Understanding the 

Effects of Certain Deposit 

Regulations on Financial 

Institutions’ Operations

NOVEMBER 2013

Findings on Relative Costs for Systems, Personnel, and 

Processes at Seven Institutions
(This page intentionally left blank)
Table of Contents

1. Introduction................................................................................................................. 19

1.1 The Need for Consumer Financial Regulations............................................................................20

1.2 Purpose and Goals of the Study.....................................................................................................23

1.3 Approach of the Study ....................................................................................................................24

2. Methodology ................................................................................................................27

2.1 Existing Research ........................................................................................................................... 27

2.2 In-Depth Review of Methodology..................................................................................................29

2.2.1 Study Scope and Key Concepts .......................................................................................... 31

2.2.2 The Case Study Approach ..................................................................................................43

2.2.3 Information Collection Design, Execution, and Analysis.................................................45

2.2.4 Methodological Challenges ................................................................................................54

3. Key Findings................................................................................................................. 61

3.1 Overview of Key Findings ..............................................................................................................62

3.1.1 Quantitative Presentation of Compliance Costs ...............................................................62

3.2 Compliance Cost by Business Function.........................................................................................64

3.2.1 Operations...........................................................................................................................66

3.2.2 Information Technology (IT)..............................................................................................71

3.2.3 Human Resources (HR)..................................................................................................... 75

3.2.4 Compliance .........................................................................................................................78

3.2.5 Retail ...................................................................................................................................83

3.2.6 Other functions ...................................................................................................................87

3.3 Compliance Costs by Regulatory Requirement............................................................................90

3.3.1 Authorization Rights .......................................................................................................... 91

3.3.2 Error Resolution .................................................................................................................94

3.3.3 Disclosures ..........................................................................................................................97

3.3.4 Advertising Standards ........................................................................................................99

3.4 Compliance Cost by Participant Bank ........................................................................................ 101

3.4.1 Possible Scale Effects in Compliance Costs..................................................................... 103

3.4.2 Evidence of Possible Scale Efficiencies ........................................................................... 107

4. Potential Implications.................................................................................................113
4 CONSUMER FINANCIAL PROTECTION BUREAU 

5. Conclusion ................................................................................................................. 125

6. Appendices................................................................................................................. 127

FIGURES AND TABLES

Benefits of the In-Scope Deposit-Related Regulations...................................................................................36

Figures

1. Notional Retail Deposit Business Expenditures, by Incremental and Baseline Components ...........40

2. Demonstration of Synthesized Compliance Cost Study Taxonomies ..................................................50

3. Relative Operations Sub-Function Costs as a Percentage of Total Compliance Costs .......................67

4. Relative Compliance Sub-Function Costs as a Percentage of Total Compliance Costs ..................... 79

5. Authorization Rights Process Flow – Overdraft Coverage Opt-In .....................................................92

6. Error Resolution Process Flow ...............................................................................................................95

7. Total Compliance Costs as a Percentage of Estimated Retail Deposit Operating Expense ............ 101

8. Potential Indicators of Scaling Effects in Compliance Costs ............................................................. 102

Tables

1. Overview of the In-Scope Regulatory Requirements ...........................................................................33

2. Participant Institutions by Asset Size Categorization ..........................................................................45

3. Regulation Taxonomy ............................................................................................................................. 47

4. Business Function Taxonomy .................................................................................................................49

5. Summary of Median Compliance Costs by Function and Cost Type ..................................................65

6. Compliance Costs by Function Relative to Retail Deposit Operating Expense ................................ 106
5 CONSUMER FINANCIAL PROTECTION BUREAU 

Executive Summary

Consumer financial markets do not always operate efficiently and fairly. Well-designed 

regulations can help enhance market efficiency and fairness without imposing undue burdens. 

Such regulations benefit consumers, responsible firms, and society more broadly. This report, 

“Understanding the Effects of Certain Deposit Regulations on Financial Institutions’ 

Operations: Findings on Relative Costs for Systems, Personnel, and Processes at Seven 

Institutions,” is a step by the Consumer Financial Protection Bureau (“CFPB” or the “Bureau”) 

in an effort to collect and evaluate information on the benefits, costs, and impacts of regulations.

A critical part of the Bureau’s mission is to make regulation more effective without imposing 

undue costs.1 To that end, the Bureau seeks to deepen its – and the public’s – understanding of 

how markets work and how regulations affect markets. These effects can be very difficult to 

trace and discern since market outcomes are determined by many influences other than 

regulation. In this foundational study (the “Study”), we concentrate on a subset of the direct and 

immediate effects of regulation – the operational cost of compliance at financial institutions. 

Regulations also have significant benefits for consumers, financial institutions, and markets –

but those benefits are not the subject of this Study.

By improving our and the public’s capacities to describe and measure immediate effects of 

regulations on institutional operations, we seek to strengthen our ability to avoid imposing 

unnecessary operational costs. Moreover, since regulations’ immediate operational effects are

 

1 The Bureau’s mission statement reads in full: “The CFPB is a 21st century agency that helps consumer finance 

markets work by making rules more effective, by consistently and fairly enforcing those rules, and by empowering 

consumers to take more control over their economic lives.” In addition, Section 1021(b)(3) of the Dodd-Frank Act 

(DFA) assigns to the Bureau five objectives, including ensuring that “outdated, unnecessary, or unduly burdensome 

regulations are regularly identified and addressed in order to reduce unwarranted regulatory burdens.”
6 CONSUMER FINANCIAL PROTECTION BUREAU 

deeply intertwined with regulations’ broader impacts on consumers, financial institutions, and 

markets, we also hope to improve our ability to maximize beneficial impacts on consumers and 

markets through this Study. 

We sought to make progress on three goals with the Study: 

• Build knowledge about the extent and sources of compliance costs that may be 

associated with regulations that the Bureau inherited; 

• Improve the Bureau’s and the public’s abilities to describe and measure costs to comply 

with existing or potential new regulations; and 

• Refine the Bureau’s and the public’s abilities to identify meaningful opportunities to 

reduce or avoid imposing unnecessary operational costs.

The report proceeds in three major sections: Methodology (Section 2), Key Findings (Section 3), 

and Potential Implications (Section 4).

Methodology

Section 2 of the report details the methodology we developed to collect and analyze data on 

compliance operations and costs. Gathering data on compliance costs is challenging. Banks 

generally do not track their full costs of compliance, and the relevant information is often 

scattered across several departments and many employees. Past studies have highlighted major 

challenges in producing reliable data on compliance costs for many different regulations or large 

numbers of institutions.

To try to address these challenges, we narrowed the scope of the Study to particular regulations 

and products, adopted a case study method rather than a broad survey, and conducted the case 

studies through in-depth, on-site interviews at each participant institution. Within the scope, we 

sought to achieve three objectives: distinguish incremental operating costs of regulation from 

baseline costs (i.e., costs that institutions would incur in the absence of regulations), cover all 

major sources of compliance cost, and measure those costs consistently within each institution 

and across institutions.

STUDY SCOPE

The Study focused on the costs banks incur to comply with the regulations that the Bureau 

inherited and that govern consumer deposit-related products and services. Specifically, we 
7 CONSUMER FINANCIAL PROTECTION BUREAU 

studied the compliance costs associated with checking accounts, traditional savings 

accounts (e.g., statement/passbook savings), debit cards, and overdraft programs (e.g.,

overdraft coverage for ATM and debit card transactions). We focused on the operational 

activities and costs to administer these products and services in compliance with Regulations 

DD (implementing the Truth in Savings Act), E (Electronic Fund Transfer Act), P 

(Gramm-Leach-Bliley Act financial privacy requirements), V, and certain sections of 

the Fair Credit Reporting Act (or, as a whole, the “in-scope regulations”).

2 The Study did not 

cover compliance costs associated with laws outside the scope of the Study (such as mortgage 

lending laws or Bank Secrecy Act).

KEY CONCEPTS

We define key concepts used in the Study as follows:

• Compliance costs – the operating costs incurred in performing the activities that are 

reasonably necessary to comply and demonstrate compliance with the deposit-related 

regulations the Bureau inherited. These are costs related to the incremental activities

that would not have been performed if these regulations did not exist.3 Compliance costs 

are therefore incremental costs because they are the costs of those incremental 

activities. In Figure A below, the incremental costs of compliance with the in-scope 

regulations are divided between those costs incurred by the Compliance function of a 

bank (labeled “2” in Figure A) and those incurred in other business functions (3).

• Baseline costs – the total operating costs exclusive of those that are reasonably 

necessary for complying or demonstrating compliance with the deposit-related 

regulations the Bureau inherited. In Figure A, baseline costs (4) equal the business-as-

 

2 These regulations were initially adopted by the Board of Governors of the Federal Reserve System. The Bureau 

inherited these regulations and now has rulemaking, supervisory, and enforcement authority over them.

3 The Study does not draw conclusions on the costs or activities the Bureau considers “reasonably necessary” for 

compliance with the Bureau’s deposit-related regulations. It is not clear that aggregate examination costs will increase 

because of a new rule going into effect. In addition, although the cost of demonstrating compliance in the course of an 

examination is not necessarily a cost of complying with specific provisions of the in-scope regulations, we have 

included this cost in our estimates because staff we interviewed uniformly regarded examination activities for the inscope regulations as routine for compliance. 
8 CONSUMER FINANCIAL PROTECTION BUREAU 

usual cost of providing deposits products and any compliance costs related to regulations 

outside the scope of the Study.

FIGURE A: NOTIONAL RETAIL DEPOSIT BUSINESS EXPENDITURES, BY INCREMENTAL AND BASELINE 

COMPONENTS

Note: Figure not drawn to scale

The Study focused on the ongoing costs, or recurring operating costs, of the Bureau’s depositrelated regulations. While we were also able to capture limited information on one-time or

implementation costs (or the operating costs of coming into compliance with new 

regulations) for implementing 2009 regulations on overdraft programs, these costs were not the 

focus of the Study.

We also did not estimate opportunity costs in the Study, which we defined as the profits 

foregone from business opportunities not pursued because of regulation. While opportunity 

costs represent a cost to the bank, such lost profits do not necessarily reflect a loss to society. For 

example, it may be true that consumer benefits from avoiding those transactions are equal or 

greater than the loss in bank profits.

An important premise of separating incremental costs from baseline costs is that not every 

requirement in a regulation necessarily results in a cost. Some of a bank’s regulatory activities 

are deeply intertwined with its “business-as-usual” procedures. As a result, it is necessary to 

avoid double-counting any particular activity or cost as both incremental and baseline. We made 

a series of informed judgments that were intended to be conservative and err on the side of 

treating arguably baseline costs as regulatory costs rather than vice-versa. Thus, the cost figures 

in this report may represent an upper bound estimate for the regulations and products studied 

in the seven participants studied.
9 CONSUMER FINANCIAL PROTECTION BUREAU 

THE CASE STUDY APPROACH

The Study proceeded in three phases. In Phase 1, we designed the methodology and prepared 

for the on-site visits. We systematically identified each functional area of a bank affected by the 

in-scope regulations. We also identified the specific processes, systems, and personnel that we 

would inquire about and whose cost we would seek to measure. Preparation in Phase 1 yielded 

an interview guide that was distributed in advance to the institutions to facilitate discussions.

In Phase 2, we interviewed about 200 executives and employees at seven participant banks 

ranging in asset size from under $1 billion to over $100 billion.4 Interviews focused on the time 

that bank personnel spent on related compliance activities, other internal non-labor compliance 

expenses, as well as the costs of third-party vendors for compliance services.

