At many community banks there is no exam team. There is a compliance officer, sometimes with one colleague, who receives the FDIC's information package, sits the pre-exam interview, answers the Compliance Information and Document Request, chases a dozen colleagues for documents, drafts every cover note and then manages the findings, all while the rest of the compliance calendar keeps running. Preparing for an FDIC consumer compliance exam at a small bank is therefore mostly a question of where that one person's hours go. Botminds' Regulatory Exam Management gives the clerical part of the work to agents that read the letter, match each request to last exam's answer, gather the evidence and check every clause, and leaves the decisions, the signature and the conversation with the examiner to people.
The same exam, carried by a small bank's people
Today
Copies the request list into a spreadsheet, emails every owner, chases, checks each answer by eye and writes all the cover notes, alongside the HMDA filing and the training plan.
With agents
Starts from a board where each request already has an owner, a due date and last exam's answer; reads drafts and decides what goes.
Still theirs: The interview, the judgement on every answer, and the relationship with the examiner-in-charge.
Today
Sees the package the night before it is due, if at all.
With agents
Sees each request with its exhibits and a completeness check, and signs with the meaning of the signature recorded.
Still theirs: Approval of everything that leaves the bank.
Today
Asked for "the QC reports" and send whatever is in their folder.
With agents
Asked only for what could not be found, with the clause and period spelled out.
Still theirs: Confirming their own evidence is right.
Today
Asked at the last minute whether last exam's findings were fixed.
With agents
Validates each fix on one timeline before it can be closed.
Still theirs: Independent validation.
How do you prepare for an FDIC compliance exam at a small bank?
The same way a large bank does, with fewer people: know what changed since the last exam, answer the CIDR completely and on time, and show that last exam's findings are fixed with evidence. The FDIC's process does not scale the request list down by headcount. It scales it by products and risk: the CIDR is tailored "to request only what is necessary to conduct the examination", based on the bank's interview answers (CCEM II-4). A small bank with mortgages, deposits and a flood-zone footprint gets mortgage, deposit and flood requests.
What the FDIC does scale is time. Banks "must have at least 30 calendar days to complete the CIDR", and "Longer time periods may be necessary based on the institution's size, resources, and complexity". The examiner-in-charge is told to agree the time at the interview, so a small bank should say plainly at the interview how many people will be answering. It should also say where things live: the interview covers how documents will move, including the FDIC's secure file exchange, and whether the bank can provide them electronically.
What does a community bank compliance officer do?
The FDIC's manual gives the same list of duties "regardless of the size or complexity of the institution's operations": developing policies and procedures; training management and staff; reviewing policies against the law; "assessing emerging issues or potential liabilities"; coordinating responses to complaints; reporting compliance activities and audit findings to the board; and making sure corrective actions are implemented and "effective at preventing recurrence" (CCEM II-3). The exam adds an eighth job on top of the seven, for months at a time.
The manual also sets the authority the role needs. The board must give the compliance officer enough authority and independence to "cross departmental lines", to "have access to all areas of the institution's operations" and to "effect corrective action". In an exam those three powers are what let one person chase a loan servicing manager for an export, a marketing director for sign-offs and a branch for a complaint file. The Bureau of Labor Statistics put the mean annual wage for compliance officers in credit intermediation at $94,090 in May 2025, against $88,400 across all industries (BLS OEWS), which makes that person one of the bank's more expensive hours to spend on copying and chasing.
Can one person run a bank compliance program?
Yes, and the FDIC allows lighter structures still: "In smaller or less complex institutions, where staffing is limited, a full-time compliance officer may not be necessary; instead, the compliance responsibilities may be divided between various individuals by type of regulation", and "In some instances, several banks may share a compliance officer" (CCEM II-3). A compliance committee of the officer, department representatives and management or board members can sit beside or instead of a full-time officer.
The one thing a single person cannot do is audit their own work. The manual defines audit as an independent assessment and allows it in-house or outsourced "as long as the individuals that perform audit activities are independent of the areas being audited". A one-person department that runs the monitoring therefore needs someone else, an internal auditor or an outside firm, to audit it, and to validate the fixes from the last exam. That independent validation is the evidence the corrective-action request in the next CIDR will ask for.
