UDAAP risk assessment that walks every new or changed journey from the ad to closing the account, pins each unfair, deceptive or abusive risk where the customer meets it, and leaves every decision to a person
Misleading claims, hidden fees and hard exits fixed before launch, not refunded after.
See one case, screen by screen ↓UDAAP risk assessment is how a bank's compliance team checks a new or changed product, fee or customer journey for unfair, deceptive or abusive acts or practices before customers see it. In this solution, agents walk the journey as a customer would, from the ad to closing the account, test every claim against the account agreement, the fee schedule and the program agreement, and pin each risk where it sits. A Consumer Compliance Officer decides every note, and the Chief Compliance Officer signs the launch decision, as part of the bank's UDAAP compliance program.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
A UDAAP risk assessment usually starts with a screen deck or a staging link that arrives days before launch. The analyst pastes screenshots into a review document and lists the claims by hand; the officer opens the account agreement, the fee schedule and the partner's program agreement separately, if at all, and scores a spreadsheet risk matrix of likelihood and impact. The comments go to the partner by email, the versions cross in the mail, and the Chief Compliance Officer signs a memo whose evidence lives in an inbox.
The risk sits in what that UDAAP review never reaches. Closing the account and making a complaint are rarely in the deck, and an exit harder than the entry is where abusive-practice risk sits. A journey approved in September comes back in October with a new headline and a phone-only close, and without a screen-by-screen comparison the officer either reviews all of it again or misses the change. Found after launch, an "always free" headline over a $4.99 fee is no longer a wording change: it is refunds.
Estimated split of a consumer compliance reviewer's hours on one changed partner journey of about ten screens, by hand and with the agents. Our estimate, kept modest.
Eight agents walk each journey as a customer would and pin every risk where it sits; a Compliance Officer decides, the CCO signs.
Fernway, a fintech partner of Tessaly Community Bank, sends version 3 of its Early Pay account journey through the partner portal. Version 2 was approved with conditions on September 24; the target launch is November 16. Here is what happens next, screen by screen, in the working solution.
Tessaly reviews about 38 new or changed journeys a quarter from 9 fintech partners and 11 of its own products. The queue shows 23 received so far, 11 open, 3 with an open High note, 1 past its SLA and escalated, and 2 held for a failed capture or a missing document. Fernway Early Pay is in review, due November 3.
Each row carries a miniature filmstrip of the journey's screens and pins.
The Journey walker opens staging build 3.0.7 with test identity T-07 and walks 10 screens: it opens an account in 3 taps, switches direct deposit, moves $300.00 out, tries to close the account and makes a complaint. The Change watch agent finds screens 1, 2, 4, 8 and 9 changed since version 2. The Claim reader reads 31 claims; the Document check agent finds 25 supported and 6 not.
Standards agent: "Note 4 at 0.71 is below the 0.80 threshold: no call, a person decides."
The journey runs left to right from the ad to closing the account, each changed screen marked. Six numbered pins sit on the exact claim, fee or friction: 3 High, 2 Medium, 1 Low. Under the screens, taps to join against taps to leave; at the bottom, the overall rating, the launch status and who signs.
"Join: 3 taps, about 1 minute 40 seconds · Leave: 4 taps, then a phone call on weekdays, 8 AM–6 PM ET."
The landing headline promises "always free". The fee schedule charges $4.99 per instant transfer, and the fee first appears on screen 4 inside a folded list. Regulation DD's rule on "free" may leave out an optional transfer, so that question stays open; under UDAAP the test is what a reasonable customer takes from the screen. Rated High, deceptive, confidence 0.91.
"Estimated reach: $1,437,120 a year in instant transfer fees (Fernway's forecast: 30% of 40,000 accounts, twice a month)."
"Get paid up to 2 days early" runs straight into "always free". Account Agreement §7 says early availability is not guaranteed. The Reasonable-consumer agent reads it as a hurried customer on a phone would; the Product agent gives Fernway's meaning from its product brief. Both are shown, with their sources, beside the passage.
Customer reading: "Every payday, my pay lands two days early." Fernway's meaning: "Up to covers the variation, and always belongs to free."
Screen 9 now reads "To close your account, call us Monday–Friday, 8 AM–6 PM ET", with no close button in the app. Account Agreement §12 promises closing in the app, and Program Agreement §8.1 requires closing through every channel used to open. Version 2 had a two-tap close in the app. Rated High, deceptive and abusive, confidence 0.95.
Customer reading: "I opened this in three taps on a Sunday. Now I have to call during work hours?"
