In 2025 the FDIC cited 1,155 consumer compliance violations, and five laws accounted for 875 of them, about 75 percent: the Truth in Lending Act with 462, the Electronic Fund Transfer Act with 136, the Flood Disaster Protection Act with 131, the Truth in Savings Act with 74 and HMDA with 72 (FDIC Supervisory Highlights, March 2026). At the Federal Reserve, HMDA data errors alone made up 45.2 percent of 2025 citations. These lists come from risk-focused exams, so they show where examiners look and what they find. For a bank between exams they are the closest thing to a published scope. Botminds' Regulatory Exam Management keeps the evidence for exactly these areas, the monitoring, testing and findings, ready for the request letter; this guide shows how to read the 2025 data as a test plan.
The FDIC's five most-cited laws in 2025: three-quarters of all citations
What were the most common FDIC consumer compliance violations in 2025?
The same five laws as the year before, in a new order. "While this list contains the same laws and regulations from our 2025 publication, EFTA moved from the fourth most frequently cited violation to the second most frequently cited violation" (FDIC, March 2026). Within each law the citations concentrate on a few sections, and those sections are what a test plan should name.
- TILA / Regulation Z. The three most-cited provisions were the Loan Estimate's good-faith estimates and timing under §1026.19(e), the Closing Disclosure's loan-cost tables under §1026.38(f)–(k), and its total of payments, finance charge, amount financed, APR and total interest percentage under §1026.38(o). "Collectively, these violations comprised 28 percent of the total TILA violations".
- EFTA / Regulation E. Error resolution: §1005.11(c), investigating and correcting within the time limits, and §1005.11(d), the procedure when no error, or a different error, is found. Together, "74 percent of the total EFTA violations".
- Flood. Failing to have adequate flood insurance in place when a loan in a special flood hazard area "is made, increased, extended, or renewed" under §339.3(a): 41 percent of flood violations.
- TISA / Regulation DD. Account disclosures under §1030.3 and §1030.4(a) and (b), split evenly, 61 percent of TISA violations.
- HMDA / Regulation C. Data collection under §1003.4(a): 82 percent of HMDA violations.
The FDIC's 2025 consumer compliance year in four numbers
~825
consumer compliance exams
1,155
violations cited, 97% of them Level 2 (medium severity)
29
Level 3 (high severity) violations, 11 of them under TILA
98%
of FDIC-supervised banks rated 1 or 2 for consumer compliance
The severity split matters for planning. Level 2 violations are "systemic, recurring, or repetitive errors that represent a failure of the bank to meet a key purpose of an underlying regulation", and almost all of 2025's citations sit there. The FDIC's own reading of its list is that "the most frequently cited violations generally involve statutes and regulations that represent the greatest potential for consumer harm". TILA errors can require reimbursement, and flood errors leave borrowers uninsured. A repeated configuration error in the loan system is exactly the kind of systemic, recurring error Level 2 describes.
What are the most common TILA violations? Loan Estimate tolerances and Closing Disclosure tables
The integrated mortgage disclosures. The most-cited TILA provision, §1026.19(e), carries two rules that fail in different ways. The timing rule: the Loan Estimate must be delivered or placed in the mail "not later than the third business day after the creditor receives the consumer's application". The good-faith rule: a closing cost is estimated in good faith only if what the consumer pays "does not exceed the amount originally disclosed", except that third-party services the consumer may shop for, and recording fees, may rise by up to 10 percent in aggregate (12 CFR 1026.19).
The cure has its own clock. When charges exceed the tolerance, the creditor complies only if it "refunds the excess to the consumer no later than 60 days after consummation" and sends corrected disclosures in the same window. A tolerance breach found in month three is therefore no longer curable; it is a violation with restitution. That is why the test has to run on closed loans while the 60 days are still open, not once a year. The other two most-cited provisions sit on the Closing Disclosure itself: the loan-cost tables under §1026.38(f) to (k), and the total of payments, finance charge, amount financed, APR and total interest percentage under §1026.38(o). Those are arithmetic, and a loan system that computes one fee differently from the disclosure will repeat the error on every file.
What are the most common Regulation E violations? The error resolution clocks
Missing the investigation deadlines, and mishandling the case where the bank finds no error. Together, §1005.11(c) and §1005.11(d) made up 74 percent of the FDIC's EFTA citations in 2025. Both are procedural, so both can be tested on every claim rather than a sample: each notice of error has a received date, and every deadline runs from it.
