Regulatory exam management, explained.

A bank examination explained: a letter of requests, weeks of gathering, a report the board must answer

From planning call to closed finding: one exam cycle

1. The examiners call and send a planning packageAt the FDIC, at least 90 days before the exam starts. Calder Ridge Bank's last joint compliance exam began in March 2023.
2. The request letter arrivesCalder Ridge gets 46 numbered requests on October 5, 2026, due October 16; fieldwork starts November 2.
3. The bank gathers, checks, approves and sendsThe coordinator and thirteen colleagues gather the answers; the CCO approves them. This is where a clause gets missed, or caught.
4. Examiners test, meet management and reportA second, transaction-level request; testing on site; an exit meeting; a report with ratings and findings.
5. The bank fixes, proves and keeps it allThe board answers in writing, internal audit validates each fix, and the next letter asks for the evidence.

Step 3 is the center of this guide, with steps 4 and 5 close behind. Calder Ridge Bank, its people and its figures are fictional.

Four surprises for a first-time exam coordinator

First-day letter, examiner-in-charge, MRA and CAMELS, defined

Fourteen terms are defined in the one-page summary.

Which regulator examines a bank or lender, and the two kinds of exam every bank gets

In shortA bank's charter decides its main federal examiner: the OCC for national banks, the Federal Reserve for state banks that are Fed members, the FDIC for other state banks, and the National Credit Union Administration (NCUA) for credit unions. State banks also answer to their state, which can take turns with the federal agency. Every bank gets two kinds of exam with separate letters: safety and soundness, and consumer compliance. Lenders that take no deposits are examined by the states that license them.

Two exams, two request lists

The two exams run on different clocks, with different teams and often different examiners-in-charge. A bank also meets specialty reviews (BSA and anti-money laundering, information technology, trust) folded into the safety-and-soundness exam, plus its own internal audits, external compliance reviews and, for mortgage lenders, data checks before each Home Mortgage Disclosure Act (HMDA) filing. Each arrives as a list of requests, and many of those requests ask for the same documents.

In the example, Calder Ridge Bank is a state bank outside the Federal Reserve, so the FDIC examines it for both kinds of exam, and its March 2027 safety-and-soundness exam is shared with the state banking department.

Bank exam frequency in 2026: 12 or 18 months for safety and soundness, up to 78 months for consumer compliance

In shortFederal law requires a full-scope, on-site safety-and-soundness exam every 12 months, or every 18 months for a small, well-rated bank. Since September 14, 2026, "small" means under $6 billion of assets. Consumer compliance exams follow each agency's own schedule; the FDIC lengthened its cycles in November 2025, to as long as 66 to 78 months for the smallest well-rated banks.

Safety and soundness: the 12-month rule and the 18-month exception

Section 10(d) of the Federal Deposit Insurance Act "generally requires" a full-scope, on-site exam of every insured bank "at least once during each 12-month period".7 A bank may go 18 months if it meets every one of these tests: total assets under $6 billion; well capitalized; a CAMELS composite rating of 1 or 2 at its last exam; a management rating of 1 or 2 as well, which is what "well managed" means here; no formal enforcement action; and no change in control in the past 12 months.7

The $6 billion figure is new. The 21st Century ROAD to Housing Act, signed July 11, 2026, raised it from $3 billion, and the OCC, the Federal Reserve and the FDIC put it into effect by an interim final rule, published and effective September 14, 2026. An interim final rule takes effect first and takes public comments afterwards.

The agencies estimate that about 188 more banks become eligible (95 supervised by the FDIC, 50 by the OCC and 43 by the Fed), bringing the total that may qualify to 4,016.7 The Federal Reserve says ratings for satisfactory banks are generally issued every 12 to 18 months.13 State banks can have every other exam done by their state supervisor.7

Consumer compliance: the FDIC's longer cycles

On November 7, 2025, the FDIC told banks that well-rated institutions "will generally be on an examination cycle of 66-78 months, 54-66 months, or 24-36 months, depending on their asset size".14 Size is read from total assets in the two previous year-end Call Reports, the quarterly financial reports every bank files.

