A UDAAP risk assessment matrix is the grid a bank uses to rate the risk of unfair, deceptive or abusive acts or practices: each risk is scored for likelihood and for impact, usually measured by how many customers it would reach, and the pair gives Low, Medium or High. Banks keep two kinds. One rates the whole portfolio once a year, the way the OCC's examiner worksheet does. The other rates a single new or changed product or customer journey before launch, one risk at a time. The second is harder, because the evidence for each score is scattered across screens, the account agreement, the fee schedule and a partner's contract. Botminds' UDAAP Risk Assessment is built for that second matrix: agents walk the journey, pin each risk where the customer meets it and propose a rating on the bank's own model, with the screen and the clause attached, and a compliance officer decides every one.
Examiners expect the first kind and look for the second. The OCC's booklet on unfair, deceptive and abusive practices, still at version 1.1 of December 2024 on the OCC's handbook index, says that "A sound risk assessment process identifies and evaluates UDAP and UDAAP risks and determines whether internal controls appropriately control risks." It wants a methodology with "quantitative and qualitative data" that covers, among other things, "due diligence and change management practices for new activities, including products and services offered through third parties" (OCC Comptroller's Handbook, UDAP and UDAAP). A portfolio grid alone cannot show that.
What the OCC's UDAP and UDAAP worksheet asks an examiner to rate
9
indicators of the quantity of risk, each Low, Moderate or High
Business activity, litigation and noncompliance
13
indicators of the quality of risk management, Strong to Weak
Policies, processes, personnel, control systems
4
conclusions: quantity, quality, aggregate risk and its direction
Direction: decreasing, stable or increasing
v1.1
the booklet version in force, December 2024
Listed on the OCC handbook index in October 2026
What is a UDAAP risk assessment matrix?
It is a scoring grid that turns a list of possible unfair, deceptive or abusive practices into ranked risks a bank can act on. The axes vary. Most banks use likelihood against impact; the sample bank in this guide uses likelihood against reach, the number of customers a practice would touch, because reach is something a product forecast already states. The output is a rating per risk and an overall rating for the product, usually the highest open rating.
The Federal Reserve's staff describe the same idea in plainer terms. Inherent risk is "the likelihood and impact of noncompliance with consumer laws and regulations that apply to the institution's products and services before considering the mitigating effects of risk management", and residual risk is "the remaining risk after controls are implemented to mitigate inherent risk", typically "categorized as high, moderate, or low, as defined by the institution" (Consumer Compliance Outlook, 2023). The article is frank that the Fed "generally does not require the institutions it supervises to conduct consumer compliance risk assessments". It is just as frank that "examiners have found that institutions with an effective CMS typically use formal compliance risk assessments."
There is no regulatory template, and a bank that downloads one inherits someone else's scales. What a regulator does prescribe is the content: the factors that raise risk, and the evidence that the bank's controls address them.
Two matrices: the portfolio view examiners rate, and the launch view a reviewer needs
The portfolio matrix answers "where in the bank is UDAAP risk concentrated?" The launch matrix answers "should this journey go live as it stands?" They share a vocabulary and almost nothing else. The portfolio matrix is filled in once a year from product inventories, complaint volumes and audit results. The launch matrix is filled in for each new or changed product, from the screens, the agreement and the fee schedule of that one product.
Same words, different questions: the annual matrix and the pre-launch matrix
Portfolio UDAAP risk assessment: Where is UDAAP risk concentrated across products and lines of business?
Launch UDAAP risk assessment: Can this new or changed journey launch, and with which changes?
Portfolio UDAAP risk assessment: A product line or activity: deposits, overdraft, add-on products, third-party programs.
Launch UDAAP risk assessment: One claim, fee, default or friction on one screen of one journey.
Portfolio UDAAP risk assessment: Volumes, complaints, audit and exam findings, fee income trends.
Launch UDAAP risk assessment: The screen, the passage of the agreement or fee schedule it contradicts, and the forecast reach.
Portfolio UDAAP risk assessment: Yearly, and when a significant change occurs.
Launch UDAAP risk assessment: Every new or changed version, before launch, and again when complaints point to a screen.
Portfolio UDAAP risk assessment: Compliance, reported to the board or its committee.
Launch UDAAP risk assessment: A reviewer decides each risk; a different person signs the launch decision.
The two meet in one place. When a launch review finds that a partner's journey charges a fee its headline calls free, the portfolio matrix should move too: the product line's quantity of risk rises until the change is made. A bank that keeps the two in separate spreadsheets usually finds out at the next annual refresh.
What are UDAAP risk factors? The indicators examiners score
UDAAP risk factors are the features of a bank's business that make an unfair, deceptive or abusive practice more likely or more harmful. The OCC lists nine in its worksheet, from product mix to complaint volume. For each it describes what Low and High look like, and a launch matrix can borrow the same factors as its likelihood drivers.
