Six years between FDIC compliance exams: keeping the memory of the last one

Under the schedule the FDIC adopted on November 7, 2025, a bank rated 1 or 2 for consumer compliance "will generally be on an examination cycle of 66-78 months, 54-66 months, or 24-36 months, depending on their asset size" (FDIC FIL-52-2025). For the smallest well-rated banks that is up to six and a half years between full exams, and the exam that eventually arrives still asks about everything since the last one started. The cycle is good news for the budget and hard on memory: the compliance officer who answered the last request letter may have left, and nobody can find what was sent. Botminds' Regulatory Exam Management keeps every answer sent to an examiner, with the document versions used and whatever the examiner asked afterwards, so the next letter starts from the last one rather than from a blank spreadsheet.

How often does the FDIC do compliance exams in 2026?

It depends on asset size and the last ratings. The FDIC's Consumer Compliance Examination Manual sets three tables, based on total assets in the two previous year-end Call Reports. A bank of $350 million or less in either year goes on the 66–78-month cycle. A bank above $350 million in both years and $3 billion or less in either goes on 54–66 months. A bank above $3 billion in both years goes on 24–36 months. Cycles run "based on the date of the last joint Consumer Compliance examination/CRA evaluation" (CCEM II-12.1).

The two longer cycles add a check in the middle. For those banks, "with no targeted Consumer Compliance examination or CRA evaluation, examiners will conduct a mid-point risk analysis of the institution and determine if an intervening supervisory activity, such as a targeted visitation, is needed". The mid-point falls at 33–45 months for the smallest banks and 27–39 months for the middle band. The manual limits what can follow: an intervening activity happens "only when there is sufficient, articulable reason why such review cannot wait", and earlier full exams "are expected to be rare".

A weaker rating changes everything. "For institutions with a "3", "4" or "5" Consumer Compliance rating and a CRA rating of "Needs to Improve" or "Substantial Noncompliance", the joint examination cycle will be shorter (either 1-12 months or 12-24 months)." A 3 for compliance with a satisfactory CRA rating brings a compliance-only exam within 12–24 months, and the long joint cycle keeps running from the last joint exam regardless.

What changed in the FDIC compliance exam cycle in November 2025?

The middle band changed most. Under the May 2023 schedule, a well-rated bank over $350 million was examined every 24 to 36 months; since November 2025, a bank between $350 million and $3 billion waits 54 to 66 months. The smallest banks moved less, from 60–72 months to 66–78, but they also lost the compliance-only exam the old table placed at 30 to 36 months, which is now a mid-point risk analysis done from the FDIC's own records (FDIC redline, November 2025).

The practical effect for a $1 billion bank is that its next consumer compliance exam may be the first in five years, against a habit of one every two or three. Each of the rhythms a team built around the old schedule (a refresher on the request list every other year, a coordinator who has run two or three exams) thins out. The mid-point analysis keeps the FDIC informed between exams; it asks nothing of the bank and leaves no request list behind to learn from.

Six years is longer than most compliance careers in one seat

Nobody publishes how long a community bank compliance officer stays in the role, but a cycle of 66 to 78 months outlasts a great deal: a core system conversion, a new loan origination system, a couple of product launches, a merger of committees, the retirement of the person who "just knew" where the QC reports lived. The FDIC's own manual anticipates the problem. Small banks' programmes may not be written down, it says, but "during periods of expansion or turnover of staff, a written compliance program becomes more important because individuals with the particular knowledge or experience may no longer be with the institution or available for contact" (CCEM II-3).

The asymmetry is stark. The FDIC keeps its side: "The completed CIDR with institution responses should be retained as an examination workpaper" (CCEM II-4), alongside prior reports, workpapers and "Prior corrective actions (such as restitution) and responses to ROEs", which the examiner-in-charge reads before planning. The examiner arrives knowing what the bank sent last time. The bank, often, does not.

The examiner opens the next exam with the bank's last answers in the workpapers. The bank should open it with the same file.

How often does the Federal Reserve do consumer compliance exams?

For state member banks, every 24 to 60 months for a well-rated bank, set by size and CRA rating. Under the Federal Reserve's schedule in CA 13-20, a bank under $350 million rated 1 or 2 is examined every 60 months with an Outstanding CRA rating and every 48 with Satisfactory; $350 million to $1 billion, every 36 months; $1 billion and over, every 24. Banks rated 3, 4 or 5 are seen every 12 months, and banks over $10 billion or with complex operations "may be placed under continuous supervision".

So a $1 billion bank's exam rhythm now depends on its charter: about two years at the Federal Reserve against four and a half to five and a half at the FDIC. The CRA side carries a floor from the Gramm-Leach-Bliley Act of 1999, which the Federal Reserve schedule cites: for a bank under $250 million rated Outstanding or Satisfactory, the routine CRA exam comes no earlier than 60 or 48 months after the last, though it can come sooner "for reasonable cause". And the Reserve Banks count a mandate as met if the exam starts "no more than 90 days past the mandated start date". Banks over $10 billion meet a third schedule, the CFPB's, for federal consumer financial law.