Version 2 sits beside version 3 for each changed screen, with the change in plain words: the ad dropped "Banking services provided by Tessaly Community Bank, Member FDIC", and the headline lost "Early pay depends on when your employer sends pay" and gained "always free". Screens 3, 5, 6, 7 and 10 keep their September 24 decisions.
On note 1 she chooses Require change. The reason code, RC-REQ-01 "Claim not supported by the agreement", and the wording Fernway must use come filled in from the agents' proposal, and she confirms or edits them. She requires changes on notes 1, 2, 3, 5 and 6, and accepts note 4, a folded fee list, with a condition: keep "See all fees" above the Continue button and recheck at 90 days.
"Get paid up to 2 days early. Early pay depends on when your employer sends pay."
With 6 of 6 notes decided, the agents propose Changes required: 5 changes and 1 risk accepted with a condition. Marisol proposes the decision as maker. Evelyn Marsh, Chief Compliance Officer, co-signs the accepted risk and signs the launch decision as checker. Marisol cannot sign her own.
Change request CR-26-117-01 lists each change with its new wording, the reason in plain words and the clause behind it. Theo sends it through the partner portal; Lena Ortiz, Fernway's Product Lead, acknowledges it, with an answer due October 29. Ratings, the agents' readings, reason codes and any confidential flag never leave the bank.
"No monthly fee. Instant transfers cost $4.99; standard transfers are free."
The same journeys, seen by the people in UDAAP compliance who decide, sign, send and test them: what their day looked like, and what it looks like now.
Eight agents walk each journey as a customer would and pin every risk where it sits; a Compliance Officer decides, the CCO signs.
Walks the partner's staging build as a customer would, from the ad to sign-up, first use, closing the account and making a complaint; captures every screen and counts the taps.
Compares each screen with the last approved version, reopens the changed ones and carries the rest forward with their decisions; each night it maps complaint themes to the screen that caused them.
Reads every claim, fee, promise, default and disclaimer on each screen, with its exact place, so a note can be pinned where the customer meets it.
Tests each claim against the account agreement, the fee schedule and the program agreement, and cites the section that supports or contradicts it.
Reads each screen once, in order, at phone size, as a typical hurried customer would, and says what that customer takes away, in their words.
Gives the partner's intended meaning for each note, citing its product brief and the program agreement.
Weighs the claim, the passage and both readings; classifies each note as unfair, deceptive or abusive, cites the rule, rates it on the bank's matrix and proposes wording.
Gathers every record for a journey, screens per version, notes, sources, decisions, signers, agent versions and partner correspondence, and writes a PDF index, a CSV and a SHA-256 manifest.
Decides every pin with a reason. The agents propose; a named person decides.
Ask about any journey, screen, note, clause or rule, or say what to draft. Every answer points to its source.
Why is "always free" a risk if the fee is disclosed?
"Free" has a narrow meaning under Regulation DD §1030.8(a)(2), and an optional instant transfer may fall outside it. UDAAP is wider: the test is what a reasonable customer takes from the screen. Screen 2 says always free; the Fee Schedule charges $4.99 per instant transfer, shown two screens later behind a folded list. At Fernway's forecast that is an estimated $1,437,120 a year charged under an "always free" headline.
What changed since version 2?
Five of ten screens: the ad dropped "Tessaly Community Bank, Member FDIC" (note 3), the headline gained "always free" and lost "depends on when your employer sends pay" (notes 1 and 2), the fee list was folded (note 4), Instant became the default (note 5), and closing moved from an in-app button to a phone call (note 6). Screens 3, 5, 6, 7 and 10 keep their September 24 decisions.
Draft the change request for Fernway
Drafted from your decisions, one change per note, each with the clause behind it: Account Agreement §7, the Fee Schedule, Program Agreement §6.4, the product brief and Account Agreement §12. Fernway never sees ratings, confidence or reason codes. Theo Lindqvist sends it once Evelyn Marsh signs.
Which journeys did complaints reopen?
Two this month: Ollarby Round-Up Savings, 14 complaints that the monthly fee went up without notice, pointing to screen 3; and Everyday Checking, 6 complaints about overdraft coverage chosen by default on screen 4. Tamsett Rent Reporting has 3, below the threshold of 5; you can reopen it early with a reason.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rating matrix, the confidence threshold, the clocks and the reason codes are settings. The administrator proposes a change, and the Chief Compliance Officer approves it before it is in force.