The cycle runs from the date of the last joint consumer compliance exam and CRA evaluation. A visitation or a compliance-only exam in between does not reset it.4 For the two longer cycles, examiners carry out a "mid-point risk analysis" from the FDIC's own records and add a targeted visit only when there is "sufficient, articulable reason".4

Weaker ratings shorten everything. A bank rated 3, 4 or 5 for consumer compliance with a CRA rating of Needs to Improve or Substantial Noncompliance goes on a cycle of "either 1-12 months or 12-24 months".4 New banks get a visit within 12 months and a full exam within 24.4

For Calder Ridge, at $3.6 billion and over $3 billion at both year-ends, the FDIC table gives a joint compliance exam every 24 to 36 months. It is also now under the $6 billion line for the 18-month safety-and-soundness cycle, if it meets the other tests: well capitalized, CAMELS composite and management ratings of 1 or 2, no formal enforcement action and no recent change in control.7

The first-day letter and the FDIC CIDR: when it arrives, what it asks and how long a bank has

In shortAt the FDIC, the exam starts with a planning call and an information package at least 90 days out, then an interview, then the CIDR, which the bank must have at least 30 calendar days to complete. A second, transaction-level request follows once the scope is set. The Federal Reserve sends its first-day letter four to eight weeks before a community bank exam. All of them go through a secure portal, and all of them are kept by the examiners.

The FDIC's manual sets this out in detail, in its own shorthand: IP is the information package, PEP-1 and PEP-2 are the two pre-examination planning phases, and CMS is the compliance management system. The field supervisor "submits the IP to the institution no less than 90 calendar days before the projected start date of the examination", and the examiner-in-charge "should begin PEP-1 no less than 45 calendar days prior to the scheduled start date". The CIDR "primarily requests information and documents to assess the CMS", and "institutions must have at least 30 calendar days to complete the CIDR and provide requested documents".1

"The majority of transaction-level documentation will be requested during PEP-2", once the bank's first answers have set the scope. Documents move through a secure exchange such as EFX, and "the completed CIDR with institution responses should be retained as an examination workpaper".1 The examiner keeps a full record of what the bank sent, so the bank should keep one too.

What a consumer compliance letter asks for

The interagency consumer compliance rating looks at three things: board and management oversight, the compliance program (policies and procedures, training, monitoring and audit, consumer complaints), and violations of law and consumer harm.12 Almost every CIDR request maps onto one of them, so a coordinator who sorts the letter by those headings sees what the examiner is testing. Requests for minutes and reports carry a period chosen by the examiner-in-charge ("since the previous examination, in the past year, in the last two years"), which keeps the bank from sending files that do not matter.1

On the safety-and-soundness side, the loan request is often a data file. The Interagency Loan Data Request is a voluntary, standard loan-level download for safety-and-soundness exams; in 2013 the agencies raised its required fields from 5 to 30.18

How to answer an exam request completely: clauses, period, version and personal data

In shortEach request has clauses (the separate things it asks for), a period (the dates it covers), a version (approved, signed, issued) and a privacy boundary (personal data only where asked). An answer is complete when every clause points to an exhibit and a page, the dates match the period read on the right day, every document is the latest approved one, and nothing extra goes out. Worked through on request 14 of the example.

Clauses, period, version, privacy: four tests for an exam answer

The numbers in request 14, worked through

Three critical defects in 169 reviewed loans is 1.8%. The bank's sampling method, a random 10% of each quarter's closings plus a discretionary sample of higher-risk loans, gives 58 of 571, 44 of 433 and 67 of 652, each just over 10%. For context, the industry-wide critical defect rate published by ACES was 1.38% for the fourth quarter of 2025 and 1.50% for the year.19 An answer that states the figures and names the two open Q2 findings, with where they are being fixed, leaves the examiner less to ask.

What the example's 46 requests cover

Fourteen owners hold these 46 requests, the exam coordinator and the chief compliance officer among them, from the loan servicing manager (seven requests) to internal audit (one). A request written as one sentence with "with", "including" or "and" in it is where incomplete answers start.