Phase 3 included analyzing and validating the data collected in Phase 2, corroborating and 

adjusting as needed the data with other sources, and following up with the participants on 

missing or inconsistent information.

Key Findings

In Section 3, we report analyses of compliance costs from three different perspectives. To 

deepen understanding of the sources of compliance costs, we analyze costs in two ways – by 

business function and by type of regulation – and examine how these breakdowns vary across 

the seven participating institutions we studied. We also compare compliance costs for the 

regulations we studied across the seven institutions.

 

4 We categorized participant banks into four different asset tiers: “Tier 1” banks have assets of over $100 billion; “Tier 

2” banks have between $10 billion and $100 billion; “Tier 3 banks” have between $1 billion and $10 billion in assets; 

and “Tier 4” banks have less than $1 billion in assets. There are seven total participant banks in the Study – one is a 

Tier 1-designated bank, and there are two participant banks each in Tiers 2, 3, and 4.
10 CONSUMER FINANCIAL PROTECTION BUREAU 

COMPLIANCE COST BY BUSINESS FUNCTION

First, we examine compliance costs by business function.5 Among the Study’s seven participant 

banks, compliance costs appear to be concentrated in Operations, Information Technology 

(IT), Human Resources (HR) (as it relates to employee training), Compliance, and Retail

functions. We describe the regulation-induced activities that each function engages in and 

identify activities that entailed higher relative costs. Table A provides an overview of median 

functional cost (as percentage of institutional compliance cost) across different cost types.6 This 

overview shows that the median shares of total compliance costs for the Operations and IT 

functions were 23% and 22%, respectively, each more than the median 13% share for the 

Compliance function itself.

 

5 We recorded compliance costs by business function, which we define as a set of responsibilities and corresponding 

activities. These responsibilities and activities might be housed in a distinct department of the bank or divided among 

several departments. In a smaller bank, several functions might be housed in one department or even attributed to 

one individual. A function-level analysis allows us to compare breakdowns of costs across institutions in a way that 

controls for differences in the ways institutions organize themselves.

6 In general, at least one of the following three different statistics is used to summarize data: mode, average (mean), 

and median. In the Study, given that no two data points are the same, using mode would be unhelpful. With only 

seven observations, using average would give excessive weight to any outliers – even one outlier observation can 

significantly affect an average across seven participating institutions. The median value summarizing the data from 

the seven participant institutions is unlikely to change because of any outliers. Median is therefore preferable for 

expressing the Study’s findings.
11 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE A: SUMMARY OF MEDIAN COMPLIANCE COSTS BY FUNCTION AND COST TYPE ACROSS 

SEVEN STUDY PARTICIPANTS (AS % OF TOTAL COMPLIANCE COSTS)7

Type of Cost

In-house 

Labor

In-house 

Non-labor

Thirdparty Overall

Operations 14.0% 9.0% 2.3% 22.6%

IT 0.2% 0.0% 21.4% 22.0%

HR 12.4% 0.0% 0.3% 15.7%

Compliance 12.6% 0.0% 0.0% 13.0%

Retail 9.5% 0.5% 0.0% 9.5%

Marketing 2.3% 0.0% 0.0% 2.3%

Audit 1.9% 0.0% 0.0% 1.9%

Legal 0.0% 0.0% 0.0% 0.5%

Overall 66.0% 14.3% 30.3%

Across most of the Study’s seven participating institutions, the Operations function contained 

the largest share of compliance costs, ranging from 15% to 29% (median = 23%) of the total 

costs of compliance. Within Operations, four sub-functions emerged as most relevant to the 

 

7 Shading denotes overall high, medium, and low relative shares of compliance costs, where red = high, yellow = 

medium, and green = low. All costs of compliance are given in median percentages of the seven participating 

institutions and for individual sub-components of in-house labor, in-house non-labor, and third-party costs (include 

outsourced labor and non-labor costs). Please note that because numbers are reported as medians, individual subcomponents of cost across the seven institutions will not necessarily sum to total overall median. Similarly, “Overall” 

median components will not necessarily sum to 100%. 
12 CONSUMER FINANCIAL PROTECTION BUREAU 

Study’s scope: fulfillment of disclosures, back office support for customer activities, call centers, 

and error resolution. 

Given the importance of technology in banking, it is unsurprising that Information 

Technology (IT) costs comprise 10% to 43% of total compliance costs (median = 22%) across 

the seven institutions interviewed. Banks implement their general IT needs through any number 

of in-house and third-party options, which can make the task of estimating compliance-related 

IT costs more difficult. Tier 4 participants in the Study relied exclusively on third-party 

providers. The largest of the Study participants typically design and maintain much of their IT 

systems in-house, as was the case with the Tier 1 bank in the Study. The Tier 2 and Tier 3 banks 

combined elements of both models.

As the function primarily responsible for the development and deployment of employee training 

across an organization, Human Resources (HR) costs represent 9% to 24% (median = 16%) 

of total compliance costs identified. This cost primarily originates from two activities: the design 

and development of compliance-related trainings and the deployment and monitoring of those 

trainings across a broad employee base. Employee training hours associated with the in-scope

regulations comprise the majority of identified HR compliance costs, and – for the purposes of 

the Study – are captured as part of the deployment cost. As a result, the majority of HR-related 

compliance costs are internal labor costs; however, there are some non-labor and third-party 

costs associated with the production of customized training material and/or the purchase of offthe-shelf training materials and administrative software.

Across participating institutions, Compliance function costs represent 5% to 31% (median = 

13%) of total in-scope regulatory compliance costs identified. 

Among the seven case study banks, the Retail function accounts for a material and sometimes 

considerable share of compliance cost because it bears a substantial share of a bank’s 

responsibility to inform consumers about products, features, and services. Across participating 

institutions, Retail function costs represent 3% to 35% of total compliance costs (median = 

10%), almost all of which are internal labor costs. The bulk of these labor costs are associated 

with front-line management and in-branch customer service (e.g., review of disclosures at 

account opening, explanation of adverse action disclosures if relevant). The remaining costs 

(median = 2% of total compliance cost) come primarily from personnel involved with product 

development and design, who spend incremental time interacting with Compliance function 

staff throughout the product development process.
13 CONSUMER FINANCIAL PROTECTION BUREAU 

The business functions related to Marketing, Audit, and Legal account for relatively small 

fractions of the overall ongoing compliance costs. Across participating institutions, Marketing

function costs comprise anywhere from less than 1% to 8% of total compliance costs identified 

(median = 2%), Audit function costs comprise anywhere from less than 1% to 7% of total 

compliance costs (median = 2%), and Legal function costs comprise 0% to 3% of total 

compliance costs (median = 1%).

COMPLIANCE COST BY REGULATORY REQUIREMENT

We also examine activities and associated costs for the types of regulatory requirements that 

have the highest relative shares of cost among Study participants. The four types of 

requirements we analyze are: authorization rights (which include opt-in for overdraft 

protection under Regulation E and opt-out for sharing information with third parties and 

affiliates under Regulations P), error resolution requirements, disclosure mandates,

and advertising standards. We describe the activities conducted by banks to comply with 

these requirements and explain how these activities generate costs across different business 

functions. The discussion of costs by regulatory requirement is qualitative, as our data collection 

did not enable us to estimate accurately the cost of each type of regulation we studied.

Authorization rights require a bank to obtain a consumer’s consent (opt-in) or give a 

consumer the opportunity to decline (opt-out) before engaging in a specified activity. In the 

Study, we focus on customer choices at the participant banks to opt-in to overdraft coverage that 

charges fees and to opt-out of sharing certain customer information with third parties and

affiliates (if applicable). Significant cross-functional coordination is required to build optin/opt-out functionality (IT, Operations), inform customers about their options (Retail, 

Operations), and oversee adherence to their preferences (Compliance, Audit). The crossfunctional coordination and the resulting interdependencies are partially responsible for the 

relatively higher compliance costs likely attributable to this type of requirement.8

The major error resolution requirement the Study addresses is the process for handling 

disputes regarding electronic fund transfers (Regulation E). All of the banks participating in the 

Study indicated that, regardless of any regulation or payment network rules, addressing 

 

8 Institutions may choose to enact more costly compliance processes for a number of reasons. For the example of 

overdraft opt-in, banks may have chosen their course of compliance in order to maintain their revenue from overdraft 

coverage or simply to continue offering a service so that customers could have the benefit of choice.
14 CONSUMER FINANCIAL PROTECTION BUREAU 

customer disputes was a business-as-usual activity. However, the need to meet prescribed 

timetables contributes to incremental compliance cost. Several participants indicated that their 

incremental cost to comply with the mandated error resolution timetable included additional 

staffing or overtime hours of existing staff.

Compliance costs associated with mandated disclosures can be split into two components:

design costs and production and delivery costs. These costs vary across the Study participants, 

depending on the extent of modifications to disclosures, the means of delivery (e.g., in mailings 

with other unrelated materials, in an independent mailing, in-person, or electronically), and the 

nature/timing of disclosures (e.g., prompted by an irregular event or occurring at periodic 

intervals).

Advertising standards govern the kind of language or content that can be used to advertise 

for banks’ products or services. The interpretation and application of open-ended regulations 

require negotiation and coordination between Marketing and Compliance functions during 

campaign design.

COMPLIANCE COST BY PARTICIPANT BANK

Finally, we compare aggregate costs across the seven institutions we studied. To draw a valid 

comparison we assess the banks’ costs against a common metric of total retail deposit operating 

expense, which we estimated from a proprietary model. We observe that the two smallest 

participants in the Study incur higher costs (as a relative share of their estimated total retail 

deposit operating expenses) than the five larger banks. Specifically, the two smallest institutions 

had in-scope compliance costs of about 4% and 6%, respectively, of their estimated total retail 

deposit operating expense. The five largest Study participants incurred costs to comply with 

these regulations roughly equal to 1% to 2% of their estimated total retail deposit operating 

expenses. A similar pattern holds when we measured costs against other denominators that 

proxy the scale of deposit operations.

The observations from the Study’s seven participants provide limited evidence for scale 

efficiencies in compliance. The scale findings are particularly tentative because we studied just 

two of over 6,000 institutions with assets under $1 billion, and our comparisons across 

institutions could not control for factors other than size. It is possible that other differences 

besides size explain some or all of the cost differences we observed. The Study discusses reasons 

that compliance might involve scale efficiencies and explores evidence we observed in the seven 

participant banks of factors that may contribute to possible scale efficiencies.
15 CONSUMER FINANCIAL PROTECTION BUREAU 

Interpretation of the findings requires important caveats both methodological and practical. 

Readers should not take the numbers in this report as definitive or as representative generally of 

institutions or regulations. 

That said, the Bureau believes that the business models of the seven participants are within the 

mainstream of retail deposits business models for banks within their respective asset tiers. 

While the estimates of compliance cost for the seven banks are not generalizable, the quality and 

depth of information shared by the bank participants was far richer than could have been 

collected via a survey.

Potential Implications

In Section 4, we discuss the potential implications of the Study in four broad categories.

First, the Study advances research on compliance operations and costs by producing some of the 

most rigorous information currently available on those subjects, refining research methods, and 

helping interested parties identify potential areas for further research. Reliable, publicly 

available data on the operating costs of complying with consumer financial regulations are 

relatively sparse. The Bureau hopes that this report provides a more solid factual basis, as well 

as a more systematic framework of analysis, to inform and elevate discussions about compliance 

operations and cost. 