Higher-risk areas for UDAAP compliance, in the OCC worksheet's own terms
| Risk indicator | Low | High |
|---|---|---|
| Product mix | Traditional, noncomplex lending, investment and deposit products | Complex products such as credit-related add-ons, non-deposit investment products or overdraft protection |
| Promotions | Limited or no promotional periods or teaser offers | Extensive use of promotional or teaser offers; materials ambiguous about time frames or requirements |
| Marketing | Limited marketing, generally generic | Multiple channels including third parties; campaigns targeted at the elderly, young people, limited-English speakers or financially distressed people |
| Third parties offering products | No products offered through third parties | High reliance on third parties for products, including products with UDAP or UDAAP risk |
| Third parties in operations | Few third parties for account management, payments, collections | A significant number of third parties for operational functions |
| Growth and competition | Stable growth; few competitors | Volume outpacing financial strength; competition pushing into products the bank is not experienced in |
| Violations and complaints | Insignificant violations; minimal complaints | Significant violations with large reimbursements or penalties; high complaint volume, including complaints about third parties |
Read as a launch checklist, the table says where to look hardest. A fintech partner's journey scores High on two indicators before anyone opens it: a third party designs and runs the screens, and the product usually has a promotional hook. The OCC's red flags add one more that matters at launch, "Inconsistencies between account disclosures and bank operating systems", with the example of a disclosure that charges a daily overdraft fee each business day while the system charges it each calendar day. The FDIC's procedures, updated in August 2025, put heightened risk where a bank changes its products, offers "a complex or atypical product" or markets through third parties (FDIC Consumer Compliance Examination Manual, VII-1).
How do you score UDAAP risk on a single journey?
Score each risk where the customer meets it, on two axes the bank has written down, and keep the evidence with the score. A useful launch matrix has three settings the chief compliance officer approves in advance: the likelihood scale, the reach bands, and which of the nine cells are Low, Medium and High. It also needs one rule that is easy to forget: the journey's overall rating is the highest rating still open, not an average.
Take a sample journey as it runs through UDAAP Risk Assessment. The data are fictional: Tessaly Community Bank, a sample sponsor bank, reviews version 3 of a fintech partner's Early Pay account, offered by a partner called Fernway and forecast at 40,000 accounts in its first year. The bank's rating model, approved on July 1, 2026, crosses likelihood (Rare, Possible, Likely) with reach (under 1,000, 1,000 to 25,000, over 25,000 customers). The agents walked ten phone screens from the ad to closing the account, read 31 claims and found six that the agreement, the fee schedule or the program agreement does not support.
Six risks on one journey, scored on the bank's own matrix
| Note | Screen | Standard | Rating | What the score rests on |
|---|---|---|---|---|
| 1. "Up to 2 days early", read with "always" | 2, landing | Deceptive | High | Account Agreement §7: early availability is not guaranteed and timing may vary from pay period to pay period |
| 2. "Always free", two screens before a $4.99 fee | 2, landing | Deceptive | High | Fee schedule: $4.99 per instant transfer; the fee first appears on screen 4 inside a folded list |
| 3. "FDIC insured" with no bank named | 1, ad | Deceptive | Medium | Version 2 named the bank and "Member FDIC"; version 3 dropped both |
| 4. The fee list is folded shut | 4, fees | Deceptive | Low | Fees are disclosed before account opening, behind "See all fees" |
| 5. The paid transfer option is chosen for the customer | 8, instant transfer | Abusive | Medium | Instant ($4.99) is preselected; standard (free) is not |
| 6. Three taps to join, a phone call to leave | 9, close account | Deceptive and abusive | High | Account Agreement §12 promises closing in the app; Program Agreement §8.1 requires closing through each channel used to open |
Two things in that table matter more than the ratings. Every row has a source a second person can open, and the standard is named before the rating, because the standard decides what has to be shown. Deception needs a claim a reasonable customer would take one way and the documents say another; abusive practice needs an advantage taken, such as an exit made harder than the entry. The three-part tests are where those standards are set out.
UDAAP Risk Assessment: the journey as a filmstrip, each risk pinned and rated
The overall rating at the foot reads High: it is the highest note still open, not an average of six.
Why a score without a citation fails an exam
A rating is a judgment, and an examiner tests judgments by asking for the evidence. The CFPB's examination procedures, which the November 2025 manual still carries, start with a document request that includes "Documentation related to new product development, including relevant meeting minutes of Board of Directors, and of compliance and new product committees" (CFPB Supervision and Examination Manual, UDAAP procedures). A spreadsheet cell that says High, with no screen and no clause, is an answer without its working.
Citations also make a matrix consistent between reviewers. Two officers will often rate the same headline differently; they rarely disagree about whether a fee schedule charges $4.99 or whether an agreement promises in-app closing. Anchoring the score to the passage moves the argument from taste to text. It is also why the solution's Standards agent makes no call below a confidence of 0.80, or when its two readings of a screen disagree: a person rates those from the evidence.
A matrix cell that says High is a conclusion. The screen, the passage and the reach estimate are the reasons, and only the reasons survive an exam.
Inherent risk, residual risk, and the risk a person accepts
Inherent risk is the score before controls; residual risk is what is left after them; accepted risk is residual risk someone with authority has signed. A launch matrix should show all three, because the decision is about the third. In the sample review, five of the six notes were sent back to the partner as required changes. One, the folded fee list, was accepted with a condition: keep "See all fees" above the Continue button and recheck after 90 days with complaint data. The chief compliance officer co-signed that accepted risk.
