What Happens During a Bank Examination

If you've never been through a regulatory examination - or you're a new compliance officer about to face your first - the process can feel opaque. Examiners arrive, request documents, ask pointed questions, and eventually issue findings. But understanding the structure behind that process changes how you prepare for it and how you perform during it.

Bank examinations follow a predictable arc: pre-examination planning, on-site fieldwork, examiner analysis, exit conference, and the final report. Each phase has specific expectations for the institution. Institutions that understand these phases respond more efficiently, produce evidence faster, and receive fewer findings rooted in process confusion rather than actual compliance gaps.

Key Takeaways:

Examinations follow a structured process - understanding it reduces surprises
Most examiner frustration stems from slow document production, not compliance failures
The entrance conference sets the tone for the entire exam
Exit conference findings are preliminary - you have an opportunity to respond with evidence before the final report

Pre-Examination: Before Examiners Arrive

The exam starts before anyone walks through the door. Weeks before the on-site visit, your institution receives two critical communications:

The Examination Notification Letter

Your primary regulator - OCC, FDIC, Federal Reserve, NCUA, or state banking department - sends a formal notification letter 30-60 days before the examination. This letter specifies:

Examination type (safety and soundness, compliance, BSA/AML, IT, CRA, or a combination)
Scheduled dates and expected duration
Lead examiner and team composition
General scope and focus areas

Pay close attention to the scope description. If the letter mentions "targeted review of fair lending practices" or "follow-up on prior BSA findings," examiners are signaling where they'll focus. Allocate your preparation time accordingly.

The Document Request List

The document request list (DRL) arrives 2-4 weeks before the on-site start date. This is the operational blueprint for your preparation. A typical DRL for a compliance examination includes 50-100 line items spanning:

Organizational charts and reporting structures
Board and committee minutes (last 12-24 months)
Compliance risk assessment
Policies and procedures (current approved versions)
Training program documentation and completion records
Audit and independent testing reports
Prior examination findings with remediation status
Complaint logs with resolution documentation
Sample transaction files for targeted review areas

The clock starts now. Examiners expect most DRL items available on day one of the on-site visit. Delays in document production waste examination time - and examiners document those delays.

Institutions with continuous evidence capture treat the DRL as an export exercise. The documents already exist in organized, retrievable form. Institutions without it treat the DRL as a research project - and the scramble begins.

Day One: The Entrance Conference

The examination officially starts with the entrance conference. This meeting sets the tone for the entire process. Attendees typically include:

From the institution: CEO or president, chief compliance officer, BSA officer (for BSA exams), relevant department heads, internal audit
From the regulator: Lead examiner (examiner-in-charge, or EIC) and examination team members

The entrance conference covers:

Examination scope and objectives. The EIC outlines what the examination will cover, which areas will receive primary focus, and any targeted review areas. Listen carefully - this tells you exactly where examiners will spend their time.

Logistics. Physical workspace for examiners (they need a private room with network access), point-of-contact for document requests, hours of operation, and communication protocols.

Prior examination follow-up. The EIC will reference prior examination findings and ask about remediation status. Come prepared with a summary of each prior finding, the corrective action taken, evidence of completion, and validation results. Providing this proactively - ideally as a prepared package - demonstrates active management oversight.

Emerging concerns. Examiners may flag industry-wide issues or recent regulatory changes they'll be evaluating. In 2025-2026, expect questions about beneficial ownership under the Corporate Transparency Act, updated CRA regulations, third-party risk management under the interagency guidance (June 2023), and AI/model risk in compliance.

Your opportunity. The entrance conference is also your chance to provide context. If your institution went through a merger, launched a new product line, or experienced significant staff turnover, explain it now. Context helps examiners interpret what they find.

The On-Site Examination: What Examiners Do

Once the entrance conference concludes, examiners begin fieldwork. Here's what's actually happening:

Document Review and Transaction Testing

Examiners spend the majority of their time reviewing documents and testing transactions against regulatory requirements. The process is methodical:

Review policies and procedures against regulatory requirements to determine if they're adequate
Pull transaction samples (loans, accounts, SARs, complaints) using risk-based selection criteria
Test each sample against applicable requirements - were disclosures provided on time? Was CDD performed? Was the adverse action notice accurate?
Document exceptions where the transaction or process didn't meet the regulatory standard

For BSA/AML examinations, examiners reference the FFIEC BSA/AML Examination Manual and test against specific procedures. For consumer compliance, the FFIEC Consumer Compliance Handbook and regulation-specific examination procedures apply.

Sample sizes vary by institution size and risk profile. Examiners typically pull larger samples from higher-risk areas and smaller samples from areas with strong prior examination results.

Interviews

Examiners interview staff at multiple levels:

Senior management - To assess whether compliance is a genuine institutional priority and whether management understands the institution's risk profile
Compliance officers - To evaluate program design, monitoring activities, and issue resolution processes
Line staff - To determine whether policies and training translate into actual practice. A loan officer who can't explain the bank's fair lending policy has received ineffective training, regardless of the completion certificate

Interviews are where the gap between policy and practice becomes visible. Examiners compare what policies say should happen to what staff describe actually happening. Inconsistencies generate follow-up testing.

Practical advice: Brief staff that examiners may ask questions. Staff should answer honestly and directly - never guess or speculate. "I'm not sure, but I can find out and get back to you" is always better than an incorrect answer.

Follow-Up Requests

As examiners work through their review, they generate follow-up document requests. These are additional documents or data triggered by what they've found during fieldwork. Follow-up requests are normal - they don't automatically signal a problem.

