From entry letter to closed finding: the FDIC compliance exam, step by step

An FDIC consumer compliance exam moves through three stages that the FDIC's own manual names: "pre-examination planning; review and analysis, both off-site and on-site; and communicating findings to institution management via meetings and a Report of Examination" (CCEM II-1.1). For the bank, the work starts when an information package arrives at least 90 days before the exam, and it ends only when the corrective action on every finding has been reported and checked. Most of that time is spent finding, checking and explaining evidence the bank already holds. Botminds' Regulatory Exam Management was built for exactly that work: agents read the request letter, match each request to the answer sent last time, gather and check the evidence, and draft the cover note, while the exam coordinator reviews and the Chief Compliance Officer signs.

The sequence below follows the FDIC's Consumer Compliance Examination Manual, because its planning rules are written down in more detail than most. The Federal Reserve, the OCC and the CFPB run the same broad pattern of a request letter, a review, a report and a response, with their own names and timings.

What happens in an FDIC consumer compliance exam?

Examiners build a risk profile of the bank, decide which products, services and regulations to test, test them, and report what they found against the FFIEC's five-point consumer compliance rating. The sample pre-exam letter in the manual tells the bank so in plain terms: examiners will evaluate the compliance management system (CMS) "using a risk-based approach", will test "selected transactions when an area has a high risk of consumer harm and CMS efforts appear weak", and "will review and follow-up on violations, recommendations, and Matters Requiring Board Attention ... identified at your previous Consumer Compliance examination" (CCEM III-1.1).

The period under review is usually everything since the last exam. In the manual's words, the scope "typically covers bank activities conducted over a discrete period of time from the start date of the prior examination through the start date of the current examination" (CCEM II-5). That one sentence explains most of the bank's workload. Every request for minutes, monitoring reports, training records or complaint logs reaches back to the last exam's start date, and under the FDIC's November 2025 schedule that can be more than six years for a well-rated small bank. Six years between exams looks at what that gap does to a bank's memory of the last one.

Ninety days out: the information package and the pre-exam interview

The first contact is a phone call, not a letter. The field supervisor or supervisory examiner calls management with the projected start date and then "submits the IP to the institution no less than 90 calendar days before the projected start date of the examination" (CCEM II-4). The package explains the exam process and the channels for raising concerns, and it carries the interview questions early, so management can prepare and invite the right people. For banks that report a large HMDA register, validation testing of the data may happen before the exam, so the data is settled before examiners arrive.

The interview follows. The examiner-in-charge (EIC) uses it to learn the bank's "risk profile, size, complexity, and the types of products or services offered", and to agree on-site and off-site work and how documents will move. The FDIC prefers its secure Enterprise File Exchange (EFX). The sample letter is explicit that "we are not requesting that you prepare written responses to these questions", but the answers drive the next document. The CIDR is generated from the interview, and an item the bank describes in the interview is an item the bank will be asked for.

This is the cheapest moment in the exam to be prepared. A coordinator who walks into the interview knowing what has changed since the last exam (new products, new vendors, a new loan system, staff who left) can answer precisely. A precise answer gives a tighter request list later.

The entry letter and the CIDR: at least 30 days to answer

The Compliance Information and Document Request (CIDR) is the request most banks call the first-day letter. The EIC produces it in the FDIC's planning system, which "filters the CIDR to make available certain items based on the institution's responses to the PEP interview questions", and the manual says it "primarily requests CMS-related information and documents". For minutes, training records and reports, the EIC sets the period, "since the previous examination, in the past year, in the last two years", which, the manual notes, "will help the institution avoid the submission of voluminous information or data not relevant to the examination" (CCEM II-4).

There is no deadline in law for answering, but there is a floor in FDIC policy: "institutions must have at least 30 calendar days to complete the CIDR and provide requested documents. Longer time periods may be necessary based on the institution's size, resources, and complexity." The EIC is told to agree the time with management at the interview. The FDIC also keeps what the bank sends: the completed CIDR goes into the exam workpapers, so the examiner who arrives next time can read the bank's last answers, whether or not the bank kept a copy.

The CIDR's parts are the subject of a separate guide, the CIDR, annotated. One thing matters here: the CIDR answers are what the EIC uses to decide the exam's scope. A thin answer on monitoring or audit does not shrink the exam. It tells the examiner the CMS may not catch problems, and that is the condition the FDIC's risk-focused method tests hardest.

A CIDR read into Regulatory Exam Management: one card per numbered request

Request 6 asks for the status of corrective action on each 2023 finding: the last exam's findings come back as this exam's first questions.

