The consequences of non-compliance in banking start small and compound: a violation cited at the exam, remediation for every customer affected, a lower consumer compliance rating, civil money penalties and, where the harm is wide, an enforcement order. A missed effective date is the most ordinary way to set that chain off. When a bank or lender misses a new regulation's effective date, every loan or account handled the old way after that date is a potential violation. Examiners find them by sampling transactions after the date, then trace the cause back to how the change was managed. Regulatory change management exists to prevent that chain: each new law, rule or order read, scoped to the products and states it touches, owned and dated before it takes effect. This page runs a pre-mortem, imagining a missed date and working back week by week, then shows where Botminds' Regulatory Change Management would have broken the chain.
Where Regulatory Change Management catches a date before it is missed
Agent
Feed readerReads every federal, state and enforcement source every 30 minutes, so a short window is not spent waiting in an inbox.
Never: drops an item without a verdict
Agent
Applicability scorerChecks every product and state in the footprint and gives a reason for each one left out.
Never: closes an unclear item
A person decides
Regulatory change leadSigns the scope: which products, which states, which owners.
Agent
Owner assignerNames an owner for every policy, system and form task, with a due date counted back from the effective date.
Never: leaves a task without a date
Agent
Deadline watcherFlags work at risk, nudges at 30 days and escalates at 14.
Never: extends a date
A person decides
Chief compliance officerSees what is at risk and reports it to the board before it takes effect.
What are the consequences of non-compliance in banking?
Six, in rising order of cost: a cited violation, a supervisory finding the board must answer, remediation to customers, a lower rating, civil money penalties and a public enforcement order, with private lawsuits alongside. They are not alternatives. A single missed rule that touched many transactions can reach every rung, and the rung it reaches depends on the four factors examiners weigh: "root cause, severity, duration, and pervasiveness" (FFIEC rating system).
The ladder of consequences for a consumer compliance failure
| Consequence | What triggers it | The rule or record behind it |
|---|---|---|
| A cited violation | Any violation of law or regulation found in the exam sample | The report of examination; the FDIC cited 1,155 consumer violations in 2025 |
| A matter requiring attention | From November 2026, for the OCC and FDIC, an actual violation of law or a material financial risk | OCC and FDIC final rule on matters requiring attention (2026) |
| Remediation to customers | Harm to identifiable consumers; for TILA disclosure errors, a pattern or practice, gross negligence or willfulness | CFPB examination procedures; 15 U.S.C. 1607(e) |
| A lower consumer compliance rating | Weak change management, violations and harm weighed together | FFIEC rating system; a 3, 4 or 5 can shorten the FDIC exam cycle |
| Civil money penalties | Violations of federal consumer financial law, per day | CFPA tiers adjusted for inflation each year |
| An enforcement order | Widespread harm or a failed compliance management system | Public consent orders, sometimes with business restrictions |
| Private lawsuits | Statutory damages for many consumer credit violations | 15 U.S.C. 1640 for the Truth in Lending Act |
The ladder has one feature that matters for regulatory change in particular. The lower rungs are about the violation; the upper rungs are increasingly about the process that let it happen. A missed effective date is a process failure by definition, so it tends to climb.
What happens if a bank misses a regulation effective date?
The violation starts on the effective date and grows with every transaction after it. Examiners weigh it on four factors: "root cause, severity, duration, and pervasiveness" (FFIEC rating system). A missed change scores badly on three of them by construction. The root cause is the change process, the duration runs from the effective date to discovery, and the pervasiveness is every transaction in the affected product. Under the CFPB's procedures, examiners then determine whether the institution "provides retrospective remediation to all consumers harmed by a particular violation" (CFPB examination manual), which turns a process failure into a cost per customer.
The best-documented example is from the mortgage servicing rules that took effect in January 2014. The CFPB's action against Flagstar Bank that September said: "When the CFPB's new mortgage servicing rules went into effect in January 2014, Flagstar committed violations of the new rules with respect to loss mitigation" (CFPB). Among them, the rules required a complete loss mitigation application to be evaluated within 30 days in most cases, and Flagstar "failed to adhere to these timelines".
