AI for regulatory exam responses: one request traced, step by step

AI can now do most of the clerical work in a regulatory exam response, provided people keep the signature and the upload. Answering an exam document request well means four things: reading exactly what was asked, finding the right version of every document, checking that each part of the request is covered, and writing a cover note that explains the answer without overstating it. This page traces how Botminds' Regulatory Exam Management does those four things for one request, minute by minute, on a fictional sample bank. The request is number 14 of 46 in Calder Ridge Bank's 2026 FDIC consumer compliance and CRA exam letter: "Provide the three most recent quarterly post-closing quality control reports for residential mortgage loans, including the sampling method, the defects identified and management's responses." The agents ran overnight, from 02:04 to 02:10. Two people took it from there.

How does AI respond to an exam document request?

Read the request as clauses, answer each clause with an exhibit, send the current approved version of every document, and say what is missing. That is true with or without software. The FDIC tells its examiners to set the period for requests about "minutes, training records, or reports" so the bank can "avoid the submission of voluminous information" (CCEM II-4), and a good answer respects that: the right three reports, not every report on the share. An AI system that responds to exam requests has to do the same four things, in the same order, and leave a record of each. What the trace below adds is the order of work and where each check happens, so a reader can judge what an agent did and what a person still decides.

The design choice that matters most is that the work is split. In this solution five of its seven agents each do one job on a request: the letter reader, the answer matcher, the evidence gatherer, the completeness checker and the response drafter. The agent that drafts is not the one that checks, and each has limits written as settings, shown in the flow further down. A single chat assistant asked to "answer request 14" can produce a fluent paragraph; it cannot show which version of which report it used, or prove that clause 2 was covered.

02:04, the letter reader: four clauses and an owner

The letter reader had already split the examiner's letter into 46 numbered requests when it arrived. At 02:04 it read request 14 in detail and named four clauses: (1) the three most recent quarterly reports, (2) the sampling method, (3) the defects identified and (4) management's responses. It kept the examiner's wording exactly, as the agent always does, and took the owner from the bank's owner map: Tomás Reyes, the mortgage QC manager.

Clause splitting is the step that decides everything after it. "Including the sampling method, the defects identified and management's responses" reads as an aside, but it is three requirements. A tracker row that says "QC reports" loses them. The letter reader cannot change a due date to one later than the letter's, and it cannot reword the request.

02:05, the answer matcher: last exam's request, and what went wrong with it

At 02:05 the answer matcher found the bank's 2023 request 11, the same subject with 91% the same wording. In 2023 the bank had sent the Q2 to Q4 2022 reports with management's responses. On 22 March 2023 the examiner came back: "Please provide the sampling methodology used for each quarter." It took five days to answer. The 2026 request now names the sampling method in its own wording, and the matcher noted that the follow-up's subject is clause 2.

The matcher's rule is a threshold the bank sets: reuse a kept answer only when the wording is at least 85% the same, and otherwise show it as a reference. Even above the threshold it never reuses a document as-is; it hands the list of what was sent last time to the evidence gatherer to check for newer versions. Here the 2022 reports were obviously stale. The useful thing it carried forward was the follow-up.

How the answer was built: the step list in Regulatory Exam Management

The last line: the run stops at 'waiting for Marisa Quinlan, then Gregory Hale'. Nothing moves further without them.

02:07 and 02:08, the evidence gatherer: issued, latest, signed

At 02:07 the evidence gatherer searched the mortgage QC share and found 14 quarterly reports on file. "The three most recent" depends on the date and on what counts as issued: the Q3 2026 report would not be issued until 20 October, after the due date. It took the three latest issued reports: Q4 2025 (issued 22 January 2026, 18 pages), Q1 2026 (20 April, 16 pages) and Q2 2026 (21 July, 21 pages). At 02:08 it pulled management's responses from the Mortgage QC Committee minutes of 3 February, 29 April and 4 August 2026, taking the signed versions, not the drafts.

The gatherer is read-only on every source system and brings in no personal data the request does not ask for. If it cannot find something, it asks the owner rather than guessing, and the owner is asked only for what is missing. Tomás Reyes was asked for nothing on request 14.

02:09, the completeness checker: every clause to an exhibit and a page

At 02:09 the completeness checker mapped each clause to the exhibit and page that answers it. Clause 1: exhibits 14-A, 14-B and 14-C, the three latest issued. Clause 2: section 2 of each report, a random sample of 10% of each quarter's closings plus a discretionary sample of higher-risk loans. Clause 3: sections 3 and 4, 169 loans reviewed across the three quarters with 3 critical defects (1.8%). Clause 4: the signed responses. It added one note: the Q3 report is issued after the due date, and the cover note must say so.

The checker's one hard rule is that it never marks a request complete with a clause unmapped. It also checks the period covered, signatures and the latest version. A request where it cannot map a clause stays in Gathering with the gap named, which is where the owner's attention goes.