The second request: transaction testing

Once the CIDR answers are in, the EIC completes the FDIC's risk assessment, the Assessment of Risk of Consumer Harm (ARCH), picks the product and regulation areas that warrant testing, and sends a transaction testing request. The manual describes its contents as "largely ... transaction-level documentation such as loan files, disclosures, notices, periodic statements, or system parameters", with the review period and sample sizes stated. There is no fixed number of days here; "examiner judgment should be exercised regarding the approximate number of days the institution needs", and the EIC should say "which documents are needed at the start of the examination" (CCEM II-4).

This request is different work from the CIDR. The CIDR asks for documents a compliance team owns or can find. The transaction request asks for exports from the loan, servicing and deposit systems: lists, samples and the files behind them. It is often the loan servicing and operations owners, not compliance, who hold the pen. If a document the EIC needs was not supplied with the CIDR, such as "Board meeting minutes or monitoring/audit reports", examiners may come to the bank during planning to read it.

On site: the entrance meeting, the testing and the exit meeting

Fieldwork opens with an entrance meeting "as soon as possible after beginning the examination", covering who is on the team, what will be done on-site and off-site, and "any issues identified during off-site review and analysis, particularly areas of significant risk of consumer harm that will be receiving close attention". The FDIC still expects every exam "to have an on-site presence" (CCEM II-5).

During the review, examiners read the board's minutes for evidence of oversight. One question the manual tells them to ask is "Whether the Board documented a review of the prior Consumer Compliance Report of Examination (ROE) that included ... a report regarding corrective action and subsequent testing for identified violations". Another is whether "management responded appropriately to deficiencies noted and suggestions made at previous examinations and audits". In other words, the last exam's findings are tested again, through the bank's own paper.

The exit meeting is where the bank first hears the findings as a whole. The manual lists its purposes, including to "Obtain management's response(s) and commitment(s) for corrective action" and to "Advise management of recommended consumer compliance and CRA ratings". Findings are graded by severity. Level 3 violations "typically result in a request or a requirement that the institution provide restitution in excess of $10,000 (in aggregate)". Level 2 reflects "systemic, recurring, or repetitive errors". Level 1 covers isolated or sporadic errors and is "left with management at the conclusion of the exit meeting but is not included in the ROE" (CCEM II-6).

Violations that a bank self-identified and fully corrected before the exam started "generally are not cited". The evidence of that correction is the bank's to produce.

That rule, also in II-6, is the strongest argument for keeping findings evidence in order between exams. Examiners "confirm that the bank identified the root cause of the violation and that the corrective action gives reasonable assurance that the violation will not recur". A bank that can show its own testing found the problem, fixed it, remediated customers and retested has turned a citation into a strength of its CMS.

The report, the board meeting and the response letter

The Report of Examination (ROE) is the exam's "principal document of record". It gives the rating, discusses board and management oversight and the compliance program, lists Level 3 and Level 2 violations "with management's response to each", and carries any Matters Requiring Board Attention (MRBAs) and recommendations. A board meeting is required when an enforcement action is recommended, when the proposed consumer compliance rating is "3," "4," or "5", when the CRA rating is below satisfactory, or when the bank asks. Findings and ratings "are not final until the appropriate reviews are conducted" at the regional or Washington office (CCEM II-6).

The exam does not end when the report arrives. Its transmittal letter "requires the institution, within a timeframe established by the applicable Regional Office, to send a letter or letters ... notifying it, in sufficient detail, of the actual resolution of the MRBAs, recommendations, and Level 3 and Level 2 violations", and the regional office "maintains a tracking system to ensure responses are received and corrective actions are completed in a timely manner". The letter has to describe the actual resolution, not a plan, so it waits on the fixes themselves and on the testing that shows they worked.

How findings are labelled is changing. An OCC and FDIC rule effective November 2, 2026 narrows when a matter requiring attention can be issued and adds non-binding supervisory observations and a separate class of "other violations". The FDIC says it is reviewing its manual to reflect the change. The findings rule of November 2026 sets out what each new label obliges a bank to do.

Findings carried to closure in Regulatory Exam Management, with internal audit's validation

Only the Chief Compliance Officer can close a finding, and only after internal audit has validated it.

How long does a consumer compliance exam take?

