Currently, the Treasury Department and federal banking agencies are studying ways to rationalize the bank examination process, and one obvious target is significant duplication of effort from the banking agencies. In areas from cybersecurity to credit underwriting to anti-money laundering, multiple agencies conduct their own examinations, asking the same questions and requesting the same documents. The result is a Tower of Examination Babel, with banks distracted or disabled from the core business of lending as they devote time and resources to overlapping, and in some cases conflicting, examiner demands.
Solving this problem has proven challenging. The most direct route to reform, agency consolidation, would require legislation, with all of the inherent challenges that would entail, and is an exceedingly unlikely outcome. Instead, the focus has shifted to coordination, which could mean joint or rotating examinations; however, there is a dismal history of the federal banking agencies sharing examination authority. A classic example is cybersecurity, where the agencies, under pressure from then-Secretary Mnuchin, agreed to conduct consolidated examinations … but then continued conducting their own individual examinations in addition to the consolidated examinations. The result is that by survey and anecdotal reports, bank cybersecurity officers now spend the substantial majority of their time answering queries from various agency examiners.[1]
There is, however, a much simpler solution to this problem: the Federal Reserve as bank holding company examiner could rely on examinations conducted by other federal agencies, as already required by law. For companies with multiple regulated subsidiaries, the Federal Reserve would continue to examine enterprise-wide risks at the top-tier level, but not regularly replicate the work of the OCC, FDIC, SEC or CFTC at the subsidiary level. If all or almost all the assets of a company were in one subsidiary, the Fed could rely on the agency responsible for that subsidiary to conduct almost all examinations.
As we will see, Congress required the Federal Reserve to do just that in 1999. By statute, the scope of the Federal Reserve’s holding company examination authority is limited to obtaining a general understanding of the firm’s business and risks and examining more specifically only those risks that “may pose a threat” to the safety and soundness of the company or the stability of the financial system of the United States. Even for those risks, though, the Federal Reserve was explicitly required to rely “to the fullest extent possible” on examinations conducted by other federal and state authorities for any bank, securities or commodities subsidiary of that holding company. And in 2010 it was explicitly divested of authority to examine large banks for compliance with consumer financial protection laws at both the holding company and bank level.
In practice, Federal Reserve examiners violate all of these restrictions, routinely examining all manner of operations across holding company subsidiaries, with little to no regard to materiality or jurisdictional boundaries.
Following the law would bring multiple benefits. The Federal Reserve would examine material, enterprise-wide risks at the holding company level but otherwise leave oversight to the agencies responsible for the company’s subsidiaries. The result would be an immediate improvement in the efficiency of our banking system, with resulting benefits for the businesses and people banks serve. Another result would be an improvement in Federal Reserve examinations, which would be more focused on material financial risks.[2] Finally, obeying the law would seem to be in the Federal Reserve’s long-term institutional interest: while there is widespread and justified support for its monetary policy independence, that support tends to fade as the Fed expands its reach into other, more politicized areas.
Executive Summary
As described below, there are three major sets of limits on the Federal Reserve’s power to examine a bank holding company.
- First, examinations are limited to (1) giving its Board a general understanding of the operations and financial condition of the firm, (2) examining risks that pose a threat to the firm’s safety and soundness or the nation’s financial stability (but not examining risks that do not) and (3) identifying violations of certain laws. There is no authority to examine practices or operations outside those three enumerated purposes.
- Second, even in areas where the Federal Reserve is authorized to examine, Congress has explicitly required it instead to rely “to the fullest extent possible” on examinations conducted by the OCC, FDIC, SEC or CFTC with respect to any holding company subsidiary that they examine — and not conduct examinations of its own.
- With respect to violations of law, the Federal Reserve is limited to examining such subsidiaries only for violations of the small number of laws the Federal Reserve has specific jurisdiction to enforce (the Bank Holding Company Act, the Federal Reserve Act and the International Banking Act). For all other laws, only the subsidiary regulator is empowered to examine for legal compliance.
- Third, the Federal Reserve is explicitly divested of authority to conduct examinations for consumer compliance at any of the 147 bank subsidiaries that have more than $10 billion in total assets (which collectively hold 92 percent of total assets across all banks).
