How to Prepare for a 2026 FDIC Bank Examination: A Step-by-Step Compliance Checklist for Community Banks
Community banks typically receive FDIC safety-and-soundness examinations every 12–18 months, and most findings trace back to documentation gaps and weak internal controls. With 2026 exams likely to emphasize governance, third-party risk, liquidity, and IT/cyber resilience, preparation must start well before the first-day request list arrives. This guide provides a step-by-step compliance checklist, practical documentation tips, and exam-ready timelines for community banks.
FDIC examinations are rarely “surprises”—but adverse findings often are. The difference is preparation: a bank that can quickly produce accurate, board-approved policies, consistent monitoring evidence, and clear remediation records usually shortens exam cycles and limits Matters Requiring Board Attention (MRBAs) and other corrective actions. For 2026, community banks should assume heightened scrutiny on governance, third-party risk, liquidity and contingency funding, information security, and model/analytics integrity, alongside core safety-and-soundness pillars like credit administration and BSA/AML.
Below is a step-by-step compliance checklist designed for community banks preparing for an FDIC exam. It is written for practical use by compliance officers, CEOs/CFOs, risk managers, IT leaders, and directors—along with counsel who support them.
1) Set the exam project plan (and assign accountable owners)
Start with a disciplined internal “exam readiness” project. The FDIC’s process may include pre-exam information requests, on-site/remote review, interviews, and post-exam follow-up. You want a single timeline and a single source of truth.
Checklist: exam readiness governance
Do now (90–180+ days before exam notice):
- Appoint an Exam Coordinator (usually Compliance, Risk, or COO) with authority to collect documents across departments.
- Create a RACI matrix (Responsible/Accountable/Consulted/Informed) for each exam area: credit, BSA/AML, IT, finance/ALCO, operations, vendor management, CRA (if applicable), trust, etc.
- Build an “exam room” repository (secure shared drive) with role-based access and version control; maintain an index matching typical FDIC request lists.
- Run a kickoff meeting with senior management and key department heads to confirm priorities and deadlines.
- Schedule a board touchpoint so directors understand the preparation plan, expected themes, and how issues will be escalated.
Practice tip: Track every document delivered to examiners (what, when, version, by whom). Post-exam disputes often arise from confusion over which policy version or report set the exam team reviewed.
2) Inventory prior findings and prove remediation
Examiners frequently begin with what happened last time. If the bank received MRBAs, supervisory recommendations, or any informal action items, your best leverage is a clean remediation file that proves closure—not just intention.
Checklist: remediation evidence package
- Create a findings register listing: issue, root cause, corrective action, owner, due date, status, and validation method.
- For each closed item, compile closure evidence: revised policies, training attendance logs, system configuration screenshots, QA/testing results, audit validation, and board/committee minutes showing review and approval.
- For open items, document interim controls and provide a credible timeline with milestones.
Example: If a prior exam criticized weak overdraft program oversight, a strong remediation file would include updated overdraft policy limits, weekly exception reporting, second-line review notes, complaint trend logs, and board/management approvals.
3) Board and committee governance: make oversight visible
Community banks can do the right things operationally but still receive criticism if board oversight is not evident in the record. Examiners look for engaged directors, clear risk appetite, and consistent reporting.
Checklist: governance documentation
- Confirm board-approved risk appetite (or equivalent) and ensure it is referenced in key programs (credit, liquidity, IT, vendors).
- Ensure committee charters are current (Audit, BSA/AML, Risk, ALCO, IT/InfoSec, Loan Committee).
- Review board packets for consistency: KRIs, trend charts, limit breaches, and management responses.
- Verify minutes quality: record discussions, questions, dissent, approvals, and follow-ups—not just attendance.
Practice tip: “If it isn’t in the minutes, it didn’t happen” is not literally true, but it is often how examiner narratives are built. Work with counsel to strike the right balance: clear oversight without unnecessary legal exposure.
