The regulation of financial institutions in the United States is split among several federal agencies, state banking departments, and a cross-agency council, with each bank, credit union, or financial company answering primarily to the regulator that matches its charter and size. The core federal supervisors are the Office of the Comptroller of the Currency, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Consumer Financial Protection Bureau. Together with state regulators, they enforce rules covering capital, liquidity, consumer disclosures, anti-money-laundering, data security, and community lending.
Which Agency Regulates Which Institution
No single agency oversees every financial institution. The regulator you deal with depends on how your institution is chartered and how large it is.
The Office of the Comptroller of the Currency, housed within the Treasury Department, supervises national banks and federal savings associations.1Office of the Law Revision Counsel. 12 USC 1 – Office of the Comptroller of the Currency National banks typically carry “National” or “N.A.” in their names and run on a single federal charter that lets them operate across state lines.
The Federal Reserve supervises bank holding companies — the corporate parents that own banks — along with state-chartered banks that choose to become Fed members. Under 12 U.S.C. § 1844, the Fed can examine holding companies, require reports, and set capital rules for them.2Office of the Law Revision Counsel. 12 USC 1844 – Administration That gives the Fed a lead role over the largest, most interconnected financial groups.
The Federal Deposit Insurance Corporation supervises state-chartered banks that are not Fed members. The FDIC also insures deposits at virtually all U.S. banks and savings institutions up to $250,000 per depositor, per institution, per ownership category.3Office of the Law Revision Counsel. 12 USC 1821 – Insurance Funds That deposit guarantee is what keeps most customers from pulling cash at the first sign of trouble.
Credit unions are member-owned cooperatives supervised by the National Credit Union Administration, which charters federal credit unions and runs the National Credit Union Share Insurance Fund. Share insurance protects accounts up to $250,000, matching FDIC coverage.4National Credit Union Administration. Share Insurance Coverage
The Consumer Financial Protection Bureau sits across these prudential regulators and enforces federal consumer financial laws at banks with more than $10 billion in assets, plus non-bank mortgage lenders, payday lenders, and private student lenders of all sizes.5Consumer Financial Protection Bureau. Institutions Subject to CFPB Supervisory Authority Smaller banks stay under the consumer-compliance supervision of their primary prudential regulator. The CFPB has been restructuring since early 2025, with closed examinations and terminated enforcement cases now the subject of litigation.6U.S. GAO. Consumer Financial Protection Bureau: Status of Reorganization The underlying consumer protection statutes remain in force, and the OCC, FDIC, and Fed continue consumer compliance examinations under their own authority.
Above the individual-agency structure sits the Financial Stability Oversight Council, created by the Dodd-Frank Act and chaired by the Treasury Secretary. FSOC identifies risks that cut across the financial system and can designate a non-bank financial company as systemically important, pulling it under Federal Reserve supervision with enhanced standards.7U.S. Department of the Treasury. Financial Stability Oversight Council Issues Proposed Guidance on Nonbank Financial Company Designations
The Dual Banking Choice
A bank can take a federal charter (supervised primarily by the OCC) or a state charter (supervised by its state banking department along with either the FDIC or the Federal Reserve). The choice affects which rules apply and which examiners show up. State-chartered banks sometimes get more flexibility on specific product offerings, while national banks benefit from uniform federal preemption of conflicting state laws.
Capital and Liquidity Requirements
Every insured depository institution has to hold enough capital to absorb losses without failing. The Dodd-Frank Act directed federal regulators to set leverage and risk-based capital requirements for banks and holding companies,8Congress.gov. Public Law 111-203 – Dodd-Frank Wall Street Reform and Consumer Protection Act and those rules track the international Basel III framework.
The headline measure is the Common Equity Tier 1 (CET1) ratio: a bank’s highest-quality capital (common stock and retained earnings) as a share of its risk-weighted assets. The regulatory floor is 4.5%.9Federal Reserve Board. Annual Large Bank Capital Requirements On top of that, banks must maintain a 2.5% capital conservation buffer, so the practical minimum sits at 7% before regulators start restricting dividends and bonuses. The largest banks face additional surcharges.
Liquidity rules solve a different problem. A bank can be solvent on paper but still collapse if it cannot turn assets into cash fast enough to meet withdrawals. The Liquidity Coverage Ratio requires large institutions to hold enough high-quality liquid assets to survive 30 days of severe financial stress.10Bank for International Settlements. Liquidity Coverage Ratio (LCR) – Executive Summary
Stress Tests
Bank holding companies with $100 billion or more in total assets go through the Federal Reserve’s annual supervisory stress test, which models capital levels under a hypothetical severe recession.11Federal Reserve Board. Stress Tests The results drive what the bank can pay out in dividends or buybacks and whether it must retain more earnings.