Reading the law, one would assume that since 1999 the Federal Reserve’s oversight of a bank holding company has consisted primarily of reviewing the examinations conducted by the other banking agencies, SEC and CFTC. For the largest bank holding companies with more complex operations and multiple bank and capital markets subsidiaries, it would also likely include conducting targeted holding company examinations of material enterprise-wide risks, such as capital and liquidity adequacy. For the many bank holding companies that hold almost all their assets in a bank subsidiary, the Federal Reserve presumably would be even more constrained, looking at equity and debt levels and issuance at the parent holding company (where those instruments are issued), but leaving examination of commercial and retail lending entirely to the OCC or FDIC.[3]
The Federal Reserve’s current practice is decidedly otherwise.
- The vast majority of holding company examination resources are now devoted to issues that pose no threat to safety and soundness — issues such as management of vendors performing inessential services; all aspects of the combined firm’s operations, policies and procedures regardless of materiality; information management systems; internal reporting systems; oversight of all models used across the firm regardless of function or importance; employee compensation and promotions; and board and management committee staffing and reporting.[4]
- Federal Reserve examiners generally recognize no difference between the holding company and bank level. They routinely conduct examinations with respect to all aspects of an organization’s operations, duplicating work being performed by the OCC at those companies’ national bank subsidiaries. They examine for compliance for a wide range of laws and regulations that Congress has instructed them to leave to other regulators, including economic sanctions laws, anti-money laundering laws, and securities laws. And even with respect to mid-sized and regional banks that might hold more than 95 percent of their assets in an OCC- or FDIC-regulated bank subsidiary, the Federal Reserve does not refrain from examination but rather generally duplicates the examinations of retail and commercial businesses conducted by the OCC and FDIC.[5]
- Federal Reserve examiners routinely examine consumer compliance at bank holding companies and state member banks.
Reform here would free up thousands of people and significant financial resources currently devoted to meeting with and providing reports to Federal Reserve examiners that they have already provided to other agencies. The costs and burdens associated with Federal Reserve oversight have been so substantial that institutions have restructured themselves to avoid it: between 2017 and 2018 three midsize banking organizations merged their holding company into their bank, concluding such a move would allow them to serve their customers more efficiently. Most companies have multiple subsidiaries that preclude that option.
Set forth below is a more detailed look at the law. In an appendix, we redline existing law against current Federal Reserve practice to highlight the divergence.
Legal Authority For, and Limits On, the Federal Reserve’s Examination Authority
General Scope & Substantive Limits
Section 5(c) of the Bank Holding Company Act of 1956 grants the Federal Reserve examination power over a bank holding company and its subsidiaries; however, Section 5(c) also imposes important statutory constraints on that power.
Examinations for informational purposes. Section 5(c) authorizes the Federal Reserve to conduct examinations of bank holding companies and their subsidiaries to inform it as to:
- “the nature of the operations and financial condition” of a bank holding company and its subsidiaries; and
- “the financial, operational, and other risks within the bank holding company system that may pose a threat to … the safety and soundness of the bank holding company or any depository institution subsidiary… or the stability of the financial system of the United States”;[6] and
- “the systems of the bank holding company for monitoring and controlling the risks described [above].”[7]
In other words, Section 5(c) limits the power of the Federal Reserve to, first, obtaining a general understanding of the business and financial condition of each holding company and its subsidiaries[8] and, second, examining risks that could threaten (i) the safety and soundness of the holding company or bank subsidiaries or (ii) the financial stability of the country.
Examination for legal compliance. The Federal Reserve’s authority to examine for violations of law is also significantly limited in scope. Section 5(c) authorizes the Federal Reserve to examine for compliance with respect to only three areas of law:
- the Bank Holding Company Act itself;
- for the holding company and all its subsidiaries, any other law that “the Board has specific jurisdiction to enforce”; and
- for subsidiaries that are not an insured depository institution or a functionally regulated subsidiary (e.g., a broker-dealer or swap dealer), “any other applicable provision of Federal law.”[9]
With respect to the second grant of authority, the portion of federal law over which the Federal Reserve has specific enforcement jurisdiction is very limited and includes (i) the Federal Reserve Act and similar statutes as they apply to bank holding company subsidiaries that are state member banks and (ii) the International Banking Act as it applies to foreign banking organizations and their U.S. operations.
The limited nature of the third grant of authority is especially notable, as it means that the Federal Reserve has no authority to examine a range of subsidiaries for compliance with the vast majority of federal laws.[10] Those subsidiaries, overseen by the OCC, FDIC, SEC and CFTC, frequently comprise a large portion of a holding company’s overall operations.