02:10, the response drafter: 132 words, every figure cited

The response drafter wrote the cover note in the bank's voice: what is provided (three reports, each with its issue date and exhibit letter), where the sampling method is (section 2 of each), the key figures (169 loans reviewed, 3 critical defects, 1.8%), the open findings (the two critical defects in Q2 2026, a self-employed income calculation and a tolerance cure issued after 60 days, tracked in remediation item MR-26-07) and what will follow (the Q3 report, on issue, if the examiner wishes). Every figure is taken from an exhibit and cites it. The note is marked draft until approved.

The cross-reference to MR-26-07 matters. An examiner reading two critical defects will ask what was done about them. The answer is in the findings tracker, and request 6 of the same letter, the status of corrective action, is answered from there. The cover note tells the examiner where to look.

09:17 and 10:42: the two people who decide

The exam coordinator, Marisa Quinlan, started her day on the exam board. Request 14's card read "3 of 3 reports found · cover note drafted". She read the draft on the card, opened the request page to see each clause beside its exhibit, and at 09:17 moved it to In review. At 10:42 the Chief Compliance Officer, Gregory Hale, opened the approval: the request, the three exhibits, "Every clause covered" and who had reviewed it. He chose the meaning of his signature, "Approved for sending to the examiner", and signed. The package was assembled as R14-QC-reports.pdf for Marisa to upload to the regulator's secure portal, and the answer was kept, with its versions, for the next exam.

The signature step: the approver sees exhibits, completeness and reviewer before signing

What the trace does not show: the requests that are not clean

Request 14 is a clean case: the documents existed, were issued and signed, and lived in one share. Many requests are not clean. In the same letter, the morning sweep re-ran missing exports for requests 20 and 21 (318 loss mitigation applications and 37 accounts with servicemember protections), found a newer version (v2.4) of the application procedures for request 45 than the v2.1 sent in 2023, and nudged the CCO for two requests only he could answer. The completeness checker flagged request 18 when 3 of 412 flood determinations were missing. Those are the requests where the board's value is in what it shows a person, not in what an agent finished.

Is it allowed to use AI for regulatory exam responses?

No rule forbids it, and no regulator has published a position on AI drafting of exam responses; nothing on this page should be read as one. What applies is the general principle that a bank answers for what it sends. The agencies' third-party guidance puts it plainly: "A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house" (88 FR 37920). And at the FDIC the completed CIDR, with the bank's answers, stays in the examiners' workpapers (CCEM II-4), so an answer an AI drafted is read and reread as the bank's own.

The rest of the record is general too. Regulators that use AI on data institutions file told the GAO "they were not using AI to make decisions autonomously or relying on it as a sole source of input" (GAO, May 2025). A Federal Reserve examiner wrote that "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements" (Consumer Compliance Outlook, 2019). And the agencies' April 2026 model risk guidance leaves generative and agentic AI out of its scope for now (SR 26-2). The trace is built to fit those principles: every step listed, every figure cited, a named person signing and a named person sending.

What to look for when buying AI for exam responses

Look for evidence, not fluency. A buyer should be able to open any answer and see what was asked, what was found, what was checked and who signed, and should be able to test the software on a closed exam before trusting it on a live one. The six questions below sort products quickly; the first and the last rule out general-purpose chat tools.

Where this solution fits: it is built for the request letters of consumer compliance and safety and soundness exams, and for the internal and external audits in between, and it keeps every answer for the next letter. A single trace shows how the work is done, not how often it is right. Replaying your last exam's letter describes how to measure that on your own closed exam, and the CIDR, annotated reads the rest of a request list the way the letter reader does.

Questions people ask

Can AI send documents to examiners?

It should not, and in this solution it cannot: the agents assemble a package, a named approver signs it with the meaning of the signature recorded, and a named person uploads it to the regulator's secure portal. Keeping the upload with a person keeps one human decision between a draft and the regulator.

How do you check an AI-drafted exam response?

Open each exhibit at the page the draft cites and read the sentence against it; check the period's first and last month; confirm the version is the latest issued or signed. The coordinator in the trace did this in the morning, on the request page where each clause sits beside its exhibit.

Does AI replace the exam coordinator?

No. It takes the copying, matching, searching and first drafts. The coordinator still decides what each answer says about the compliance program, handles the examiner's questions, and reads every draft before it goes to the approver.

What access does exam-response AI need?

Read-only access to the places evidence lives: shares, policy libraries, the loan and deposit systems' reports. In this solution the gatherer cannot write to a source system and brings in personal data only where a request asks for it.

How long does it take to answer an exam request with AI?

On the sample bank, six minutes of agent time for request 14 overnight, then a morning review and a signature. For a whole 46-request letter the solution's design target is four days to a complete answer, against an estimated nine by hand; the people's review time is what remains.