The cost of compliance for banks falls hardest on the smallest. In a survey of 469 community banks analysed by the Federal Reserve Bank of St. Louis, banks under $100 million in assets spent 8.7% of their noninterest expense on compliance, against 2.9% at banks of $1 billion to $10 billion. Personnel was by far the largest part at every size. Regulatory change management, the work of reading each new law, rule and order, deciding whether it applies and carrying it into policies and systems before it takes effect, is a large share of that personnel time, and it is close to a fixed cost: the federal rulebook changes by the same amount for a $90 million bank as for a $9 billion one. Botminds' Regulatory Change Management gives the reading and mapping to agents so that cost stops scaling with the rule flow.
Compliance cost as a share of noninterest expense, by bank size
How much does compliance cost a community bank?
Roughly three times as much, relative to its size, as a bank of $1 to $10 billion. The St. Louis Fed economists found that banks under $100 million averaged $163,800 of compliance cost in 2014, or 8.7% of noninterest expense, while banks of $1 to $10 billion averaged $1.8 million, or 2.9% (Federal Reserve Bank of St. Louis). "The observed tripling of costs across these size thresholds is consistent with the existence of economies of scale in achieving a given regulatory performance outcome." The ratio falls smoothly through every size band in between.
The cost is not a matter of a few large items. The survey asked about five categories, "1) data processing; 2) accounting and auditing; 3) consulting and advising; 4) legal; and 5) personnel", and the smallest banks spent more of their budget than larger ones on almost all of them. One category did not follow the curve: legal costs "were relatively invariant across size cohorts" (St. Louis Fed). The rest of the gap is people, systems and outside help that a larger bank spreads across far more loans and deposits.
Why is compliance more expensive for small banks?
Because much of the work is the same whatever the size of the balance sheet, so a small bank spreads it over far less revenue. The St. Louis Fed authors put it in economists' terms: "The observed tripling of costs across these size thresholds is consistent with the existence of economies of scale in achieving a given regulatory performance outcome." A rule has to be read, a procedure written and a control tested once, whether the bank makes 300 mortgages a year or 30,000.
Compliance personnel cost alone, as a share of noninterest expense
The regulators' own cost models show the same curve. When the CFPB priced HMDA reporting in 2015, it estimated annual operating costs of about $2,500 for a low-complexity lender with 50 records and $313,000 for a high-complexity lender with 50,000, which "translates into an estimated per-application cost of approximately $51, $36, and $6" across its three examples (80 FR 66128). Its 2026 small business lending rule makes the same point: about $87 per application for the smallest covered lender and a little over $47 for the largest (91 FR 23530). Per unit of business, the small lender pays several times more for the same obligation.
What is the largest compliance cost for banks?
People. Every size group in the 2014 data spent more on compliance personnel than on anything else, and the most recent survey finds the same with a different cut. In the Conference of State Bank Supervisors' 2025 survey, answered by 268 community banks between April and July 2025, compliance accounted on average for only 13% of personnel spend, yet because personnel is so much larger than the other lines, "the category comprises 58% of total compliance expenditures" (CSBS 2025 Annual Survey).
Where community banks say compliance shows up in each expense line
Accounting and auditing
- Compliance · 36.4%
- Other · 63.6%
Consulting and advisory
- Compliance · 28.5%
- Other · 71.5%
Legal
- Compliance · 23.7%
- Other · 76.3%
Data processing
- Compliance · 17.3%
- Other · 82.7%
Personnel
- Compliance · 13.1%
- Other · 86.9%
By subject, the 2025 survey splits the total three ways: "safety and soundness, money laundering, and consumer protection costs accounted for 27%, 25%, and 23%, respectively". Consumer protection, where most regulatory change for a lender lands, is close to a quarter of the bill. One banker quoted in the survey put the trend in his own numbers: compliance labor up 58% and software up 74% in five years at a bank with "four full-time people and one part-time person" in compliance (CSBS). That is one bank's account, but the shape is the common one: the people cost is the one that keeps rising.