Seven case studies do not justify broad generalizations – especially about scale effects – so we 

are careful not to draw any. This is not a flaw of the methodology; rather, it is a necessary tradeoff of careful research. In practice, interviews of case study institutions’ employees to assess how 

they spend their time can take significant effort on the part of researchers and participants and 

still produce only a rough approximation of costs. At the very least, the methods we employed 

should help set guideposts for producing and evaluating estimates of compliance costs. The 

Study also suggests fruitful areas for further research, including economies of scale in 

compliance and the ways that smaller firms might navigate the market for compliance 

technology.

Second, the Study of compliance operations and costs for individual firms is most valuable as 

part of a broader effort to understand how regulations affect consumers and markets. Better 

understanding of compliance costs allows policy-makers and researchers to better understand

overall regulatory impact. Policy-makers and researchers still face major challenges to 
16 CONSUMER FINANCIAL PROTECTION BUREAU 

measuring the effects of regulation on consumers and markets, especially the benefits of 

regulation. As a result, progress will come in small increments rather than major breakthroughs. 

Research on regulations is a long-term priority for the Bureau, and we welcome opportunities to 

work with interested parties to enrich the body of available evidence.

Third, the Study will inform and help the Bureau refine its ongoing efforts to reduce or avoid 

unnecessary compliance costs, without sacrificing the benefits of regulation. These steps include 

the collection of information about costs, the design of regulations to minimize costs without 

sacrificing significant benefits, and the effective communication of regulations to entities that 

must comply with them. The Study will also inform future reviews that the Bureau will conduct 

on the effectiveness of significant regulations adopted. 

Fourth, stakeholders such as industry participants and consumer advocates may find that this 

Study helps them improve their participation in the regulatory process – during rulemakings, 

implementation, and in anticipation of reviews of existing regulations. The traditional notice 

and comment process has often fallen short of producing concrete and reliable information 

about compliance costs (or, for that matter, about costs more broadly). The Bureau has a 

number of suggestions stakeholders may wish to consider when providing the Bureau 

information about compliance costs or responding to such information. These suggestions are 

purely voluntary and at the discretion of stakeholders.

Conclusion

The effects on institutions’ operations are but one of the wide range of effects of consumer 

financial regulation on consumers, firms, and markets that matter to policy-makers. Operational 

effects are among the most direct and immediate effects. Alone, however, estimates of these 

effects have limited value to policymaking. Operational effects matter more to the extent they 

suggest how a specific regulation might affect product pricing and availability or market 

structure and competition. Moreover, these types of effects on a market can be understood

properly only in the context of the fundamental benefits of regulation to consumers and the 

marketplace.

The ultimate benefits and costs of a regulation are difficult to measure, and progress in their 

measurement is likely to come in small increments rather than major breakthroughs. Research 

on the effects of regulations is an ongoing priority for the Bureau, and we welcome opportunities 

to work with interested parties to enrich the body of evidence. Meanwhile, we will continue to 
17 CONSUMER FINANCIAL PROTECTION BUREAU 

address problems that we see in the marketplace and evaluate potential responses to those 

problems on the basis of the evidence that is reasonably available – mindful that, whatever the 

costs of regulation, the costs of not regulating adequately can be even larger.
(This page intentionally left blank)
19 CONSUMER FINANCIAL PROTECTION BUREAU 

1.Introduction 

Consumer financial markets do not always operate efficiently and fairly. Well-designed regulations 

can help to enhance market efficiency and fairness without imposing undue costs. Such regulations 

benefit consumers, responsible firms, and society more broadly. This report, “Understanding the 

Effects of Certain Deposit Regulations on Financial Institutions' Operations: Findings on Relative 

Costs for Systems, Personnel, and Processes at Seven Institutions,” is a step by the Consumer 

Financial Protection Bureau (“CFPB” or the “Bureau”) in an effort to collect and evaluate 

information on the benefits, costs, and impacts of regulations.

A critical part of the Bureau’s mission is to make regulation more effective without imposing undue 

costs.9 To that end, the Bureau seeks to deepen its – and the public’s – understanding of how 

markets work and how regulations affect markets. These effects can be very difficult to trace and 

discern since market outcomes are determined by many influences other than regulation. In this 

foundational study (the “Study”), we concentrate on a subset of the direct and immediate effects of 

regulation – the operational cost of compliance at financial institutions. Regulations also have 

significant benefits for consumers, financial institutions, and markets – but those benefits are not 

the subject of this Study.

By improving our and the public’s capacities to describe and measure immediate effects of 

regulations on institutional operations, we seek to strengthen our ability to avoid imposing 

unnecessary operational costs. Moreover, since regulations’ immediate operational effects are 

deeply intertwined with regulations’ broader impacts on consumers, financial institutions, and 

 

9 The Bureau’s mission statement reads in full: “The CFPB is a 21st century agency that helps consumer finance markets 

work by making rules more effective, by consistently and fairly enforcing those rules, and by empowering consumers to 

take more control over their economic lives.” In addition, Section 1021(b)(3) of the Dodd-Frank Act (DFA) assigns to the 

Bureau five objectives, including ensuring that “outdated, unnecessary, or unduly burdensome regulations are regularly 

identified and addressed in order to reduce unwarranted regulatory burdens.”
20 CONSUMER FINANCIAL PROTECTION BUREAU 

markets, we also hope to improve our ability to maximize beneficial impacts on consumers and 

markets through this Study.

1.1 The Need for Consumer Financial 

Regulations

When many firms provide a product and consumers are well-informed about and able to choose the 

product, firms have a financial incentive to compete on quality, variety, price, and other features. In 

addition, firms that focus on long-term success have a financial incentive to make sure consumers 

are well-informed about and benefit from the products, as well as to keep their promises about the 

products and services they provide. In a marketplace that is operating optimally, firms will succeed 

by building customer loyalty, winning additional business from existing customers, and developing

strong reputations in order to attract new customers. If all of these conditions hold, firms generally 

will produce products and services that consumers understand and willingly choose for their 

perceived value, at prices that provide firms with a competitive rate of return.

Consumer financial markets generally have at least some of these characteristics. There are many 

providers of almost every type of consumer financial product. Many providers focus on serving the 

long-term interests of their customers and seek to build and maintain strong reputations. Firms 

compete on quality, variety, price, or other features, and often treat their customers well. These 

firms must also comply with a range of consumer financial protection regulations. This raises the 

question of how and to what extent the regulations contribute to these positive outcomes for 

consumers, or whether these outcomes would occur without regard to the incentives that flow from 

regulations backed by credible oversight mechanisms. As the following discussion describes, 

regulations indeed provide important benefits to consumers overall.

If all firms were focused on building a strong business reputation and achieving sustainable, longterm success, they would have strong incentives to avoid misrepresenting their products and 

misleading consumers. Unfortunately, firms can sometimes earn significant profits very quickly by 

employing undesirable practices. This type of behavior, if unchecked, can cause significant injury 

both to consumers and to competitors that eschew these practices. Consumers who choose products 

about which they are misinformed or under-informed can experience a variety of negative 

outcomes. They may pay more than is necessary for products and services, incur unexpected fees 

and charges, and risk lowering their credit scores and ability to borrow. Other consumers may avoid 

markets in which some providers are known to mislead consumers, out of concern that they could 

not distinguish legitimate from illegitimate providers and might obtain riskier, higher-priced, or 
21 CONSUMER FINANCIAL PROTECTION BUREAU 

lower quality products than expected. Firms pursuing long-term success would have a difficult time 

competing against providers that charge less for products that can be made to appear comparable

but are not. Regulations that deter these practices therefore prevent particular consumers from 

being harmed by the products they select. The regulations also benefit both consumers and 

responsible firms by facilitating the development of a legitimate market that can function properly 

and generate justifiable consumer confidence and more robust participation.

Apart from preventing false or misleading statements, regulations also require firms to provide 

consumers with disclosures that distill the most critical product feature information out of the 

underlying contract documents, mandate product features and services, and set general standards

for quality and service. These regulations also provide overall benefits to consumers that the market 

would not provide. Many consumer financial protection regulations require disclosures that 

facilitate informed product choice and comparison shopping and that reduce consumer search 

costs. Disclosures that allow consumers to compare more effectively the key characteristics provide 

information on a fixed set of characteristics using standardized terminology and measures. An 

individual firm would not have a strong incentive to develop such comprehensive disclosures on its 

own, and competing firms are not likely to agree on the precise characteristics and measures. 

Regulations define these characteristics and standardized terminology and measures (e.g., the 

Annual Percentage Rate or Annual Percentage Yield), mandate disclosures of these measures, and 

provide formatting requirements based on consumer research. These approaches help overcome the 

weak incentives that firms would otherwise have to develop disclosures that facilitate comparison 

shopping.

Even with good disclosures and honest and accurate representations from providers, consumers 

may not be able to detect, understand, and protect themselves against certain risks. For example, 

consumers unfamiliar with consumer financial products may not fully consider the probabilities 

associated with poor outcomes or the value of services that could help them manage those 

outcomes. Consumer financial products are often complex – even experienced consumers may have 

difficulty evaluating the likelihood of paying certain fees and charges, ascertaining whether these 

costs are justified, and seeking assistance in managing them. While leaving certain risks 

unregulated might induce some shopping around by consumers for product features that reduce the 

chances and severity of adverse events, it is not clear how well people perceive and manage such 

situations, especially if the chances are small. Consumers who are unable or unprepared to perceive 

and manage these risks well will choose the wrong product, misuse the product, or avoid the market 

entirely. Further, competition might lead providers to fail to mitigate risks to consumers or to erode 

protections that were once offered. As just one example, lenders originating mortgages without 
22 CONSUMER FINANCIAL PROTECTION BUREAU 

consideration of the borrower’s ability to repay created risks to consumers that were realized quite 

profoundly in the recent financial crisis.

To respond to the difficulties many consumers have in managing these risks and the weak incentives 

providers may have in helping consumers manage them, consumer financial regulations may 

mandate standards for service and restrict potentially harmful product features. For example, 

certain regulations require providers to respond to consumer requests for information, provide 

error resolution procedures, and retain records that can be made available for future examination. 

Regulations may also limit the consequences for consumers from missing a payment (e.g., no 

pyramiding of late fees), exceeding a credit limit, or failing to meet other obligations. Recent 

regulations require mortgage loan originators and credit card issuers to take into account the ability 

to repay before making a loan.

Consumer financial regulation also imposes standards on services that are used by lenders, such as 

credit reporting, loan servicing, and debt collection for which lenders transact and the consumer is a 

third party. Consumers generally have no influence over the selection of these service providers, and 

consumers have no avenues (absent regulation) through which to impose costs on these agents for 

inaccurate credit reports, poor loan servicing and incorrect or harassing debt collection. The 

interests of the lender do not fully capture the interests of consumers in preventing these problems. 

The financial crisis highlighted risks to consumers from the ability of mortgage loan servicers to 

acquire loans without the obligation or incentive to provide certain services that are important to 

consumers. Recent regulations have addressed these risks. 

The Bureau also implements federal laws, such as the Equal Credit Opportunity Act and the Home 

Mortgage Disclosure Act, intended to ensure fair, equitable and non-discriminatory access to credit. 