However, the speed and quality of your response to follow-up requests matters. An examiner who requests a document and waits three days to receive it loses productive time and forms impressions about your organization. Designate a single point of contact to receive and triage examiner requests. Set an internal target to respond within hours, not days.

Common Examiner Frustrations (and How to Avoid Them)

Examiners examine dozens of institutions each year. They're experienced at distinguishing genuine compliance efforts from performative ones. These are the patterns that generate frustration and, often, harsher findings:

Slow document production. Examiners have a fixed window for on-site work. Every hour spent waiting for documents is an hour they can't spend completing their review. The result: they either extend the examination (expensive for everyone) or narrow their testing (and flag the delay in the report).

Policies that don't match practice. A BSA policy that describes a risk-based approach to enhanced due diligence, but EDD files that show identical treatment for all high-risk customers, is a red flag. Examiners test policies against actual practice. If they diverge, the finding is inevitable.

Unable to produce evidence of work completed. "We did that, but I can't find the documentation" is functionally equivalent to "we didn't do that" from an examination perspective. If the evidence doesn't exist, the work didn't happen - as far as the exam report is concerned.

Corrective actions from prior exams that weren't completed. Open prior-exam findings - particularly repeat findings - signal that management doesn't take regulatory requirements seriously. Examiners review prior findings first because they're a barometer of institutional culture.

Over-explaining or being defensive. Answer the question asked. Provide the document requested. Volunteering extensive justifications for practices examiners haven't questioned can direct attention to areas that weren't on their radar.

The Exit Conference

After completing fieldwork - typically 1-3 weeks for community banks, longer for larger institutions - examiners hold an exit conference. The same stakeholders from the entrance conference attend.

The EIC presents:

Preliminary findings and conclusions - Identified violations, MRAs, and observations
Examination ratings - For safety and soundness exams, preliminary CAMELS component and composite ratings. For compliance exams, the compliance rating
Areas of concern - Issues that didn't rise to the level of formal findings but warrant attention

Exit findings are preliminary. This is a critical point. You have an opportunity to respond in writing to the examination report. If you believe a finding is factually incorrect - and you have documentation to prove it - present your case through the formal response process. Examiners do modify findings when presented with evidence they didn't see during fieldwork.

Take detailed notes during the exit conference. Ask clarifying questions about any finding you don't fully understand. Request the specific regulatory citation for each finding so you can evaluate it accurately.

After the Examination: The Report and Response

The formal examination report arrives 30-60 days after the exit conference (timelines vary by agency). The report documents:

Examination scope and procedures performed
Findings, violations, and MRAs with regulatory citations
Ratings (if applicable)
Required corrective actions and expected timelines
Commendations (yes, examiners note areas of strength)

Your Response

You'll have an opportunity to provide a written response, typically within 30-45 days. For each finding, your response should include:

Whether you agree or disagree with the finding (with supporting evidence if disagreeing)
Root cause analysis
Corrective action plan with specific actions, owners, and deadlines
Status of any actions already completed

This response becomes part of the examination record. It's the starting point for the next examination's review of prior findings. Make it thorough.

Managing the Examination Experience

The institutions that handle examinations most effectively share a few characteristics: they respond to document requests within hours, not days. They provide evidence proactively instead of waiting to be asked. They brief staff beforehand. And they treat the examination as a professional engagement, not an adversarial proceeding.

Canarie helps compliance teams maintain that posture by keeping evidence organized and accessible year-round. When the DRL arrives, the response is an export - not a search. When examiners ask follow-up questions, evidence is pulled from the same system that captured it during normal operations.

See how compliance teams stay exam-ready without the scramble →

Frequently Asked Questions

How long does a bank examination typically last?

On-site duration depends on institution size, examination scope, and the number of examiners assigned. Community banks under $1 billion in assets typically have 1-2 week on-site visits for compliance exams. Larger institutions or multi-scope examinations may last 3-6 weeks. BSA/AML-focused examinations at institutions with complex products or high-risk customer bases can extend beyond these norms.

Can we refuse an examiner's document request?

Regulators have broad legal authority to examine institutions and access records under the Federal Deposit Insurance Act (12 U.S.C. § 1820), the Federal Reserve Act (12 U.S.C. § 483), and comparable state banking laws. Refusing a legitimate document request is not advisable and can escalate to formal enforcement. If you believe a request is outside the examination scope, discuss it with the EIC. If you have privilege concerns (e.g., attorney-client privilege), consult legal counsel before responding.

Do examiners look at the same things every time?

Core examination procedures are consistent, but examiners allocate more time to higher-risk areas and areas with prior findings. They also respond to current regulatory priorities - if your regulator has issued recent guidance on a topic, expect examination focus in that area. The FFIEC examination manuals define baseline procedures, but examiners exercise judgment in determining depth and scope.

What happens if we receive a poor examination rating?

A poor rating (3, 4, or 5 on the CAMELS or compliance scale) triggers increased supervisory attention. This may include more frequent examinations, formal or informal enforcement actions, restrictions on business activities, and requirements for board-approved corrective action plans. The path back to a satisfactory rating requires demonstrated, sustained improvement - not just a plan, but evidence of execution.

Should we hire a consultant to help prepare for examinations?

Consultants can be valuable for institutions facing their first examination in a new area, preparing for a targeted review, or recovering from a prior examination with significant findings. However, examiners evaluate your institution's capabilities, not your consultant's. If a consultant builds your program, your team needs to understand and operate it independently. Examiners will interview your staff, not your consultant.

What Happens During a Bank Examination (2026)