Banking Supervision Readiness

Banking supervision readiness

The supervision-readiness pack is the artifact a bank's chief risk officer, chief compliance officer, head of supervisory affairs, BSA officer, and examination coordinator carry into an OCC, FRB, or FDIC examination cycle. It is not the engagement playbook (who-routes-what, document-handling, privilege posture); that lives in exam-brief. It is the substantive readiness sprint: what the bank is going to be rated on, what evidence it has against each rating-driver, where the open supervisory items sit on the closure curve, and what the bank needs to do in the weeks before entry to close the obvious gaps.

The spine is CAMELS for a depository-institution cycle and the BHC rated-component framework for a holding-company cycle. The examiner-letter response posture and the MRA / MRIA closure cross-walk run alongside. For covered banks ($50B+ avg total consolidated assets), the Heightened Standards readiness view sits at the tail. For a topical exam (BSA / AML, IT, fair lending, third-party risk), a topical readiness slice bolts on. The pack itself is firm-confidential by convention; CSI references constrain what the pack can carry forward across access populations.

The named lead attests. The pack is a draft until that step. The skill stops short of speaking for the bank to the regulator.

Ask first

Settle these before drafting. Most cycles answer them in the first conversation; default and flag where they do not.

• What is the institution and who is the primary federal regulator. National bank (OCC), state-member bank (FRB and state), state non-member bank (FDIC and state), federal savings association (OCC), state savings association (FDIC and state), bank holding company or savings-and-loan holding company (FRB), or intermediate holding company (FRB). The regulator drives the supervisory framework, the rated components, the supervisory-letter mechanics, and the response-window calculation.
• What is the asset size band and is the bank a covered bank under 12 CFR Part 30 Appendix D. Asset bands matter because the rated framework, the FRB's tailoring-rule applicability (CCAR / DFAST scope, LCR / NSFR scope), and the OCC's Heightened Standards trigger ($50B+ avg total consolidated assets) all key off size. A bank approaching the threshold (typically $40B+) gets a forward-looking Heightened Standards readiness section.
• What is the cycle type, the dated cycle window, and the rated framework in scope. Full-scope safety-and-soundness, targeted, point-in-time, BHC supervisory, BSA / AML, IT, consumer compliance, CRA, or fair lending. Rated framework is CAMELS for a depository-institution cycle and the BHC rated framework for a holding-company cycle. A holding-company organisation typically gets both in different forms; the pack must be built for the cycle in scope, not collapsed into one.
• What does the bank inherit at the start of the cycle. Open MRAs and MRIAs by regulator and date issued, open consent-order articles with milestone status, open written-agreement provisions, in-flight supervisory-letter responses, self-identified issues the bank intends to surface proactively, recent enforcement themes from the responsible regulator, and the prior-cycle composite and component ratings (held in CSI; the access population for the pack constrains what can be carried forward).
• What is the source posture and the access population for the pack. Public-only, public-plus-firm-policy, public-plus-firm-policy-plus-evidence, or connector-aware. CSI references (prior supervisory letters, prior examination reports, prior MRAs / MRIAs) cannot leave the bank without the regulator's written authorisation under 12 CFR Part 4 Subpart C (OCC), Part 261 (FRB), or Part 309 (FDIC); the access population for the pack itself constrains what it can include and at what label.

When an scope record is supplied, consume it for institution profile, persona, source posture, sector overlay (always banking for this skill), and cross-cutting overlay set. When it is not supplied, ask the questions and default; flag the defaults in the pack.

How the pack gets built

The pack has a three-part body around a cover, plus a tail that varies with the cycle. Walk it in the order the conversation surfaces evidence; the structured record sorts itself.

Cover and cycle scope. Institution profile (legal name placeholder, type, primary federal regulator, asset size band, charter, registrations, geographic footprint, Heightened Standards applicability). Cycle profile (cycle type, dated fieldwork window, dated review period, rated framework, examiner-in-charge role, supervisory office). Source posture and access population. Confidence label. The cover is the orientation any examiner or board member reads first; the rest of the pack is the answer to the questions the cover raises.

Part A — CAMELS preparation by component (or BHC rated components)

One subsection per component, same internal shape: a component summary, the public criteria the component is rated against, the evidence inventory (system-of-record paths and named-role owners, not screenshots), open issues with trend, and reviewer questions. The component shape forces the pack to read the way examiners read; a pack organised as a flat risk register reads as not-ready.