Access to financial services and products is critical to helping individuals and families manage their 

money; providing for educational expenses, transportation and housing needs; and build wealth 

and strong communities. However, throughout history some providers have discriminated through 

“red-lining” and other practices that are biased against segments of the market based on race, 

gender, marital or familial status, disability, or other characteristics having no bearing on credit 

worthiness. The results of such discrimination are felt not only by individuals and families who are 

arbitrarily and unjustly barred from achieving their financial goals, but also by their communities. 

The Bureau is mandated both to study and monitor consumer access to credit and to implement and 

enforce federal laws to ensure that markets provide fair access to credit. 
23 CONSUMER FINANCIAL PROTECTION BUREAU 

1.2 Purpose and Goals of the Study

By enhancing market efficiency and fairness, financial regulation can improve markets. However, 

regulations can also result in costs to consumers and financial institutions. For example, regulations 

can raise the cost of operating a business if institutions must invest in additional labor or technology 

resources to comply with a rule that they would not invest in absent the rule. Conversely, 

regulations may also offset some other firm costs that they would not otherwise incur, as when 

mandatory disclosures reduce the costs associated with handling consumer complaints. Regulation 

may also expand business and profit opportunities by helping to create a market, but impose costs 

on particular institutions in the form of foregone profits from business opportunities not pursued 

because of regulation. Regulation can potentially increase prices and/or reduce availability of 

products and services to consumers, at least in the short-term.

A critical part of the Bureau’s mission is to make regulations more effective without imposing undue 

costs. To that end, the Bureau consistently seeks to deepen its – and the public’s – understanding of 

how markets work and how regulations affect markets. However, the benefits and costs of 

regulation can be quite difficult to ascertain since market outcomes are determined by many 

influences other than regulation, and data are often inadequate to capture all of these influences.

The benefits of regulation are diverse, such as allowing for easier shopping and reducing risks of 

both unexpected fees and charges, and the avoidance of foreclosure, bankruptcy, reduced access to 

financial products and services and other negative market outcomes. Quantifying the magnitude of 

these effects and assigning a monetary value to them are widely recognized as highly challenging.

Given the challenges of measuring the ultimate effects of regulation, research must proceed in 

increments. In this Study, we have concentrated on one of the direct effects of consumer financial 

protection regulations – their effects on the operations of financial institutions. As challenging as 

the operational effects are to measure, they may be easier to measure than other benefits and costs 

of regulations. 

Accordingly, we sought to make progress on three goals with the Study: 

• Learn more about the extent and sources of compliance costs associated with regulations 

that the Bureau inherited; 

• Improve the Bureau’s and the public’s abilities to describe and measure costs to comply 

with existing or potential new regulations; and 

• Refine the Bureau’s and the public’s abilities to identify meaningful opportunities to reduce

or avoid imposing unnecessary operational costs.
24 CONSUMER FINANCIAL PROTECTION BUREAU 

Improving methods for evaluating direct effects of regulations on institutions – as this Study sets 

out to do – can strengthen our ability to detect or predict effects on consumers and markets, and 

therefore to maximize benefits for consumers and markets.

1.3 Approach of the Study

Evaluating compliance costs is inherently challenging. The personnel, processes, and systems 

required to comply with a particular regulation are frequently intertwined with the operations of the 

business itself or with operations to comply with other regulations or standards. Moreover, financial 

institutions generally do not track consistently or comprehensively the compliance costs associated 

with particular regulations. One cannot determine compliance costs for a regulation by looking at an 

institution’s financial statements and regulatory filings.

To help address these challenges, we narrowed the scope of the products and regulations we studied 

and the number of case study institutions. We limited the Study to ongoing costs to comply with the 

Bureau’s inherited regulations that apply to retail checking accounts, savings accounts, debit cards, 

and overdraft programs (the “in-scope regulations”). The inherited regulations that govern these 

products have not changed for several years, making them a good candidate for a study of ongoing

costs – as opposed to the one-time cost of implementing new regulatory requirements.10

A narrower scope allowed us to be more rigorous in three key dimensions: first, distinguishing 

incremental operating costs of regulation from baseline costs (i.e., costs that institutions would 

incur even in the absence of regulations); second, covering all major sources of compliance cost; and 

third, measuring those costs consistently within each participating institution and across all the 

Study participants.

To capture compliance costs consistently and comprehensively, we conducted interviews with about 

200 employees and executives from seven participant banks ranging in asset size from under $1 

billion to over $100 billion. These interviews focused on the operational activities and processes 

required to implement compliance. The focus on a small number of institutions gave us multiple 

opportunities to scrutinize and validate information we received from participant employees. The 

 

10 There is one major exception: Regulation E recently was amended to implement new statutory protections for 

remittance transactions. These amendments are outside the scope of the Study.
25 CONSUMER FINANCIAL PROTECTION BUREAU 

accuracy of information likely depended on the extent to which bank staff could check their 

intuition against corroborating or conflicting information. Also, institutions voluntarily provided 

additional information and documentation that corroborated information from some interviews.

This report analyzes compliance operations and associated costs at the seven participants we 

studied by functional area (department or business function) of each bank – the way an institution

might look at its own operations. We report qualitative findings on bank operations, as well as

estimates of relative costs for the different functions within the seven participating institutions.

These estimates should be interpreted with care. They are not estimates of the cost of compliance 

for institutions in general. Moreover, a cost figure cannot be evaluated meaningfully without more 

information than we could produce in the Study – especially an estimate of the benefits of the 

regulations, which was outside the scope of the Study. A large compliance cost might produce even 

greater benefits for consumers and the marketplace; conversely, even a very small compliance cost 

might be questioned if the benefit was not apparent. 

□ □ □

The following sections of this report describe in detail the methodology of the Study (Section 2), its 

key findings (Section 3), and the potential implications for research and for the policy-making 

process (Section 4).
(This page intentionally left blank)
27 CONSUMER FINANCIAL PROTECTION BUREAU 

2.Methodology

There are no standard ways to collect and analyze information on compliance costs, since banks 

generally do not track their full costs of compliance. Therefore, we endeavored to develop a 

methodology that was comprehensive and well-defined, and yielded consistent estimates. 

First, we review existing research on compliance costs, highlighting some strengths and weaknesses 

of previous efforts to characterize and measure compliance costs. We use the best practices 

identified in previous studies to help define the scope of the Study and to build a robust 

methodology. 

We proceed to outline the parameters of the Study, defining the regulatory and product scope and 

the ongoing compliance costs related to deposit-related regulations the Bureau inherited. We define 

the difference between incremental compliance costs and baseline costs. We then offer an overview 

of the case study methodology and the criteria we used to select participants. We also describe in 

detail the process to design the data collection, conduct on-site information collections, and analyze 

and validate the information. Finally, we discuss some challenges involved in this type of research 

and the steps we took to mitigate them.

Other researchers may be interested in following or adapting the methodology described in this 

report. Appendix H: General Techniques also summarizes the key considerations when using the 

methodology described in this section.

2.1 Existing Research 

Published research on compliance costs with respect to financial regulation is limited, but 

nevertheless offers a helpful starting point to develop our methodology. Our review of the limited 
28 CONSUMER FINANCIAL PROTECTION BUREAU 

available research on compliance costs offers some insights on methodology and approach to 

researching this topic.

11

Elliehausen (1998) reviewed some of the empirical studies of regulatory burden and compliance 

costs, assessing the strengths and weaknesses of their methodologies (e.g., case studies, surveys, 

and econometric analyses). Elliehausen suggested a number of advantages of case studies, which 

permit researchers to work closely with a limited number of financial institutions. For example, 

Elliehausen indicated that the case study approach allows researchers to “exercise considerable 

control over the quality of the data” by directly questioning bank staff that perform specific 

compliance activities. Elliehausen also provided a taxonomy of regulatory costs, such as operating 

costs and opportunity costs.12

Elliehausen found that researchers were able to obtain more reliable estimates when they provided 

detailed guidance to study participants by: 

• Identifying regulations and the specific regulatory requirements covered in the study;

• Suggesting activities that may have been undertaken to satisfy those requirements;

• Defining the types of costs that are being measured (e.g., ongoing costs versus start-up 

costs); and

• Providing specific instructions for estimating components of those costs.

Elliehausen suggested that studies attempting to estimate the aggregate cost of financial regulation 

for the entire banking industry produced less reliable data and less informative insights. Also, 

studies that did not guide respondents through information collections by specifying in-scope 

regulations or identifying compliance activities were less likely to produce meaningful information. 

 

11 For a more comprehensive discussion of the literature reviewed as part of the Study, see Appendix A: Review of 

Existing Research.

12 For definitions of types of costs related to regulation, see sub-section 2.2.1: Study Scope and Key Concepts – Defining 

Compliance Costs and Other Key Concepts.
29 CONSUMER FINANCIAL PROTECTION BUREAU 

Grant Thornton (1993) was a three-phase study that involved a hybrid survey-case study 

methodology.

13 This approach attempted to determine the total cost of compliance and the total 

full-time employee hours required for 13 regulatory areas across the entire community bank 

industry. Barefoot, Marrinan & Associates, Inc., Thakor, and Beltz (1993) also used two surveys to 

examine the compliance costs at commercial banks and thrifts related to Federal consumer laws and 

regulations, with a particular focus on the Bank Secrecy Act, the Community Reinvestment Act, and 

the Real Estate Settlement Procedures Act.

A more recent study of community banks by the Federal Deposit Insurance Corporation (FDIC) in 

2012 offered some observations about collecting information on compliance costs. Researchers in 

FDIC (2012) conducted structured interviews with community bankers to identify specific 

regulations or supervisory practices that were significant drivers of compliance costs. FDIC (2012)

reported that tracking compliance costs was not regularly done, since costs are “so interwoven into 

[the banks’] operations.” However, participant banks said they could estimate the direct costs 

associated with regulatory compliance, while recognizing that indirect costs were more difficult to 

identify. 

Some of these studies and others reviewed in Elliehausen (1998) found evidence of economies of 

scale in compliance costs. Both Grant Thornton (1993) and Barefoot, Marrinan & Associates, Inc., 

Thakor, and Beltz (1993) found that compliance costs, when measured against factors such as total 

assets or net income, were greater for smaller institutions than for larger institutions. 

2.2 In-Depth Review of Methodology

Previous study methodologies and interviews with banks, trade associations, and researchers 

informed our choice of a case study approach using on-site structured interviews to collect 

information directly from employees at a small number of institutions. The ability to capture 

granular data on compliance costs depended on clear communication with participants about the 

costs being measured and direct contact with bank personnel. From our review of the literature and 

consultation with banks, trade associations, and researchers, we identified several best practices for

producing reliable findings, including:

 

13 The Grant Thornton study was prepared for the Independent Bankers Association of America (now Independent 

Community Bankers of America).
30 CONSUMER FINANCIAL PROTECTION BUREAU 

• Narrowing the scope of regulations in the Study; 

• Specifying the regulatory requirements and possible related compliance activities in 

scope;

• Identifying the specific costs that need to be estimated (i.e., specifying the activity and the 

component of cost being measured, such as internal labor, internal non-labor, and 

third-party resources); and

• Separating operating costs incurred only as a result of a regulation (incremental 

costs) from operating costs incurred absent regulation (baseline costs).

Separating costs of regulation from other costs requires judgment. In this sub-section, we describe 

our assumptions for the Study about the types of costs that are reasonably necessary to comply with 

the Bureau’s deposit-related regulations. These assumptions were generally conservative, so the 

compliance cost estimates in this report should be considered an upper bound.14

The methodology was separated into three phases, which involved preparing structured interviews, 

executing on-site information collections, and analyzing and validating data. 