4) Safety-and-soundness core: credit administration and asset quality
Credit remains a primary driver of CAMELS outcomes for community banks. Examiners evaluate underwriting discipline, portfolio risk rating accuracy, appraisal controls, concentration management, and the allowance methodology (including any CECL framework).
Checklist: credit administration readiness
- Loan policy: current, board-approved, with clear exceptions, concentration limits, and approval authorities.
- Underwriting files: consistent global cash flow analysis (as applicable), guarantor support, collateral documentation, and covenant tracking.
- Credit risk ratings: documented rationale, timely updates, and alignment with internal policy.
- Exceptions tracking: log, compensating factors, approval evidence, and aggregate reporting to management/board.
- Appraisals/evaluations: independence controls, review procedures, and validation of collateral values.
- Stress testing (if used): concentration stress, CRE sensitivity, and borrower-level monitoring for higher risk segments.
Example: A bank with a growing CRE portfolio should be ready to show concentration monitoring (by property type, geography, sponsor), policy limits, and documented actions when approaching thresholds—such as tightened underwriting or increased monitoring frequency.
5) Liquidity and interest rate risk: ALCO must tell a coherent story
Liquidity and interest rate risk management has been a sustained supervisory focus. Examiners will look for realistic assumptions, contingency funding plans (CFP), diversified funding sources, and board reporting that reflects stress conditions—not just base-case comfort.
Checklist: ALCO and liquidity package
- Liquidity policy with limits, early warning indicators, and escalation triggers.
- Contingency Funding Plan: actionable playbooks, tested lines, collateral schedules, communication plan, and defined decision authority.
- Stress testing: idiosyncratic and market-wide scenarios; deposit runoff assumptions supported by data.
- Uninsured deposits and concentration reporting: segmentation by type, industry, relationship depth, and behavior.
- Borrowing capacity: FHLB/FRB (if applicable), pledge documentation, collateral valuation, and periodic tests.
- IRR modeling governance: model validation, change management, and back-testing where feasible.
Practice tip: Align Treasury/Finance narratives across documents. Inconsistencies between the CFP, ALCO minutes, liquidity dashboard, and Call Report schedules invite follow-up questions and potential MRBAs.
6) BSA/AML and OFAC: demonstrate risk-based, well-tested controls
Even when no formal enforcement action is on the table, BSA/AML weaknesses can drive serious supervisory criticism. Examiners want to see a defensible risk assessment, competent staffing, quality control, and timely SAR/CTR processes, supported by independent testing.
Checklist: BSA/AML exam prep
- BSA/AML risk assessment: updated for products, services, customers, geographies, delivery channels, and recent changes (e.g., faster payments, fintech partnerships).
- Customer Due Diligence: CIP, beneficial ownership (as applicable), risk scoring, and enhanced due diligence procedures.
- Transaction monitoring: alert disposition standards, tuning documentation, and QA sampling evidence.
- SAR/CTR governance: timeliness tracking, decision rationales, and documentation of “no SAR” conclusions when issues are investigated.
- OFAC screening: list management, interdiction procedures, and escalation records.
- Independent testing: scope aligned to risk; findings tracked to closure with validation.
- Training: role-based, current, with completion and testing records.
Example: If the bank onboarded a new MSB customer segment, examiners will expect to see updated risk assessment inputs, EDD checklists, monitoring rules adjustments, and board/committee awareness of the increased risk profile.
7) Third-party risk management: contracts, SOC reports, and ongoing monitoring
Vendor and fintech relationships are a frequent source of compliance breakdowns. FDIC examiners often focus on how the bank selects vendors, negotiates controls, monitors performance, and manages exit risk.
Checklist: third-party oversight
- Third-party risk policy addressing due diligence, contracting, monitoring, and termination.
- Vendor inventory with risk tiers (critical/high/medium/low) and assigned business owners.
- Due diligence files: financial condition, information security, business continuity, compliance posture, subcontractor oversight.
- Contract review checklist: audit rights, SLAs, data ownership, breach notice, BCP/DR, regulatory access, and termination assistance.
- <strong