Required Reliance on Functional Regulators
In addition to these general constraints, Section 5(c) imposes special limitations on the Federal Reserve’s power to examine (i) a depository institution that is regulated by another federal banking agency (e.g., a national bank overseen by the OCC) or (ii) an entity subject to the jurisdiction of another regulator (e.g., a subsidiary overseen by the SEC or CFTC).
Section 5(c)(2)(B) states that the Federal Reserve shall, “to the fullest extent possible”:
- make use of reports and other supervisory information that a bank holding company or a subsidiary thereof has already provided to another regulator;
- use those reports to reduce the need for the Federal Reserve to conduct its own examinations of those subsidiaries; and
- with respect to depository institution subsidiaries and other functionally regulated subsidiaries that are overseen by another federal or state regulatory agency, avoid duplication of examination activities, reporting requirements and requests for information.
Thus, even for risks threatening a bank holding company’s safety and soundness, the Federal Reserve is still directed to rely to the fullest extent possible on work done by the other agencies. Certainly, if there is an enterprise-wide risk that no subsidiary-level examination captures, the Federal Reserve would be empowered to examine it. For companies with multiple subsidiaries, this would include capital and liquidity adequacy and interest rate risk. But if the OCC has just conducted an examination of credit underwriting or cyber risk, there is no legal justification for the Federal Reserve duplicating that work.
As noted above, today’s Federal Reserve examination practices are at odds with this mandate. For example, the trading and capital-markets activities of bank holding companies are conducted almost exclusively in a broker-dealer or bank subsidiary, and subject principally to federal laws the Federal Reserve has no specific jurisdiction to enforce. Furthermore, for broker-dealers, the Federal Reserve’s examination authority is limited to safety and soundness risks to the bank holding company and its insured depository institution subsidiaries — not any broker-dealer or commodities subsidiary itself, whose oversight Congress meant to be the sole province of the SEC and CFTC.[11] Yet the Federal Reserve maintains an examination manual detailing “key examination and review considerations for trading and capital-markets activities” that is 672 pages long.[12]
Similarly, while the Federal Reserve has no specific authority or jurisdiction to enforce compliance with economic sanctions administered by the Treasury Department’s Office of Foreign Assets Control, and the financial activities subject to those sanctions are frequently conducted in bank or functionally regulated subsidiaries overseen by other primary regulators, the Federal Reserve routinely examines subsidiaries of holding companies for sanctions-related compliance and brings enforcement actions for problems that occur at those subsidiaries. The Federal Reserve also regularly duplicates Bank Secrecy Act examinations conducted by the OCC and FDIC at national bank and state nonmember bank subsidiaries, respectively.
The Federal Reserve has memorialized its non-compliance with law in its examination manuals. While Section 5(c)(2)(B) in no way distinguishes based on the asset size of the company, a Federal Reserve program manual states that for large insured depository institution subsidiaries, it “coordinates with the supervisory teams from functional regulators”;[13] however, for smaller subsidiaries, it examines only in “rare and limited circumstances.”[14] There is no legal basis whatsoever for this distinction.
Summary
In short, the Federal Reserve’s examination practices today do not abide by these legal restrictions, particularly as they apply to bank subsidiaries or functionally regulated subsidiaries overseen by another primary regulator. This is no small breach: at the largest U.S. bank holding companies, approximately 86 percent of total U.S. bank holding company assets are held in functionally regulated subsidiaries: 66 percent in national or state nonmember bank subsidiaries, and another 20 percent in broker-dealer subsidiaries.[15]
Certainly, there are some important risks — for example, the management of interest rate risk or liquidity risk — that are uniquely managed at an enterprise-wide level and thus both fall within the Federal Reserve’s examination authority at the holding company level and warrant Federal Reserve attention. Indeed, a Federal Reserve emphasis on these risks, instead of duplicating work conducted by other agencies, would likely result in a more safe and sound banking system.
Even then, however, many regional and mid-sized banks hold well north of 95 percent of their total assets in national bank or state nonmember bank subsidiaries. The OCC’s or FDIC’s examination of those firms thus effectively comprises the vast majority of the consolidated firm’s activities and risks, and the overlap with Federal Reserve examination is thus near total. By law, it is hard to see why the Federal Reserve could justify the great majority of its examination activity for those banks.