• C — Capital adequacy. Ratios and trends (CET1, Tier 1, total RBC, leverage, supplementary leverage where applicable; well-capitalised threshold under 12 CFR Part 6 / Part 208 / Part 324 [verify part by charter]); capital-action history; capital-planning posture and ICAAP equivalent; for applicable BHCs, DFAST / CCAR results integration [verify current CCAR scope under tailoring framework]. Public criteria pin to OCC Comptroller's Handbook Capital and Dividends and FDIC Manual section 5.1; for covered banks, the Heightened Standards risk-governance evidence on capital-adequacy oversight at the board level. Evidence inventory pulls Call Report extracts, the capital-plan owner sign-off, board capital-action minutes, and stress-test results where applicable.
• A — Asset quality. Concentration profile (CRE, C&I, consumer, agricultural, sector concentrations), classified-asset trend, ALLL / CECL methodology and back-testing, charge-off and non-accrual trends, OREO. Public criteria pin to OCC Comptroller's Handbook Asset Quality booklets (Allowances for Credit Losses, Concentrations of Credit, Commercial Lending, Rating Credit Risk), the Interagency CRE Concentration Guidance (December 2006 and 2015 statement) including the 100% / 300% screen, and the Interagency Guidance on Credit Risk Review Systems (May 2020). For BHCs and large banks, the consolidated supervisory frame from FRB SR 12-17. Evidence inventory pulls loan-review reports, classified-asset listings, the CECL methodology document and back-testing, concentration reports, and the workout pipeline status.
• M — Management. Board oversight maturity, three-lines-of-defense maturity, audit and compliance independence, MRA / MRIA closure trend, governance policies, risk-appetite calibration. Public criteria pin to FDIC Manual section 4.1, the FRB consolidated supervision frame for large institutions, and the OCC heightened-standards risk-governance-framework expectations for covered banks (citations live in references/source-anchors.md; the published Appendix D uses lettered Roman-numeral headings without the III.B-style sub-numbering colloquially used). Evidence inventory pulls board minutes (redacted to non-confidential), risk-committee charter and minutes, audit-plan coverage and independence evidence, compliance-program-effectiveness reporting, and the MRA / MRIA closure log.
• E — Earnings. Net interest margin, fee-income mix, expense trend, earnings stability, dividend coverage, earnings-at-risk reporting. Public criteria pin to OCC Comptroller's Handbook Earnings and FDIC Manual section [verify section]. Evidence inventory pulls Call Report income-statement extracts, budget-vs-actual, ALCO earnings-at-risk pack, and dividend-coverage analysis.
• L — Liquidity. Funding mix, contingency funding plan and most recent test record, LCR / NSFR positions for applicable banks under 12 CFR Part 50 (OCC) / Part 249 (FRB) / Part 329 (FDIC) [verify part by charter and applicability], deposit concentration and runoff assumptions, brokered-deposit reliance under 12 CFR Part 337 [verify section], sponsor-program FBO-deposit treatment if applicable. Public criteria pin to OCC Comptroller's Handbook Liquidity, FDIC Manual section 6.1, and the interagency liquidity-risk-management guidance. Evidence inventory pulls liquidity reports, the CFP test record, deposit-concentration reports, the brokered-deposit listing, and the sponsor-program FBO-account ledger reconciliation if applicable.
• S — Sensitivity to market risk. Interest-rate-risk profile, EVE and NII sensitivities under standard rate-shock scenarios, model governance for traditional IRR models (EVE and NII engines) tied to the Joint Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13 / FRB SR 26-2 / FDIC FIL-15-2026, April 17, 2026) — the bulletin scope covers traditional statistical / quantitative models and excludes GenAI and agentic AI from scope (footnote 3) — ALCO oversight cadence. Public criteria pin to OCC Comptroller's Handbook Interest Rate Risk and the interagency IRR guidance [verify]. Evidence inventory pulls ALCO packs, IRR model validation reports, back-testing, and the ALCO-policy IRR-limit cross-walk.

For BHC supervisory cycles, replace CAMELS with the BHC rated-component framework (RFI/C(D) or successor as applicable [verify current FRB rating system]). Component subsections take the same shape; the public criteria shift to FRB Bank Holding Company Supervision Manual sections, FRB SR 12-17, and the consolidated supervisory framework.

Part B — Examiner-letter response readiness

For each open or expected examiner-letter item (MRA, MRIA, supervisory recommendation, consent-order article, written-agreement provision, pre-finding question), the pack carries: item ID, source (regulator, letter date, finding number), category, finding text (verbatim where the access population allows; summarised where it does not), CAMELS / topical link, action-plan summary with named-role owner and dated milestones, evidence pointer (system-of-record path), closure status (open, in-remediation, sustained-remediation, ready-for-validation, closed-pending-examiner-confirmation), aging vs target, and an escalation-risk flag.

The category matters. MRAs are matters requiring attention; MRIAs are matters requiring immediate attention. Aging tolerance, escalation risk, and board-reporting expectations differ between them, and a pack that conflates them reads as not-ready. If the regulator labels the item differently than the bank's tracker, defer to the regulator's label. The category and the source-letter date are the inputs to the aging calculation; the aging calculation is the input to the escalation-risk flag.