The same rulebook, two budgets
$163,800
average 2014 compliance cost at banks under $100 million: 8.7% of noninterest expense
$1.8M
average at banks of $1–10 billion: 2.9% of noninterest expense
58%
of community banks’ compliance spending is people (2025 survey)
Why regulatory change is a fixed cost
Regulatory change is a fixed cost because the number of rules to read depends on the institution's charter, products and states, not its assets. A $90 million bank and a $9 billion bank with the same federal regulator receive the same Federal Register. In 2025 the CFPB, OCC, FDIC, Federal Reserve and NCUA together published 55 final rules, 64 proposed rules and 482 notices there (Federal Register counts, our tabulation). Most of those notices are holding company applications and most rules will not touch a given lender, but each has to be looked at to know that.
What does vary is the part of the work that comes after a rule applies. A bank with seven products in nine states has more cells to scope, more policy sections to map and more owners to assign than one with three products in one state. That variable part scales with the business, which is how it should be. The reading does not, and on a small team it competes for the same hours as testing, training and exam preparation.
Which parts of regulatory change scale with the institution, and which do not
| Part of the work | Scales with | At a small bank |
|---|---|---|
| Reading federal rules, guidance and orders | The charter and regulator, not size | The same flow as a much larger bank, read by one or two people |
| Reading state law and bulletins | The number of states | Often one or two states, but each legislature and banking department still publishes |
| Scoping to products and states | Products × states | Fewer cells; the judgement on each is the same |
| Mapping to policies, controls and systems | The policy library and systems | A smaller library, often maintained by the same person who reads the rules |
| Owners, dates and board reporting | Governance structure | The same expectation of evidence, with fewer people to share it |
Regulators allow for that in the process, not in the rulebook. The OCC says the formality of change management "should be commensurate with the bank's size, complexity, and risk profile" (OCC Comptroller's Handbook). A small bank may run a lighter process; it may not skip reading a rule. With 4,238 FDIC-insured institutions, 90% of them community banks, and 4,214 federally insured credit unions at mid-2026 (FDIC, NCUA), most of the institutions carrying this fixed cost are small ones.
How much does a new regulation cost a bank to implement?
The regulators' own estimates run from tens of dollars per loan to millions across an industry, and most of the cost is in the first year. The CFPB's assessment of the TRID mortgage disclosure rule found "a typical cost for a lender to implement the TRID Rule was $146 per mortgage originated in 2015, or roughly 2.0 percent of the average cost of originating a mortgage" (CFPB TRID assessment). The 2015 HMDA rule was estimated to cost the industry $725.9 million to $1.339 billion in one-time costs (80 FR 66128). And the standing paperwork of Regulation Z alone is estimated at 1,345,102 hours a year across 17,215 respondents (88 FR 16954), about 78 hours per institution before any rule changes (our arithmetic).
Those figures price the big rules. Most changes are small, and their cost is mostly the time it takes to find out that they are small. The cost of regulatory change can be written as the reading load plus the work on rules that apply, priced at the team's day rate. The first term is set by the flow of publications, the second by the footprint. Agents change the first term most and the second partly. A team can fill in its own numbers.
The annual cost of keeping up with regulatory change
Reading and triage
items read × minutes each
Every federal, state and enforcement item, including the ones that do not apply.
Compliance analyst
Work on applying rules
applying rules × days per rule
Scoping, mapping to sections and controls, agreeing owners and dates, reporting.
Change lead and policy owners
Day rate
× loaded cost per day
Wage plus benefits and overhead for the people doing it.
Finance
Tools and services
− subscriptions and set-up
Alert services, trackers, or a solution that does the reading.
Compliance and procurement
A worked example shows the scale. Compliance officers in credit intermediation earned a mean of $94,090 in May 2025 (BLS), about $360 for an eight-hour day before benefits (our arithmetic). Our estimate for one rule that touches several products, handled by email and spreadsheet, is about 14 working days from publication to owned tasks: two reading and deciding whether it matters, three scoping it to products and states, three finding the policy sections and controls, four agreeing owners and dates, two updating the tracker and board summary. That is roughly $5,070 of wages for one rule before any policy is rewritten. With the solution, the same steps are estimated at about one day.
Those are estimates, not measured results. The point they make does not depend on their precision: most of the days go on finding and routing, not on deciding, and finding and routing are what agents do well. How the remaining day divides between agents and people is set out in which change tasks agents can take.