Additional Constraints on Consumer Compliance Examinations
In 2010, Congress made explicit changes to the Federal Reserve’s power to examine large state member banks and bank holding companies for compliance with the consumer financial protection laws — to wit, divesting it of such authority. In this case, the removal of authority applied not only to the Federal Reserve’s authority over large bank holding companies and state member banks, but also to the OCC and FDIC’s authorities over large national banks and state nonmember banks, respectively.
- As a part of subtitle B of the Consumer Financial Protection Act of 2010, Section 1025(b) of the Dodd-Frank Act provides that, for banks with assets greater than $10 billion, the CFPB shall have “exclusive authority to receive reports and conduct examinations on a periodic basis … for purposes of … (A) assessing compliance with the requirements of Federal consumer financial laws; [and] (B) obtaining information about the activities subject to such laws and the associated compliance systems or procedures of such persons….”
- Section 1061(b)(1)(A) of the Dodd-Frank Act provides that “[a]ll consumer financial protection functions of the Board of Governors are transferred to the Bureau.” Section 1061(a)(1) defines “consumer financial protection functions” to include the authority to conduct examinations for compliance with those laws with respect to banks with assets greater than $10 billion.
- Section 1061(b)(1)(B) of the Dodd-Frank Act provides that the CFPB “shall have all powers and duties that were vested in the [Federal Reserve], relating to consumer financial protection functions, on the day before the designated transfer date.”
- Recognizing the significance of these changes in authority, Section 1061 also provided for the transfer of the Federal Reserve’s consumer compliance staff to the CFPB.
As a conforming (and emphatic) change to reflect the above transfer of examination authority, section 604 of the Dodd-Frank Act amended Section 5(c) of the Bank Holding Company Act to make the entirety of its examination authority over bank holding companies “[s]ubject to subtitle B of the Consumer Financial Protection Act of 2010,” as set forth above. In other words, Congress not only explicitly divested the Federal Reserve of authority to examine large state member banks for consumer compliance but also made clear that it was not to use its holding company examination authority to evade that requirement.
Notwithstanding all of the above, by innumerable accounts,[16] the Federal Reserve has if anything increased its examination focus on consumer financial protection since being divested of authority to conduct any such examinations.
By some accounts, Federal Reserve examiners have attempted to avoid the statutory prohibition by contending that they are not examining for consumer law compliance but rather are examining the risk management systems designed to monitor consumer law compliance. This argument is not serious.[17] Even if that were a sensible distinction, the statute specifically includes examination of “compliance systems” among the powers divested from the Federal Reserve. There is no getting around that.
Conclusion
Sometimes, fortunately, complex problems have simple solutions. The most effective way to reform the examination process is for the Federal Reserve to follow laws enacted in 1999 and 2010. Doing so would be in the best interests of banks, the businesses and individuals they serve — and the Federal Reserve itself.
[1] Testimony of Heather Hogsett, Senior Vice President, Technology & Risk Strategy, BITS, Bank Policy Institute, Before the Subcomm. on Cybersecurity & Infrastructure Protection of the H. Comm. on Homeland Sec., 119th Cong. (Mar. 11, 2025), (“According to a survey of our member firms, bank Chief Information Security Officers now spend 30-50 percent of their time on compliance and examiner management. The cyber teams they oversee spend as much as 70 percent of their time on those same functions. In the leadup to exams, financial institutions routinely receive over 100 requests for information, followed by 75 to 100 supplemental requests during an exam. Of those requests, firms report that roughly 25 percent duplicate requests from other agencies.”)
[2] The failure of Silicon Valley Bank was a case study in how examination overreach resulted in material risks being overlooked. See Jeremy Newell and Pat Parkinson, A Failure of Self-Examination: A Thorough Review of SVB’s Exam Reports Yields Conclusions Very Different from Those in the Fed’s Self-Assessment, Bank Policy Institute (April 2023), https://bpi.com/a-failure-of-self-examination-a-thorough-review-of-svbs-exam-reports-yields-conclusions-very-different-from-those-in-the-feds-self-assessment/.
[3] In cases in which the bank subsidiary was a state member bank, which the Federal Reserve directly oversees pursuant to different legal authorities, the Federal Reserve would of course conduct typical examinations at the bank level.
