The OCC compliance risk assessment is the structured process federal examiners use to measure how much consumer-compliance risk a national bank or federal savings association carries and how well its systems control that risk. The assessment answers two questions at once: the quantity of risk the bank faces from its products and activities, and the quality of the bank’s management of that risk. The conclusions drive the institution’s Consumer Compliance Rating, the frequency of future exams, and — when things go wrong — the enforcement tools the OCC brings to bear.
The Two Questions Behind Every Assessment
OCC examiners split the analysis into “quantity of risk” and “quality of risk management.”1Office of the Comptroller of the Currency. Comptroller’s Handbook – Large Bank Supervision Quantity reflects what the bank actually does. A community bank holding residential mortgages and consumer deposits presents a different profile than an institution running complex structured products, subprime lending, or high-volume electronic payments. More products, more accounts, and more complex transactions push the quantity higher.
Quality asks whether the bank can identify, measure, monitor, and control those risks. Examiners look at four things:
- Board and management oversight — whether leadership commits real resources to compliance, understands the bank’s exposure, and holds staff accountable.
- Policies and procedures — whether written guidance covers the bank’s products clearly enough that employees can follow it without guessing.
- Management information systems — whether reporting tools capture compliance data accurately and get it to decision-makers in time to act.
- Internal controls and audit — whether the bank independently verifies that its compliance systems are working.
The combination decides where risk is concentrated and whether the controls match the exposure.
The Compliance Management System
Alongside the general risk framework, examiners evaluate the bank’s compliance management system, or CMS. The Comptroller’s Handbook identifies two primary CMS components: board and management oversight, and the consumer compliance program underneath it.2Office of the Comptroller of the Currency. Comptroller’s Handbook – Compliance Management Systems
Oversight covers leadership’s commitment to compliance, the bank’s ability to absorb changes in law or strategy, its process for handling product and service risks, and its record of catching problems internally before examiners do. Examiners look for signs that compliance is a genuine priority, not a box-checking exercise.
The consumer compliance program includes four elements: policies and procedures appropriate to the bank’s complexity and risk (including third-party relationships); training that is current, tailored, and covers the relevant laws; monitoring and audit that independently tests whether controls work; and a consumer complaint response process that resolves complaints quickly and uses complaint patterns to spot systemic issues.2Office of the Comptroller of the Currency. Comptroller’s Handbook – Compliance Management Systems Board oversight is the foundation. If leadership isn’t engaged, the program underneath tends to drift regardless of how good the policies look on paper.
What the Bank Has to Produce
Preparing for an assessment means assembling documentation across every operational area. The Comptroller’s Handbook is the official examiner manual and specifies what each product line and compliance area requires.3Office of the Comptroller of the Currency. Comptroller’s Handbook At a minimum, expect to gather:
- Internal audit reports, including identified deficiencies and how management addressed them.
- Compliance officer reports showing how the bank meets its obligations under federal consumer protection statutes.
- Training records documenting that staff have been trained on the applicable laws — Truth in Lending, Electronic Fund Transfer Act, and others — tailored to each person’s role.
- Consumer complaint logs, including resolutions and any patterns pointing to product-level problems.
- Marketing materials — advertisements, disclosures, promotions for products such as credit cards and mortgages — reviewed for accuracy and fairness.
- Product-level data for each business line, including loan volume, dollar amounts, and compliance staffing.
Every product line is categorized in the bank’s internal risk log so no part of the business goes unexamined. The common mistake is treating this as a document-collection exercise. Gathering the audit report is step one. Connecting its findings to specific ratings in the compliance profile is where the real work happens, and unsupported ratings draw examiner scrutiny fast. If you call something low risk but the complaint data says otherwise, the examiner will notice.
Where Examiners Concentrate Their Attention
Every consumer protection law that applies to the bank is in scope, but certain areas draw closer review.
Fair Lending
The OCC evaluates fair lending primarily under the Equal Credit Opportunity Act and the Fair Housing Act.4Office of the Comptroller of the Currency. Comptroller’s Handbook – Fair Lending Examiners use statistical modeling and Home Mortgage Disclosure Act data to screen for discrimination risk. They assess weaknesses in the compliance program itself, pricing disparities, underwriting inconsistencies, discriminatory marketing, and redlining. A bank that does not regularly analyze its own lending data for disparities is waiting for an examiner to find the problem first.
Bank Secrecy Act and Anti-Money Laundering
Every OCC-supervised bank must maintain a BSA/AML program with four required elements: a system of internal controls, independent testing, a designated BSA compliance officer, and training for appropriate staff.5FFIEC. Assessing the BSA/AML Compliance Program The program must include customer identification procedures and risk-based ongoing due diligence. Examiners work from the FFIEC’s BSA/AML Examination Manual, covering suspicious activity reporting, funds transfer recordkeeping, and foreign correspondent accounts.6Office of the Comptroller of the Currency. Bank Secrecy Act and Anti-Money Laundering Examinations
Data Privacy and Information Security
Under the Gramm-Leach-Bliley Act, banks must maintain a written information security program with administrative, technical, and physical safeguards appropriate to their size and complexity.7Office of the Comptroller of the Currency. Examination Procedures to Evaluate Compliance With the Guidelines to Safeguarding Customer Information Examiners check whether the bank has identified foreseeable threats to customer information, ranked its data assets by sensitivity, and tested the effectiveness of its safeguards. The board or a designated committee must approve the program and receive status reports at least annually. Risks that could cause immediate material loss require prompt action, not just documentation.
