What software do banks use for compliance testing? Four approaches

Banks use four kinds of software for compliance testing. Spreadsheets carry most sampled testing. Governance, risk and compliance (GRC) platforms run the workflow around it: plans, assignments, results and issues. Rules engines test structured data in the core, such as hold codes, amounts and dates, on every record. And agents, the newest kind, read the documents as a tester would: the hold notice, the error-resolution letter, the disclosure. The choice matters because the evidence for most deposit rules is split between the core and a document, and only some of these tools look at both. Botminds' Consumer Compliance Testing is built on agents, and this page shows all four on one Regulation CC exception hold so the difference is concrete.

What software do banks use for compliance?

Across compliance as a whole, banks run a stack: the core banking system and its settings, document imaging, dispute and complaint systems, a GRC or issue-management platform, regulatory change tools, and spreadsheets in between. Testing borrows from all of them. The testing program's own tool is usually a spreadsheet or a GRC module, and the work of getting evidence into it is done by people.

Regulators judge the result, not the tool. The GAO's 2025 review of artificial intelligence in financial services found that federal regulators oversee it mainly through the laws, guidance and risk-based exams they already have, and that the regulators themselves have started to use AI in supervision (GAO-25-107197, May 2025). For a buyer, that means the same questions apply to every option: what was tested, against what evidence, and who decided.

One exception hold, four kinds of software

The hold is from a fictional sample bank. A customer deposited a $9,800.00 insurance settlement check on Friday, August 14, her only deposit that day. The large-deposit exception allowed the bank to hold the part above $6,725, which is $3,075.00, beyond the normal schedule (12 CFR 229.13(b)). The core held all $9,800.00 until Tuesday, August 25, and the notice the teller printed said "Amount delayed: entire deposit" and quoted the threshold retired on July 1, 2025. Here is what each kind of software sees.

Spreadsheets and a sample: the default

A spreadsheet is still the most common testing tool, and in skilled hands it tests the right things: an analyst reads the notice and the core screen together and records each attribute. Its limit is not the spreadsheet but the reading. Because every item needs a person, the program samples, about 60 items a script, and on 1,512 holds that puts the Brennan hold in the sample about four times in a hundred. What a 59-item sample can prove works through the odds for the whole cluster.

GRC platforms: the workflow around the test

A GRC platform organises testing: the risk assessment, the schedule, test steps, assignments, sign-offs, issues and reports to the board. That is real value, because examiners read the schedule and the issue trail. But a GRC platform records results; it does not produce them. The tester still reads the notice and types the answer in. When a vendor says its GRC tool "automates testing", ask which step it automates: usually the routing.

Rules engines on core data: every hold, but not the notice

A rules engine is the strongest of the traditional options on structured attributes. Given the day's deposits, the hold code, the amount held and the release date, it can compute on every hold what the exception allowed and flag the Brennan hold, and the five others like it, as holding too much. That is genuine full-population testing for the attributes the core can answer.

It cannot answer the others. The rule requires a written notice that states the account, the date of the deposit, the amount being delayed, the reason and when the funds will be available (12 CFR 229.13(g)). That notice is an image, often printed at a teller window from a form the core never sees. So the rules engine finds six amount failures with no reason attached, and the reason, a retired form still printing at two branches, sits in the documents and the teller platform settings. The Federal Reserve's examiners have long pointed at those settings: "Testing is especially important on new platforms and models as well as updates to existing ones" (Consumer Compliance Outlook, 2013).

Agents that read the notice beside the record

Agents close the gap by doing what the analyst does, on every item: open the notice image, read it, compare it with the core record attribute by attribute, and cite both for every failure. On the Brennan hold that means two failed attributes, with the arithmetic laid out: $275.00 was due Monday, August 17, $6,450.00 on Tuesday, August 18, and only $3,075.00 could be held longer. Then the step that turns exceptions into a finding: the six holds share a form, the form is retired, and the teller platforms at two branches still print it.

The notice the customer got, beside the hold the core recorded

Can compliance software read notice images reliably?

It can read them well enough to test, provided the design assumes it will sometimes be wrong and catches it. Three controls do that. A confidence floor sends any item the agent is unsure of to a person; the default in Consumer Compliance Testing is 0.95. A second agent on a different model family re-tests every exception and a random 5% of passes without seeing the first answer; on the sample bank's quarter, it agreed on 468 of 469. And a missing or unreadable image is reported as missing, never passed.

