Its design target is about 9 business days from the run to approved findings. A pilot on last quarter's notices is the way to test that claim on your own files before paying for it; the Consumer Compliance Testing page shows each screen.

Questions people ask

How much do compliance testing services cost?

Firms quote per engagement, by scope, number of regulations and items tested, and no public source publishes rates. Compare quotes per tested item and per week to findings, and add the cost of what a sample can miss. For most banks the larger existing cost is staff: personnel was over 60% of compliance spending in the St. Louis Fed study.

What do outside compliance reviewers test?

Usually a sample of transactions per regulation in scope, such as exception holds, Regulation E claims and account disclosures, plus a review of policies, procedures and training. The FDIC expects any outsourced audit program to be based on current law and comprehensive in scope.

How long do outsourced reviews take?

Fieldwork is often a few weeks, but the clock that matters runs from the first error to the approved finding. An annual review can find an error many months after it started; quarterly in-house testing on the sample bank's estimate took 31 business days from the run to approved findings, and the agents' design target is about 9.

What does compliance cost a community bank?

In the St. Louis Fed's study of 2014 data, compliance averaged 8.7% of noninterest expense at banks under $100 million in assets and 2.9% at community banks of $1 billion to $10 billion. Personnel was the largest category in every size group.

Is outsourced testing more independent than in-house testing?

Yes, and that is its main value. An outside firm with no role in the business or in compliance can serve as the independent audit. In-house testing, whether by analysts or agents, is management's own monitoring and should be audited by someone independent of it.

Can a small bank use agents for testing?

Yes; the volume that makes sampling necessary is the same at a small bank, and the reading is what agents take. The revised model risk guidance of April 2026 is aimed mainly at banks over $30 billion, but any bank should be able to show how it checks the agents' results, for example with a blind re-test.