A Reg CC audit checklist for exception holds should follow the examination procedures, because that is how the bank's holds will be tested. The FDIC and NCUA procedures ask examiners to find out how and where hold decisions are made, sample exception holds from each of those places, check when the funds were actually made available against the schedule plus the reasonable extension, review every notice for content and timing, confirm the reason for each reasonable-cause hold was reasonable and its notice was kept for two years, and test each exception against its own definition, from new accounts to repeated overdrafts (FDIC Consumer Compliance Examination Manual, VI-1; NCUA). Exception notices are where banks are most often cited: the Federal Reserve cited the notice rule in 229.13(g) 12 times at state member banks in 2025. The difficulty for an auditor is that the evidence for one hold sits in the core, the image archive, the notice system and someone's memory. Botminds' Reg CC Exception Holds produces that evidence as each hold is decided, and the checklist below is also the list to put to it, or to any hold tool, before relying on it.
Product examples come from a fictional sample bank, Tessaly Community Bank, in the third quarter of 2026, as it runs through the solution.
What is at stake in an exception-hold sample
12
citations of the exception notice rule, 229.13(g), at state member banks in 2025; tied for sixth of all provisions
850
consumer complaints about funds availability and access at Fed-supervised banks in 2024
$1,350
the most a court can add per individual action on top of actual damages, since July 1, 2025
1year
for a customer to sue after a violation
What do the Reg CC exam procedures cover?
Four objectives for the funds availability rules, as the FDIC states them: that the bank's availability policies comply with Regulation CC; that it has internal controls for compliance; that it "has established a training program for applicable employees concerning their duties"; and that it keeps records of compliance for two years (FDIC CCEM VI-1). NCUA's guide for credit unions follows the same structure almost word for word. Under them sit procedures for disclosures, automatic holds, the $275 and cash-withdrawal rules, case-by-case holds, each exception, special deposit slips, posted notices, interest, calculated availability and record retention.
Exception holds get the most detailed treatment, and the procedures start with a question that shapes the whole sample: how decisions are made and where records are kept. If branches decide and keep their own records, sampling happens at branches; if decisions are central, sampling happens there. The examiner then reviews hold reports, which "should include records from the main office as well as branch offices", and samples "a few of the exception holds". An internal audit that samples only the central desk, at a bank where tellers can place holds, has not tested what the examiner will test.
The exception-hold test matrix
Each row below is a test drawn from the procedures, the evidence that answers it, the failure it is designed to catch, and what a hold tool should be able to show for it. Used as an audit plan, it gives the sample its tests; used as an evaluation, it tells a buyer what to ask a vendor to demonstrate on the bank's own deposits.
Reg CC audit checklist: the exception-hold test matrix
| Test | Evidence to pull | The failure it catches | What a hold tool should show |
|---|---|---|---|
| Was an exception available on the facts? | Account age and owners, the day's total, the return reason, overdraft history, the facts for reasonable cause | A hold the rule does not allow, such as a missing-indorsement redeposit or day 31 of a new account | The test applied and its inputs, with a refusal where the rule does not allow one |
| Was only the right amount held? | The day's check deposits across accounts, cash and electronic items excluded | Holding the whole deposit instead of the amount over $6,725 | Each slice of the deposit with its own date |
| Was the money available by the latest lawful day? | Banking day of deposit, cutoff, release date on the core | Counting errors around holidays and cutoffs; extensions longer than 1, 5 or 6 business days | The counted business days and the holiday list used |
| Did the notice carry all five items? | The notice as sent | Missing amount delayed; vague or missing reason; a superseded threshold in the reason | The notice drafted from the same dates as the hold |
| Was the notice on time? | Deposit channel and time; knowledge time for later facts; delivery record | Notices mailed days late; no proof of when facts reached the decision-maker | Deadline, send time and delivery proof per notice |
| Was the reasonable-cause reason reasonable? | The facts statement and its sources | Holds resting on an impression, a class of check or a class of person | Each fact with its source, and who approved it |
| Was the record kept two years? | Notices and facts statements for reasonable-cause holds | Notices kept, facts statements missing | Retention status by hold |
| Were fees handled when no notice was given at deposit? | Overdraft and returned-item fees after the hold; refund requests | Fees kept on a check that was later paid, with no refund paragraph | Fee and refund status linked to the hold |
| Did repeated-overdraft status expire? | The date the status was set and six months of statements | Status never removed; overdrafts from bank error counted | The qualifying days and the expiry date |
| Do disclosures, procedures and practice match? | Disclosure, lobby notice, procedures, a sample of actual holds | Old amounts or periods in disclosures; practice longer than disclosed | Settings with versions and effective dates |
How do examiners sample exception holds?
