“Risk-Based Exams” is a phrase that has been increasingly discussed across the compliance landscape. As we move toward 2026, institutions should expect a noticeable adjustment in the Federal Reserve’s supervisory examination approach toward more risk-based supervision.
On October 29, 2025, the Federal Reserve Board issued a Statement of Supervisory Operating Principles outlining a significant shift in how examinations will be conducted. The statement directs examiners to focus primarily on material financial risks to safety and soundness, rather than procedural matters, documentation, or lower-risk process issues. It also emphasizes reliance on an institution’s internal audit and risk management functions when those functions are operating effectively.
What’s Changing?
- Supervisory assessments and ratings will be tailored to an institution’s size, complexity, and risk profile, with increased reliance on other primary federal or state regulators, where appropriate.
- Examiners are instructed to focus on material financial risks and avoid excessive attention to processes, procedures, and documentation that do not pose a meaningful risk to the institution’s safety and soundness.
- Examiners are encouraged to apply judgment and escalate issues that present material risk, including those not fully addressed by existing supervisory tools.
- The Federal Reserve confirmed that it is not changing exam frequency or scheduling. Institutions examined by the Federal Reserve will remain on their existing examination cycles.
Federal Reserve Board Memo:
Statement of Supervisory Operating Principles
What does this mean for you?
- Substance over form. Expect examiners to focus more on how effectively risks are identified, managed, and mitigated, rather than on the volume of policies, procedures, or documentation.
- Internal audit and risk management matter more. Strong, independent internal audit, compliance, and risk reporting functions may play a larger role in exam scoping and issue validation.
- Clear governance and oversight are critical. Board and senior management oversight should be demonstrated through effective challenge, decision-making, and follow-through, not just meeting minutes.
- Targeted documentation is still important. Documentation should clearly support key risk decisions and controls, but institutions may see less scrutiny of low-risk or purely procedural items.
CCI suggests sharing this update with your compliance, risk, internal audit, and senior management. As always, we are here to help with any compliance-related questions. Contact us via inquiries@completecompli.com.
Victoria Peterson, CCBCO