Our approach sought to mitigate some of the inherent challenges in studying the costs of regulatory 

compliance. Banks’ business models and compliance management programs differ. In addition, 

banks generally do not track compliance costs. Therefore, identifying the costs that are uniquely 

attributable to a regulation and reporting them accurately and consistently across participants 

requires significant effort and judgment on the part of researchers. Researchers encounter a 

number of the difficulties in gathering information and calculating costs, including:

• Identifying all resources involved in compliance activities – Have all personnel, 

systems, and vendors been accounted for?

• Quantifying compliance activities – How much time or what share of a bank’s system 

or departmental resources is used for compliance? 

• Monetizing compliance activities – How much money is spent on compliance 

activities?

 

14 For a discussion on the assumptions made to estimate incremental compliance costs, see sub-section 2.2.1: Key 

Assumptions and Judgments and Appendix C: Incremental Cost Assumptions.
31 CONSUMER FINANCIAL PROTECTION BUREAU 

• Containing the Study’s burden on participants and researchers – How can 

researchers maximize efficiency of information collections?

• Standardizing data and analysis – What guidance do we need to provide to limit 

variation in the information that banks provide on compliance costs? How do we ensure that 

calculations are consistent across different institutions?

Given these general challenges, our methodology needed to be relatively simple for researchers to 

execute, easy for participating institutions to understand and follow, and still rigorous and

comprehensive.

2.2.1 Study Scope and Key Concepts

The Study focused on the costs that participants incurred to comply with regulations the Bureau 

inherited that govern consumer deposit-related products and services.15 Specifically, we studied 

compliance costs associated with checking accounts, traditional savings accounts (e.g., 

statement/passbook savings), debit cards, and overdraft programs (e.g., overdraft coverage for 

ATM and debit card transactions). While the Bureau’s inherited deposit-related regulations affect 

other products such as payroll cards, gift cards, and remittance transfers, these products and 

services were not in-scope for the Study.

The decision to study deposit products and services was partially attributed to logistical 

considerations. On-site bank visits and field work in spring 2013 coincided with the early stages of 

the 12-month implementation period for seven mortgage rules finalized in January 2013. Given the

mortgage industry’s concurrent efforts to implement new rules under Title XIV of the Dodd-Frank 

Act, it would have been difficult to assess ongoing compliance costs for this particular line of 

business. In addition, research focused on deposit products and services would be relevant for 

banks of various sizes, whereas some other products of potential interest, such as credit cards, are 

not offered by all institutions across the banking industry.

With respect to regulations, the Study focuses on Regulations DD (implementing the Truth in 

Savings Act), E (Electronic Fund Transfer Act), and, as they relate to deposit products and 

 

15 The Study does not comment upon the appropriate method and scope of analysis with respect to particular rules. The 

Bureau has discretion in any rulemaking to choose an appropriate scope of analysis with respect to potential benefits and 

costs.
32 CONSUMER FINANCIAL PROTECTION BUREAU 

services, parts of P (Gramm-Leach-Bliley financial privacy requirements), V, and certain 

sections in the Fair Credit Reporting Act (or, as a whole, the “in-scope regulations”).

16 These 

regulations implement statutes that affect common retail deposit business practices. For this report, 

we refer to the regulations as the “deposit-related regulations that the Bureau inherited” or “inscope regulations.” Table 1 outlines some of the major provisions that are within the scope of the 

Study.17

With respect to deposit-related products and services, the in-scope regulations have not been 

amended substantively since 2010. This allowed for more informative inquiries into ongoing costs

without the potentially skewing effects of significant rule changes or amendments. In light of 

changes to Regulations DD and E in 2009 concerning overdraft programs, we were also able to 

collect information on some related one-time implementation processes and costs.18 However, such 

costs were not the focus of the Study.

 

16 The CFPB inherited these regulations upon the founding of the Bureau, and now has rulemaking, supervisory, and 

enforcement authority over them. The Bureau considered certain provisions of the FCRA related to adverse action notices 

that are not implemented by Regulation V and included these provisions among the in-scope regulations. Respondents at 

participant banks indicated that they did consider activities and costs for adverse action notices to be relevant for the 

Study’s in-scope regulations.

17 A broader list of the in-scope regulatory provisions can be found in Table 1 in Appendix B: Taxonomies.

18 For more information, see Appendix G: Insights on One-time Implementation Costs. The Study does not take into 

consideration recent amendments to Regulation E governing remittance products and services, as these amendments did 

not go into effect until October 2013 and were not in scope for the Study.
33 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE 1. OVERVIEW OF THE IN-SCOPE REGULATORY REQUIREMENTS

Regulation/Law Overview of In-Scope Provisions19

Regulation DD 

(implements the Truth in 

Savings Act (TISA))

• Prohibits inaccurate or misleading information in advertisements

• Requires account disclosures be provided with interest rate and other key 

account features at account opening and on consumer request

• For institutions that provide periodic statements, requires them to include 

certain information, such as annual percentage yield, interest earned, fees 

imposed (including fees for overdraft or returned items), and length of 

statement period

Regulation E

(implements the 

Electronic Fund Transfer 

Act (EFTA))

• Prohibits assessing fees for overdraft payments for ATM and point-of-sale 

transactions unless the consumer “opts in” 

• Limits consumer liability for unauthorized electronic fund transfers based on 

timing of consumer notice to financial institution

• Enumerates procedures for responding to and resolving consumers’ error 

claims about electronic fund transfers, including a timeframe of 10 business 

days for providing provisional re-credit 

• Requires initial disclosures of terms and conditions of electronic fund transfer 

services

• Requires disclosures explaining changes in account terms at least 21 days 

prior to a change

• Requires receipts at electronic terminals for transactions above $15

• Requires monthly periodic statements 

• Requires information on ATM fees be provided at the ATM

Regulation P

(implements privacy 

provisions of the 

Gramm-Leach-Bliley 

Act)

• Enumerates conditions under which a financial institution may disclose a 

consumer’s non-public personal information to non-affiliated third parties

• Requires giving consumers, with certain exceptions, the right to opt out of 

having a financial institution disclose their non-public personal information to 

a non-affiliated third party 

• Requires initial disclosures explaining the financial institution’s privacy 

policies to a consumer before initiating a business relationship

• Requires annual disclosure to customers describing the financial institution’s 

privacy policies

 

19 The provisions in this table are not a complete list of the provisions within each regulation. For these and other 

provisions of the in-scope regulations that were studied, see Table 1 in Appendix B: Taxonomies.
34 CONSUMER FINANCIAL PROTECTION BUREAU 

Regulation/Law Overview of In-Scope Provisions19

Regulation V

(implements parts of the 

Fair Credit Reporting 

Act)

• Includes requirements that institutions: develop reasonable policies and 

procedures to apply when they receive a notice of address discrepancy from 

a CRA; respond to direct disputes from consumers regarding information the 

institution reported to a CRA; and establish and implement reasonable 

written policies and procedures regarding the accuracy and integrity of 

information that they furnish to CRAs. 

Fair Credit Reporting 

Act

(provisions not

implemented by 

regulation)

20

• Includes requirement that an institution provide a disclosure to a consumer if

the institution takes any action deemed to be an “adverse action” with 

respect to the consumer (i.e., denial of account approval) based in part on 

information obtained from a CRA.21

The Study does not cover compliance costs related to all federal deposits-related regulations. For 

example, the Study omits Regulation CC (implementing the Expedited Funds Availability Act), 

which contains sections pertaining to funds availability and the disclosure of funds availability 

policies.22 The Study also does not cover compliance costs related to statutory prohibitions of unfair, 

deceptive, or abusive practices (UDAAP). Nor did we investigate possible impacts from supervisory 

guidance issued by other regulators, such as those affecting depository institutions’ overdraft 

practices.23 Also outside the scope of the Study are federal statutes, regulations, and guidance 

intended to prevent crimes or threats to national security, such as the Bank Secrecy Act (BSA), 

“know your customer” requirements, and controls established by the Office of Foreign Assets 

 

20 Some of the provisions in the Fair Credit Reporting Act (FCRA) are not implemented by a regulation. For the purposes 

of the Study, only the adverse action notice provision from FCRA was within the scope of the Study. Other FCRA 

provisions were not included in the Study, even if they may be applicable to deposit operations, because they were less 

likely to generate material costs with respect to the in-scope products. 

21 Other disclosure requirements apply if institutions take an adverse action based on information obtained from another 

third party.

22 The Bureau does not have sole rulemaking authority for the funds-availability provisions of Regulation CC; the Bureau 

has joint rulemaking authority with the Federal Reserve Board.

23 For example, see Joint Guidance on Overdraft Protection Programs, 70 Fed. Reg. 9127 (Feb. 24, 2005) (FDIC, OCC, 

Federal Reserve Board, and NCUA); see Overdraft Payment Programs and Consumer Protection, Final Overdraft 

Payment Supervisory Guidance, FIL-81-2010 (Nov. 24, 2010) (FDIC).
35 CONSUMER FINANCIAL PROTECTION BUREAU 

Control. These laws and standards are outside the Bureau’s jurisdiction. Thus, the Study does not 

capture all of compliance costs affecting an institution’s retail deposit business.24

The Study’s focus on a well-defined set of products and consumer financial regulations was 

intended to allow us to conduct a large number of in-depth, on-site interviews with employees of 

several different departments (or business functions, such as Operations and Information 

Technology) at each participant bank.

 

24 The Bureau also recognizes that the Study methodology for segregating costs attributable to the in-scope regulations 

results in the inclusion of these out-of-scope compliance costs in the baseline costs.
36 CONSUMER FINANCIAL PROTECTION BUREAU 

Benefits of the In-Scope Deposit-Related Regulations

Each of the regulations in the Study provides certain protections to consumers who are shopping for 

deposit-related products and services. These regulations are meant generally to encourage participation in 

the banking system by promoting transparency and limiting the risks associated with such products and 

services. While the Study does not attempt to quantify the benefits associated with the in-scope regulations, 

it is important to note the types of benefits and protections these regulations afford consumers. 

Regulations DD and E each have disclosure provisions that help consumers compare and understand 

deposit and transaction products and services, including the costs associated with them. These two 

regulations also allow consumers to track fees, electronic fund transfer (EFT) activity, and other information 

about their accounts by requiring financial institutions to include certain information when providing periodic 

statements. Advertising provisions in Regulation DD further promote consumers’ ability to comparison shop 

by requiring certain account features to be disclosed and by prohibiting misleading or inaccurate 

representations of a deposit contract. Regulation E supports the growth of electronic payments and 

commerce, by reducing the risk of consumer loss associated with EFTs (e.g., through an unauthorized 

EFT). Regulation E establishes standards for investigation processes and timelines to ensure financial 

institutions meet a minimum level of responsiveness when consumers dispute certain EFT transactions to 

and from their deposit accounts. Regulation E also limits the liability of consumers from unauthorized EFTs, 

and outlines standards for re-crediting consumer funds when the financial institution has been notified of an 

EFT error.

Recent changes to Regulation E extend consumer protections around ATM and point-of-sale (POS) 

transactions. Beginning in 2010, financial institutions were required to obtain affirmative consent from 

consumers for overdraft coverage on ATM and POS transactions before the institutions charge fees on 

these transactions. This “opt-in” requirement helps ensure that consumers are aware that they might incur 

fees for overdrafts on ATM and POS transactions and gives consumers a clear opportunity to avoid such 

fees if they prefer not to elect coverage. 