What the 2014 servicing rules cost one servicer that was not ready
$27.5M
redress to about 6,500 consumers
$10M
civil penalty
13,000
active loss mitigation applications in 2011, reviewed by 25 full-time employees and a vendor
Flagstar's problem was capacity as much as change management: the backlog predated the rules. But the shape is the one this page is about. The rules had an effective date, the operation was not ready for it, and the violations were counted from that date.
"When the CFPB's new mortgage servicing rules went into effect in January 2014, Flagstar committed violations of the new rules."
CFPB press release, September 29, 2014
What are the penalties for non-compliance in banking?
Under the Consumer Financial Protection Act, civil money penalties run per day in three tiers, which for penalties assessed after January 15, 2025 are $7,217, $36,083 and $1,443,275 per day for ordinary, reckless and knowing violations (CFPB inflation adjustment). The prudential regulators have their own penalty powers under the Federal Deposit Insurance Act, and the amounts in practice are set case by case. What makes the per-day structure dangerous for a missed date is duration: the clock starts on the effective date.
What consumer compliance failures cost FDIC-supervised banks in one year
1,155
consumer protection violations cited by the FDIC in 2025
27
enforcement actions: 16 formal and 11 informal
~$150M
civil money penalties ordered
~$1.2B
restitution ordered, most of it in one order
Federal enforcement has thinned since early 2025: from January 31 to December 31, 2025 the CFPB dismissed or withdrew as plaintiff in 19 cases and terminated or modified 22 orders (CFPB enforcement by the numbers). That changes who is likely to bring a case, not whether the rule applies. Prudential examiners still cite violations, states enforce their own laws and the Consumer Financial Protection Act, and borrowers can sue: for a closed-end loan secured by a dwelling, TILA statutory damages in an individual action are "not less than $400 or greater than $4,000" (15 U.S.C. 1640), plus actual damages and attorney's fees.
Do banks have to pay restitution for compliance violations?
Often, and for a missed effective date usually for every affected customer, not just the ones who complained. The CFPB's examiners check "whether the financial institution provides retrospective remediation to all consumers harmed by a particular violation" (CFPB examination manual). For Truth in Lending disclosure errors, reimbursement is written into the statute: each agency "shall require such an adjustment when it determines that such disclosure error resulted from (A) a clear and consistent pattern or practice of violations, (B) gross negligence, or (C) a willful violation" (15 U.S.C. 1607(e)).
A system that kept producing the old disclosure after an effective date is the textbook pattern or practice: the same error, on every loan, from the same cause. That is why the cost of a missed date is roughly the number of transactions since the effective date multiplied by the remedy per transaction, plus the cost of finding them. Self-identified remediation is cheaper on both counts. The FDIC reported institutions making voluntary restitution of $4.7 million to 47,902 consumers in 2025 (FDIC), money paid on the institutions' own initiative rather than under an order.
A pre-mortem: one state law, missed, week by week
A pre-mortem imagines the failure has already happened and asks how. For this one we use a change from the solution's sample data, which runs on a fictional lender, Kestrel Bank, with nine states and seven products. The change is a fictional Ohio bill, HB 214, requiring a total-cost box on installment loans under $5,000, effective November 30. Kestrel made 1,240 such personal loans in Ohio last year, roughly a hundred a month (our arithmetic). Below is how it could have been missed in an email-and-spreadsheet process. Nothing in the left-hand column is anyone being careless; each step is ordinary.
