Overdraft protection compliance, tested on last year's postings

Overdraft protection compliance means showing that every courtesy pay, overdraft and NSF fee was charged with the consent Regulation E requires, as the account disclosures promise, and in a way a customer could reasonably avoid. Most institutions test it with a sample of 25 to 60 accounts a quarter, pulled by hand from the core. A sample shows whether a problem exists; it cannot size the refund, and a rare problem, such as a few hundred invalid opt-ins among 400,000 accounts, is very unlikely to appear in it at all. Replaying a full year of postings for every fee finds the population. Botminds' Overdraft Compliance does that replay with agents that hold for a person anything they cannot decide, and the honest way to evaluate it is to run it on last year's postings, where you already know some of the answers. This page covers how examiners test, what a sample can and cannot find, what a full replay needs, and what to look for before you buy anything to do it.

What is overdraft protection compliance?

It is the evidence that an overdraft program follows four sets of rules. Regulation E, 12 CFR 1005.17, requires a notice, an opt-in and a written confirmation before any fee on an ATM or one-time debit card overdraft. Truth in Savings, Regulation DD for banks and Part 707 for credit unions, requires statement totals, accurate overdraft advertising and balances that leave out the overdraft limit. The unfairness and deception standards govern how fees are triggered and described. And prudential guidance, the FDIC's 2010 overdraft payment guidance, OCC Bulletin 2023-12 and the 2005 Joint Guidance, sets expectations on daily limits, posting order, heavy use and oversight of vendors. Which of these are still in force after 2025 is set out in CFPB overdraft rule repealed: what still binds banks in 2026.

Testing it means testing fees, not policies. The OCC's bulletin puts the control in one sentence: "Banks periodically test operating system settings and parameters to determine whether transaction postings are aligned to disclosures" (OCC Bulletin 2023-12). A policy that says no APSN fees, a fee schedule that says four fees a day and an opt-in procedure that says notice first are only as good as what the core actually did with each item.

How do examiners test overdraft programs?

Policies first, transactions if the policies show weaknesses. The FDIC's examination procedures for overdraft payment programs, a manual chapter last updated in October 2025, tell examiners to start with management and policy-related procedures and to "conduct transaction testing using the Transaction-Related Examination Procedures if, after completing the Management and Policy-Related Examination Procedures, they discover weaknesses or other risks requiring further investigation" (FDIC Consumer Compliance Examination Manual V-14). The Federal Reserve describes transaction testing the same way, as checking a sample of customers' transactions against the rule, and treats it as the more intensive kind of review (Consumer Compliance Outlook, 2018); what changes when the sample becomes every transaction is set out in what full population testing is.

The FDIC's manual is specific about what examiners ask for when they do test. The document list includes overdraft activity reports and board reporting on "fee waivers, daily limits, de minimis transactions", third-party contracts, "ATM receipts, periodic statements, and ATM/POS terminal notices", opt-in correspondence and marketing scripts. On size, it leaves the sample to the examiner and sets only a standard: keep enlarging it until the examiner is confident about every part of the program the rule touches. An institution that has already tested every fee can hand over its population and its exceptions; one that sampled 40 accounts will be sampled again.

How many accounts should an overdraft review sample?

Enough to detect the problem you are looking for, which for the rarest problems is more accounts than any manual review can handle. The arithmetic is simple. If a share p of accounts is affected and you draw n accounts at random, the chance of seeing at least one is 1 − (1 − p)ⁿ. At the sample credit union, 1.29% of checking accounts were affected by at least one finding, but the opt-in finding touched 0.05% of accounts and the daily-limit finding 0.03%.

Even a sample that finds a problem does not size it. Finding two APSN fees in 60 accounts proves the practice; it does not say whether the refund is 400 fees or 4,920. That is why the published APSN and re-presentment resolutions turned on lookbacks across the whole population rather than on the samples that first found the problem. The FDIC's audit standard already expects the population to be visible: a written audit report should say how many transactions were sampled for each type of product (FDIC Consumer Compliance Examination Manual II-3).

What a full replay of last year's postings found

Take the fictional sample credit union as it runs through the solution. Overnight, the agents read 61.8 million transactions and 214 fee settings and ran eight tests on every fee from October 20, 2025 to October 19, 2026. Four found problems; three passed. Each finding names the setting or practice behind it, because the refund is only half of the fix.

A finding names its population, its cause, its rules and what was set aside

What data do you need to replay overdraft fees?

Six sources, most of which the institution already holds but rarely in one place. The core's posting history in posting order, with the fee settings in force on each date. The card processor's authorizations and settlements, with timestamps, which is the file most often missing. ACH returns and the entries that follow them, and images of re-deposited checks. The opt-in notices, consents, call recordings and confirmations. The fee schedule, account agreement and Truth in Savings disclosures. And the general ledger's fee income accounts, to reconcile what the replay found with what was booked.

