New product approval process: bringing UDAAP review in early

A new product approval process is how a bank decides that a new, modified or expanded product is safe to offer: due diligence and approvals before launch, policies and controls, change management, and monitoring afterwards. Unfair, deceptive and abusive practices (UDAAP) are among the risks it must catch, and the hard part is timing. Compliance usually sees the product last, as a screen deck or a staging link days before launch, when a misleading headline or a phone-only exit is expensive to change. Botminds' UDAAP Risk Assessment is built to move that review earlier by making it fast: agents walk each new or changed journey from the ad to closing the account, test every claim against the agreement and fee schedule, and reopen only what changed, while a compliance officer decides every risk and a second person signs the launch.

The OCC's principles for new activities, still in force in OCC Bulletin 2017-43 (its references to reputation risk were struck out in March 2025), name four components every bank's system should have: "Adequate due diligence and approvals before introducing a new activity", "Policies and procedures to properly identify, measure, monitor, report, and control risks", "Effective change management for new activities or affected processes and technologies" and "Ongoing performance monitoring and review systems" (OCC Bulletin 2017-43). UDAAP review belongs in all four, not only the first.

What is a new product approval process in a bank?

It is the set of steps between an idea and a launch at which named people confirm that a product fits the bank's strategy, risk appetite and the law, and the steps after launch that check it still does. The OCC's due-diligence list runs from "identifying the customer demand for the proposed new activities" to "determining the requirements of applicable laws and regulations and considering the principles set forth in agency guidance", and it includes "consideration of fair access to financial services and fair treatment of customers in all aspects related to the new activities" and an exit strategy if the product fails.

The bulletin is equally clear about who owns the result. "Management should inform the board of all material new activities, including due diligence findings and plans that clearly articulate and appropriately manage risks and returns." A committee is optional: depending on size and risk, the board or management "may consider establishing senior management positions or independent risk committees". What is not optional is that someone with authority approves, on evidence, before the product reaches customers.

For UDAAP the monitoring component carries a specific instruction. Performance and monitoring systems should "include periodic testing to ensure compliance with applicable laws, regulatory requirements, and the bank's policies and procedures. This should include consideration of potential risks for unfair or deceptive acts or practices." The approval is the start of the review, not the end of it.

When should compliance review a new product?

From design, not at the end. The Federal Reserve's examiners have written down what they see instead: "Examiners occasionally observe that compliance staff members are either absent from the product design and development process or involved only in the final review of a product before it is introduced or after it has been launched and transactions have been consummated. Successful management teams involve compliance staff throughout the entire design and development process" (Consumer Compliance Outlook, 2015).

The examination manuals test for the same thing. The CFPB's UDAAP procedures, still in its November 2025 manual, ask whether "The entity conducts prior UDAAP reviews of advertising and promotional materials, including promotional materials and marketing scripts for new products" and whether it "reviews new products and changes in the terms and conditions of existing products for potential UDAAP concerns" (CFPB Supervision and Examination Manual). The OCC's handbook tells examiners to assess whether the bank has "adequate processes to review newly developed or modified advertising materials, marketing materials, processes, or operational systems for potential UDAP and UDAAP issues before deployment" (OCC Comptroller's Handbook, UDAP and UDAAP).

"[T]echnical compliance alone does not mean that a product is free from potential consumer harm."

Federal Reserve, Consumer Compliance Outlook, 2015

That line is the reason a disclosure check at the end is not enough. A product can carry every required disclosure and still be built around a fee most customers cannot avoid, or an exit much harder than its entry. Those are design decisions, and they are cheap to change while the product is still a design.

Why UDAAP reviews arrive days before launch

Because the review itself is slow, product teams treat it as the last step rather than a conversation. A reviewer on a changed partner journey of about ten screens spends most of the time collecting screenshots, listing claims by hand, opening the agreement, the fee schedule and the partner's program agreement in separate windows, and working out what changed since the version that was approved. Comments go back by email and the versions cross. A team that has seen that cycle takes as long as it can before starting it.

The estimate's point is the shape, not the total. Two-thirds of the manual hours go to finding and arranging evidence; the judgment itself, scoring and writing the change, is a small slice in both lanes. Agents take the evidence work; the reviewer keeps the judgment. In the sample review described below, the agents' walk of ten screens took 17 minutes on a staging build, and the design target is a cited launch decision within three days of submission, inside a ten-business-day review window. That is a target, not a measured result.

Who signs off on a new bank product?

The product owner proposes, compliance decides each risk, a senior officer signs the launch, and the board hears about every material new activity. The common failure is collapsing those roles: the person who prepared the review signs it, or the business line signs its own exception. The OCC places ultimate responsibility on the board and says the board "should hold management accountable for appropriate policies and due diligence processes for new activities."

How do you review changes to an approved product?

Compare the new version with the approved one screen by screen, reopen only what changed, and carry the rest forward with its decision. Change is where approval processes leak. The FFIEC's rating definitions credit a satisfactory bank because "Management evaluates product changes before and after implementing the change" (FFIEC rating system), and the FDIC lists "changes to a bank's products or services" first among the situations where heightened UDAAP risk may be present (FDIC manual, VII-1).