The Volcker Rule
The Volcker Rule, at 12 U.S.C. § 1851, bars banking entities from proprietary trading and from owning or sponsoring hedge funds or private equity funds.12Office of the Law Revision Counsel. 12 USC 1851 – Prohibitions on Proprietary Trading and Certain Relationships With Hedge Funds and Private Equity Funds The premise is that banks with federal deposit insurance should not gamble with that backstop. Smaller banks with under $10 billion in consolidated assets and limited trading activity are generally exempt.13FDIC. Volcker Rule
Consumer Protection Rules
A separate body of law governs how financial institutions deal with individual customers. These rules focus on disclosure, fairness, and accountability, and they apply regardless of which prudential agency supervises the institution.
Loan Disclosures
The Truth in Lending Act requires creditors to hand borrowers standardized cost information, including the annual percentage rate and total finance charges, before any commitment to borrow.14Office of the Law Revision Counsel. 15 USC 1601 – Congressional Findings and Declaration of Purpose Lenders who violate the disclosure rules face liability for actual damages, statutory damages that vary by loan type, and the borrower’s attorney’s fees.15Office of the Law Revision Counsel. 15 USC 1640 – Civil Liability For a closed-end mortgage, statutory damages run from $400 to $4,000 per violation.
Mortgage transactions carry extra protection under the Real Estate Settlement Procedures Act. Lenders must send a Loan Estimate within three business days of receiving a mortgage application and a Closing Disclosure at least three days before settlement.16Office of the Law Revision Counsel. 12 USC 2601 – Congressional Findings and Purpose
Fair Lending and Credit Reports
The Equal Credit Opportunity Act makes it illegal for a creditor to discriminate against a loan applicant based on race, color, religion, national origin, sex, marital status, or age, or because the applicant’s income comes from public assistance.17Office of the Law Revision Counsel. 15 USC 1691 – Scope of Prohibition The ban covers every stage of a credit transaction.
When a lender denies credit based wholly or partly on a credit report, the Fair Credit Reporting Act requires an adverse action notice. The notice must include the credit score used in the decision, the name and contact information of the credit bureau that supplied the report, and a statement that the bureau did not make the denial decision.18Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports You then have 60 days to request a free copy of the report and dispute any errors.
Debit Card and Electronic Transfer Liability
The Electronic Fund Transfer Act caps your liability for unauthorized debit card or electronic transfers at $50 if you report promptly. Wait more than two business days after discovering a lost card or unauthorized access, and liability can rise to $500. Beyond 60 days without reporting, your bank is not required to reimburse losses it can show would have been prevented by earlier notice.19Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Once you report an error, the bank generally has 10 business days to investigate and resolve it, with extensions available if provisional credit is issued.
Unfair, Deceptive, or Abusive Practices
Beyond those specific statutes, regulators can act against any financial institution engaged in unfair, deceptive, or abusive acts or practices (UDAAP). This catch-all standard reaches confusing fees, misleading marketing, and product designs that exploit a customer’s lack of understanding. Enforcement actions have produced large consumer refunds and civil penalties.
Anti-Money-Laundering Obligations
Banks sit on the front line of the government’s response to money laundering, terrorist financing, and other financial crime. The Bank Secrecy Act requires every bank to run a compliance program designed to detect and report the suspicious movement of money.20Office of the Law Revision Counsel. 31 USC 5311 – Declaration of Purpose
The USA PATRIOT Act layered customer identification rules on top of the BSA. Before opening any account, a bank must verify the customer’s identity by collecting a name, address, date of birth, and identification number, and must check that information against government watchlists of known or suspected terrorists.21U.S. Department of the Treasury. Treasury and Federal Financial Regulators Issue Patriot Act Regulations on Customer Identification The implementing regulation lives at 31 C.F.R. § 1020.220.22eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
Currency and Suspicious Activity Reports
Banks must file a Currency Transaction Report for any cash transaction over $10,000 in a single day, automatically, whether or not the transaction looks suspicious.23Financial Crimes Enforcement Network. Notice to Customers: A CTR Reference Guide Willful violations of BSA reporting obligations expose an institution to civil penalties of up to the greater of $100,000 or $25,000 per violation.24Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Negligent violations start at $500 per incident and reach $50,000 for a pattern of negligent activity.
Suspicious Activity Reports do something different. When a bank spots behavior that lacks a clear economic purpose or looks designed to dodge reporting thresholds, it must file a SAR with the Financial Crimes Enforcement Network.25Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The classic example is a customer making repeated cash deposits just under $10,000 to stay below the CTR trigger. That practice, called structuring, is a federal crime by itself. SARs are filed confidentially and feed law enforcement leads without alerting the person being watched.
