Reg DD compliance testing: a pilot on last quarter's notices

Reg DD compliance testing checks that a bank's deposit disclosures follow the Truth in Savings rules: account disclosures given on time and complete, change-in-terms notices mailed at least 30 days ahead, periodic statements showing the annual percentage yield earned and the fee totals, and advertising that states rates the way the rule requires. It is mostly document testing, which is why it is slow by hand and why a buyer should test any automation on documents the bank already knows. Botminds' Consumer Compliance Testing reads every disclosure and notice image beside the core record; the pilot described here runs it on a closed quarter your team has tested, and compares the two results before anything goes live.

How do you test Reg DD compliance?

Test each kind of document against its own clock and content, on its own population. Account disclosures are tested against new accounts opened in the period: did the customer get the disclosure before the account was opened, and does it carry every item the rule lists for that product (12 CFR 1030.4)? Change-in-terms notices are tested against the changes the bank made: was each adverse change noticed at least 30 calendar days before it took effect (12 CFR 1030.5(a))? Statements are tested against the account's own activity, and advertising against the rule's triggers.

The accuracy attribute needs arithmetic, not only reading. The rule rounds the APY to two decimal places and treats it as accurate within five hundredths of a percentage point either way (12 CFR 1030.3(f)). A tester has to recompute the APY from the rate and the compounding, then compare it with what the disclosure and the statement say. The Truth in Savings disclosure sample, mapped field by field shows where each figure on a disclosure comes from.

What are the most common Truth in Savings violations?

Disclosure basics, at least at FDIC-supervised banks. In 2025 the FDIC cited 74 Truth in Savings violations, and two sections accounted for 61% of them, split evenly: the general requirement to give disclosures clearly and conspicuously, in writing and in a form the customer can keep, and the account-disclosure requirements of section 1030.4 on timing and content (FDIC Consumer Compliance Supervisory Highlights, March 2026). Those are exactly the attributes that need the document, not the core record, to test.

Why a closed quarter is the right pilot

Because you already know the answers. A pilot on live data can only show what the software finds; a pilot on a quarter your team has tested shows what it finds that you found, what it finds that you missed, and what it gets wrong. Hold your own results back from the vendor, run the agents on the same quarter, and compare item by item.

A closed quarter also tests the parts of a program that a demonstration hides: whether the populations can be pulled and reconciled, whether the imaging system has every document, and whether the scripts read your forms as well as a sample form. The FDIC's own examination procedures for Regulation DD leave the sample size to examiner judgement and say it "should be increased until confidence is achieved that all aspects of the institution's activities and policies that are subject to the regulation are reviewed" (FDIC Consumer Compliance Examination Manual VI-3, May 2023). A full closed quarter gets there in one step.

The pilot, week by week

Four weeks is enough for two or three Regulation DD scripts on one quarter, provided read-only access to the core, the imaging system and the mail vendor's files is arranged before week one. The plan below is a starting point, not a fixed schedule.

In week two each test is written as one plain sentence, such as "every adverse change in terms was mailed at least 30 calendar days before it took effect, and stated the change and the date". In Consumer Compliance Testing an agent turns the sentence into attributes cited to the regulation, and any change to a script is dry-run on the prior quarter's items before the compliance manager approves it. In the pilot, the prior quarter is the test itself.

What the pilot compares: by hand and agents, one quarter

The comparison should be item by item, not a count of exceptions. Two programs that each find four exceptions may have found different four. The rows below are what to lay side by side for each script.

A pilot finds data gaps before it finds exceptions

How do you test change-in-terms notices?

Start from the changes, not the notices. The population is every change the bank made to a term it must disclose, and for each one the accounts it affected. Then four attributes: could the change lower the annual percentage yield or otherwise work against the customer; if so, did each affected account get a notice; did the notice include the effective date; and was it mailed or delivered at least 30 calendar days before (12 CFR 1030.5(a))? Three kinds of change need no notice: variable-rate changes, check-printing fees, and changes to time accounts of one month or less.

The 30 days is counted in calendar days from the mailing, so the evidence is the mail date, not the date the letter was approved. A vendor file of mailed notices is the natural control total. At the fictional sample bank, the change-in-terms population was 1,420 notices, matching the mail vendor's file, and an earlier finding had caught a savings product's change-in-terms letter mailed 27 days ahead: three days short.

How do you test account-opening disclosures?

Match every new account to its disclosure and its timing. The rule requires disclosures before the account is opened or a service is provided, whichever comes first; if the customer is not present, they may be mailed or delivered no later than 10 business days after; if the account is opened online, they must come before it is opened (12 CFR 1030.4(a)). That means three timing tests depending on the channel, and the channel has to come from the core's account-opening record.