Take a sample journey as it runs through the solution; the data are fictional. Fernway, a fintech partner of the sample bank, Tessaly Community Bank, submits version 3 of its Early Pay account after version 2 was approved with conditions on September 24. The Change watch agent compares every screen: five of ten changed and are walked again; five keep their September decisions. The changes are small on a screen and large in effect. The ad dropped "Banking services provided by Tessaly Community Bank, Member FDIC." The headline lost "Early pay depends on when your employer sends pay" and gained "always free". The fee list was folded, the paid instant transfer became the default, and an in-app close button became a phone number.

What changed since version 2, in plain words, and what was carried forward

Five screens keep their September decisions, so the reviewer spends her time on the five that changed rather than redoing ten.

Without the comparison, the reviewer has two bad options: review all ten screens again, which is why changed products queue behind new ones, or review the description of the change the partner chose to send, which is how a removed close button slips through. The sample program agreement requires the bank's approval of every change to an approved screen; a diff is how that clause is enforced in practice.

What should a new product approval form include?

A form should collect the evidence a reviewer needs to test claims, not only describe the product. Most forms ask what the product is and who owns it; fewer ask for the screens a customer will see when leaving, or the forecast that turns a fee into a number.

The product life cycle review: approval is the first check, not the last

A product life cycle review follows a product from concept to termination and asks the compliance questions of each stage. The Federal Reserve's version has seven stages, from strategic considerations through design, marketing, delivery, origination, use and termination, and it begins with a warning that cuts both ways: "Although compliance risk is typically greater for new products than for existing ones, financial institutions must still be vigilant in conducting risk management for their current products as well."

After launch, complaints are the cheapest signal. In the sample bank's settings, five complaints on one theme within 30 days reopen a launched journey, and the solution maps each complaint theme to the screen that caused it. On the sample queue, 14 complaints that a savings product's monthly fee went up without notice pointed to a pricing screen that still showed the old fee, and reopened that review. An accepted risk carries its own clock: the folded fee list on the Fernway journey was accepted only with a recheck after 90 days of complaint data. How those decisions are rated is set out in the UDAAP risk assessment matrix.

The UDAAP review queue: every new or changed product this quarter, with its clock

What to look for in new product approval software

Look for software that shortens the review rather than only routing it. A workflow tool that sends the same screen deck to the same reviewer faster changes the inbox, not the timing. The things that move review earlier are the things that make it cheaper to start.

Evidence gathered for the reviewer. Screens captured from the staging build, claims listed with their place on the screen, each tested against the agreement and fee schedule with the section cited, or "no source" when there is none. Changes made visible. A version comparison that reopens what changed and carries forward what did not. A clock that escalates. In the sample settings a review is due ten business days after routing, with a nudge at day eight and escalation to the chief compliance officer at day ten. Holds instead of guesses. A capture that fails, or a document that is missing, should stop the review, as it does for two journeys on the sample queue, rather than let anyone fill the gap. Separation of duties. The person who proposes the decision cannot sign it, and the product owner who submitted the journey can do neither.

Where UDAAP Risk Assessment fits in your approval process, and where it does not

The solution covers the UDAAP part of approval for products a customer meets on a screen: deposit accounts, fees, digital journeys and fintech partner journeys, new or changed. It works with the systems an approval process already has: the partner portal for submissions and change requests, document management for agreements and fee schedules, the product inventory and core banking system for fee codes, and complaint management for the signals after launch.

It does not run the whole new product committee. Credit, capital, liquidity, technology and pricing decisions stay where they are, and so does the legal call on a close question. Its outputs are the inputs a committee and a chief compliance officer need for the UDAAP question: the risks found, where each sits, the passage behind it, the decision and who made it. Why a disclosed fee can still fail that question is covered in the UDAAP 3 part test; to try the approval flow on one of your own journeys, start from UDAAP Risk Assessment.

Questions people ask

How long does a UDAAP review of a new product take?

It depends on the product and the evidence, and no regulator sets a time. The sample bank's own clock is ten business days from routing, with escalation at day ten. The design target for the solution is a cited decision within three days of submission, and Botminds estimates a reviewer's own hours on one changed ten-screen journey at about 15 by hand against under three with agents.

Is a new product committee required?

No rule requires one. OCC Bulletin 2017-43 says the board or management "may consider establishing senior management positions or independent risk committees" depending on size and risk. What examiners do look for is evidence that compliance took part, including committee minutes where a committee exists.

Do changes to an existing product need the same review as a new one?

They need a review of what changed, before it goes live. The CFPB's procedures ask whether an institution reviews "changes in the terms and conditions of existing products", and the FFIEC credits banks that evaluate changes both before and after implementation.

Should a bank tell its regulator about a new product?

The OCC says management "should discuss plans with its OCC portfolio manager, examiner-in-charge, or supervisory office before developing and implementing new activities, particularly if the new activities constitute substantial deviations from the bank's existing business plans." The Federal Reserve encourages the same early discussion.

What is a product life cycle review?

It is a review of a product's compliance risk at each stage from strategy to termination. The Federal Reserve's framework has seven stages and treats complaints during use, and the experience of closing an account at the end, as part of the review, not as afterthoughts.