Retention sets the outer limit. Regulation E and Regulation DD each require evidence of compliance to be kept for at least two years (12 CFR 1005.13; 12 CFR 1030.9), and card processor authorization files are often purged sooner. In the sample, the 24-month option needs the processor's archive for the older authorizations; the plan stays at 12 months until the Supervisory Committee decides.

What is an overdraft lookback, and how far back should it go?

A lookback is the replay of past fees to find every customer harmed by a practice, so that each can be refunded. Supervisory Highlights 29 reports that examiners told institutions to stop charging APSN fees, look back over past postings and refund the customers who had paid them (CFPB, March 2023). How far back is set case by case. The same report notes that remediation plans institutions reported covered "time periods starting in 2018 or 2019 up to the point they ceased charging APSN overdraft fees"; the Regions order covered August 1, 2018 to July 14, 2021 (CFPB Consent Order 2022-CFPB-0008).

Three factors usually decide the window in practice: when the practice started, which is often a conversion or a setting change that the institution can date; how far back reliable data exists; and what the regulator asks for. The FDIC's 2023 position on re-presentment lookbacks, that it would not ask for one unless substantial harm to consumers was likely, was rescinded with the rest of that guidance in April 2026, so it no longer narrows the window. What a lookback costs, and how refunds are sized, is in bank overdraft fee refunds: what one wrong core setting costs.

How do you validate overdraft fee findings before trusting them?

On work you already know. Before any institution relies on automated testing, it should run the tool on a period where it has answers: fees it already refunded, a lookback it already ran, a setting it knows changed on a given date. If the tool finds those, and explains each the way the institution's own analysts would, it has earned a trial on the period nobody has looked at. The Federal Reserve's internal audit guidance makes the related point about systems: "upfront validation of the defaults and settings may reduce the number of transactions tested" (Consumer Compliance Outlook, 2013).

Inside the solution the same principle runs continuously. Each agent's version, model, prompt and threshold is recorded on every run; a new version must pass a golden set of 214 fee events with known answers and waits for the Compliance Officer before it is used. Any fee below a 0.90 confidence threshold, or with a missing source file, goes to a person with an owner and a three-business-day due date. The analyst who drafts a finding cannot approve it, and any override of an agent's call needs a reason code that is reported to internal audit.

What the agents hold for a person instead of guessing

What to look for in overdraft compliance testing software

The questions below are the ones that separate a testing tool from a reporting tool. They apply to any approach, including building the replay in-house, and they are also the limits of what Overdraft Compliance does. It tests courtesy pay, overdraft and NSF fees on consumer deposit accounts; it does not handle Regulation E error disputes, which have their own clocks and their own checklist in Reg E audit checklist: plant the errors examiners cite, count catches. It reads the core and never changes it. It needs authorization files to judge card fees, and holds fees for a person when they are missing. And its findings are drafts until a named person approves them.

A pilot on your own postings: what it takes

The useful pilot is short and uses a year you already know. The solution's makers offer to run it on a sample of the institution's own posting history, fee settings and fee schedule, and the design target is five business days from a finding to an approved refund plan with two signatures. The timeline below is the solution's own estimate for one quarterly test at a credit union the size of the sample, by hand on a sample of accounts and with the agents on every fee; it is an estimate, kept deliberately modest, not a measured customer result.

What a pilot cannot show is how the institution's people will use it. The sample's design keeps the Compliance Officer as the only approver of findings and the Deposit Operations Manager as checker on every refund plan and core change, and the FDIC expects the board to oversee an overdraft program and to review its key features every year (FDIC FIL-81-2010). Agree those seats before the pilot starts, and the pilot tests the whole program rather than a report.

Questions people ask

How do you test an overdraft program for compliance?

Test the fees, not the policy: for each ATM and one-time debit fee, check the opt-in; for each card fee, check the balance at authorization; for each NSF fee, check whether the item had already been returned; and compare every fee with the fee schedule's promises, including the daily limit. Then read the core's settings and confirm they match what the tests found.

How do examiners decide whether to transaction-test overdraft fees?

At the FDIC, examiners complete the management and policy-related procedures first and transaction-test when those reveal weaknesses or other risks, increasing sample sizes "until confidence is achieved". A program that can show its own full-population testing gives examiners less reason to expand.

What does a full population overdraft test find that a sample does not?

The rare problems and the size of the common ones. In the sample year, invalid opt-ins touched 214 of 410,284 accounts and over-limit fees 131; a 60-account random sample would include even one such member only about 3% and 2% of the time.

Does the FDIC still expect monitoring of frequent overdraft users?

Yes. Its 2010 guidance, amended in February 2026, asks institutions to monitor customers who pay a fee on more than six occasions in a rolling twelve months and to offer a less costly alternative. Examiners count an occasion as each fee charged, so three fees in one day are three occasions.

Can overdraft testing replace an internal audit?

No. The FDIC distinguishes monitoring, the institution's own proactive testing, from audit, an independent review of whether the compliance program works. Full-population testing is monitoring; the internal auditor still reviews it, which is why the sample's auditor reads everything, changes nothing and exports the examiner pack.