Content is the second half. For a savings account that means the APY and interest rate using those terms, compounding and crediting, minimum balances and how they are determined, the balance computation method, fees and transaction limits; time accounts add maturity, early withdrawal penalties and renewal. The disclosures also have to match the legal terms of the account agreement (12 CFR 1030.3(b)), so a fee schedule that disagrees with the core's fee table is an exception even if every item is present.

Each script re-tested blind, with agreement shown by script

How do you test periodic statements?

Recompute what the statement says from the account's own history. A statement must show the annual percentage yield earned, the interest earned, the fees debited by type, and the length of the period or its dates (12 CFR 1030.6(a)), and, where the bank charges them, overdraft and returned-item fee totals for the period and the year to date. The APY earned has its own formula in Appendix A: 100 × [(1 + interest earned ÷ balance)^{365 ÷ days in period} − 1], where the balance is the average daily balance for the period (Appendix A to Part 1030). A statement that prints the account's disclosed APY instead of the APY actually earned fails, however close the two are.

Statements are often where full population testing stops. Statement images may be kept for a short window or rendered on demand, and a test cannot read what it cannot retrieve. The fictional sample bank keeps its statement test as a sample of 40 for that reason, and has the second agent re-test all 40 at year end.

How do you test savings advertising?

Collect every ad that ran, then test each against its triggers. If an ad states a rate, it must be the annual percentage yield, using that term at least once; the interest rate may appear only alongside it and no more conspicuously (12 CFR 1030.8(b)). Stating an APY triggers further disclosures where they apply: that a variable rate may change, how long the APY is offered or the date it was accurate, the minimum balance to earn it, any higher minimum to open, that fees could reduce earnings, and time-account terms. An account may not be called "free" if a maintenance or activity fee may be charged. Broadcast, outdoor and indoor-sign ads have partial exemptions; internet ads do not.

The population is the hard part, because social posts, web banners, posters and email campaigns live with marketing, not compliance. At the sample bank an earlier finding had caught two savings ads showing a rate without its APY conditions, and by late October the issue was overdue and escalated to the chief compliance officer.

What the pilot needs from IT and the business

Read-only access to the core's account-opening, fee and statement data; to document imaging for disclosures, notices and statements; and to the mail vendor's files for change-in-terms notices. A list of the quarter's product changes and the ads that ran. Your sealed hand-test results. And someone from deposit operations who can say what a field means. Nothing in the pilot should write to a bank system; findings stay in the pilot until the bank decides to go live.

What proves the pilot worked?

Agreement with what you know, value in what you did not, and a false-alarm rate your analysts can live with. Set the bar before the run, in writing, so the result cannot be argued into a pass afterwards: the same discipline a testing program needs, and the subject of testing into compliance.

A pilot also shows what it does not cover. Advertising tests need the ads; statement tests need statement images, which some banks keep only for a short window, so a sample may remain the honest method there. Retention is part of the test: evidence of compliance must be kept at least two years (12 CFR 1030.9(c)), and the FDIC's procedures suggest keeping sample disclosures for each type of account, ads and change-in-terms notices (FDIC VI-3). The Consumer Compliance Testing page shows how the pilot's scripts become the live library, and the total cost of the options covers what to weigh once the pilot is in.

Questions people ask

How long should a compliance testing pilot run?

Long enough to cover one full closed quarter for two or three scripts: about four weeks, most of it data access and comparison. A pilot shorter than a quarter cannot be compared with your own quarterly results.

What records does Reg DD require?

Evidence of compliance for at least two years after disclosures were required or action was required. The FDIC's procedures describe procedures for paying interest and giving timely disclosures, plus sample disclosures, advertisements and change-in-terms notices for each account type, and rate and balance information sufficient to verify interest paid.

How do you test the APY on a statement?

Recompute the annual percentage yield earned from the interest earned, the balance and the days in the period under the formula in Appendix A, and compare it with the statement. The figure is accurate if within 0.05 of a percentage point. The statement must also show the interest earned, fees by type and the period's length or dates.

Do overdraft fee totals belong in a Reg DD test?

Yes. Each periodic statement must show total overdraft fees and total returned-item fees for the period and the calendar year to date, using the term "Total Overdraft Fees", in a format like Sample Form B-10 (12 CFR 1030.11(a)). The totals can be recomputed from the fee history and compared with the statement.

Can a pilot use live data?

It should use real data from a closed period, read only. The point is your forms, your systems and your known results; synthetic data proves only that the software works on synthetic data.

Who should sign off a pilot?

The testing manager, who owns the comparison, and the compliance manager or chief compliance officer, who owns the decision. Inviting internal audit to read the workpapers before go-live saves a later debate about whether the new testing can be relied on.