Under Regulation P, a financial institution must provide consumers a notice of privacy policies and 

practices. For institutions that disclose non-public personal information about customers (and even 

consumers who are not customers) to non-affiliated third parties, with certain exceptions, customers must 

be afforded a notice and an opportunity to “opt out” of this disclosure practice. The regulation affords 

consumers an opportunity to identify financial institutions with privacy policies that match their preferences.

The ability to limit disclosure of non-public personal information to non-affiliated third parties allows 

individual consumers to balance the possible benefits of such disclosures against the chances of negative 

outcomes from such disclosures in light of their own personal preferences with respect to privacy.

Regulation V outlines the steps that furnishers and users (including banks) of consumer report information 

must take, in part to ensure information that is provided and appears on consumer reports is accurate. This 

regulation helps facilitate corrections of inaccurate or incomplete information in consumer reports through 

furnishers, which benefits consumers while also increasing reliability in the overall consumer reporting 

system. Under the Fair Credit Reporting Act, consumers who are denied the ability to open a checking 

account or get overdraft protection based on information from a Credit Reporting Agency (CRA) must be 

given an adverse action notice, which contains information about the right to dispute the accuracy or 

completeness of the information with a CRA. 
37 CONSUMER FINANCIAL PROTECTION BUREAU 

DEFINING COMPLIANCE COSTS AND OTHER KEY CONCEPTS

A key element of the Study was distinguishing costs uniquely attributed to regulation from a 

participant’s business-as-usual costs. Compliance costs are defined as operating costs incurred 

in performing the activities that are reasonably necessary to comply with and to demonstrate 

compliance with the deposit-related regulations that the Bureau inherited. These are the costs 

related to the incremental activities that would not have been performed if these regulations did 

not exist.25 Compliance costs are therefore incremental costs because they are the costs of these 

incremental activities. Baseline costs are total operating costs exclusive of those that are 

reasonably necessary for complying with or demonstrating compliance with the deposit-related 

regulations that the Bureau inherited. That is to say, baseline costs plus incremental compliance 

costs equal total operating costs.

Activities undertaken to comply or demonstrate compliance with a particular set of regulations may 

be difficult to distinguish from a participant's standard baseline practices. Some activities that a 

bank conducts to comply or demonstrate compliance with regulation may also not be “reasonably 

necessary,” which further complicates measurement of incremental costs. For the purposes of the 

Study, we did not generally judge what costs or activities are reasonably necessary for compliance,

since operational efficiency and risk appetite both vary across institutions. We based our analysis on 

the costs and activities that each participant bank reported as related to compliance with the inscope regulations. As a result, some costs and activities that may not be considered reasonably 

necessary may be included in our estimates (or, for that matter, some activities that may be 

considered reasonably necessary may not be included in our estimates).

The Study focused on the ongoing costs, or recurring operating costs, of the Bureau’s depositrelated regulations. We were also able to capture limited information on one-time or

implementation costs (or the operating costs of coming into compliance with new regulations), 

as they related to regulatory changes in 2009 governing overdraft programs, but these costs were 

not the focus of the Study.26 Implementation costs can be different in nature from ongoing costs. 

For example, labor costs, particularly costs for staff-level, non-supervisory labor, may represent a 

 

25 Elliehausen (1998).

26 In 2009, the Board of Governors of the Federal Reserve System amended regulations DD and E, which included new 

requirements for banks’ overdraft policies and practices. For more information, see Appendix G: Insights on One-time 

Implementation Costs.
38 CONSUMER FINANCIAL PROTECTION BUREAU 

larger share of costs for ongoing compliance activities than they do for implementation compliance 

activities.27

Apart from implementation costs, there are other costs related to regulation that were out of scope 

for the Study.

The Study does not estimate the opportunity costs associated with the in-scope regulations. 

Similar to Elliehausen (1998), we considered opportunity costs to the institution as the profits 

foregone from business opportunities not pursued because of regulation. Opportunity costs may 

include profit foregone as a result of avoiding products perceived to have significant regulatory risk. 

Opportunity costs may also arise from foregone profits due to regulatory restrictions (e.g., 

prohibiting banks from charging overdraft fees if a customer has not opted-in to overdraft coverage 

for ATM and point-of-sale debit transactions under Regulation E). While opportunity costs 

represent a cost to the bank, such lost profits do not necessarily reflect a loss to society. For 

example, it may be true that consumer benefits from avoiding those transactions are equal to or 

greater than the loss in bank profits.

The Study also did not measure the full scope of litigation costs, which can be incurred in response 

to public or private litigation or threats of such. Institutions may set aside funds to cover any 

potential litigation costs based on their assessments of their litigation and regulatory risks. 

Litigation costs can include costs an institution incurs to defend against accusations of noncompliance (e.g., fees for external counsel). They can also be costs from paying fines, penalties, 

damages, or settlements associated with such accusations or required by verdict. For the purposes 

of the Study, the latter form of litigation costs were out of scope since we only sought to characterize 

and measure the costs related to performing the activities required by the in-scope regulations. This 

approach is consistent with that in prior research. In addition, the frequency of cases based on the 

in-scope regulations has been limited. To the extent a participant bank performed activities to 

mitigate litigation risk for the in-scope regulations (e.g., establishing compliance management 

systems), the associated costs were considered incremental compliance costs and were accounted 

for as such.

Finally, our compliance cost estimates did not take into account the savings on operating costs that 

may offset other compliance costs. For example, mandatory disclosures may reduce the costs 

 

27 Elliehausen (1998).
39 CONSUMER FINANCIAL PROTECTION BUREAU 

associated with handling consumer inquiries, while error resolution procedures may reduce the 

costs associated with handling consumer complaints. The cost of complying with the error 

resolution requirement in Regulation E may not take into account the reductions in other operating 

costs, but those reductions would offset some of the increase in total operating costs due to the 

regulation. In addition, regulation may create large-scale demand for the mandated products or 

services that provide benefits to consumers. This is especially apparent for mandated disclosures, 

where a vendor can develop a disclosure (and the software for accessing data that need to be 

disclosed) and offer it to multiple potential users. The large-scale demand can drive down the unit 

costs of providing information about deposit accounts to consumers. Firms that wanted to provide 

these benefits in the absence of regulation would face higher costs if their competitors were not also

required to provide the benefits.

MEASURING INCREMENTAL AND BASELINE COSTS

The Study’s cost estimates rely primarily on employees’ estimates of the portions of in-house labor, 

in-house non-labor, and third-party vendor costs that are reasonably necessary to comply with and 

demonstrate compliance with the in-scope regulations. Where possible, we validated estimates with 

certain cost accounting documentation (e.g., vendor invoices for compliance-related products and 

services, budgets from the Compliance function). However, since none of the participant banks 

track compliance costs as defined in the Study, cost accounting documents alone were insufficient to 

identify incremental compliance costs.

Estimates of incremental costs were also dependent on our decisions of what activities and costs 

should be designated as a baseline cost (as opposed to a fully incremental cost that is separate from 

baseline). Such decisions have implications for the size of the compliance costs that are measured. 

Furthermore, we had to choose an available measure of operating cost to calculate a baseline cost 

for the Study.

As Figure 1 below demonstrates, we estimated each participant’s total retail deposit operating 

expense (labeled “1” in Figure 1).28 This is the total operating expenditure in the retail line of 

business that is reasonably attributable to deposit products and services. Incremental costs (2 

and 3 in Figure 1) are the costs incurred by the different departments of a participant bank to 

 

28 The Study calculated the retail deposit operating expense for each of the seven participant banks using publicly 

available information on total deposits at each bank and internal research conducted by McKinsey Global Concepts 

Institute. The model was most recently updated in 2012 and the data set includes all U.S. banks and credit unions.
40 CONSUMER FINANCIAL PROTECTION BUREAU 

perform activities required by the in-scope regulations. We measured the incremental compliance 

costs incurred by the Compliance function (2), as well as the compliance costs incurred by other

individual business functions (3) (e.g., Information Technology, Human Resources). To 

determine the baseline costs (4) for each participant, we subtracted the total incremental 

compliance costs (2 and 3) from the total retail deposit operating expenses at each participating 

institution. This remaining amount is an estimate of potential baseline cost at the participant. The 

baseline costs include compliance costs of regulations that are beyond the scope of this Study, as 

well as other costs for activities performed as a result of regulation but not required by the 

regulation.

FIGURE 1: NOTIONAL RETAIL DEPOSIT BUSINESS EXPENDITURES, BY INCREMENTAL AND BASELINE 

COMPONENTS

Note: Figure not drawn to scale

We chose to estimate a baseline using this method because attempting to construct an item-by-item 

baseline cost would have been a more challenging and time-consuming exercise. This would have 

required inquiries about the entirety of a participant bank’s operating expenses and perhaps the 

entirety of a branch’s operations, rather than targeting our questions on incremental compliance 

costs.

We generally report total incremental compliance costs as a percentage of total retail deposit 

operating expenses. Total retail deposit operating expenses is one possible denominator with 

which to compare compliance costs across banks. We also measured total compliance costs for the 

in-scope regulations against other potential denominators, such as operating expenses for the entire 

retail line of business (including residential mortgages and other consumer lending business lines)
41 CONSUMER FINANCIAL PROTECTION BUREAU 

and profit for the retail deposit line of business. 29 But we report our data using a denominator of 

retail deposit operating expenses to avoid bringing in operating expenses of other retail product 

lines. We also wanted to reduce potential error attributed to measuring compliance costs against 

denominators derived from multiple numbers (e.g., retail deposit profit). 30

KEY ASSUMPTIONS AND JUDGMENTS

Calculating incremental compliance costs required judgment to distinguish incremental activities 

from baseline activities that a participant would undertake regardless of regulatory requirements. A 

complete statement of our assumptions can be found in Appendix C: Incremental Cost 

Assumptions. Some of the incremental costs we identified that relate to the in-scope regulations 

were associated with: 

• Interactions between the Compliance function and other functions when designing new 

products, marketing campaigns and trainings, or when providing compliance advice within 

the institution;

• Preparing for related supervisory examinations;

• Producing, administering, and tracking compliance-related trainings for employees;

• Providing disclosures;

• Portion(s) of software and systems with some level of compliance-related functionality; and 

• Back office operations support for Retail function’s front office compliance activities (e.g., 

imaging and storing signature cards, customer declarations of overdraft opt-in, and other 

records required to be retained to demonstrate compliance) and for the error resolution 

process (as defined by Regulation E).

An important premise of separating incremental costs from baseline costs is that not every 

requirement in a regulation results in costs. For any given regulation, the costs related to 

performing all activities that satisfy the requirements of the regulation may include both baseline 

 

29 We do not report the data underlying specific denominators and only express compliance costs relative to a 

denominator in part to preserve anonymity of participant banks. Further, since some denominators were estimates, such 

as total retail deposit operating expense, we reviewed these figures with the participant banks. 

30 See sub-section 3.4: Compliance Cost by Participant Bank for discussion of compliance costs compared to other 

denominators and on scale effects on compliance. 
42 CONSUMER FINANCIAL PROTECTION BUREAU 

costs and incremental costs.31 It is necessary to avoid double-counting any particular activity or cost 

as both incremental and baseline. For example, Regulation E requires a periodic statement. 