CAMELS and the consumer compliance rating: what each grade means and the 2026 proposal to change CAMELS

In shortEvery exam ends in a confidential rating from 1 (strongest) to 5. CAMELS rates safety and soundness on six components and a composite; banks rated 4 or 5 are on the FDIC's problem bank list, which held 47 banks in June 2026. The consumer compliance rating weighs oversight, the compliance program and violations. In 2026 regulators moved to stop the management component outweighing the others, and a CAMELS overhaul was proposed in May.

The 2026 moves on the management component

Examiners have long been able to pull a bank's composite down through its management rating even when its capital and earnings were strong. Two changes in 2026 push the other way.

First, the Federal Reserve's operating principles, updated September 24, 2026, say "the management and risk management components of CAMELS and RFI/C (D) ratings should not be given more weight than the other components in determining a firm's composite rating".6 RFI/C (D) is the Fed's rating system for bank holding companies. Second, on May 19, 2026, the Federal Financial Institutions Examination Council (FFIEC), the interagency body that sets common exam standards, proposed the first material revision of the rating system since 1996.22

Individual ratings are confidential supervisory information, which is why the public figures on ratings are aggregates like the two charts above.

The most common consumer compliance violations in 2025, from the FDIC and Federal Reserve data

In shortIn 2025 the FDIC cited 1,155 consumer compliance violations, three-quarters of them under five laws, with Truth in Lending far ahead. At Federal Reserve member banks, HMDA data errors were 45.2% of all citations. Almost every citation was the middle severity, a systemic or repeated error. These lists come from risk-focused exams, so they tell a bank where to test itself before the letter arrives.

The Federal Reserve's examiners conducted 97 consumer compliance exams in 2025 and cited 630 violations; in 2024 they conducted 223 and cited 662, with HMDA data at 38.2% of the total.24,25 Fewer exams in 2025 still produced a larger share of HMDA citations.

The FDIC grades violations by severity. Level 3 violations "have resulted in significant harm to consumers or members of a community" and typically lead to restitution of more than $10,000 in aggregate. Level 2 violations reflect "systemic, recurring, or repetitive errors". Isolated, sporadic errors are the lowest level, which the examiner leaves with management at the exit meeting and keeps out of the report.2,21

MRAs, MRIAs, MRBAs and supervisory observations: what each finding means after the November 2026 rule

In shortA finding is how an exam tells a bank what to fix, and each agency names its findings its own way. The Federal Reserve issues MRAs and, for the most urgent, MRIAs. The OCC issues MRAs. The FDIC has issued MRBAs, and the new rule makes its findings MRAs too. Violations of law are cited beside them. From November 2, 2026, an OCC or FDIC examiner may issue an MRA only for a practice that threatens material financial harm or for an actual violation of law; lesser weaknesses become supervisory observations, which carry no duty to act.

The OCC and FDIC MRA rule, effective November 2, 2026

The final rule "Unsafe or Unsound Practices, Matters Requiring Attention", published September 1, 2026, defines when an MRA may issue (12 CFR 4.92 for the OCC; part 305 for the FDIC). It allows two grounds.5

For banks over $10 billion, the two agencies will not issue MRAs on federal consumer financial law, which is the CFPB's to supervise.5 In practice, from November 2 a weakness that meets neither ground becomes a supervisory observation: the examiner writes it down, and the bank decides what to do about it.

How many MRAs Federal Reserve–supervised banks still had open

At community and regional banks, IT and operational risk, cyber included, was the largest category of open Fed findings at year-end 2025, followed by risk management and internal controls.13 The CFPB, for its part, says its MRAs "will focus on pattern and practice violations of law where there is substantive and identifiable consumer harm or clear violations of the disclosure requirements".10,26

How an MRA or cited violation gets closed: the board's letter, the fix, internal audit's validation

In shortA finding closes when the examiners are satisfied it has been fixed, usually at the next exam or a targeted visit. The bank's part is a written board response, a plan with dates, the fix itself, testing that shows it worked, and validation by internal audit. Since 2026 the Federal Reserve relies on an effective internal audit's validation and closes findings as soon as they are fully fixed. A problem a bank finds and fixes itself before the exam is generally not cited at all.