[4] See, Bank Policy Institute, Bank Supervision is Broken. Here’s How to Fix It., Bank Policy Institute (Apr. 2023), https://bpi.com/bank-supervision-is-broken-heres-how-to-fix-it/; Greg Baer, Testimony Before the Senate Banking Committee: Guidance, Supervisory Expectations, and the Rule of Law: How do the Banking Agencies Regulate and Supervise Institutions? (Apr. 30, 2019), Bank Policy Institute, https://bpi.com/wp-content/uploads/2019/05/Greg-Baer-Written-Testimony-Before-Senate-Banking-Committee-on-Guidance-and-Supervision-April-30-2019.pdf.
[5] The issue is not really raised with respect to state member bank subsidiaries for which the Federal Reserve itself is the appropriate federal examination agency.
[6] The authority to conduct examinations to inform the Federal Reserve as to financial stability risks was added to Section 5(c) in 2010 pursuant to § 604 of the Dodd-Frank Act, which also made other changes to Section 5(c) to remove certain limits that has previously applied. Title I of the Dodd-Frank Act also granted the Federal Reserve new authority to establish enhanced prudential standards and resolution plan requirements for certain large bank holding companies and conduct supervisory stress tests, but it did not otherwise grant the Federal Reserve any new examination authority over those (or any other) bank holding companies or loosen any of the existing restrictions on its examination authority.
[7] 12 U.S.C. 1844. Section 5(c) also grants the Federal Reserve authority to require the submission of reports by bank holding companies for substantially similar purposes, subject to the same type of limits and constraints that apply to its authority to conduct examinations, which we describe in more detail below. See 12 U.S.C. § 1844(c)(1)(A).
[8] The statutory reference to the examination for the purpose of informing the Federal Reserve as to the “nature” of the bank holding companies’ operations and financial conditions is itself an important limitation, underscoring the general and informational nature of the examination activity that is authorized. The Merriam-Webster Dictionary defines “nature,” in relevant part, as “the inherent character or basic constitution of a person or thing.” See https://www.merriam-webster.com/dictionary/nature.
[9] 12 U.S.C. § 1844(c)(2)(A)(ii).
[10] With respect to national bank subsidiaries, we note that limiting the Federal Reserve’s examination authority only to laws the Federal Reserve has specific jurisdiction to enforce is consistent with and complementary to 12 U.S.C. § 484, which provides that “[n]o national bank shall be subject to any visitorial powers except as authorized by Federal law.”
[11] 12 U.S.C. 1844(c(2)(A)(i).
[12] See Board of Governors of the Federal Reserve System, Trading and Capital-Markets Activities Manual (last updated July 2011), https://www.federalreserve.gov/boarddocs/supmanual/trading/trading.pdf.
[13] Board of Governors of the Federal Reserve System, Coordination and Continuing Education, Federal Reserve (Feb. 2023), https://www.federalreserve.gov/publications/february-2023-liscc-coordination-continuing-education.htm.
[14] Board of Governors of the Federal Reserve System, Relying on the Work of the Regulators of the Subsidiary Insured Depository Institution(s) of Bank Holding Companies and Savings and Loan Holding Companies with Total Consolidated Assets of Less than $100 Billion, SR 16-4 (Mar. 3, 2016; rev. Feb. 17, 2021), https://www.federalreserve.gov/supervisionreg/srletters/sr1604.htm.
[15] The figures are for U.S. bank holding companies designated as Category I, II, III or IV organizations under the Federal Reserve’s enhanced prudential standards framework. If only looking at Category III and IV organizations, the percentage of total U.S. bank holding company assets that are held in bank subsidiaries that are overseen by another federal regulator is even higher.
[16] See, e.g., https://www.federalreserve.gov/newsevents/speech/barr20230718a.htm (“Congress acted in 1968 to make discrimination in housing illegal with the Fair Housing Act, and it passed the Equal Credit Opportunity Act (ECOA) in 1974 to bar lending discrimination. These landmark laws—now 55 and 40 years old—are the foundation of the Federal Reserve’s work in this area, we use our supervisory and enforcement authority to ensure these laws are followed.”) (There is no distinction with respect to banks above or below $10 billion in assets.)
[17] One imagines an overcharging doctor prohibited by Medicare from performing routine physical examinations on patients. Continuing that practice, he contends that he isn’t conducting a physical examination — just testing the patient’s breathing, blood pressure, heart rate, cholesterol, etc.