From the places decisions are made, with a check on dates first. The core procedure reads: "Sample a few of the exception holds and determine when the bank makes the funds available for withdrawal. Determine that the bank does not add more than one business day for on-us checks and five business days for local checks to the maximum time periods in the federal availability schedule for the deposit unless it can show that a longer delay is reasonable" (FDIC CCEM VI-1). Notices come next, then each exception's own tests.
The reasonable-cause procedure is the most searching. Examiners are told to find out whether the bank has a policy for these holds and "who initiates" them, obtain a list of the accounts or checks held, review each notice, "Determine if the reason for invoking the exception was reasonable", and check timing and fee refunds. The new-account procedure starts from the bank's definition of a new-account relationship and asks for "documentation concerning the composition of the opening deposit or the most recent deposit". The large-deposit procedure asks the examiner to review at least one large-deposit hold and confirm only the excess was held.
"A few" is the examiner's sample, not the auditor's. An internal audit can do better by risk-weighting: more holds from branches and channels with high hold rates, every reasonable-cause hold from a period with a policy change, and every hold that crossed a holiday. The sample bank's quarterly consistency report is that weighting in practice: it shows which branch, channel or neighbourhood departs from the bank's pattern, and with what facts.
Where to aim the sample: one branch out of line on reasonable cause
What are the most common Reg CC violations?
Notice failures lead, on the Federal Reserve's published data. In 2025 its examiners cited the exception notice rule, 229.13(g), 12 times at state member banks, 1.9% of all 630 consumer violations and tied for sixth with a flood insurance notice rule; it was the only Regulation CC provision in the top list (Consumer Compliance Outlook, 2026). The data count citations in exam reports, not consumers affected, and cover only the banks the Fed supervises. The full ranking across agencies is in the most common consumer compliance violations.
Federal Reserve top-cited consumer violations, 2025: where the exception notice rule sits
Beyond the published counts, the rule itself shows where violations come from, because each test in the matrix has an easy way to fail. Dates: a hand count that skips a business day or a holiday table that is wrong. Amounts: a $5,525 or $5,000 left in a parameter, a template or a lobby notice after July 1, 2025. Reasons: a reasonable-cause hold resting on "seemed nervous", or an "Other" reason with nothing written. Status: a repeated-overdraft or new-account flag that outlives its period. Timing: a notice mailed when the deposit operations queue clears rather than by the next business day. Each is checkable, which is why the matrix can test all of them.
Reg CC violation penalties
Two channels: the regulators and the customer. Compliance is enforced by each bank's regulator under section 8 of the Federal Deposit Insurance Act, or the Federal Credit Union Act for credit unions, and a violation of the EFA Act counts as a violation of those statutes (229.3). That is where findings, corrective action and, in serious cases, enforcement actions come from.
The customer channel is civil liability under 229.21: actual damages, plus an amount the court allows of $125 to $1,350 in an individual action, or in a class action up to the lesser of $672,950 or 1% of the bank's net worth, plus costs and a reasonable attorney's fee. A suit must be brought within one year of the violation. In a class action the court weighs, among other things, how often and how stubbornly the bank failed to comply and how far the failure was deliberate (229.21(b)), much as a court does under the Equal Credit Opportunity Act for late adverse action notices. Those factors are exactly what a weak sample and an unremediated finding put on the record. A bank escapes liability for a bona fide error only if it shows the error was unintentional and happened despite procedures reasonably adapted to avoid it; an error of legal judgment never qualifies.
Using the regulators' checklists without importing their errors
The examination procedures are the right skeleton for an audit program, and both agencies publish a yes-or-no checklist under them. Copy them with one caution: their dollar amounts are out of date. The NCUA guide, last modified December 8, 2025, still tells examiners to test "the $225 availability rule" and large deposits "exceeding $5,525", and the FDIC chapter, last updated in March 2024, carries the same figures. Since July 1, 2025 the amounts are $275, $550 and $6,725 (A Guide to Regulation CC Compliance). An audit step that tests against the old threshold will pass holds that are wrong and fail holds that are right. Where the old amounts still survive, and why, is set out in the July 2025 changes.