Those controls also answer the model risk question in a form an examiner can check. The interagency model risk guidance revised on April 17, 2026 sets out principles rather than rules, and the FDIC expects it to matter most to banks with more than $30 billion in assets (FDIC FIL-15-2026). Whatever a bank's size, the OCC's examiners ask whether a bank tests its automated processes enough to rely on what they produce (OCC Comptroller's Handbook, Compliance Management Systems). A quarterly agreement rate from a blind re-test is that evidence.

A rules engine can prove the bank held too much. Only the notice can show what the customer was told, and the cause usually lives there.

What each approach needs from your systems

Spreadsheets need people and a population extract. A GRC platform needs the testing program loaded as plans, steps and owners, and someone to keep it current. A rules engine needs clean structured data: hold codes, deposit amounts by banking day, release dates, account-opening dates and channels, usually in an extract that IT builds and maintains. Agents need the same structured data plus read access to the images, the dispute system, the call notes and the teller platform's form settings.

That last list is the real cost of reading documents, and it is also where the cause of most deposit errors lives. In the sample bank's hold test, the core alone could show that six holds were too large. Only the teller platform settings and the form register showed why: two branches were still printing a form retired more than fifteen months earlier.

Using a rules engine and agents together

They are complements more than rivals. A rules engine is cheap per record, fast and transparent on attributes that live in fields, and many banks already have one in the core or the data warehouse. Agents are the tool for attributes that live in documents and for finding causes. A sensible design lets structured checks run where the data is structured and sends the document attributes, and the exceptions, to agents and people. What matters to an examiner is that every attribute is tested by something, every result cites its evidence, and nothing passes for want of a document.

Security and access questions to ask

Testing touches account data, so the access model is part of the purchase. Ask whether every connection is read only, which system the tool writes to and why, how account numbers are masked in workpapers and exports, who can see which issues, and whether anything about suspicious activity reports can be read or shown. In Consumer Compliance Testing the only write is to the issue register, workpapers show the last four digits of an account, and testing never reads or shows whether a SAR exists. Ask too whether anyone, administrators included, can edit the audit trail, and whether exports are themselves recorded. A tool that cannot answer those in writing is not ready for a bank's information security review.

How do you compare compliance monitoring software?

On your own quarter, against questions whose answers you can check. A demonstration on a vendor's sample data shows the interface; a replay of a closed quarter shows coverage, accuracy and what the tool leaves behind. A pilot on last quarter's notices sets out how to run that replay and judge it.

Where Consumer Compliance Testing fits, and where it does not

It fits as the testing layer for deposit and payment rules: Regulations CC, E and DD, run every quarter on every item the data allows. It reads from the core, imaging, the dispute system, call notes and teller platform settings, all read only, and writes issues to the bank's issue register. It keeps a trail of every agent step and every person's decision, and builds the examiner pack from it.

It is not a core system, a GRC platform or an audit. It does not replace the independent compliance audit the FDIC expects alongside monitoring (FDIC II-3); it makes that audit easier to do, because every result already carries its evidence. It does not test loans; Loan Compliance Testing covers TILA and TRID. Where images do not exist, such as statements a bank keeps only briefly, a sample remains the honest method, and the solution says so rather than testing what it cannot read. Each screen of the quarter is on the Consumer Compliance Testing page.

Every agent step and every decision on one trail, with the examiner pack a click away

Questions people ask

What is GRC software for banks?

Governance, risk and compliance software organises risk assessments, policies, controls, testing plans, issues and board reporting in one place. For testing it supplies the workflow and the record. The testing itself, reading evidence against a rule, still has to be done by people or by another tool.

Can compliance software test Reg CC holds?

A rules engine can test the parts of a hold that live in the core: whether the exception fits the deposit and how much was held for how long. The notice requirements of 12 CFR 229.13(g), what the customer was told and when, need the notice itself, which takes a person or an agent that reads it.

What is compliance automation?

Any use of software to do compliance steps people used to do by hand. In testing, the useful question is which steps: routing work, checking structured data, or reading documents and recording evidence. Only the last removes the reason programs sample.

Do banks use AI for compliance testing?

Increasingly, and regulators apply existing rules and risk-based exams to it rather than separate AI rules. The controls that make it defensible are the same ones expected of people: cited evidence, an independent re-test, and decisions by named staff who did not prepare the work.

Which features matter most in compliance testing software?

Coverage with a reconciled population, reading the customer's document, a citation for every result, measured accuracy, and a clear line between what the software proposes and what a person decides. Workflow and dashboards matter less than whether each result would survive an examiner's question.