| Setting | Default | Choose from |
|---|---|---|
| Rating model | RRM-3, approved July 1, 2026 | Likelihood (Rare, Possible, Likely) × reach (under 1,000, 1,000–25,000, over 25,000 customers) gives Low, Medium or High |
| Overall rating of a journey | The highest open note | Reach comes from the partner's forecast or the product inventory |
| Confidence threshold | 0.80 | Proposed by the administrator, approved by the Chief Compliance Officer; below it a person decides |
| Review SLA | 10 business days from routing | Nudge to the reviewer and the team lead at day 8; escalation to the Chief Compliance Officer at day 10 |
| Partner answer | 5 business days | After a change request is sent |
| Complaint reopen | 5 complaints on one theme in 30 days | Below it, a reviewer may reopen early, with a reason |
| Reason codes | 8 codes | RC-REQ-01 to 04 to require a change · RC-ACC-01 and 02 to accept a risk · RC-DIS-01 and 02 to dismiss |
| Keep review records | 5 years after a product is retired | Test identities only; customer data on a capture is masked before it is stored |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, to be measured in the live solution · “estimated” = our estimate · “typical” = published figures (Congressional Research Service, IN12513: more than $140 million refunded after CFPB examinations of overdraft and NSF fee practices). Rules named: Dodd-Frank Act sections 1031 and 1036 (12 U.S.C. 5531 and 5536); FTC Act section 5; Regulation DD, 12 CFR 1030.4 and 1030.8; Regulation E, 12 CFR 1005.7(b)(5); FDIC, 12 CFR 328.102; the OCC Comptroller's Handbook, Unfair or Deceptive Acts or Practices and Unfair, Deceptive, or Abusive Acts or Practices, Version 1.1, December 2024; the Interagency Guidance on Third-Party Relationships, 88 FR 37920. Tessaly Community Bank, Fernway, Ollarby, Tamsett, Pemmick, Quillon, Vantrell, Sorrelby, Wrenhollow, Yarrowpay and the people, journeys and numbers named on this page are fictional: characters and sample data in the working solution.
UDAAP risk assessment is how a bank's compliance team checks a new or changed product, fee or customer journey for unfair, deceptive or abusive acts or practices before customers see it. In this solution, agents walk the journey as a customer would, from the ad to closing the account, test every claim against the account agreement, the fee schedule and the program agreement, and pin each risk where it sits. A Consumer Compliance Officer decides every note, and the Chief Compliance Officer signs the launch decision, as part of the bank's UDAAP compliance program.
On the sample journey: an absolute claim the agreement does not support ("up to 2 days early" read with "always"), "always free" two screens before a $4.99 fee, "FDIC insured" with no bank named, a fee list folded shut, a paid transfer option chosen for the customer, and a phone call to close an account opened in three taps. Each note is classified as unfair, deceptive or abusive under Dodd-Frank sections 1031 and 1036 and the FTC Act, with the passage behind it.
It runs your matrix instead of a spreadsheet. The sample bank's rating model rates each note by likelihood and reach, gives Low, Medium or High, and takes the highest open note as the journey's overall rating. The administrator proposes changes to the model and the Chief Compliance Officer approves them, so every UDAAP review is scored on the version in force and cited to the screen and the clause.
The solution shows both tests side by side. Regulation DD §1030.8(a)(2) bars "free" when a maintenance or activity fee may be imposed, and its official comment may leave out an optional transfer service, so on the sample journey that check is marked an open question. The UDAAP test is wider: what a reasonable customer takes from the screen. The person decides, with a reason code.
Partners submit through the partner portal, and the Journey walker walks their staging app with a test identity, closing and complaint included. The Partners screen shows each partner's journeys, open notes, complaints, tier and next oversight review, beside its program agreement clauses. Only the Program Manager sends a change request, and the partner sees the change, the plain reason and the clause, never the bank's ratings or the agents' readings.
A new version is compared screen by screen with the last approved one: changed screens are reopened and walked again, unchanged screens keep their decisions. Each night complaint themes are mapped to the screen that caused them, and five complaints on one theme in 30 days reopen a launched journey; a reviewer may reopen one earlier, with a reason.
Yes. The agents walk, read, compare, rate and draft; they never decide a note, sign a launch or send to a partner. A Compliance Officer decides every note with a reason code, a different person signs every launch decision and co-signs every accepted risk, and below 0.80 confidence the agents make no call at all.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your UDAAP risk assessment matrix, reason codes, account agreements, fee schedules and program agreements, and a sample of past reviews, and it goes live once every quality gate has passed. We will walk you through it on one of your own journeys first.
Every board report sentence tied to its data, and every weak point challenged first.
1-min demoDeposit Compliance SearchCited answers while the member is on the line, and Reg E claims opened on the first call.
1-min demoFDIC Signage ComplianceEvery screen checked against Part 328 monthly; no finding closed without a recapture.
1-min demoWe'll run UDAAP Risk Assessment on one of your own recent product or partner journeys.