UDAAP training for the board of directors: who signs a launch

UDAAP training for a board of directors should cover four things: the three standards in plain terms, the board's own accountability for the compliance management system, how a new or changed product is decided and signed before it reaches customers, and which unfair, deceptive or abusive risks the bank has knowingly accepted. Most board sessions stop at the first. The other three are what examiners test, and they are hard to teach in the abstract because a director rarely sees a launch decision being made. Botminds' UDAAP Risk Assessment makes that chain concrete: every risk on a journey is pinned to the screen with the clause behind it, a compliance officer decides each one, the chief compliance officer signs the launch and co-signs any accepted risk, and the record exports for the board's compliance committee and the examiner.

"The Board of a financial institution is ultimately responsible for developing and administering a CMS that ensures compliance with federal consumer protection laws and regulations."

FDIC Consumer Compliance Examination Manual, II-3

What UDAAP training does a board of directors need?

Training tailored to what directors decide and oversee. The FDIC's procedures say "Education of a financial institution's Board, management, and staff is essential to maintaining an effective compliance program", and that the compliance officer should keep a regular training calendar that reaches directors as well as management, staff and, where it fits, the bank's service providers (FDIC Consumer Compliance Examination Manual, II-3). The FFIEC rating system describes the strongest programs as ones where training is "specifically tailored to the particular responsibilities of the staff receiving it, including those responsible for product development, marketing and customer service" (FFIEC rating system).

For a board, tailored means four modules rather than one. The standards themselves, briefly: unfair turns on unavoidable injury, deceptive on a misleading impression, abusive on taking advantage; the UDAAP 3 part test sets them out. The board's own duties. The approval chain for new and changed products, with real examples from the bank's own launches. And the accepted risks: what the bank chose to live with, why, and when it will look again.

What is the board's role in UDAAP?

To own the compliance management system that keeps UDAAP risk within the bank's appetite, and to hold management to it. The FDIC lists the board and management actions that show commitment, among them naming a compliance officer with real authority who answers for the results (the role is described in thebank CRA officer job description), "anticipating and evaluating changes in the institution's operating environment and implementing responses across impacted lines of business", and "providing for recurrent reports by the compliance officer to the Board." It is blunt about delegation: a compliance committee may help, "However, the ultimate responsibility of overall compliance with all statutes and regulations resides with the Board."

The OCC frames the stakes in the same terms. Its UDAP and UDAAP booklet says that "The potential consequences of UDAP or UDAAP violations can affect the bank, management, and directors", and lists customer reimbursements, remediation costs, financial losses, legal actions and enforcement actions including civil money penalties (OCC Comptroller's Handbook, UDAP and UDAAP). Among the indicators an examiner uses to rate the quality of a bank's UDAAP risk management is whether "UDAP and UDAAP risk assessments and reports presented to the board and management are comprehensive, accurate, and timely."

Who approves new products for UDAAP risk?

Management approves, a compliance function decides the UDAAP questions, and the board oversees and hears about the material ones. The OCC's principles for new activities put it this way: "Although the board may delegate the bank's daily managerial duties to others, the board is ultimately responsible for providing the appropriate oversight to ensure that the bank operates in a safe and sound manner and in compliance with applicable laws and regulations," and "The board or a delegated board committee should consider whether new activities are consistent with the bank's strategic goals and risk appetite" (OCC Bulletin 2017-43).

The Federal Reserve's staff quote a community banking article on why that matters: "jumping into a new product or business line without effective challenge from board members can result in future headaches" (Consumer Compliance Outlook, 2015). Effective challenge needs material the board can challenge: not a memo that says "reviewed", but the risks found, where they sit, what was decided and by whom. How the approval process brings that review in early is the subject of the new product approval process.

What does the chief compliance officer sign at launch?

A launch decision that someone else prepared, with every risk, decision and condition on the record. In a well-built chain each signature attests to something different, and the board should be trained to know which. The flow below is the sample bank's configuration in UDAAP Risk Assessment; the bank and its people are fictional.

What UDAAP risks does the board accept?

Every residual risk a launch goes live with, whether or not anyone named it. A trained board asks for the list. Take a sample launch to see what one looks like. Fernway, a fintech partner of Tessaly Community Bank, submitted version 3 of an Early Pay account; the agents found six risks. The compliance officer required five changes and accepted one, a fee list folded behind "See all fees", on a condition: keep "See all fees" above the Continue button and recheck after 90 days with complaint data. The chief compliance officer co-signed that accepted risk and signed the launch decision, Changes required, three minutes after it was proposed.