Third-Party and Fintech Relationships
Banks partnering with fintechs or using third parties to deliver products face heightened scrutiny. The OCC, Federal Reserve, and FDIC issued interagency guidance requiring banks to manage third-party risk throughout the entire relationship lifecycle, from due diligence through monitoring to termination.8Office of the Comptroller of the Currency. Third-Party Relationships: Interagency Guidance on Risk Management Not every third-party relationship carries the same weight; examiners expect the level of risk management to match how critical the activity is. In 2024, the three agencies issued a joint request for information specifically about bank-fintech arrangements, signaling continued supervisory attention.9Office of the Comptroller of the Currency. Bank-Fintech Arrangements: Request for Information
How the Exam Runs
After the bank completes its compliance risk profile, the formal examination begins. Banks submit documentation through BankNet, the OCC’s secure electronic system for regulated institutions.10Office of the Comptroller of the Currency. BankNet The designated Examiner-in-Charge reviews the submitted materials and sets the scope. Depending on the bank’s size and complexity, the review may happen off-site at an OCC office or on-site at the bank. Examiners often request follow-up interviews with department heads and compliance staff to test whether documentation matches actual practice.
The process concludes with a Report of Examination laying out findings, required corrective actions, and the Consumer Compliance Rating. Reports are confidential supervisory information. The bank cannot share them publicly or with third parties without written OCC permission, and unauthorized disclosure can carry criminal penalties.11Office of the Comptroller of the Currency. Supervisory Ratings and Other Nonpublic OCC Information Results are presented directly to the bank’s board, which must acknowledge the findings and develop a corrective plan.
How Often Examinations Occur
The standard on-site cycle is 12 months. Banks meeting specific criteria qualify for an 18-month cycle: less than $3 billion in total assets, a CAMELS rating of 1 or 2, well-capitalized status, no formal enforcement action in effect, and no change of control in the prior 12 months.12Office of the Comptroller of the Currency. Expanded Examination Cycle Eligibility: Final Rule Even for qualifying banks, the OCC retains authority to examine sooner if circumstances warrant.
The Consumer Compliance Rating
The rating uses the Uniform Interagency Consumer Compliance Rating System, a 1-through-5 scale where 1 is the best.13Federal Reserve. FFIEC Guidance on the Uniform Interagency Consumer Compliance Rating System A 1 reflects a strong CMS that prevents violations and consumer harm. A 2 is satisfactory with only minor weaknesses. A 3 indicates deficiencies requiring correction. A 4 means the CMS is “seriously deficient,” with fundamental and persistent weaknesses. A 5 means “critically deficient,” reflecting an absence of crucial CMS elements and a lack of willingness or ability to comply.14Federal Deposit Insurance Corporation. Consumer Compliance Examination Manual – Consumer Compliance Ratings
What Happens When Examiners Find Problems
The OCC’s response scales with the severity of the deficiency and the bank’s willingness to correct it.
Matters Requiring Attention
A Matters Requiring Attention notice, or MRA, is the first significant escalation. Under a proposed interagency rule, agencies would issue an MRA only for a practice that either violates a banking law or regulation, or is contrary to generally accepted standards of prudent operation and has caused or could cause material harm to the institution’s financial condition.15Office of the Comptroller of the Currency. Defining Unsafe or Unsound Practice and Revising the Framework for Issuing Matters Requiring Attention An MRA demands a concrete response. Unresolved MRAs tend to escalate.
Formal Enforcement Actions
When informal measures fail or the issue is severe, the OCC uses formal enforcement tools:16Office of the Comptroller of the Currency. Enforcement Action Types
- Formal agreements — a written agreement signed by the OCC and the bank’s board setting out specific corrective steps.
- Cease-and-desist orders — issued under 12 USC 1818(b), these can stop an unsafe practice and require affirmative action to fix the damage.
- Restitution orders — a cease-and-desist order specifically requiring the bank to reimburse harmed customers.
- Civil money penalties — monetary fines imposed on the bank or on individuals.
Civil Money Penalty Tiers
Civil money penalties follow a three-tier structure in 12 USC 1818(i)(2). Tier 1 covers any violation of law, regulation, final order, or written agreement. Tier 2 applies when the violation is part of a pattern, causes more than minimal loss, or produces financial benefit to the violator. Tier 3 targets knowing violations that recklessly cause substantial loss to the institution or substantial gain to the individual.17Office of the Law Revision Counsel. 12 U.S. Code 1818 – Termination of Status as Insured Depository Institution
The base statutory maximums of $5,000, $25,000, and $1,000,000 per day are adjusted annually for inflation. As of January 2025, the inflation-adjusted maximums under 12 USC 1818(i)(2) are $12,567 per day for Tier 1, $62,829 per day for Tier 2, and $2,513,215 per day for Tier 3.18Federal Register. Notification of Inflation Adjustments for Civil Money Penalties For a Tier 3 penalty against an institution, the maximum is capped at the lesser of $2,513,215 or 1% of the bank’s total assets. Because the penalties run per day, they compound quickly when violations continue over weeks or months.
Challenging Examination Results
Banks that disagree with findings or ratings have a structured appeals process, and the deadlines are short. An informal appeal to the supervisory office must be filed within 10 calendar days of receiving the decision.19Office of the Comptroller of the Currency. Bank Appeals Process If that doesn’t resolve the dispute, the bank can file a formal appeal with the deputy comptroller or the OCC Ombudsman within 60 calendar days of the original decision. A second-tier appeal to the Ombudsman is available within 15 calendar days of receiving the deputy comptroller’s decision. Missing the 10-day informal window closes that path entirely.