The Compliance Information and Document Request (CIDR) is the FDIC's first written request list in a consumer compliance exam, the document most bankers call the first-day letter. It follows the pre-exam interview, is tailored to the bank's answers, and, in the words of the FDIC's manual, "primarily requests CMS-related information and documents" for a period the examiner-in-charge sets, usually "since the previous examination" (CCEM II-4). The answers decide the exam's scope. Botminds' Regulatory Exam Management reads a CIDR into numbered requests and their clauses, matches each to what the bank sent last time, and checks every clause against an exhibit before a person signs and sends it. This guide reads a sample CIDR the same way, line by line.
The FDIC no longer posts its full sample request list, so the letter below is a sample of our own: a fictional bank, Calder Ridge Bank, and its 2026 consumer compliance and CRA exam. Its structure follows the manual, and its requests are the kind every CIDR carries.
A CIDR, line by line: what each part of the request is for
ACompliance Information and Document Request
The name tells you the stage. The CIDR comes after the pre-exam interview and "primarily requests CMS-related information and documents". Loan files come later, in a second request.
BThis request is made in connection with the consumer compliance and Community Reinvestment Act examination …
Which exam, and whether CRA runs alongside it. A joint exam adds CRA items, such as lending and community development data, to the same list.
CPlease provide the items below through the secure portal by [the due date] …
How and by when. At the FDIC the portal is usually EFX. Policy gives the bank at least 30 calendar days for the CIDR, agreed at the interview.
DWhere an item does not apply, please say so.
A silent gap reads as a missing document. "Not applicable, because we do not offer the product" is an answer.
E1. Provide minutes of the Board of Directors and of the Compliance Committee since the last examination (March 2023).
The period runs back to the last exam's start date: the exam's review period. Examiners read minutes for oversight, including whether the board reviewed the last report and its corrective action.
F6. Provide the status of corrective action taken on each finding of the 2023 examination, with supporting evidence.
The last exam's findings return as this exam's questions. "With supporting evidence" is a clause, and the one most often answered with narrative alone.
G8. Describe new products, services, delivery channels and significant changes since the last examination, with the compliance review of each.
Change management, a rated factor. Two clauses: the list of changes and the compliance review behind each one.
H14. Provide the three most recent quarterly post-closing quality control reports for residential mortgage loans, including the sampling method, the defects identified and management's responses.
One request, four clauses. A complete answer shows the reports, the method, the defects and the signed responses, and says what is not yet issued.
What is in an FDIC CIDR, and what documents does it request?
A CIDR asks for the documents that show how the bank manages compliance, grouped by area and limited to a period. The FDIC builds it from a standard list in its planning system, which "filters the CIDR to make available certain items based on the institution's responses to the PEP interview questions", and the examiner-in-charge (EIC) tailors it so that it requests "only what is necessary to conduct the examination" (CCEM II-4). A bank that does not offer a product should not be asked about it, and a bank that described a new product in the interview should expect to be.
How each CIDR area maps to the consumer compliance rating
The areas follow the FFIEC's rating system, which is why the CIDR reads like a rating worksheet. Two of its three categories assess the compliance management system: Board and Management Oversight, and the Compliance Program. The third, Violations of Law and Consumer Harm, is assessed by testing. The oversight factors include "effectiveness of the institution's change management processes" and "self-identification of consumer compliance issues and corrective action undertaken as such issues are identified". The program factors are policies and procedures, training, "the sufficiency of the monitoring and, if applicable, audit", and "the responsiveness and effectiveness of the consumer complaint resolution process" (81 FR 79473). Almost every CIDR request maps onto one of those eight factors.
Reading the letter this way helps in two places. It tells the coordinator which requests carry the most weight in the rating: an answer on monitoring and audit or on corrective action speaks to the bank's whole program, while a product disclosure speaks to one product. And it shows that one factor is often evidenced in several requests: change management, for instance, surfaces in the minutes, in the new-products request and in the policy approvals, so those answers have to agree with each other.