Regulation E error resolution: the deadlines examiners test
| Step | Deadline | Rule |
|---|---|---|
| Decide whether an error occurred | Within 10 business days of the notice; 20 if the transfer was within 30 days of the account's first deposit | §1005.11(c)(1), (c)(3)(i) |
| Extend the investigation | Up to 45 days (90 for point-of-sale, foreign or new-account transfers), only if the account is provisionally credited within 10 business days | §1005.11(c)(2), (c)(3)(ii) |
| Report the result | Within three business days after completing the investigation | §1005.11(c)(1) |
| Correct an error found | Within one business day of determining it | §1005.11(c)(1) |
| No error, or a different one | A written explanation, noting the consumer's right to the documents relied on | §1005.11(d)(1) |
| Reverse a provisional credit | Notice of the date and amount, and five business days of honoring items without overdraft charges | §1005.11(d)(2) |
What are the most common flood insurance violations?
Lending in a special flood hazard area without adequate flood insurance in place at the moment that triggers it. The FDIC's rule says a bank "shall not make, increase, extend, or renew any designated loan" unless the building is insured "for the term of the loan", for at least the lesser of the outstanding principal or the maximum available under the National Flood Insurance Program (12 CFR 339.3). That provision alone was 41 percent of the FDIC's flood citations in 2025.
The four trigger words are where a test should look hardest. A new loan passes through a closing checklist that asks for the flood determination. An increase in a line of credit, a maturity extension or a renewal can run through a different process, and if that process does not ask for the determination, the insurance is not rechecked. The separate notice to the borrower, required under §339.9 whenever the bank makes, increases, extends or renews a loan on a building in a flood zone, fails the same way. A complete test therefore lists every loan event of the four kinds, not only new loans, and checks the determination, the notice and the evidence of coverage for each.
The Federal Reserve's list: HMDA data first, by a distance
The Federal Reserve publishes its own list for state member banks. In 2025 its examiners "conducted 97 examinations" and cited 630 violations. Regulation C's data collection rule, §1003.4(a), accounted for 285 of them, 45.2 percent (Consumer Compliance Outlook, 2026). In 2024, with 223 exams, it was 253 citations, 38.2 percent (2025 issue). Error resolution under Regulation E is third on the Fed's list in both years, so EFT error handling sits near the top for both agencies.
Federal Reserve: the most-cited provisions in 2025 at state member banks
The Fed says what it uses the data for: "to risk-focus future compliance examinations, and to inform its understanding of areas where supervised institutions face compliance challenges". The same data can risk-focus a bank's own monitoring. Data-driven rules (HMDA fields, CRA data, error-resolution clocks, disclosure tables) dominate both lists, and they are the rules a bank can test completely, by sampling or by checking every item, before an examiner does.
How examiners decide what to test in your bank
Published violation data tells you what is common; your own CIDR answers decide what is tested in your bank. FDIC examiners build a risk assessment from the CMS evidence, and where "an inherent risk is sufficiently mitigated by the strength of the CMS, then minimal residual risk of consumer harm exists and transaction testing is not considered necessary". Where it is not, "the examiner should tailor the actual sample and test to the identified weakness" (CCEM II-5).
That gives a bank two levers. The first is to find and fix errors in high-risk areas before the exam: violations "self-identified by a bank and fully corrected before the start of the examination (including remedial action, if appropriate) generally are not cited" (CCEM II-6). The second is to show that work in the CIDR answer: monitoring schedules, results and management's responses for exactly those areas. A strong monitoring answer on Regulation E error resolution is evidence the examiner can rely on. An answer of "no testing performed" makes it more likely that sample will be pulled.
From the 2025 lists to a pre-exam test: what to check, and where it surfaces in the letter
| Most-cited area | Test before the letter | Where examiners will ask for it |
|---|---|---|
| Loan Estimate and Closing Disclosure (§1026.19(e), §1026.38) | Tolerance and timing on a sample of closed mortgages; CD loan-cost tables and §1026.38(o) figures recomputed | Monitoring and testing results; transaction testing request for closed mortgage files |
| EFT error resolution (§1005.11(c), (d)) | Every notice of error against the 10-business-day and 45-day clocks; written results where no error was found | Complaint and error logs; Regulation E procedures; a sample of claims |
| Flood insurance (§339.3(a) and notices) | Determinations, notices and evidence of insurance at origination, increase, extension and renewal | Flood determinations list; loan files in special flood hazard areas |
| Deposit disclosures (§1030.3, §1030.4) | Account-opening disclosures against current account terms; advertised APY statements | Deposit product list and disclosures; marketing pieces |
| HMDA data (§1003.4(a)) | Every reported field against the loan file, or a sample sized like the examiner's | HMDA data validation, often before the exam starts |
HMDA is a special case, because it is tested as arithmetic: examiners use published sample sizes and error thresholds. Botminds' sister solution covers it in depth in HMDA transaction testing and your odds.