Data Privacy and Security
The Gramm-Leach-Bliley Act imposes a broad duty on financial institutions to protect the security and confidentiality of customer nonpublic personal information. Under 15 U.S.C. § 6801, each institution must maintain administrative, technical, and physical safeguards to secure customer records, guard against anticipated threats, and prevent unauthorized access.26Office of the Law Revision Counsel. 15 USC 6801 – Protection of Nonpublic Personal Information
The FTC’s Safeguards Rule implements that mandate for non-bank financial institutions. Covered companies must develop and maintain a written information security program addressing risk assessments, access controls, encryption, and incident response. Institutions must also tell customers what information they collect, how it is shared, and give the option to opt out of certain third-party information sharing.27Federal Trade Commission. Gramm-Leach-Bliley Act A security breach affecting 500 or more people must be reported to the FTC.28Federal Trade Commission. Safeguards Rule Security Event Reporting Form Federal banking regulators impose their own notification requirements on banks and credit unions, often on tighter deadlines.
Community Reinvestment
The Community Reinvestment Act addresses the risk that banks take deposits from low- and moderate-income neighborhoods without lending back into them. Under 12 U.S.C. § 2901, regulated financial institutions have a continuing obligation to help meet the credit needs of the communities where they are chartered, consistent with safe and sound operations.29Office of the Law Revision Counsel. 12 USC 2901 – Congressional Findings and Statement of Purpose
Regulators evaluate CRA performance by looking at lending to low- and moderate-income borrowers and neighborhoods, investments in community development projects, and the availability of banking services such as branches in underserved areas. Smaller banks are typically evaluated on retail lending alone. Poor CRA ratings can block a bank’s ability to expand through mergers, acquisitions, or new branches, which gives the law real force even without specific lending quotas.
How Regulators Enforce the Rules
All of these rules depend on regulators actually checking compliance, which happens through a recurring cycle of on-site and off-site examinations. The standard cycle runs every 12 months, though well-capitalized and well-managed institutions with less than $3 billion in assets can qualify for an 18-month cycle.30Federal Deposit Insurance Corporation. Final Rules on Expanded Examination Cycle for Certain Small Insured Depository Institutions and U.S. Branches and Agencies of Foreign Banks Banks showing signs of trouble get examined more often.
The main examination tool is the CAMELS rating, which scores six components on a 1 (strongest) to 5 (weakest) scale:31Federal Reserve Board. Supervisory Letter SR 96-38 on Uniform Financial Institutions Rating System
- Capital adequacy: whether the bank holds enough capital for its risk profile.
- Asset quality: the level of credit risk in the loan and investment portfolios.
- Management: the board’s and management’s ability to identify and control risks.
- Earnings: profitability and whether earnings are sustainable.
- Liquidity: the ability to meet short-term obligations without fire-selling assets.
- Sensitivity to market risk: exposure to changes in interest rates, exchange rates, and other market variables.
A composite rating of 1 or 2 means the institution is fundamentally sound. A 4 or 5 signals serious problems and triggers immediate regulatory intervention. Regulators can issue cease-and-desist orders requiring a bank to stop specific practices, remove management, or raise additional capital within a set timeframe. In extreme cases, a bank’s charter can be revoked.
Banks also submit detailed financial data every quarter through Consolidated Reports of Condition and Income, known as Call Reports. These filings give regulators a continuous view of each institution’s financial health between examinations and feed the off-site monitoring systems that flag emerging problems before the next on-site visit.
Resolution Planning for the Largest Firms
The biggest financial companies must plan for their own potential failure. Under 12 U.S.C. § 5365(d), bank holding companies subject to enhanced prudential standards must submit resolution plans, commonly called “living wills,” to the Federal Reserve and the FDIC.32Office of the Law Revision Counsel. 12 USC 5365 – Enhanced Supervision and Prudential Standards for Nonbank Financial Companies Supervised by the Board of Governors and Certain Bank Holding Companies The plans describe the company’s ownership structure, assets, liabilities, major counterparties, and a strategy for rapid and orderly resolution under the Bankruptcy Code without destabilizing the broader financial system.33FDIC. FDIC and Financial Regulatory Reform – Title I and IDI Resolution Planning
If the Federal Reserve and FDIC jointly find a plan not credible, they notify the company and require a revised submission. A company that fails to produce a credible plan can face more stringent capital and liquidity requirements, restrictions on growth, or mandatory divestiture of business lines.