CIDR areas, the rating factor each one feeds, and where answers fall short
| CIDR area | Rating factor it evidences | What a full answer includes | Common gap |
|---|---|---|---|
| Oversight: minutes, CMS policy, reports to the board | Board and management oversight | Board and committee minutes for the whole review period, showing compliance reports received and acted on | Minutes from the last year only; reports listed but not attached |
| Corrective action on prior findings | Self-identification and corrective action | Each finding with its fix, the retest after the fix and who validated it | A status narrative with no retest or validation |
| New products and changes | Change management | Each change since the last exam with the compliance review done before launch | The list of changes without the reviews |
| Policies and procedures | Policies and procedures | The current approved version, with the approval date | A superseded version, or a draft |
| Training | Training | Curriculum by role and completion records for the period | Curriculum only, or completions for one year |
| Monitoring, testing and audit | Monitoring and audit | Schedule, results and management's responses for each review | Results without responses; the latest period missing |
| Complaints | Complaint resolution | The log with resolutions and any root-cause analysis | A count of complaints with no resolutions |
| Third parties | Oversight and program | The list of third parties in consumer products, with the latest oversight review of each | The vendor list without reviews |
The anatomy of one request: wording, clauses, period and version
Every numbered request has four parts, and a complete answer covers all four. The wording is the examiner's, and it should be kept exactly, because a paraphrase drifts towards what the bank has rather than what was asked. The clauses are the separate things the wording asks for, often joined by "with", "including" or "and". The period is the time the answer must cover, usually back to the last exam. Theversion is the document's state: the latest approved, signed or issued copy, not the draft in someone's folder.
Request 14 in the sample letter shows all four. It asks for "the three most recent quarterly post-closing quality control reports for residential mortgage loans, including the sampling method, the defects identified and management's responses". That is four clauses: three reports, the method, the defects and the responses. The period is "three most recent", which changes with the date. The version is "issued", and management's responses must be the signed ones. In the sample, the third-quarter report would not be issued until after the due date, so a complete answer says so and offers it on issue.
Which period should each CIDR answer cover?
Unless the request says otherwise, the period runs from the start date of the last exam to the start date of this one. The FDIC's manual sets that as the exam's review period, "from the start date of the prior examination through the start date of the current examination" (CCEM II-5), and the examiner-in-charge narrows it item by item, choosing "since the previous examination, in the past year, in the last two years" so that the bank avoids "the submission of voluminous information or data not relevant to the examination" (CCEM II-4).
Three period errors recur. The first month is missing, because the folder someone keeps starts at a reorganisation or a system change rather than at the last exam's start date. The last month is missing, because the request was answered from a file pulled weeks before it was sent. And a relative period such as "the three most recent" or "the past year" is read on the wrong date. The fix is mechanical: write the period's first and last date on the answer, and check that the first and the last document fall inside it. Where an export is involved, state the as-of date the data was drawn on; the Federal Reserve's community bank letter, SR 19-5, tells its examiners to "specify the as-of date for the data requested" for the same reason.
How long does a bank have to complete the CIDR?
At least 30 calendar days. The FDIC's manual says the examiner-in-charge should start planning at least 45 days before the exam, but "institutions must have at least 30 calendar days to complete the CIDR and provide requested documents. Longer time periods may be necessary based on the institution's size, resources, and complexity" (CCEM II-4). The window is agreed at the pre-exam interview, which is the moment to ask for more time if the letter will land in a quarter-end, a system conversion or the HMDA filing season.
Thirty days is less than it sounds once the work is planned backwards. The answers have to be reviewed by the coordinator and signed by the Chief Compliance Officer before anyone uploads them, so owners need internal due dates well before the FDIC's. The bar below is one way to lay the days out; your own split will follow the size of the letter and how much of it you can answer from last time.
Thirty days for a CIDR, planned backwards from the upload
- Assign2
- Owners gather15
- Check each clause5
- Review and sign5
- Upload3
One request in Regulatory Exam Management: four clauses, each mapped to an exhibit
The note at the bottom of the check: the next report is not yet issued, and the cover note says so instead of leaving a silent gap.
Why do examiners send follow-up requests? Often, a clause nobody read
A follow-up is often not about a missing document but about a missing clause. An owner asked for "QC reports with management's responses" sends the reports, because the reports are what the owner keeps. The examiner reads them, finds no responses and asks again. The follow-up costs days, and it tells the examiner something about the CMS. The manual tells examiners that if documents "such as Board meeting minutes or monitoring/audit reports, are not provided in response to the CIDR", they may come to the bank to read them (CCEM II-4).
In the sample bank's history the gap was the sampling method. At the 2023 exam the bank sent three QC reports with management's responses; eight days later the examiner asked, "Please provide the sampling methodology used for each quarter", and the answer took five days. The 2026 request names the sampling method in its wording. A team that kept the 2023 follow-up next to the 2023 answer would have answered it up front even if the wording had not changed.
Request 14 answered two ways
Answer as owners usually send it: The three reports found in the QC share, one of them a draft.
Complete answer: The three latest issued reports, each with its issue date and page count, lettered 14-A, 14-B and 14-C.
Answer as owners usually send it: Not mentioned. Section 2 of each report covers it, but nobody points to it.
Complete answer: Cited by exhibit and section: a 10% random sample of each quarter's closings plus a discretionary sample of higher-risk loans.
Answer as owners usually send it: In the reports, unsummarised.
Complete answer: Summarised in the cover note from the reports: 169 loans reviewed, 3 critical defects (1.8%).