Prior findings are the most reliable forecast of all
The published lists are averages across hundreds of banks. A bank's own last report is specific to it, and the next exam is required to follow it up: the FDIC's pre-exam letter says examiners "will review and follow-up on violations, recommendations, and Matters Requiring Board Attention ... identified at your previous Consumer Compliance examination". A finding that recurs is worse than a new one. It speaks to root cause and duration, two of the four factors examiners weigh, with severity and pervasiveness, when rating violations.
In the fictional sample bank used throughout this series, flood was the last exam's finding: late flood hazard notices, fixed with a procedure change, a checklist in the loan system and four clean quarters of testing, then validated by internal audit. When the 2026 letter asked for flood determinations, the evidence gatherer found 3 of 412 missing and flagged the request for a close read, because flood was a 2023 finding. That is the forecast applied at the scale of one request.
A prior finding steering this exam's attention, on the Regulatory Exam Management board
Run log, 08:31: three of 412 flood determinations missing, and flood was a 2023 finding.
Turning the forecast into a pre-exam plan
A forecast is only useful if it changes what the bank does in the months before the information package. The practical version is short: rank the bank's products against the published lists, test the high-ranking ones the way an examiner would, fix and remediate what the tests find, and keep the evidence where the CIDR answer can reach it. The steps below are ordered so that each one produces something the request letter will ask for.
A pre-exam plan built on the 2025 violation data
- Map the lists to your products
Mortgages bring TILA and HMDA; deposit accounts bring Regulation E and DD; any lending in flood zones brings flood. Drop what you do not offer.
- Add your own last findings
Every violation, recommendation and board-attention matter from the last report goes to the top of the list.
- Test the way examiners test
Use the provision, not the topic: §1005.11(c) clocks, §1026.19(e) tolerances, §339.3(a) coverage at each trigger event.
- Find the root cause of each error
A system setting or a missing step, fixed once, retested, and remediated for every affected customer.
- Keep the evidence for the CIDR
Schedule, results, management's responses and retests, filed by area so the monitoring request is answered in one place.
- Re-rank each spring
The FDIC and the Fed publish new lists each year; EFTA moved from fourth to second between the 2025 and 2026 FDIC publications.
Where the evidence sits when the letter comes is the subject of setting up the evidence library between exams. The way findings will be labelled from November 2026, and what each label obliges a bank to do, is covered in the findings rule of November 2026.
Questions people ask
What is the most common FDIC consumer compliance violation?
By law, TILA and Regulation Z, with 462 of the FDIC's 1,155 citations in 2025. By provision, the Loan Estimate's good-faith and timing rule under §1026.19(e) is among the most cited.
Why is HMDA the Fed's top violation but fifth at the FDIC?
The two agencies examine different banks, and the counts are citations, not affected loans. A single HMDA citation often covers many inaccurate fields. Both lists show data accuracy rules near the top.
What is a Level 3 violation, and what does it cost?
Level 3 violations are those that "have resulted in significant harm to consumers or members of a community", and they typically lead to restitution of more than $10,000 in aggregate. The FDIC cited 29 in 2025, and ordered about $1.2 billion in restitution that year through orders under section 8(b) of the Federal Deposit Insurance Act (FDIC, March 2026).
Where do the FDIC and the Federal Reserve publish these lists?
The FDIC in its yearly Consumer Compliance Supervisory Highlights, which covered 2025 in its March 2026 edition. The Federal Reserve in Consumer Compliance Outlook, which publishes aggregate violation data for state member banks. Both list violations by provision, which is the level a test plan needs.
Do the lists predict my exam's scope?
Not directly. Your scope follows your products, your CIDR answers and your history. The lists tell you which tests examiners most often find failing, which is a good place to test first.