The Federal Reserve's 2013 guidance still sets the bank's obligations: "the banking organization's board of directors is required to respond to the Reserve Bank in writing regarding corrective action taken or planned along with a commitment to corresponding timeframes", and an MRIA "will remain an open issue until resolution and examiners confirm the banking organization's corrective actions".3 At the FDIC, the report's transmittal letter requires the bank to write back with "the actual resolution of the MRBAs, recommendations, and Level 3 and Level 2 violations", and the regional office tracks the responses.2

What the Fed's 2026 principles change about closing a finding

All four make the same demand on the bank: dated evidence. A fix with no test result, a test with no date, or a validation memo that cannot be found when the examiner asks leaves the finding open. In the example, finding F-23-1 from the 2023 exam (flood hazard notices given late) carries a procedure change, a checklist built into the loan system, quarterly flood testing with four clean quarters, and internal audit's validation; it now waits for the examiners to close it. The 2026 letter's request 6 asks for exactly that file.

How bank supervision changed in 2025 and 2026, and what it means for the next exam

In shortFederal supervisors spent 2025 and 2026 narrowing what they examine and criticize. Reputation risk is out of exams. MRAs need material financial risk or an actual violation. Disparate impact is out of FDIC and OCC fair lending exams. The CFPB said it would halve its supervisory events, and active formal enforcement actions fell to the lowest count in a ten-year series. The request letters keep coming, and the findings that remain depend more on the bank's own evidence.

None of this removes the request letter. Banks still meet a full-scope exam every 12 or 18 months, the FDIC conducted about 825 consumer compliance exams in 2025,21 and the remaining findings are concentrated on actual violations and material risk, where a bank's own testing and internal audit's validation decide how quickly they close.

State and multistate exams for nonbank mortgage lenders, servicers and consumer finance companies

In shortA mortgage company, servicer or consumer lender that takes no deposits is licensed and examined by each state it lends in. States run their exams in one shared system, the State Examination System on NMLS (the Nationwide Multistate Licensing System), which handled 2,641 exams in 2024, most of them mortgage. Companies in ten or more states increasingly get one coordinated multistate exam with a standard request list.

The Conference of State Bank Supervisors describes the State Examination System (SES) as "the supervisory component of NMLS": state agencies run company exams in it from start to finish, for consumer finance, debt, money services and mortgage companies.9 The Multistate Mortgage Committee coordinates exams of the largest companies. From 2025 it runs every multistate mortgage exam as "One Company, One Exam", aimed at lenders and servicers in ten or more states, and a working group cut "thousands" of SES questions to 70 core items for mortgage servicing exams.8

The request-and-answer work is the same shape at a nonbank: a numbered list, owners across the company, a due date, and findings to close before the next exam.

Eight ways an exam response goes wrong, and which ones cost the most

In shortMost problems in an exam response come from the paperwork: a clause missed, the wrong period, a draft instead of the approved version, a document nobody can find, personal data sent without being asked for, a late answer, a finding closed without evidence. Each one invites a follow-up, and some shape the scope of the exam itself.

Repeat problems weigh more than new ones. Among the four factors examiners weigh for a consumer compliance violation are its root cause and its duration,12 and at the Federal Reserve repeat criticisms that "have escalated in importance due to insufficient attention or inaction" become MRIAs.3 A finding fixed but not proven looks the same, from the examiner's side, as a finding not fixed.

How long a bank exam takes, what compliance costs a small bank, and what regulators expect of AI in exam work

In shortNo regulator publishes the hours a bank spends answering a request letter. The best public measure of exam length is a Federal Reserve inspector general study: consumer compliance exams of community banks averaged 145 days from start to disposition. The smallest banks spend roughly 11% to 15.5% of payroll on compliance. Model risk guidance leaves generative AI to each bank's own governance, and regulators expect people to make the decisions.

The same inspector general report notes that when Federal Reserve staff send a bank a preliminary analysis of a possible unfair-practice or fair lending violation, "the institution typically has 30 to 45 days to provide a response", and that extensions are often sought and granted.35 Counting the planning months before and the remediation after, an exam occupies a compliance team for well over a year.