Part C — MRA / MRIA closure cross-walk

A matrix view, one row per finding, with columns: finding ID, finding text, regulator, date issued, response date, action taken, evidence type (policy update, control implementation, training, system change, sustained-operation period observed), sustained-operation period in months, closure-readiness assessment (low, medium, high), named-role owner, and last status-update date.

Closure-readiness high requires a documented sustained-operation period. Banks typically use 6 to 12 months internally; examiners apply judgement. A pack that marks every item closure-ready without sustained-operation evidence reads as overconfident and triggers examiner skepticism. Default to medium when the sustained-operation period is below the bank's policy threshold; default to low when the action plan is dated within the last 30 days.

Tail — Heightened Standards, topical readiness, recommended owner actions, source trace

For covered banks under 12 CFR Part 30 Appendix D, the tail carries a Heightened Standards readiness section: risk-governance-framework attestation status, board independent-risk-committee evidence, risk-appetite-statement cross-walk, three-lines-of-defense maturity assessment, and the rebuttable-presumption posture if applied. For banks approaching the $50B threshold, the tail carries the forward-looking readiness section even where the framework is not yet binding.

For a topical cycle, the tail carries the topical readiness slice. BSA / AML readiness pulls from the FFIEC BSA/AML Examination Manual structure (CIP, CDD, BO, suspicious-activity monitoring, CTR, OFAC) and the bank's BSA-officer attestation and most recent independent-testing report. IT readiness pulls from the FFIEC IT Examination Handbook (Information Security, Management, Outsourcing Technology Services) and the most recent IT audit and penetration-testing posture. Consumer-compliance and CRA readiness pull from the FDIC Compliance Examination Manual or OCC consumer-compliance handbook and the bank's CRA performance evaluation history; flag the CRA modernised-rule status as [verify current effective state given litigation history] because the 2023 final rule has been subject to legal challenge. Fair-lending readiness pulls from ECOA / Reg B, FHA, HMDA controls and the bank's most recent fair-lending statistical-analysis report. Third-party risk readiness pulls from the Interagency Guidance on Third-Party Relationships: Risk Management (June 2023) and the bank's third-party inventory with criticality classification.

The tail also carries recommended owner actions before entry meeting (concrete, dated, named-role), the source trace (every material claim cites a source from references/source-anchors.md or the topical references; unsupported items marked [evidence needed]; section references that cannot be confirmed marked [verify section]), and the sign-off block.

Sector and cross-cutting overlays

This skill is banking-sector-only. There is no references/sector-overlays/ directory because the entire skill is the banking sector overlay. Cross-cutting overlays load when the cycle scope implicates them.

• cross-cutting/cyber.md loads when the cycle includes IT examination scope, when the FFIEC IT Examination Handbook drives the request list, or when a cyber incident in the review period shapes the Management or Sensitivity component. Anchors: FFIEC IT Examination Handbook (Information Security booklet, current edition [verify edition]), 23 NYCRR Part 500 for state-chartered banks supervised by NYDFS, the SEC cyber-disclosure framework for the BHC where the BHC is a public registrant.
• cross-cutting/conduct.md loads when the cycle includes consumer-compliance scope. Anchors: CFPB Supervision and Examination Manual (current edition [verify section]), FDIC Compliance Examination Manual, OCC consumer-compliance handbook, UDAAP examiner expectations.
• cross-cutting/privacy.md loads when the cycle includes IT or compliance with information-security overlap. Anchors: GLBA Safeguards Rule (16 CFR 314.4 [verify]), Reg P (12 CFR 1016).
• cross-cutting/climate.md does not load. Climate-related financial-risk supervision is evolving; flag as a [verify current state] reviewer question rather than embedding an overlay.

Loading an overlay the cycle does not implicate adds noise without challenge value. Loading none when one applies is the more common failure mode.

Quality bar

Every material claim about supervisory framework, rated component, examiner-letter mechanics, response-window calculation, sustained-operation expectation, or threshold trigger cites a source from references/source-anchors.md (or a loaded overlay) by path. Unsupported items carry [evidence needed]. Section references that cannot be confirmed get [verify section]. CSI references constrain the pack's access population. Source evidence, bank management assertion, public-source obligation, generated inference, and open legal question stay distinguishable. Roles only, never named individuals. No named institutions in narrative beyond a public defendant in a finalised consent order, and only for structural pattern. The pack stops short of speaking for the bank to the regulator. The named lead attests.