The pre-mortem: what happened, and what the file would show the examiner
| When | What happened | What the file shows |
|---|---|---|
| Week 0 | A state law adds a required total-cost box to installment notes under $5,000, effective in about 15 weeks. The alert lands in a shared inbox with thirty others. | An alert email, unread. |
| Week 2 | The analyst reads it and decides it applies to personal loans. Auto loans under $5,000 in the same state are not considered. | A tracker row: “Ohio HB 214, applies, personal loans.” No reason, no scope signature. |
| Weeks 3–6 | Ownership is negotiated by email between compliance, consumer lending and operations. The note form is owned by a vendor relationship nobody listed. | A thread of replies. No owner named in the tracker. |
| Weeks 7–12 | The procedure is reworded. The new note form is “in progress”; the form vendor’s lead time is longer than the time left. | Procedure approved. Form task open, no due date. |
| Effective date | Loans continue on the old form. Nobody is escalated, because no date was ever set for the form. | Nothing. The tracker says “in progress”. |
| Months 1–5 | About a hundred personal loans a month are made on the old form. A borrower complaint mentions the missing box. | A complaint, routed to customer service. |
| Next exam | Examiners sample loans made after the effective date and cite the violation. They then ask how the change was managed. | The tracker row, the email thread and an approved procedure that the form never matched. |
Three things stand out. The miss happened in week 2, when the scope was set without a reason and without the second product. It became unrecoverable in weeks 3 to 6, when no one owned the form. And it went unnoticed on the effective date itself, because a task with no date cannot be late. The examiner's sample at the next exam finds the violation, but the change file finds the cause: no reason, no signature, no owner, no date.
How do examiners rate change management failures?
As a factor in its own right, on the same 1-to-5 scale as the whole consumer compliance rating. Examiners do not stop at the violation. Once they find loans on the old form, they read how the change was managed, because the rating system makes change management a factor in its own right: a 1 "anticipates and responds promptly", a 5 "fails to monitor and respond". The OCC lists what they will read: project tracking records, committee minutes, the policies adopted and the monitoring or audit reports afterwards. In the pre-mortem's file, each of those is thin or missing.
The rating has consequences of its own. Under the FDIC's schedule since November 2025, an institution with a consumer compliance rating of 3, 4 or 5 and a weak CRA rating is examined every 1 to 12 or 12 to 24 months, against 66 to 78 months for a well-rated small bank (FDIC FIL-52-2025). A downgrade can buy more frequent examinations and more management time spent on exam response rather than on the work itself.
At the far end of the scale, change management failures appear in enforcement orders. The FDIC's 2025 amended order against Discover Bank found failures in its compliance management system "including (a) board of directors (Board) and Bank management oversight and commitment, change management, comprehension, identification, and management of risk" among other elements, alongside a $150 million penalty and at least $1.225 billion in restitution (FDIC). The underlying conduct there was not a missed rule. The point is narrower: change management is something regulators name when they write orders.
The same weeks, with the change caught
In the solution's sample data, the same Ohio change is not missed. It is at risk, which is different, and the difference is visible weeks before the effective date. The applicability scorer found the bill applied to both personal loans and auto loans in Ohio, and each got a policy section, an owner and a due date 21 days before November 30.
The pre-mortem’s weeks against the same change in Regulatory Change Management
Email and spreadsheet: Week 2, from an inbox.
With the solution: On the next 30-minute read of the state’s sources, with a verdict and a reason.
Email and spreadsheet: Personal loans only; no reason for leaving auto out.
With the solution: Personal loans and auto loans in Ohio, confirmed with the change lead’s signature.
Email and spreadsheet: Agreed by email over four weeks; the form unowned.
With the solution: From the ownership map: Tomás Rivera for personal loans, Luis Ortega for auto.
Email and spreadsheet: None for the form.
With the solution: November 9, 21 days before the effective date.
Email and spreadsheet: None until the exam.
With the solution: Flagged at risk: form CL-OH-04 not yet ordered; escalated at 14 days if still open.
Email and spreadsheet: Not reported.
With the solution: Listed as at risk in the Q4 change summary to the risk committee.
At risk, not missed: the Ohio task in red on its owner’s lane
The difference is not that the solution reads faster, although it does. It is that every piece of work has an owner and a date before the effective date, so lateness is visible while it can still be fixed. The deadline watcher nudges owners at 30 days and escalates open work to the chief compliance officer at 14; it cannot extend a date.