What compliance costs, and the price of an hour

The same survey found that roughly 50% to 64% of what the smallest banks spend on consultants goes to compliance, against 19% to 30% at the biggest.36 The median compliance officer earned $80,730 in 2025, $38.81 an hour, before benefits.37 No regulator, trade body or study publishes the hours a request letter takes, the share of requests that repeat from one exam to the next, or how often answers draw follow-ups. Part C shows how to measure your own in a week.

What regulators expect of AI in exam responses

An exam answer is a statement by the bank to its regulator. Whatever helps prepare it, a named person should approve it, every fact in it should trace to a document the examiner can open, and personal data should go only where the request asks for it. Software can gather, check and draft inside those limits, while a person approves and sends.

Inside a bank's exam response today: one coordinator, a dozen owners, a spreadsheet and a crowded last two days

In shortOne coordinator runs the request list, a dozen or more owners across the bank supply the documents, the chief compliance officer approves, and internal audit validates the fixes afterwards. The tools are usually a spreadsheet, email and shared drives. Most of the coordinator's days go to chasing owners and finding what was sent last time.

Who works a request letter: coordinator, owners, CCO, audit, credit

A request's path from tracker row to the regulator's portal

Nine coordinator days on one 46-request letter, by task

Nine working days is the whole window the example's letter allowed, which is why the end of the window is crowded. The approver sees most items in the last two days, the owners who answered first wait longest for questions, and the clause checks are squeezed by the deadline.

In-house trackers, outside reviewers and exam modules, compared

Calder Ridge Bank's request letter: 46 requests on a board, request 14 answered overnight, and the CCO's signature

In shortThis is the example from the top of the page, inside the product. The letter is read into 46 requests with owners and due dates minutes after it arrives. On Monday, October 12, four days before the due date, Marisa Quinlan, the exam coordinator, finds request 14 gathered overnight: three QC reports, four clauses checked, a cover note drafted. She reviews it on the board, and Gregory Hulme, the chief compliance officer, signs it for sending.

1

The whole letter on one board, four days out

At 9:10 a.m. on Monday, October 12, Marisa opens the exam board: 14 requests sent, 11 in review, 13 gathering, 8 open, and 4 days to the Friday, October 16 due date. Each card carries the request number, area, due date, owner and the evidence already found. 34 of the 46 carry a link to the answer the bank sent at its 2023 exam.

The run log on the right lists what happened overnight, request by request. At 8:31 a.m. the completeness checker flagged request 18: 3 of 412 flood determinations missing, and flood was a 2023 finding.

2

The letter, read eleven minutes after it arrived

The FDIC's letter came in on Monday, October 5. By 4:12 p.m. it had been read into 46 requests across 11 areas, with two due dates (October 16, and October 30 for the loan-file sample in request 46) and 14 owners taken from the bank's owner map.

The letter screen shows the examiner's wording exactly as written, with a note beside each request: its owner, its stage, and the 2023 request it matches or "New".

3

Request 14, every clause tied to a page

Overnight, between 2:04 and 2:10 a.m., request 14 was read into four clauses, matched to 2023 request 11, and answered from the mortgage QC share: the Q4 2025, Q1 2026 and Q2 2026 reports, issued January 22, April 20 and July 21, 2026, as exhibits 14-A to 14-C.

The completeness check shows 4 of 4 clauses covered: the three latest issued reports; the sampling method in section 2 of each, highlighted on the page; 169 loans reviewed with 3 critical defects (1.8%); and the responses signed February 3, April 29 and August 4, 2026. One note: the Q3 report is issued on October 20, after the due date, and the cover note says so.

4

She reads the draft on the card

Marisa opens the card from the board: the examiner's wording, the three exhibits with their issue dates and page counts, and the 132-word cover note. It states the figures from the reports and names the two Q2 2026 critical findings, a self-employed income calculation and a tolerance cure issued after 60 days, tracked in remediation item MR-26-07.

She clicks Move to In review, and the card slides across.

5

The CCO signs, and a person uploads

Gregory Hulme opens request 14 in review. He sees the three exhibits, "Every clause covered" and who reviewed it, chooses the meaning of his signature, "Approved for sending to the examiner", and signs.