Twelve questions to put to any Reg CC hold tool before relying on it
- Does it show the test behind each exception?
Age and owners, the day's total, the return reason, the overdraft days: not just a code.
- Does it refuse holds the rule does not allow?
Missing-indorsement redeposits, day 31 of a new account, five overdraft days instead of six.
- For reasonable cause, does it hold facts, not scores?
Each fact with its source, written so it can be kept as the 229.13(g)(5) statement.
- Does it count dates the rule's way?
Cutoffs, banking day, the 229.2(g) holiday list, every slice, and a written decision on June 19.
- Do the notice and the core hold come from one computation?
Or can the notice show a different date from the hold?
- Does it prove notice timing?
The deadline, the send time, the delivery channel, and E-SIGN consent for electronic notices to consumers.
- Does it record when facts reached the decision-maker?
That time starts the clock for holds placed after the deposit.
- Who decides, and who checks?
A named person approves each hold, and someone else checks it; nobody checks their own work.
- Can it show consistency by branch and channel?
Departures from the bank's own pattern, without using protected characteristics.
- Are amounts and periods versioned settings?
With effective dates and an approver, so July 1, 2030 is a settings change, not a project.
- What does it do when it is unsure?
It should stop and hand the decision to a person, not guess.
- Can it produce the examiner's sample in minutes?
Holds, notices, facts statements and overrides for any period, masked where needed.
Where Reg CC Exception Holds fits an audit, and where it does not
The solution is built to answer the matrix. Each hold carries its exception and test, every slice's date with the count behind it, the notice drafted from the same dates and kept with its delivery proof, the facts statement for reasonable cause, and the maker and checker who approved it; any change to the agents' proposal needs a reason code. The examiner package gathers all of it for a period, with account numbers masked and fraud referrals left out. At the sample bank, the third-quarter package held 4,190 holds and notices and 214 facts statements.
Maker, checker and the core hold, in one place an auditor can test
What it does not do is audit itself. Evidence produced by the system that made the decision is still the first line's evidence; the test of it belongs to compliance testing and internal audit, working from their own sample and their own reading of the rule. The value to them is time: a sample that used to need records pulled from four systems is one filter, and the time saved goes into the judgment calls, above all whether each reasonable-cause reason was reasonable. To see the matrix answered on a sample of your own past holds, start from Reg CC Exception Holds; the file each hold should leave behind is described in the Reg CC hold record retention guide.
The examiner package: one quarter's holds, notices and facts, masked
Questions people ask
What is in a Reg CC examination manual?
For FDIC-supervised banks, chapter VI-1 of the FDIC Consumer Compliance Examination Manual; for credit unions, the Regulation CC section of NCUA's Federal Consumer Financial Protection Guide; the other banking agencies publish their own. Each sets objectives, procedures for disclosures, holds, notices and records, and a yes-or-no checklist.
How often should Reg CC be audited?
The regulation sets no frequency, so the bank's own risk assessment sets it. The triggers that justify testing out of cycle are a change in availability policy or cutoffs, a change in the rule's amounts, a new hold system, and evidence such as complaints or uneven hold rates across branches.
What records does an examiner ask for in a Reg CC review?
Availability disclosures, exception, case-by-case and special deposit forms, change-in-terms notices, hold reports from the main office and branches, the list of reasonable-cause holds with their notices and facts statements, new-account reports, the repeated-overdraft list, and training materials and written procedures.
Can a bank be fined for Reg CC violations?
Regulators enforce Regulation CC through their general enforcement powers under the Federal Deposit Insurance Act or the Federal Credit Union Act, which include corrective orders and civil money penalties in serious cases. Customers can also sue for actual damages plus $125 to $1,350 each, or a class recovery capped at the lesser of $672,950 or 1% of net worth.
Does a self-identified Reg CC error still count in an exam?
Examiners decide how to treat it, but an error the bank found, corrected and remediated before the exam reads very differently from one an examiner finds. For civil liability, a clerical or calculation error can be a bona fide error if the bank's procedures were reasonably designed to prevent it.