What the review period means when it is six years long

The exam's scope "typically covers bank activities conducted over a discrete period of time from the start date of the prior examination through the start date of the current examination" (CCEM II-5). A request for "minutes of the Board of Directors and of the Compliance Committee since the last examination" meant two or three years of minutes under the old schedules. It can now mean more than six. The same is true of training completions, complaint logs, monitoring reports and the status of every finding from the last exam.

Long periods change the nature of the work. Documents from the early years sit in retired systems, in the inbox of a former employee or in a share nobody has opened since the conversion. Versions multiply: a policy reapproved six times has six candidates for "the policy in force on" a given date. And findings from the last exam need evidence that spans years, from the fix to several rounds of retesting.

How often are safety and soundness exams? The clock that keeps running

Every 12 or 18 months, and they never stop. On-site safety and soundness exams come every 12 months, or every 18 for small, low-risk banks that meet criteria set by law, "including that they are considered well managed and well capitalized". After the 21st Century ROAD to Housing Act raised the threshold, the agencies' September 2026 interim final rule lifted the asset limit for the 18-month cycle from $3 billion to $6 billion (press release, September 10, 2026). A small bank on the longest compliance cycle therefore meets four or five safety and soundness teams, each with its own request letter, between two consumer compliance exams.

Internal audit, HMDA filings and external compliance reviews add calendars of their own. The compliance team answers request lists far more often than once in six years, and many requests repeat across them: minutes, policies, monitoring results, complaint logs. That repetition is the strongest reason to keep every answer in one place, with the version sent.

Keeping the memory as documents, not people

What has to survive a long cycle is narrow and specific. For each request in the last letter, the bank needs the examiner's exact wording, the answer it sent (cover note and exhibits), the version of each document it used, and anything the examiner asked afterwards. For each finding, it needs the fix, the retests and who validated them. With those, a new coordinator can answer most of the next letter from the last one; without them, the bank pays twice for the same answers, six years apart.

The answer library in Regulatory Exam Management: the last exam beside this letter

The 2023 follow-up for the sampling method sits beside this year's request, so the gap is closed before the letter is answered.

In the sample bank, the library holds 412 answers from nine exams and audits since 2019. When the 2026 consumer compliance letter arrived, 34 of its 46 requests matched a kept answer that same day. The match is the start of an answer, not the answer: the answer matcher reuses a kept answer only when the wording is at least 85% the same, and never reuses a document without checking for a newer version. Below that threshold, the old answer is shown as a reference. Replaying your last exam's letter shows how to test that matching on your own past exam before relying on it.

What is the FDIC mid-point risk analysis, and how to use it

The mid-point risk analysis is the FDIC's look at the bank between exams: examiners review what they know and decide whether "an intervening supervisory activity, such as a targeted visitation, is needed". It is also a natural moment for the bank's own check: half-way through a long cycle, are the last exam's findings closed with evidence, is the owner map current, and could a newcomer answer the last letter today? The FDIC treats self-identified violations that were "fully corrected before the start of the examination" as generally not cited, if examiners can "confirm that the bank identified the root cause" (CCEM II-6). Six years gives a bank plenty of time to find, fix and prove, if it keeps the proof.

Small banks face this most, because they are on the longest cycle and have the fewest people. When the compliance officer is the exam team looks at an exam from that seat.

Questions people ask

What exam frequency applies to a $350 million bank?

It depends on the two previous year-end Call Reports. If total assets were $350 million or less in either year, the FDIC's 66–78-month table applies; if over $350 million in both years, the 54–66-month table applies, up to $3 billion.

Does a visitation or mid-point review reset the cycle?

No. The manual says "the examination cycle will not reset if there is an intervening supervisory activity (such as a Consumer Compliance-Only examination, CRA-only evaluation, or visitation)".

When will our next FDIC compliance exam be?

Count from the start of your last joint consumer compliance exam and CRA evaluation, not from any later visitation or compliance-only exam. A well-rated bank of $350 million or less should expect the next one 66 to 78 months later, and the information package at least 90 days before it starts.

Are new banks examined sooner?

Yes. A newly chartered bank, or one that converts its charter to come under FDIC supervision, gets a visitation within its first 12 months and a full exam within 24, then joins the standard schedule for its size.

Can the FDIC examine a bank earlier than the schedule?

It can, when supervisory concerns warrant it, but the manual says such deviations "are expected to be rare". A bank under $250 million can also face an earlier CRA evaluation for "reasonable cause", such as significant fair lending violations or credible complaints about its CRA performance.