The Fed's article puts the same logic at portfolio level: once residual risk is known, the bank should "determine whether it aligns with the board's risk appetite", and the most effective assessments name "the responsible parties and the time frames" for each change (Consumer Compliance Outlook, 2023). A launch matrix that ends in Changes required with five owners and a 90-day recheck is that sentence applied to one product.
How often should a UDAAP risk assessment be updated?
Yearly at portfolio level, and whenever something material changes; at launch level, on every new version. The second rule is the one banks miss. A partner who changes a headline, folds a fee list or moves the close button has changed the risk, whether or not anyone resubmitted the journey. The FFIEC's rating system describes the strongest banks as ones where management "reviews the change after implementation to determine that actions taken have achieved planned results" (Uniform Interagency Consumer Compliance Rating System).
In the sample review, five of the ten screens had changed since version 2 was approved on September 24. Only those five were reopened and scored again; the other five kept their September decisions. Complaints are the third trigger: five complaints on one theme within 30 days reopen a launched journey in the sample bank's settings, and a reviewer may reopen one earlier, with a reason. How changes get into review early is the subject of the new product approval process.
What to look for in a UDAAP risk assessment matrix tool
Look for a tool that runs your matrix rather than its own, scores where the customer meets the risk, and keeps every score with its evidence and its signer. Grids are easy to build in a spreadsheet; what a spreadsheet cannot do is hold the screen, the passage and the decision together across versions.
Questions to ask before you buy a UDAAP risk assessment matrix tool
- Can you load your own rating model?
Likelihood scale, reach or impact bands, the cell mapping and the confidence threshold should be settings your chief compliance officer approves, with the version in force recorded on every score.
- Is each score tied to a screen and a passage?
A rating without the claim, the screen and the contradicting clause is a cell, not evidence.
- Does it walk the whole journey?
Ad, sign-up, fee disclosure, first use, closing and making a complaint. Exit screens are where abusive-practice risk often sits, and screen decks rarely include them.
- What happens on a new version?
Changed screens should reopen; unchanged ones should keep their decisions, so a reviewer does not redo the whole review or miss the change.
- Who decides, and who signs?
The tool should propose; a named person should decide each risk with a reason, and a different person should sign the launch decision.
- Can complaints reopen a launched journey?
Complaint themes mapped to the screen that caused them are the cheapest early warning a matrix can get.
- What does the examiner get?
Every version's screens, the notes and their sources, the decisions, the signers and the third-party oversight evidence, exportable in one pack.
Where UDAAP Risk Assessment fits, and where it does not
The solution fits the launch matrix: new and changed products, fees and digital journeys, including those a fintech partner runs. It runs the bank's rating model, pins each risk on the screen, cites the passage behind it and proposes a rating and wording. The compliance officer decides each note with a reason code, and the chief compliance officer signs the launch decision and co-signs any accepted risk. Its agents never decide a note, sign a launch or write to a partner.
It does not replace the annual portfolio assessment, the board's risk appetite or legal advice on a close question. Some calls stay open by design. On the sample journey, whether Regulation DD's narrow rule on calling an account "free" reaches an optional instant transfer fee is marked as an open question for a person, while the wider deception test is applied to the screen. The design target is a cited launch decision within 3 days of submission, inside the bank's 10-business-day review window; it is a target, not a measured result.
One person proposes the launch decision, another signs it
A matrix is only as current as the journeys behind it, and most of the journeys a sponsor bank reviews are drawn by someone else; why third-party products are a UDAAP concern covers that side. To see the scoring, the pins and the signatures on one of your own journeys, start from UDAAP Risk Assessment.
Questions people ask
Is there a regulatory UDAAP risk assessment template?
No regulator prescribes one for banks. The nearest thing is the OCC's appendix B worksheet, an examiner's tool with nine quantity-of-risk indicators and thirteen quality-of-risk-management indicators. Many banks adapt its factors and keep their own scales.
Does the OCC expect a UDAAP risk assessment?
The OCC's examiners are told to "assess the effectiveness of the bank's risk assessment process" for UDAP and UDAAP, and the booklet describes a well-designed process as one that evaluates risk across products, third-party relationships, change management for new activities, incentive compensation and fee processing. In practice a bank with no assessment has little to show for that review.
What is the difference between inherent and residual UDAAP risk?
Inherent risk is the likelihood and impact of a practice before controls; residual risk is what remains once controls work. The Federal Reserve's staff describe residual risk as typically rated high, moderate or low, as each institution defines those levels.
Should a UDAAP matrix average its scores?
Averaging hides the one practice that causes harm. A journey with one High risk and five Low ones is a High-risk journey until the High one is fixed or accepted by someone with authority, which is why the sample bank rates a journey by its highest open note.
Can a UDAAP risk be rated Low and still need a change?
Yes. A Low rating sets priority, not permission. In the sample review the folded fee list was rated Low and still accepted only with a condition, a 90-day recheck against complaints, co-signed by the chief compliance officer.