The regulatory requirements for banks in the United States span capital adequacy, liquidity, consumer protection, privacy and cybersecurity, anti-money laundering, fair lending, community reinvestment, proprietary trading limits, internal controls, examinations, deposit insurance, and public financial reporting. Federal oversight comes primarily from the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC), with the Consumer Financial Protection Bureau (CFPB) enforcing consumer-facing rules and state banking departments regulating state-chartered institutions.1Federal Reserve. About the Federal Reserve The overlap is intentional. It builds a safety net that protects depositors and the broader economy from systemic shocks.
Capital and Liquidity Minimums
Banks have to hold their own money as a cushion against losses before depositor funds are ever at risk. Under 12 CFR Part 3, the OCC enforces minimum capital ratios aligned with the Basel III international framework, developed after the 2007–2009 financial crisis.2Bank for International Settlements. Basel III: International Regulatory Framework for Banks The floors are:
- Common Equity Tier 1 (CET1) of at least 4.5 percent of risk-weighted assets
- Tier 1 capital ratio of at least 6.0 percent
- Total capital ratio of at least 8.0 percent
- Leverage ratio of at least 4.0 percent
Risk-weighted assets means the bank assigns a weight to each asset based on how risky it is. A U.S. Treasury bond gets a lower weight than a subprime auto loan, so riskier portfolios require more capital backing.3eCFR. 12 CFR Part 3 – Capital Adequacy Standards Tier 1 capital, made up mainly of common stock and retained earnings, is the highest-quality buffer because it’s immediately available to absorb losses. Tier 2 supplements it with items like subordinated debt and loan loss reserves.
Capital ratios measure solvency over time. Liquidity standards address a more immediate risk: can the bank meet withdrawal demands right now. The Liquidity Coverage Ratio (LCR) requires banks to hold enough high-quality liquid assets to survive a 30-day stress scenario where cash flows out faster than normal.4Bank for International Settlements. Liquidity Coverage Ratio (LCR) – Executive Summary The Net Stable Funding Ratio (NSFR) looks further ahead, requiring available stable funding to equal or exceed required stable funding on an ongoing basis.5Office of the Comptroller of the Currency. Net Stable Funding Ratio: Final Rule
Consumer Protection Rules
The Truth in Lending Act, implemented through Regulation Z, requires banks to disclose the annual percentage rate, total finance charges, and payment schedule before a borrower commits, in a standardized format that lets consumers compare offers.6eCFR. 12 CFR Part 1026 – Truth in Lending (Regulation Z)
The Electronic Fund Transfer Act, known as Regulation E, protects people who use debit cards and electronic payments. If a debit card is stolen or an unauthorized transfer hits an account, the customer’s liability turns on how quickly they report it: $50 if they notify the bank within two business days, up to $500 if they wait up to 60 days, and potentially unlimited liability after that.7Consumer Financial Protection Bureau. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
The Equal Credit Opportunity Act (ECOA) prohibits discrimination against credit applicants based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance income. When a bank denies an application or takes other adverse action, it must send a written notice within 30 days that includes the specific reasons for the denial. Vague statements like “you didn’t meet our internal standards” aren’t enough.8Federal Deposit Insurance Corporation. V-7 Equal Credit Opportunity Act (ECOA)
Privacy and Cybersecurity Obligations
The Gramm-Leach-Bliley Act (GLBA) governs how banks handle nonpublic personal information. Banks have to provide a privacy notice when a customer relationship begins, explaining what data they collect, who they share it with, and how they protect it. Customers have the right to opt out of having their information shared with unaffiliated third parties.9Federal Trade Commission. Gramm-Leach-Bliley Act Since 2015, banks that haven’t changed their data-sharing practices and only share information in limited, routine ways are exempt from sending annual privacy notices. If the bank changes its policies, the annual notice requirement resumes.10Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act (Regulation P)
Beyond disclosure, GLBA’s Safeguards Rule requires every covered financial institution to maintain a written information security program with administrative, technical, and physical safeguards to protect customer data.
Cybersecurity has its own rapid-response rule. When a computer-security incident materially disrupts a bank’s ability to serve customers or threatens the stability of its core operations, the bank must notify its primary federal regulator within 36 hours of determining the incident occurred.11eCFR. 12 CFR Part 53 – Computer-Security Incident Notification Bank service providers that experience such incidents must also notify their affected bank clients as soon as possible.12FDIC. Computer-Security Incident Notification
Anti-Money Laundering Programs
The Bank Secrecy Act (BSA) is the cornerstone of U.S. anti-money laundering law, requiring formal programs to detect and report suspicious financial activity. The USA PATRIOT Act expanded those obligations, adding identity verification and enhanced scrutiny of higher-risk accounts.13Internal Revenue Service. Bank Secrecy Act
Banks must verify the identity of every person who opens an account. For business accounts, the Customer Due Diligence (CDD) Rule adds a layer: banks must identify and verify any individual who owns 25 percent or more of a legal entity, as well as the person who controls it.14FinCEN.gov. Information on Complying with the Customer Due Diligence (CDD) Final Rule
Any cash transaction exceeding $10,000 in a single business day triggers a Currency Transaction Report.15U.S. GAO. Currency Transaction Reports: Improvements Could Reduce Filer Burden While Still Providing Useful Information to Law Enforcement Suspicious transactions of any size trigger a Suspicious Activity Report filed with federal investigators. Deliberately structuring deposits to stay below the $10,000 threshold is itself a federal crime.