Small banks carry a heavier compliance load per person
The burden falls hardest on the smallest banks. Ten years of the CSBS Annual Survey of Community Banks show that "the smallest banks reported spending roughly 11% to 15.5% of their payroll on compliance tasks, compared with 6% to 10% at the largest institutions—a statistically significant gap every single year" (CSBS, November 2025). They lean far more on outside help too: consulting costs devoted to compliance ran "roughly 50% to 64% for the smallest banks compared with 19% to 30% for the biggest".
Compliance at the smallest community banks
11–15.5%
of payroll spent on compliance at the smallest banks, against 6–10% at the largest community banks
50–64%
of consulting spend devoted to compliance at the smallest banks, against 19–30%
90%
of the 4,238 FDIC-insured institutions are community banks (Q2 2026)
The FDIC expects those people to have the room to do the job. Its CMS chapter says "a compliance officer must be provided with ongoing training, as well as sufficient time and adequate resources to do the job" and that "When more than one individual is responsible for compliance matters, responsibility and accountability must be clearly defined" (CCEM II-3). Among the oversight questions examiners ask: "Has management allocated the appropriate level of resources to compliance?" and "Does the institution have a designated compliance officer and/or Compliance Committee?" (CCEM II-5). An exam answered late, or in pieces, is evidence on that question.
The request list does not shrink with the bank. The number of people who can answer it does.
The calendars that collide on one desk
The exam is not the only deadline. A compliance officer at a small mortgage lender may file HMDA data by March 1, face a safety and soundness exam every 12 or 18 months that also asks compliance questions, run quarterly monitoring and annual training, and answer an outside auditor. The consumer compliance exam arrives into that calendar with at least 90 days' warning and at least 30 days for the first request list, and then a second request once scope is set.
One person, several calendars: what a small bank's compliance officer answers to
| Obligation | How often | What it asks of the compliance officer |
|---|---|---|
| FDIC consumer compliance and CRA exam | Every 66–78 months if $350M or less and rated 1 or 2; far more often if rated 3 or worse | Interview, CIDR, transaction testing request, fieldwork, findings and the response letter |
| Safety and soundness exam | Every 12 or 18 months; the 18-month cycle now reaches $6B banks that qualify | Requests on BSA, IT and lending that often need compliance documents |
| HMDA data (if a reporter) | Annual filing by March 1; quarterly for the largest reporters | Collecting, checking and certifying the register |
| Monitoring, audit and training | Ongoing, on the bank's own schedule | The evidence the CIDR will later ask for |
| Findings from the last exam and from audit | Until each is closed with evidence | Owners, dates, retests and validation, then the board report |
Where the hours go when one person answers 46 requests
Take a fictional sample bank, Calder Ridge Bank, as it answers a 46-request consumer compliance and CRA letter in Regulatory Exam Management. The requests span 11 areas and 14 owners. By hand, our estimate of the work is about nine business days of the coordinator's and the approver's time: a day to build the tracker and assign owners, three days chasing, a day and a half finding last exam's answer and the current version of each document, a day checking answers against the requests, a day and a half writing cover notes, and a day for review, approval and upload. Only the last of those needs the compliance officer's judgement at every step.
The solution's design target for the same letter is four days to a complete answer. The chasing does not vanish (owners still have to confirm their evidence), but the tracker, the matching to last exam, the clause-by-clause check and the first draft of every cover note move to agents. What one request letter costs prices those hours and shows the method for your own.
Who owes what, without a spreadsheet, in Regulatory Exam Management
The coordinator's chasing becomes one view and one button, and the nudge carries each owner's own requests only.
Should a small bank hire a compliance consultant for an exam?
For specific jobs, often yes; for the exam itself, no one can stand in for management. The CSBS data above show the smallest banks already send half or more of their consulting budgets to compliance. The jobs that buy the most are the ones a small team cannot do for itself: the independent audit, validation of the last exam's fixes, and a dry run of transaction testing in the areas the published violation lists put at the top. The FDIC asks for due diligence on the choice: the compliance officer "should perform sufficient due diligence to verify that the provider is qualified".