Answer as owners usually send it: Committee minutes extracts, unsigned.
Complete answer: The signed responses from the committee minutes of 3 Feb, 29 Apr and 4 Aug 2026.
Answer as owners usually send it: Silence about the next quarter.
Complete answer: "The Q3 2026 report will be issued on 20 October; we will send it on issue if the examiner wishes."
Answer as owners usually send it: Not linked.
Complete answer: The two critical findings in Q2 2026 point to the remediation item tracking them.
Request by request: what examiners do with each answer
Each request feeds the examiners' risk assessment, the FDIC's Assessment of Risk of Consumer Harm (ARCH), which "documents the scope of the examination". A strong answer on monitoring and audit can mean that "minimal residual risk of consumer harm exists and transaction testing is not considered necessary" in that area (CCEM II-5). A weak one sends the examiner to the loan files.
Minutes are read for oversight. The manual lists what examiners look for in them, including "Consideration of new loan or deposit products and strategies for their implementation", "Consideration of new software or software vendors", and whether the board "documented a review of the prior Consumer Compliance Report of Examination". The corrective-action request (request 6 in the sample) is checked against the same minutes. Answering request 6 with a status table while the minutes never mention the findings invites the question of who was overseeing the fix.
Third-party requests carry more weight than they once did. The CMS chapter says the board and management remain "responsible for identifying and controlling compliance risks arising from third-party relationships, to the same extent as if the third-party activity was handled within the institution" (CCEM II-3). The sample pre-exam letter tells banks examiners "will also review your institution's ability to appropriately assess, measure, monitor, and control the risks associated with significant third-party relationships" (CCEM III-1.1). A vendor list without the oversight review of each vendor is a partial answer.
The cover note: what a complete answer says
A cover note turns a folder of exhibits into an answer. It says what is provided, for which period, what the key figures are and where they come from, and what will follow. The sample's note for request 14 runs to 132 words: three reports with issue dates, the sampling method by section, the defect count, the open remediation item and the report still to come. Every figure in it is taken from an exhibit and cites it.
Two rules keep a cover note safe. It states nothing that is not in an exhibit, because an examiner will test the sentence against the document. And it says what is missing, with a reason and a date, because a gap the bank names is a scheduling detail and a gap the examiner finds is a finding about the CMS.
The drafted cover note, readable from the exam board
Before any CIDR answer goes out: six checks
- Keep the examiner's wording
Answer the request as written, not a paraphrase of it. Number its clauses.
- Map every clause to an exhibit and page
"With", "including" and "and" each start a clause. No clause unmapped.
- Cover the whole period
Back to the last exam's start date unless the request says otherwise. Check the first and last month are present.
- Send the right version
Approved policies, issued reports, signed responses. No drafts.
- Name what is missing
Not applicable, not yet issued, or to follow by a date. Never a silent gap.
- Check last exam's follow-ups
Whatever the examiner came back for last time belongs in this answer up front.
The last check depends on having last exam's answers and follow-ups at all, and at a small bank on a long exam cycle they are often gone. Keeping the memory of the last exam covers why that happens and what to keep. The full exam sequence, from information package to response letter, is set out in the FDIC compliance exam, step by step.
Questions people ask
Should we send more than the CIDR asks for?
Send what each clause asks for, over the stated period, and stop there. The FDIC sets periods precisely so banks avoid "voluminous information or data not relevant to the examination". The opposite error is worse, though: a Federal Reserve examiner's advice is that "Institutions should not interpret questions too narrowly" (Consumer Compliance Outlook, 2018).
What if a requested document does not exist?
Say so on the answer, with the reason: the product is not offered, the review is scheduled for a later quarter, or the report is not yet issued and will follow on a date. If a review the program calls for was never done, say that too and say what has been done since. Silence leaves the examiner to infer the worst, and the examiner may come to the bank to look.
Can we reuse our answers from the last exam?
The documents usually change, but the questions often do not. A kept answer is a strong starting point if you check the wording against the new request, refresh every document to its current version, and add whatever the examiner asked for afterwards.
Is the CIDR the same as an OCC or Federal Reserve first day letter?
The name and format differ by agency, and the CFPB sends its own information requests, but the content is similar: CMS documents first, then transaction-level samples once the scope is set. The CFPB says its requests "hew to the defined scope of the exam" (CFPB, April 2026).
Who should answer each CIDR request?
The person who owns the evidence drafts it, and one coordinator owns the whole letter, its clock and its consistency. The compliance officer can answer the oversight and corrective-action requests directly, but QC reports, training records, complaint logs and system exports sit with the areas that keep them, and an answer drafted second-hand is where clauses go missing. Map each request area to its owner before the letter arrives.