Community Reinvestment Act
The Community Reinvestment Act (CRA) requires banks to meet the credit needs of the communities where they operate, including low- and moderate-income neighborhoods. Regulators evaluate each bank’s CRA performance and assign one of four ratings: Outstanding, Satisfactory, Needs to Improve, or Substantial Noncompliance.16Federal Financial Institutions Examination Council. CRA Rating Search Frequently Asked Questions For interstate banks, examiners also evaluate performance in each state and metropolitan area where the bank has branches.
Regulators consider CRA performance when a bank applies to open new branches, merge with another institution, or expand its operations, so a rating of “Needs to Improve” or “Substantial Noncompliance” can block those applications. Banks are currently evaluated under the 1995/2021 regulatory framework, after a 2023 modernization rule was enjoined by a federal court and never took effect.17Office of the Comptroller of the Currency. Community Reinvestment Act: Rescinding the 2023 CRA Final Rule
Proprietary Trading Limits
The Volcker Rule, codified for national banks in 12 CFR Part 44, prohibits banks from engaging in proprietary trading and from acquiring ownership interests in hedge funds or private equity funds. Banks backed by federal deposit insurance shouldn’t be gambling with that safety net on speculative bets for their own profit.18eCFR. 12 CFR Part 44 – Proprietary Trading and Certain Interests in and Relationships With Covered Funds Exceptions exist for market-making, underwriting, hedging, and trading in government securities, each with conditions that prevent it from becoming a loophole. A bank caught violating the rule must terminate the prohibited activity and dispose of the investment, and regulators can restrict its permissible trading activities going forward.
Internal Controls and Continuity Planning
Under 12 CFR Part 30, banks must maintain internal controls covering loan documentation, credit underwriting, information systems, and more.19Legal Information Institute. 12 CFR Appendix A to Part 30 – Interagency Guidelines Establishing Standards for Safety and Soundness The compliance function has to operate independently from lending and investment teams. The board of directors holds ultimate responsibility for overseeing these controls and approving risk management policies.20eCFR. 12 CFR Part 30 – Safety and Soundness Standards
Banks also have to maintain an enterprise-wide business continuity program that goes beyond simple disaster recovery. Examiners expect the program to include resilience strategies, testing and exercises, employee training, and regular board reporting.21Office of the Comptroller of the Currency. FFIEC Information Technology Examination Handbook: Revised Business Continuity Management Booklet A bank that can’t demonstrate a tested, current continuity plan will face examiner criticism and potential enforcement action.
Examinations, Reporting, and Stress Testing
Every quarter, banks submit a Consolidated Report of Condition and Income, universally called a Call Report. The standardized filing gives regulators and the public a detailed snapshot of the bank’s assets, liabilities, income, and risk profile.22Federal Deposit Insurance Corporation. Consolidated Reports of Condition and Income Banks file the data electronically through the FFIEC’s Central Data Repository.23Federal Financial Institutions Examination Council. Consolidated Reports of Condition and Income for a Bank with Domestic and Foreign Offices – FFIEC 031
The OCC has to conduct a full-scope, on-site examination of every national bank and federal savings association at least once every 12 months.24eCFR. 12 CFR 4.6 – Frequency of Examination of National Banks and Federal Savings Associations The FDIC conducts similar examinations for state-chartered insured banks. Examiners review loan files, interview management, inspect physical security, and verify reported data. They then assign a CAMELS rating based on six components: Capital adequacy, Asset quality, Management, Earnings, Liquidity, and Sensitivity to market risk. Each component gets an individual score, and the bank receives a composite rating that drives how closely regulators watch it.25Office of the Comptroller of the Currency. Supervisory Ratings: Proposed Revisions to the Uniform Financial Institutions Rating System A composite of 1 or 2 is satisfactory. Ratings of 3 through 5 draw increased scrutiny, more frequent examinations, and often formal enforcement actions.
Banks with more than $250 billion in total consolidated assets must conduct company-run stress tests under the Dodd-Frank Act, projecting how their capital would hold up under hypothetical downturns.26FDIC. FDIC Releases Economic Scenarios for 2026 Stress Testing That threshold was raised from $10 billion in 2018, which freed most community and regional banks from the formal stress-test obligation. Smaller banks still face capital adequacy scrutiny through the normal examination process.
Deposit Insurance Assessments
Every insured depository institution pays quarterly assessments to the FDIC to fund the Deposit Insurance Fund, which backs the $250,000-per-depositor coverage guarantee. The FDIC’s designated reserve ratio for the fund is 2 percent of estimated insured deposits.27eCFR. 12 CFR Part 327 – Assessments Assessment rates vary with the bank’s risk profile: well-capitalized, well-managed institutions pay lower rates, and riskier banks pay more.
Enforcement Actions and Penalties
When a bank violates the law, engages in unsafe practices, or breaches its fiduciary duties, regulators can issue cease-and-desist orders, impose civil money penalties, remove individual officers or directors, and in extreme cases revoke a bank’s charter or insurance.28Office of the Comptroller of the Currency. Enforcement Actions
Civil money penalties follow a three-tiered structure under federal law. Basic violations carry penalties of up to $5,000 per day. When the violation is part of a pattern, causes more than minimal loss, or produces a financial benefit for the wrongdoer, the cap rises to $25,000 per day. For knowing violations that cause substantial harm, individuals face up to $1,000,000 per day, and institutions face even steeper maximums.29Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution Officers who knowingly ignore requirements can also face criminal prosecution and permanent industry bans. Regulators publish enforcement actions publicly, so the reputational damage compounds the financial cost.
After an examination, regulators provide a formal report of findings. Banks rated poorly or cited for violations must submit corrective action plans within a set timeframe and demonstrate measurable progress. Failure to follow through typically escalates the response from informal supervisory guidance to binding legal orders.