However, we did not treat the entire cost of a periodic statement as a cost of regulation, because 

banks would likely provide their customers periodic statements for business reasons (perhaps in 

lower-cost formats and in different delivery frequencies) regardless of the regulatory requirement to 

provide a periodic statement. Instead, we treated just the additional pages that the participant bank 

might mail only because of the regulation as the incremental cost of compliance. Similarly, 

Regulation E also requires claims and disputes to be resolved within specific timelines. However, as 

a matter of standard business practice, banks are likely to have processes to resolve customer 

disputes related to electronic fund transfer transactions even without the regulation. Therefore, we 

assume as incremental only a portion of the staff hours spent on resolving Regulation E claims and 

disputes as a result of the mandated timelines.32

We exercised judgment in determining which costs are considered to be incremental. Arguably, 

some incremental compliance costs could be considered baseline costs and vice versa. For example, 

in assessing whether a particular regulation imposed incremental cost, we did not explicitly exclude 

state law from the baseline. State law may impose overlapping requirements and, in some instances, 

would likely impose more requirements if federal regulations did not exist. We also did not consider

as incremental the costs associated with private standard setters, such as the National Automated 

Clearing House Association (NACHA)

33 or debit card networks, although some of these standards 

may also overlap with federal regulations. If these standards would exist independent of federal 

regulation, our estimates may overstate the incremental compliance costs related to the in-scope 

regulations. 

We also made judgments about how to attribute the cost of certain activities to specific regulatory 

requirements. For example, we counted the entire time a branch employee explains the overdraft 

opt-in disclosure to a customer as an incremental cost of regulation. This may include baseline 

 

31 Elliehausen (1998).

32 For full description of assumptions made to distinguish incremental costs from baseline costs, see Appendix C: 

Incremental Cost Assumptions.

33 NACHA – The Electronic Payments Association is responsible for the management of “the development, administration, 

and governance of the ACH network.” Financial institutions using the ACH network are required to follow the NACHA 

Operating Rules, which governs activity over the ACH network. https://www.nacha.org/intronacha. 
43 CONSUMER FINANCIAL PROTECTION BUREAU 

costs, as some banks may take extra time to explain an opt-in disclosure to help the customer 

understand and perhaps sign up for available overdraft alternatives at the bank, such as linked 

account overdraft protection. Such extra time is not necessarily required by the regulation and may 

be considered a business-as-usual practice, but is included in the calculation of incremental cost.

In general, our judgments are intended to be conservative and tend to err on the side of treating 

arguably baseline costs as regulatory costs rather than vice versa. We endeavored to be systematic in 

our judgments so that estimates of compliance costs were calculated consistently across the 

participant institutions. With conservative judgments, like those described above, we recognize that 

the incremental costs reported in the Study may represent an upper bound of possible compliancerelated costs for the in-scope regulations and products at the participating institutions. 

2.2.2 The Case Study Approach

The case study methodology that this Study employed involved in-depth, structured interviews and 

data follow-ups with personnel from across each participant bank. We believed a case study 

approach was more appropriate than a survey for this foundational study for a number of reasons.

First, it was important to capture compliance activities performed throughout the participant bank, 

not just activities within the Compliance function. For employees outside the Compliance function 

of a bank, compliance activities may comprise only a small portion of their work. Only certain 

managers in the organization may recognize that they play a role in compliance, despite not being 

employees of the Compliance function. Since banks generally do not account fully for all costs of 

compliance, we needed to identify and conduct interviews with staff that could provide granular 

insight into the everyday tasks and activities performed to comply with the in-scope regulations.

Second, the Study required engagement with participants throughout the entire research process,

not just during the information collection phase. We engaged with participant banks prior to our 

arrival to help participants prepare for structured interviews. We also kept in touch with 

participants after the on-site visits when following-up on additional information and data quality 

issues. The on-site interviews were important for identifying specific compliance activities 

performed by individual functions. A small number of case studies also allowed us to perform 

thorough reviews of a multiple bank functions and the roles of various personnel within those 

functions. Other data collection methods, or even a larger number of case studies, would have been 

less likely to capture such information. 

Finally, the case study method allowed us to explain to participant bank staff what we defined as 

compliance activities within each function, and this ensured more consistency in measurement 
44 CONSUMER FINANCIAL PROTECTION BUREAU 

across participants and functions. This opportunity to work closely with the Study participants 

separates the case study methodology from other approaches used in previous studies, such as 

surveys. While surveys could cover more firms and potentially produce representative results, they 

also pose major challenges in capturing reliable and granular information that the Study sought to 

collect. Ensuring that appropriate personnel are responding to applicable survey questions can be 

difficult.34 Survey methodologies for compliance costs require extensive effort on the part of 

respondents and researchers to ensure that they consistently capture all compliance activities.

Surveys also limit a researcher’s ability to pose many specific questions. Since some of the concepts 

and definitions introduced in the Study are open to interpretation, the participants could have 

defined those parameters for themselves in ways that were inconsistent. Therefore, we needed to be 

able to set clear and consistent parameters by which specific costs and activities were to be 

considered incremental or baseline.

BANK SELECTION

The methodology developed for the Study was intended for use with participant institutions of all 

sizes and types. Given the resource demands of the case study methodology, we approached a small 

number of institutions for participation in the Study. Seven banks voluntarily agreed to participate. 

We believed that focusing on a small number of institutions increased data reliability. Limiting the 

number of banks in the Study also afforded us multiple opportunities to scrutinize and validate the 

information we collected. However, the Study does not have enough case studies to generalize our 

findings across the broader banking industry. The findings therefore represent hypotheses of 

compliance costs rather than evidence for any particular industry-wide conclusion.35

We used several standards to select participants in the Study. We segmented the industry by a 

number of variables including asset size, size of branch network, geographic distribution (i.e., 

location of branches), prudential regulator, and size of an institution’s consumer banking business 

(which we proxied by size of its residential lending portfolio).

The participant banks are divided among four different asset tiers, as described in Table 2.

 

34 Elliehausen (1998).

35 Elliehausen (1998), “Relationships suggested by the results of case studies, therefore, should be regarded as hypotheses 

rather than definitive evidence.”
45 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE 2. PARTICIPANT INSTITUTIONS BY ASSET SIZE CATEGORIZATION 

Tier36 Asset Size # of Banks in Study

1 > $100 billion 1

2 $10 billion - $100 billion 2

3 $1 billion - $10 billion 2

4 37 < $1 billion 2

The selection criteria allowed us to study a group of participant institutions that could offer insight 

into the different ways banks manage compliance. However, we are mindful that banks that are 

willing to volunteer for research of this type may differ in business or compliance practices from 

those would not be willing to volunteer. A study of institutions outside of the participant group of 

seven banks may have yielded different findings.

Even among the seven participant banks, there were differences in business models. To avoid 

adding complicating variables, the Study focused on commercial banks and did not include other 

types of institutions. Credit unions and thrift institutions were excluded from the Study since key

differences, such as ownership structure, might have contributed to these institutions having 

different compliance spending patterns from banks. Differences amongst institution types could 

also have further compounded errors in calculations.

2.2.3 Information Collection Design, Execution, and Analysis

The methodology we outline in this report was developed to capture ongoing compliance activities 

and costs, as well as those activities and costs that can be measured retrospectively. By design, the 

 

36 The seven banks in the Study are designated as follows, in order of decreasing asset size: Tier 1, Tier 2A, Tier 2B, Tier 

3A, Tier 3B, Tier 4A, and Tier 4B.

37 As of the fourth quarter of 2012, of the more than 6,000 FDIC-insured commercial banks, approximately 90 percent 

had assets of $1 billion or less. The median asset size of banks in this broader population was approximately $168 million. 

The two Tier 4 banks in the Study had asset sizes above the median for the population. Source: FDIC, Institution 

Directory, online at http://www2.fdic.gov/IDASP/main.asp.
46 CONSUMER FINANCIAL PROTECTION BUREAU 

methodology is not informative about ongoing compliance costs in years with significant regulatory 

change or unusual levels of product change. In these atypical years, the compliance costs might be 

higher or lower, and other business functions might have a bigger or smaller share of costs.38

We developed a case study methodology that consisted of three phases. Phase 1 designed the 

information collection and focused on preparation for the on-site visits. Phase 2 consisted of on-site 

interviews at the seven participating institutions. Phase 3 included analyzing and validating the 

data, as well as conducting additional quality control tasks, such as follow-ups with participants on 

any missing or inconsistent information.

PHASE 1: DESIGNING THE INFORMATION COLLECTION

The first phase of the Study focused on determining which bank personnel to interview and 

developing targeted interview questions. We constructed three broad taxonomies: one for types of 

regulatory requirements, a second for various activities in the customer lifecycle of deposits-related 

products and services, and a third for business functions at participant banks.39 Identifying the 

more salient intersections of the three different taxonomies allowed us to identify potential 

compliance responsibilities of different business functions. This made it easier to propose a list of 

bank personnel to interview.

The regulation taxonomy categorizes the particular requirements of the in-scope regulations. 

For example, one type of requirement was disclosures. Required disclosures could be either 

prompted by consumer action (e.g., overdraft opt-in disclosure at account opening) or unprompted 

(e.g., privacy notice sent out every year). Some of the other types of requirements focused on error

and dispute resolution, as well as authorization rights (e.g., consenting to paid transactions that 

overdraw an account). In total, we created nine different categories of the types of regulation in the 

scope of the Study, as summarized in Table 3. The categories were comprised of 38 specific 

provisions from the in-scope regulations.

 

38 Atypical years may experience one-time compliance costs due to the implementation of new regulations and/or 

amendments. While these one-time implementation costs were outside the scope of the Study, we were able to collect 

some information from participant banks about the steps they took to implement regulatory changes. Such information 

provided some insight into the size and nature of one-time implementation costs for the 2009 amendments to Regulations 

DD and E on overdraft programs. See Appendix G: Insights on One-time Implementation Costs.

39 Three tables presented in Appendix B: Taxonomies provide details on each of the taxonomies.
47 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE 3. REGULATION TAXONOMY 

The customer lifecycle taxonomy details the activities and sub-activities across different stages 

of a customer’s interaction with a participating institution around its deposit products and services. 

The customer lifecycle has four stages: customer acquisition, account opening, account 

maintenance, and account closing. Each stage is comprised of a number of major activities and 

sub-activities that personnel perform to support the higher-level activity. For example, subactivities involved in “providing account information” during account maintenance include sending 

consumers monthly account statements and providing online access to account information. Within 

the four stages of the customer lifecycle, we identified 37 categories of customer lifecycle activity 

and 119 corresponding categories of sub-activity.

The business function taxonomy consists of the major functional areas (“functions”) and 

associated activities (“sub-functions”) within banks that support regulatory compliance for the retail 

deposit line of business. Such functions include Compliance, Operations, and Information 

Technology (IT). Within each function are sub-functions that have specific responsibilities related to 

REGULATION REQUIREMENT 

CATEGORY DESCRIPTION

Advertising Requirements or limitations on the form or content of information 

disseminated for the purposes of advertising products

Authorization Rights Requirements to provide consumers with the option of accepting 

or declining participation in a given service 

Calculation Methodologies Requirements regarding methods for calculating rates, charges, 

fees, or other quantitative metrics

Contracting and Outsourcing Requirements or limitations regarding the contracting or 

outsourcing of bank operations that affect consumers

Error and Dispute Resolution Requirements or limitations regarding the manner in which 

consumer disputes can be resolved

Information Exchange Requirements or limitations regarding the provision or receipt of 

non-public consumer information to or from a third-party agent

Information Retention Requirements or limitations regarding the retention and storage 

of consumer information

Prompted Disclosures Requirements to provide information to the consumer prompted 

by an exogenous bank- or consumer-initiated event

Unprompted Disclosures Requirements to provide information to the consumer on a 

recurring and/or ongoing basis
48 CONSUMER FINANCIAL PROTECTION BUREAU 

compliance with the in-scope regulations. For example, the IT function generally houses subfunctions such as application development, quality assurance, and infrastructure management.