The risk committee sees the at-risk change before it takes effect
What should a bank do after missing a compliance deadline?
Stop the error, size it, fix the cause and remediate, in that order, and write each step down before the next exam. Examiners weigh self-identification and corrective action as part of the rating, and the CFPB's procedures ask whether complaint reviews "include comprehensive root cause analysis to assess why a particular law violation or error occurred – for example, whether an information system coding error led to inaccuracies across a portfolio" (CFPB examination manual). The same question applies to a missed date.
After a missed effective date: the order of work
- Stop the error at its source
Switch the form, the system table or the procedure now, and record the date the fix went live.
- Size the population
Every transaction from the effective date to the fix, across every product and state the rule touches, not only the one where it was found.
- Find the root cause in the change process
Read late, scoped narrow, unowned or undated: name the link that failed and the control that would have stopped it.
- Assess and pay remediation
For everyone affected, with the calculation kept; the statute or rule sets whether reimbursement is required.
- Decide on disclosure to the regulator
With counsel; a problem the institution found and fixed reads differently from one the examiner finds.
- Report it to the committee and board
What happened, how many customers, what was paid and what changed in the process.
- Test the fix after it runs
A sample of transactions after the correction, kept as evidence that the change now works.
Where the chain breaks, and the control for each link
Each step of the pre-mortem has a control that breaks it. None of them is novel; the point is that each needs to run on every item, not only the ones that look important. A Federal Reserve examiner's guidance puts the first and last plainly: identify the change through "established risk monitoring processes", and test it "before the change goes live" (Consumer Compliance Outlook).
Five links in a missed date, and the control that breaks each
| Link | Control | In the solution |
|---|---|---|
| Read late | Every source read on a fixed short cycle; the age of the oldest unread item measured | Sources read every 30 minutes; every item gets a verdict |
| Scoped narrow | A reason for every product and state left out; a signed scope | Reasoned verdicts; the change lead signs each scope |
| Owned by nobody | An ownership map covering systems and forms, not only policies | The owner assigner works only from the map, with backups |
| Tracked without a date | A due date for every task, counted back from the effective date | 21 days before by default; nudge at 30, escalate at 14 |
| Found by the examiner | A retest after the change and a line in the board report | Retest tasks listed with the change; board summary drafted from the matrix |
The file an examiner would read for this change is laid out part by part in the regulatory change impact assessment an examiner reads, and who should hold each control in who is responsible for regulatory change management. Changes whose window is short every year, such as the January threshold resets, are covered in the CFPB annual threshold adjustments. To follow the sample Ohio change screen by screen, start from Regulatory Change Management.
Questions people ask
Is there a grace period after a regulation's effective date?
Only if the rule or the agency provides one. Some rules have a compliance date later than the effective date, and some agencies announce supervisory flexibility, but absent that the obligation starts on the date in the rule. The change file should say which date applies and why.
What is a matter requiring attention?
A supervisory finding the institution must correct, which the board must answer. Under Federal Reserve guidance the board provides a written response on its plan, progress and resolution; under the OCC and FDIC rule effective November 2, 2026, those agencies may issue one only for practices that threaten material financial harm or for an actual violation of a banking or banking-related law or regulation.
Can a missed regulatory change lower a consumer compliance rating?
Yes. Change management is one of the factors under board and management oversight, and the violations a missed change produces are weighed for root cause, severity, duration and pervasiveness. A missed change that touched a whole product scores badly on all four, and a rating of 3 or worse can bring more frequent examinations.
Is the risk lower now that the CFPB has pulled back on enforcement?
The source of the risk has shifted, not disappeared. The regulations still apply, prudential regulators still cite violations at every exam, states enforce their own laws and can enforce the Consumer Financial Protection Act, and borrowers keep their private rights of action.
Do examiners treat a missed state law differently from a federal one?
The violation is examined by whoever has jurisdiction, but the change-management question is the same for both: was it identified, scoped, owned, dated and tested. State law is where coverage gaps are most common, because the sources are many and less uniform.