Some of the exam's work is reading, matching and checking, and it can be delegated to software or to an outside firm. Some of it is judgement the bank must keep: what an answer says about the CMS, whether a gap is a finding, how to explain an exception, and what the board commits to. The FDIC is explicit that outsourcing does not move responsibility: the compliance officer "may utilize third-party service providers or consultants", but "ultimately the institution's Board and management are responsible" (CCEM II-3).
In the solution, that line is drawn in the settings. Agents read, gather, check and draft. A named approver signs each request with the meaning of the signature recorded, a named person uploads to the regulator's portal, and the agents never send anything. For a one-person department, the approver is often the CEO, and the uploader is the compliance officer.
What to do when the compliance officer leaves before an exam
Tell the examiner-in-charge at the interview, take the time the manual allows, and rebuild from the last exam's paper rather than from memory. The FDIC already plans around turnover in the bank's own monitoring: "The frequency and volume of employee turnover at an institution should be factored into the schedule for reviews", and reviews matter most "after problems have been noted during past audits or examinations" (CCEM II-3). A bank whose compliance officer left in the last year is in exactly that position.
The newcomer needs four things on the first day, in this order: the last exam's request letter and the answers sent, with any follow-ups; the open findings and the evidence of each fix; the owner map; and the compliance calendar for the next six months. If those exist only in the former officer's mailbox, recovering them is the first project, before the information package arrives. The Federal Reserve examiner who wrote Consumer Compliance Outlook's preparation guide suggests scheduling "more tenured employees for interviews because they are more experienced with the institution's practices" (2018), which at a bank with a new compliance officer may mean a lending or operations manager sits beside them in the room.
Exam preparation for a one- or two-person compliance department
- Ask for the time you need at the interview
The FDIC floor is 30 days for the CIDR; longer periods may be given for size and resources. Say who will be answering.
- Keep an owner map between exams
Which role answers which request area. It is the first thing a new or covering compliance officer needs.
- Keep last exam's letter, answers and follow-ups together
Most requests come back; the follow-ups show which clauses to answer up front.
- Close findings with evidence as you go
Fix, retest, validation, board report. Six years later, nobody will remember.
- Delegate the clerical work, not the judgement
Tracker, matching, gathering, clause checks and first drafts can be handed off. The answer and the signature cannot.
- Name a backup
If the compliance officer is ill the week the CIDR is due, someone else must know where everything is.
The deeper problem for small banks is memory: under the FDIC's current schedule, the person answering the next letter may not have answered the last. Six years between exams looks at that gap, and the CIDR, annotated reads a request list line by line.
Questions people ask
Does a small bank need a written compliance program?
The FDIC says a bank "should generally establish a formal, written compliance program", and also that "The formality of the consumer compliance program is not as important as its effectiveness", especially at small institutions with an effective monitoring system. Examiners judge what works, but a written program is what survives a change of people.
Does the FDIC expect less of a small bank's compliance program?
Less formality, not less effectiveness. The FFIEC rating system says "All institutions, regardless of size, should maintain an effective CMS", and that its "sophistication and formality ... typically will increase commensurate with the size, complexity, and risk profile" (81 FR 79473).
How often is a small bank examined for consumer compliance?
At the FDIC, a bank of $350 million or less rated 1 or 2 is now on a 66–78-month cycle for its joint compliance and CRA exam, with a mid-point risk analysis in between; a bank rated 3 or worse is seen within one to two years (CCEM II-12.1). FDIC compliance exam frequency sets out every band.
Who coordinates a bank exam?
Usually the compliance officer, as the single point of contact for the examiner-in-charge. The Federal Reserve's advice is to designate that contact early, confirm the arrival date and the number of examiners, and reserve workspace for them, so the logistics do not fall to the week fieldwork starts.
Can a compliance officer also be the BSA officer or the CRA officer?
Nothing in the FDIC's CMS chapter forbids combining roles. It asks that responsibility and accountability be clearly defined and that the compliance officer have sufficient time and resources, and examiners judge whether that holds.