Where a small team's hours actually go
On a small team, the reading crowds out the testing. The person who reads the rules is often the one who updates the policies, trains the staff and prepares for the exam. When the reading takes Monday, the testing that would show a change worked is what slips, and the rating system marks down exactly that: the difference between a 1 and a 2 includes reviewing "the change after implementation".
In the solution's sample data, a fictional lender called Kestrel Bank, the agents read 918 items in 30 days from 41 sources. Three applied; five needed a person's decision; every other item was closed with a one-sentence reason. Overnight on the morning of the sample story, the agents read 38 items and none applied, each with its reason. A person still re-reads a 5% sample of the "does not apply" verdicts each week, so the reading is checked, not abandoned.
A month of reading on one screen: three items applied, the rest closed with reasons
Footprint, not assets, sets the scoping work
The variable part of change management is set by what the institution offers where. A state-chartered lender adding one product in one new state takes on that state's rules for that product, and the rules already in its feed that would now apply. The solution makes that visible before the decision is made: switch a product on in a state on the footprint and it lists the open changes that would apply.
Products and states: what a change of footprint would bring in
For a credit union or a community bank with a short footprint, that grid is small and the scoping work modest. The reading is not, which is why the economics of automating regulatory change favour the smallest teams most. What has to be in place before the agents can read for a given institution is covered in the product–state map a change program runs on. To see the solution on a sample footprint, start from Regulatory Change Management.
How can a small bank reduce compliance costs without weakening the program?
By cutting the hours that do not change the outcome: the reading of items that turn out not to apply, the searching for which policy sections a rule touches, and the chasing of owners and dates. Those are the parts that scale with the rule flow rather than with the bank, and they are where a small team loses the time it needs for testing. The OCC's room for a lighter process applies to formality, not to coverage; what a small bank can change is how the coverage is produced.
Five ways to lower the cost of regulatory change, in order of effect
- Stop reading by hand what can be screened
Let software read every source and close the items that plainly do not apply, with a reason a person can sample.
- Keep the policy library in numbered, owned sections
So mapping a rule is a lookup, not a reading exercise, and each change has one obvious owner.
- Prepare the predictable changes early
Annual thresholds and dated compliance deadlines can be worked months ahead, which removes the December scramble.
- Spend the saved hours on testing
A post-implementation check is what separates a strong change management rating from a merely adequate one.
- Price tools against analyst days, not salaries
Count the days a year that go on reading and routing, and what they would buy if spent elsewhere.
Botminds' Regulatory Change Management is built for the first three. Its agents read the sources, score each item against the bank's own products and states, map the ones that apply to policy sections and controls, and set owners and dates, while people keep the scope decision, the wording and the sign-off. For a small team, the gain is not fewer people; it is the same people spending their week on the work examiners rate.
Questions people ask
Is the compliance cost gap between small and large banks still as wide?
The detailed cost-share figures are from 2014 survey data, the most complete published breakdown by size we found from a regulator. The CSBS's later annual surveys continue to report that compliance takes a material share of community banks' personnel, legal, accounting and consulting spend, and that personnel is most of the total.
Do credit unions face the same change load as banks?
Largely, through different channels: the NCUA rather than the OCC or FDIC for safety and soundness, but the same Regulations Z, B, C and E for consumer lending. In the Federal Register counts, the NCUA published 17 final and 35 proposed rules in 2026 to late October, more than in any of the four previous full years.
How many compliance officers work in banking and lending?
The Bureau of Labor Statistics counted 19,850 compliance officers in credit intermediation in May 2025, with a mean annual wage of $94,090, out of 417,070 in all industries. The count excludes staff whose title is not compliance officer but who spend much of their time on it, which at a small bank is often most of the operations team.
Does a smaller bank get examined less often?
Yes, if it is well rated. Since November 2025 the FDIC generally schedules consumer compliance examinations every 66 to 78 months for institutions of $350 million or less, 54 to 66 months up to $3 billion, and 24 to 36 months above that, with a mid-point risk analysis for the longer cycles. Fewer exams do not lower the cost of keeping up; they lengthen the time a missed change can run before anyone outside the bank sees it.
What does regulatory change management software cost compared with an analyst?
That depends on the vendor and the footprint. The useful comparison is not licence against salary but the formula above: how many analyst days a year go on reading and routing, and what those days could be spent on instead.