Adaptation

Pack depth scales to cycle type and stakes: a targeted IT exam pack reads short, organised around the FFIEC IT Handbook spine and the bank's IT audit posture; a full-scope OCC exam pack at a Heightened Standards covered bank reads long, with all six CAMELS components, the Heightened Standards section, the MRA / MRIA cross-walk, and the topical readiness slices for any in-scope topical exam running in parallel; a quarterly consent-order remediation update reads as the cross-walk plus the article-by-article evidence section. Audience drives shape: the head of supervisory affairs and the chief risk officer run the operational version; a board pre-read distills to the executive summary, the open MRA / MRIA aging chart, and the recommended owner-action list. Source posture (public-only through connector-aware) drives what the pack can assert at high confidence and what carries [evidence needed]. Where firm-specific policy or named review machinery applies, it lives in references/firm-overlay.md and is consumed when present; the pack itself stays generic.

Common pitfalls

• Treating the pack as a generic risk inventory. The CAMELS or BHC rated components are the spine. A pack that does not organise by component reads as a risk register, not a supervision-readiness pack; examiners skim component-by-component.
• Conflating MRA and MRIA. MRAs are matters requiring attention; MRIAs are matters requiring immediate attention. Aging tolerance, escalation risk, and board-reporting expectations differ. Defer to the regulator's label where the bank's tracker disagrees.
• Over-claiming closure readiness. Closure-readiness high requires a documented sustained-operation period. A pack that marks every item closure-ready without sustained-operation evidence triggers examiner skepticism. Default to medium when the sustained-operation period is below the bank's policy threshold; default to low when the action plan is dated within the last 30 days.
• Skipping Heightened Standards readiness for banks approaching the threshold. 12 CFR Part 30 Appendix D applies to covered banks ($50B+). Banks at $40B+ approaching the threshold need a forward-looking section even where the framework is not yet binding, because OCC examiners will probe it.
• Treating board minutes as the only Management-component evidence. Minutes are necessary but insufficient. The Management component pulls from internal-audit independence, compliance independence, MRA closure trend, three-lines-of-defense maturity, and risk-appetite calibration. Build the evidence inventory across all of them.
• Citing an FFIEC Examination Modernization Project initiative without confirming current effective state. The Project's deliverables evolve. Mark [verify current state] when the pack relies on a specific Modernization initiative.
• Collapsing the BHC supervisory cycle into the depository-institution cycle. A BHC cycle uses the FRB BHC supervisory framework and the BHC rated system; a depository institution cycle uses CAMELS. A holding-company organisation typically gets both in different forms; build the pack for the cycle in scope.
• Carrying CSI forward into a pack that reads at a lower access population than the CSI. Prior supervisory letters, prior MRAs, and prior examination reports are CSI under 12 CFR Part 4 Subpart C (OCC), Part 261 (FRB), and Part 309 (FDIC); the access population for the pack itself constrains what it can include.

Pointers

• references/source-anchors.md — citations and excerpts for the named anchors (federal banking supervisory framework, CAMELS and BHC rated framework, MRA / MRIA framework, Heightened Standards, topical examination manuals, CSI regimes, threshold triggers).
• references/firm-overlay.md — firm-installed supervisory-history, named examination-coordinator role, internal CSI-handling SOP, response-letter style guide, sustained-operation policy threshold; consumed when present.
• templates/default-output.md — pack template carrying cover, Parts A / B / C, and the variable tail.
• schemas/supervision-readiness.schema.json — structured-output contract for downstream consumption (reuses issue.schema.json for individual findings and control.schema.json for control evidence).
• examples/ — public-source-derived scenarios (OCC full-scope at a midsize national bank approaching the Heightened Standards threshold; FRB consent-order quarterly update at a state-member bank with eight articles spanning BSA / AML, third-party risk, and IT).

Output

Default to drafting against templates/default-output.md. Render as Word, Excel, PowerPoint, or Markdown when the audience or workflow asks for it; a full-scope readiness pack typically rides as a Word memo with the MRA/MRIA cross-walk in Excel, while a board pre-read collapses to a deck. Produce the structured record at schemas/supervision-readiness.schema.json when downstream automation or a registered consumer needs it. The named lead attests; the pack is a draft until that step.

Downstream consumers: exam-brief reads the cycle profile, the open-item posture, and the topical-readiness flags to set the engagement-side scaffolding (request-list mapping, document-handling, interview-prep). issue-writeup reads the examiner-letter items and the closure cross-walk to refresh individual finding artifacts. implementation-plan reads the recommended owner actions and the action-plan-stage cross-walk rows for the milestone build-out. risk-committee-pack reads the MRA / MRIA cross-walk and the Heightened Standards section for the standing committee section. The schema is the cross-skill contract; additive changes only, never silent renames. Breaking changes ship as a versioned migration with downstream skills told in advance.