UDAAP Risk Assessment: one person proposes the launch decision, another signs it

The launch date moves only when a signed decision says Approved, so a launch cannot outrun its review.

What do examiners ask the board about UDAAP?

They read the minutes and ask whether the board knew. The CFPB's UDAAP document request starts with "Minutes of the meetings of the Board of Directors and of management committees, including those related to compliance", and its procedures ask whether "Management and the Board of Directors are made aware of and review significant deficiencies and their causes" (CFPB Supervision and Examination Manual, UDAAP). For partner programs the FDIC's examiners have a sharper list, beginning with whether "the board provides approval prior to entering into any material third-party arrangements" and asking, among other things: "Are board members fully aware of the risks, issues, and responsibilities associated with the third-party relationship under consideration?" and "Were board members provided access to the due diligence findings and were findings accurately presented?" (FDIC manual, VII-4).

Those questions are a board training syllabus in themselves. A director who can answer them for the bank's three or four riskiest products, using the bank's own records, is better prepared than one who has sat through a definitions course. Why partner products deserve that attention is set out in why third-party products are a UDAAP concern.

When a UDAAP problem becomes an order, the board is named in it

Enforcement orders make the board the owner of the fix. The OCC's consent order with The Federal Savings Bank over deceptive mailers, signed in April 2026, was signed by nine directors, and it directs: "The Board shall ensure that the Bank, its officers, employees, and agents immediately cease and desist engaging in violations of Section 5 of the FTC Act related to VA-guaranteed mortgage loans" (OCC, AA-ENF-2025-63). The FDIC's procedures add that consumer compliance audit findings go straight to the board or one of its committees, not through management, and that the board and management's response "should be prompt."

How often should the board get UDAAP training?

No rule sets a frequency. The FDIC asks for "a regular training schedule" that includes directors, and the FFIEC's strongest rating describes a program "updated proactively in advance of the introduction of new products or new consumer protection laws and regulations." A reasonable pattern, and it is our suggestion rather than a requirement, is a short annual session on standards and duties, plus a briefing before any material new product or partner program, and a quarterly report of launches, accepted risks and reopened reviews that teaches by example.

Where UDAAP Risk Assessment fits in board oversight, and where it does not

The solution produces the records a board's oversight depends on: each launch decision with its maker and checker, each accepted risk with its condition and co-signer, reopened reviews and their causes, and partner-by-partner oversight. Among its exports are an examiner pack per journey and a board compliance committee report. Every agent step, decision and signature is kept with who, what, when and why.

One export for the examiner, another for the board's compliance committee

It does not set the board's risk appetite, deliver the training or replace legal advice to directors. It gives the training its material: real decisions, on real screens, with real signatures. To see that chain on one of your own launches, start from UDAAP Risk Assessment.

Questions people ask

Who owns UDAAP in a bank?

The board, ultimately; management and the compliance officer day to day. The FDIC says the ultimate responsibility for compliance "resides with the Board", and that the board and management must give the compliance officer authority to cross departmental lines and effect corrective action.

Does the board have to approve every new product?

No. The OCC expects management to inform the board of material new activities and the board, or a delegated committee, to consider whether they fit its strategy and risk appetite. For material third-party arrangements, the FDIC's examiners check whether the board approved them before the bank entered into them.

What should a board UDAAP report contain?

The risks that matter to the board's appetite: launches decided and their outcomes, risks accepted with their conditions and recheck dates, reviews reopened by complaints or changes, partner programs and their open issues, and audit findings with corrective actions. The OCC rates reports to the board on whether they are comprehensive, accurate and timely.

Can directors be affected personally by UDAAP violations?

The OCC's booklet says the consequences of UDAP or UDAAP violations "can affect the bank, management, and directors." In practice, orders place the corrective duties on the board by name, as the OCC's April 2026 order against The Federal Savings Bank shows.

Is generic UDAAP training enough for a board?

It is a start. Examiners look for training tailored to responsibilities, and a board's responsibilities are oversight, approval and accepted risk. Training that uses the bank's own launches and accepted risks teaches directors what they will actually be asked about.