Regulatory Examination

A regulatory examination is a structured review in which a supervisory authority tests whether a regulated firm is operating safely and in line with the law. Examiners study the firm's records, policies and systems, interview staff and sample transactions, then report findings that the firm must correct. Examinations apply to banks, credit unions, money transmitters, payment and e-money firms, broker-dealers, insurers and, increasingly, crypto businesses.

The term is most closely associated with the United States, where periodic examinations are a central supervisory tool and the specific case of a bank examination has a long history. Other countries use different words, such as inspection, on-site review or supervisory visit, but the activity is similar. An examination differs from an internal or external audit because it is carried out by, or on behalf of, the regulator and can lead directly to supervisory or enforcement action.

In the United States, banks are examined by their prudential regulators, such as the Office of the Comptroller of the Currency, the Federal Reserve, the FDIC and state banking departments. Larger institutions also face consumer compliance examinations. Licensed money transmitters are examined by state regulators, which often coordinate multistate examinations through the Conference of State Bank Supervisors to avoid repeated reviews of the same firm. Money services businesses are also examined for Bank Secrecy Act compliance by the Internal Revenue Service under authority delegated by FinCEN, a review commonly called a Title 31 examination.

Elsewhere, supervisors such as the UK's Financial Conduct Authority, the European Central Bank and national central banks run on-site inspections, thematic reviews and desk-based assessments. Some can require a firm to appoint an independent expert to review a specific area and report back.

Examinations can be full-scope or targeted. A full-scope review of a payment firm typically covers:

• Financial condition. Capital, net worth, liquidity and, for money transmitters, permissible investments held against outstanding obligations.
• Anti-money laundering. The AML compliance programme, customer due diligence, transaction monitoring, sanctions screening and the filing of reports such as suspicious activity reports.
• Consumer compliance. Disclosures, complaint handling, error resolution and fair treatment of customers.
• Operations and technology. Information security, business continuity, vendor management and record keeping.
• Governance. Board oversight, management competence and the independence of compliance and audit functions.

An examination usually follows a predictable pattern. The regulator sends a notice and a request list asking for policies, reports, transaction data and board minutes. Examiners review this material remotely, then carry out fieldwork, on site or virtually, testing samples of transactions and customer files and meeting management. At the end they hold an exit meeting to discuss preliminary findings, followed by a written report of examination.

Findings are graded by severity. US bank regulators, for example, issue matters requiring attention for weaknesses that must be fixed and more serious findings for significant problems, and assign composite ratings such as the CAMELS rating for banks. State regulators rate money transmitters on similar components. The firm must respond with a corrective action plan and timelines, and the next examination checks whether issues have been resolved.

Examination frequency depends on the firm's size, risk and previous results. Large banks are under continuous supervision with teams dedicated to them, while smaller institutions are examined on cycles that commonly range from one to several years. Firms with poor ratings or recent problems are examined more often. Regulators also run targeted examinations after incidents, complaints or media reports, and thematic reviews that look at one issue across many firms.

Most examinations end with findings that the firm fixes through normal remediation. Serious or repeated failures can escalate into enforcement action, including consent orders, civil money penalties, restrictions on growth or new products, or, at the extreme, loss of a licence. For fintech firms that rely on partners, a sponsor bank's own examination findings can force changes on the whole programme.

Firms prepare by keeping policies current, maintaining an obligations register, testing controls through compliance testing and internal audit, tracking open findings, and being able to produce data quickly. Supervisors generally regard self-identified and promptly corrected problems more favourably than those examiners discover.