The package is assembled as one PDF with the request number in its file name, for Marisa to upload to the regulator's secure portal. The answer is kept, with the version of every document used, for the next exam.

The solution's design target is a complete answer to a 46-request letter in 4 days, against the 9 business days this letter allowed, with every clause checked against evidence before anything is sent. They are targets, to be measured on your own letters.

The answer library, the morning sweep, the owners, findings to closure and the next twelve months of exams

In shortOne request is the story. These screens show the rest of the exam: the kept answers the letter was matched against, the daily sweep that clears what it can, who owes what, the findings timeline that answers request 6, the calendar of exams and audits ahead, and the bank's own rules.

Select any screen to open it larger. The bank, people, examiner, vendors and figures are fictional.

Who does what on an exam answer: agents gather and draft, the coordinator reviews, the CCO signs, a person uploads

In shortEach agent has one job and limits it does not cross. They are read-only on every source system, state no fact without an exhibit, never change a due date and never contact the regulator. The exam coordinator reviews every answer, the chief compliance officer approves every item with an electronic signature, the chief credit officer co-approves credit requests in safety-and-soundness exams, and a named person uploads. Only the CCO closes a finding, after internal audit validates it.

What each agent does on a request letter, and the line it never crosses

Coordinator review, CCO approval, credit co-approval: the three sign-offs

Every agent step, move and signature is on the run log and the audit trail, kept answers record the version of each document used, and settings changes are versioned. The bank's data stays in its own workspace.

Request letters and bank records in; checked exhibit packages out

The bank systems exam evidence is read from

Hours, follow-ups and open findings: pricing your bank's exam work before you buy anything

In shortStart from your own numbers. Nobody publishes the hours a request letter takes, how many requests repeat from one exam to the next, or how often answers draw follow-ups, so the figures that matter are yours. A few published figures frame them: what a compliance hour costs, how much of a small bank's payroll compliance takes, and how long an exam runs.

Price your last request letter in a week

What a weak exam answer costs beyond the hours

The return on exam software is a yearly sum across every request list you answer

In shortCount every request list in a year, not one exam. The calculator starts from a published compliance wage and asks you for the rest: how many lists you answer, how many requests each holds, the hours they take now and after, the follow-ups you would avoid, and the yearly cost of the tool and your testing. Every default marked illustrative is an assumption to replace.

Six places the return on exam work comes from

Price your request lists: hours, follow-ups and the tool's cost

A bank that answers five or six request lists a year and drew several follow-ups at its last exam sits near the first line. A bank that answers one exam every six years and few audits should expect most of the return from follow-ups avoided and from the memory kept between exams, and should say so before buying anything.

Score your exam program: request lists a year, last exam on file, owner map, findings evidence and AI rules

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

What your exam readiness score says to do next

Fourteen questions that show whether exam software tracks tasks or builds complete, checked answers

In shortAsk every vendor the same questions, us included. The answers show whether the tool tracks tasks or builds answers: whether it reads clauses, keeps what was sent with its versions and follow-ups, reaches your evidence, checks before sending, and leaves the approval and the upload to your people.

We found no published independent test of any exam management product as of October 2026. A replay of your own last letter is the fairest comparison, and it measures your current process at the same time.

A ten-week pilot built on your last exam's letter, scored request by request

In shortCollect your last exam, replay its letter with any tool you are considering, score the answers request by request against what you sent and what the examiner asked afterwards, then run the tool alongside your team on the next real request list. None of these steps commits you to a vendor.

1. Collect your last exam: the letter, every answer with its versions, the follow-ups, the report and the findings evidence.
2. Count your baseline: days by step, follow-ups and their days, clauses missed, request lists in a year.
3. Replay the letter with the tool and today's documents; your coordinator reviews every answer as if it were going out.
4. Run in parallel on the next real request list, an internal audit or an external review, with your people approving and sending.
5. Decide on four numbers: clauses covered, follow-ups the replay would have prevented, coordinator days, owner hours.

Scoring the replay: clauses, follow-ups, versions, days and owner hours

First day letters, the FDIC CIDR, exam frequency, CAMELS and MRAs: short answers to common bank exam questions

In shortThe questions compliance teams and buyers search for most, each answered on its own.