No agency publishes a standard duration, and planning alone runs at least three months at the FDIC. The best public measure comes from the Federal Reserve's Inspector General, which reviewed Federal Reserve consumer compliance exams from 2017 to 2019. It found that "the average for all consumer compliance examinations, including those with UDAP consultations, was 145 days". For the exams that needed a consultation on unfair or deceptive practices, "the average examination time was 370 days. The length of examinations ranged from 57 days to 801 days" (Federal Reserve OIG, 2021).

The same report gives the bank's side of the tail: after findings, "the institution typically has 30 to 45 days to provide a response, but interviewees indicated that institutions often seek and are granted extensions". Add the corrective work itself, which can run across quarters of retesting, and the true span from the first phone call to a closed finding is commonly longer than a year.

Most banks come out of it well. At the end of 2025, "98 percent of all FDIC-supervised institutions were rated satisfactory or better for consumer compliance (i.e., ratings of "1" or "2")" (FDIC, March 2026). The exam is rarely a crisis. It is a long, document-heavy project that arrives every few years, and often finds a team that has never run one.

The Federal Reserve and CFPB versions of the same exam

The other agencies follow the same arc of request, review, report and response, but on different clocks, and a bank that changes charter or crosses $10 billion in assets meets a different process. The Federal Reserve's community bank letter, SR 19-5, tells examiners to send the request letter "four-to-eight weeks prior to the examination start date", to "specify the as-of date for the data requested" and to name a contact for questions on the list. That is a shorter lead than the FDIC's 90-day information package, and the as-of date matters: an export run on the wrong date answers a different question from the one asked.

The Federal Reserve also splits its requests in two. A Minneapolis Fed senior examiner, writing in Consumer Compliance Outlook, describes the first-request letter as "a detailed questionnaire that requests specific documents"; a second-request letter follows before examiners arrive, and "Reserve Banks will issue the final report no later than 60 days after the examination closing date". At the CFPB, which supervises banks over $10 billion, supervised entities get advance notice, requests "hew to the defined scope of the exam", and findings arrive as an exam report or a supervisory letter.

How should a bank prepare for a consumer compliance examination?

Start with the last exam, not the next request list: the prior Report of Examination, the corrective action on each finding, and everything that has changed since. The Consumer Compliance Outlook article advises institutions to "review relevant federal guidance, previous examination results, and their own processes", to be able to "document that the institution has adequately addressed issues from the previous examination", and to show how the compliance system "anticipates change", because "Change often increases compliance risk."

Three practical steps follow from the FDIC's process. Name one coordinator who owns the request list and the channel to the examiner-in-charge. Map every likely request area to a current owner before the CIDR arrives, since the request list will follow what was said in the interview. And pull together, for each finding of the last exam, the dated evidence of the fix and of the testing after it, because the board-minutes review in II-5 will look for exactly that. Botminds' Regulatory Exam Management keeps all three between exams: the owner map, the kept answers from the last letter, and each finding's evidence on one timeline.

The second half of that list is a filing problem as much as a compliance one, and it is the part a small team finds hardest to keep between exams. Ready before the letter sets out how to build the evidence library in the months before an information package arrives.

Questions people ask

What is a first-day letter in a bank exam?

It is the examiners' first written request list. At the FDIC it is the entry letter with its Compliance Information and Document Request, sent after the pre-exam interview and answered before fieldwork. Other agencies use their own names for it, and a second, transaction-level request usually follows once the scope is set.

Do examiners cite violations of guidance?

Not at the FDIC. Its manual says examiners "will not criticize a supervised financial institution for a 'violation' of supervisory guidance. Rather, any citations will be for violations of law, regulation, or non-compliance with enforcement orders or other enforceable conditions" (CCEM II-1.1).

Who attends the exit meeting?

The FDIC sends at least two representatives "when practical". Who else attends from the bank is management's call: consultants, counsel, directors or the staff who run the affected areas may join for the segments on their area, and third parties must be under contract with the bank with confidentiality terms (CCEM II-6). A separate board meeting needs at least a quorum of directors.

Does the bank see everything the examiners write?

No. The Report of Examination has a Supervisory Section that carries confidential or sensitive information for the FDIC's regional and Washington offices and for the next examiners, and it "is not included in the ROE transmitted to the institution". The bank sees the report, the Level 1 list and the exit meeting agenda.

Can a bank appeal the findings of an FDIC compliance exam?

Yes, for material supervisory determinations such as ratings and violations cited. From August 4, 2026 appeals go to the FDIC's Office of Supervisory Appeals, which replaced the former review committee, and they must be filed within set timeframes (CCEM II-11). Before that, management can answer at the exit meeting: if it presents significant new information there, the manual says the review may be left open for further work.