40

A function is not necessarily equivalent to a separate office or team in a bank. Functions may differ 

based on the way that an institution organizes its business. Many financial institutions are too small 

to create a separate staff for each function. At the smallest banks, a single employee might perform 

two or more functions. While we structured our interviews to gather information from various 

business functions, we ultimately collected and recorded cost information for individual 

compliance-related activities. As a result, similar functions at participants may not perform the 

same set of compliance-related activities. For example, the two Tier 4 banks in the Study do not take 

in customer calls through call centers, a sub-function we categorized under the Operations business 

function. Rather, the front-line staff in the Retail function handles customer phone inquiries and 

any disputes reported by phone. In those two cases, we captured compliance costs associated with 

the intake of disputes in the Retail function. 

By categorizing tasks and personnel to more detailed sub-function levels, we were also able to 

categorize costs into different components, such as internal labor costs, internal non-labor costs, 

and external third-party costs. In total, we identified eight general business functions with 35 

corresponding sub-functions. Details on the functions and the sub-functions are provided in Table 

4.

 

40 Throughout the report and for distinction from general terms, business functions as described in the Study taxonomy 

are capitalized (e.g., the “Compliance” function, as opposed to general “compliance” activities). The taxonomy’s subfunctions are also referenced frequently in the report, but are not capitalized.
49 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE 4. BUSINESS FUNCTION TAXONOMY 

FUNCTION SUB-FUNCTIONS OVERVIEW OF RESPONSIBILITIES

Operations

• Call Centers

• Fulfillment

• Back Officer Support

• Fraud Mitigation/ Error Resolution

The Operations function oversees production and 

distribution of statements and forms, branch support, 

researching and resolving disputes in relation to error 

resolution processes, and consumer interactions in Call 

Centers.

Information 

Technology

(IT)

• Application Development and 

Maintenance

• Infrastructure Management

The IT function is responsible for the development and 

maintenance of systems and software that provide some 

degree of compliance functionality. Some systems and 

software may be uniquely dedicated to supporting a 

compliance activity, while others support other business 

functions and activities (e.g., a core processor), but may 

include additional compliance activities.

Retail

• Distribution

• Front-line Management/Platform 

FTEs

• Product Development and 

Management

The Retail function is the consumer-facing function 

responsible for managing the bank’s ATM and branch 

network, interfacing with customers to open/update 

account or resolve disputes/concerns, and developing 

and designing new products and services.

Corporate 

Oversight 

(Risk/Audit)

• Enterprise-wide Standard Design

• Internal Exams

Corporate Oversight consolidates the Risk and Audit 

functions. Responsibilities include conducting enterprise 

risk monitoring and preparing, designing, and 

performing internal audits of various bank functions.

Legal

• Research

• Product and Policy Review

• Advice and Counsel

Legal reviews and assesses regulatory requirement to 

help guide compliance, provides advice for 

product/policy reviews, and defends the business 

against lawsuits or complaints.

Human 

Resources 

(HR)

• Training Design and Development

• Training Deployment and Monitoring

HR is responsible for the continuous development, 

deployment, and monitoring of annual employee 

compliance-related trainings.

Marketing • Marketing Design and 

Implementation

Marketing staff are typically responsible for conducting 

market research, developing marketing strategy for new 

products and services and for the bank as a whole, and 

advertising.

Compliance

• Regulatory Research and Gap 

Analysis

• Policy and Procedure Design

• Monitoring and Reporting

• Business Advice and Counsel

• External Exams

Compliance staff perform regulatory research, designing 

policies and procedures to ensure compliance, 

monitoring compliance processes, providing advice and 

responses to other functions, and facilitating external 

supervisory activity.
50 CONSUMER FINANCIAL PROTECTION BUREAU 

After constructing the taxonomies, we mapped each regulatory requirement to a corresponding 

activity on the customer lifecycle and identified the various functions that would likely perform each 

activity. This exercise yielded thousands of intersections among the different regulatory 

requirements, customer lifecycle activities, and business functions. Each of these intersections 

represented a hypothesis of potential compliance costs. After conducting internal analysis and 

consulting subject matter experts familiar with retail banking and bank operations, we determined 

that the vast majority of these intersections had insignificant costs and worked to identify the 

intersections that plausibly could contain a cost greater than zero. Figure 2 demonstrates an 

example where, for a given bank, there could be internal non-labor costs in the Compliance function 

(business function) associated with marketing to potential new customers (customer lifecycle 

– [customer] account acquisition) while complying with advertising standards (regulation –

Regulation DD).

FIGURE 2: DEMONSTRATION OF SYNTHESIZED COMPLIANCE COST STUDY TAXONOMIES

Testing all of the hypotheses would be challenging in any reasonable amount of time, and most of 

them were too granular to elicit useful information from an employee. Thus, we used guidance from 

our industry and regulator consultations to narrow our list of intersections into a list of about 500 

hypotheses. Each hypothesis indicated whether the potential cost would have a comparatively 
51 CONSUMER FINANCIAL PROTECTION BUREAU 

higher, medium, or lower impact. For each interview, we focused our questioning on gaining insight 

where there appeared to be a high or medium cost impact. These characterizations of impact are 

relative to the total cost of compliance at a participating institution. They do not represent a 

judgment that any particular cost would be “high” or “low” in an absolute sense or relative to 

benefits of the regulation.

While we initially attempted to record a cost for each of the 500 hypotheses, as our on-site visits 

progressed we narrowed down the set of hypotheses to 140. Some sub-functions that we included in 

initial lists of hypotheses were removed if we observed little to no costs incurred at that subfunction or if the participant bank considered the costs to be incurred by another function or subfunction. 

Based on our list of hypotheses, we developed an interview instrument that would give us sufficient 

flexibility to address these hypotheses.

41 Before visiting each participating institution, we briefed 

key personnel by telephone conference call to explain the scope of the Study and answer questions. 

We gathered background information about each participating institution prior to arriving on-site, 

such as organizational charts, sample disclosures, and policies and procedures. This information 

allowed us to familiarize ourselves with each institution, organize in advance our interviews, and 

structure our questions accordingly.

It is important to note that some of the costs that we measured fall outside of the taxonomies. 

Specifically, costs related to preparing for and managing external examinations are not necessarily 

costs related to complying with particular provisions of the regulations in scope. Still, institutions 

are subject to examination around the in-scope regulations and products. To remain consistent with 

our definition of compliance costs, which includes the costs of demonstrating compliance, we 

included some costs associated with undergoing a supervisory exam related to the in-scope 

regulations. The compliance-related examination costs we report in the Study only include the 

Compliance function costs of facilitating exams, as estimated through activities associated with preexam preparation, on-site support, and post-exam follow-up. While we believe this captured a 

major portion of examination costs, our estimates may underestimate the full cost of exams by not 

fully accounting for the involvement of non-Compliance function staff and executives in relevant 

 

41 Per requirements set forth in the Paperwork Reduction Act, we obtained approval from the Office of Management and 

Budget to collect this information (OMB Control Number 3170-0032). See Appendix D: Pre-Visit Documents —

Compliance Cost Study Pre-Visit Information. While in the field, we adapted the instrument to each bank function as 

needed.
52 CONSUMER FINANCIAL PROTECTION BUREAU 

exam activities. Further, we included the costs related to external examination to provide greater 

context and because the staff we interviewed often were involved in the examination process.42

PHASE 2: CONDUCTING ON-SITE INTERVIEWS

Phase 2 focused on conducting on-site bank interviews. We interviewed approximately 200 bank 

executives and employees across all seven participant banks.

The on-site visit at each case study bank started with a kick-off meeting to remind relevant senior 

executives, managers, and other bank personnel of the Study’s goals and brief them on the Study’s 

methodology. Following the kick-off meeting, the initial portion of the on-site visit (one to two days) 

was spent in scheduled meetings with executives and other bank personnel. These initial interviews 

focused on getting an overview of the business functions of each participant bank and discussing the 

key compliance responsibilities of each of these functions as they relate to the Study scope. At each 

participant bank, some aspects of the business functions were different. For example, while HR staff 

at most participants were responsible for the development of training materials and modules, one 

bank placed more development responsibility on Retail function staff. We ensured that, despite 

such differences, costs were captured and allocated to functions consistently in our analyses.43

We made efforts to interview personnel who were either responsible for or who would have the most 

knowledge of the cost of a particular compliance activity. For example, at each participant bank we 

interviewed a branch banker to find out how much time is spent on activities related to the in-scope

regulations during the account opening process.

The initial interviews also provided an opportunity for executives and managers at each respective

participant institution to identify additional staff who had a more detailed understanding of 

compliance activities. Follow-up interviews with these identified personnel comprised the 

remainder of the on-site visit. These targeted discussions focused on estimating the costs of 

 

42 The Study does not draw conclusions on the costs or activities the Bureau considers “reasonably necessary” for 

compliance with the Bureau’s deposit-related regulations. It is not clear that aggregate examination costs will increase 

because of a new rule going into effect. In addition, although the cost of demonstrating compliance in the course of an 

examination is not necessarily a cost of complying with specific provisions of the in-scope regulations, we have included 

this cost in our estimates because staff we interviewed uniformly regarded examination costs for the in-scope regulations 

as compliance activity.

43 See discussion in sub-section 2.2.4: Methodological Challenges – Standardizing Data and Analysis for more 

information on the steps we took to control for any inconsistencies in the manner data was collected by different teams or 

in the way banks provided us with data.
53 CONSUMER FINANCIAL PROTECTION BUREAU 

particular sub-functions within one of the identified business functions. We also conducted followup interviews to review and corroborate information from on-site conversations.

During each interview, we took time to explain the concept of incremental cost of compliance, which 

helped interviewees understand the key concepts of our methodology and describe the costs and 

activities related to the in-scope regulations. Since each participant is organized differently, we 

needed to be structured but not rigidly prescriptive in our interview approach. This allowed 

interviewees to identify relevant tasks, personnel, and issues that might have been otherwise 

overlooked.

Two different interview approaches, or a combination thereof, were used to lead the interview:

• Top-down – Interviewees identified the scope of their responsibilities, and the Study team 

facilitated the interviewees in narrowing those responsibilities to those related to compliance 

with the in-scope regulations and products, and ultimately to our hypotheses (e.g., 

interviewees describe their responsibilities and Study team prompts them to divide up their 

time – by hours or percentages – dedicated to those responsibilities and activities).

• Bottom-up – The Study team framed the conversation around particular compliancerelated activities based on the hypotheses developed, and the interviewees specified the 

details of their everyday tasks that contributed to those activities (e.g., the Study team 

described the broad responsibilities within the business function of regulatory interest, and 

interviewees itemized their activities – by task and time spent on each – which are tallied for 

analysis).

In most interviews, we generally obtained information on staffing, dollar costs for labor and nonlabor resources, dollar costs on third-party services, and time (or percentage of time) spent on 

compliance activities.

Information collected during the on-site interviews was sometimes supported by additional

documentation. We also asked participants for any readily available reports and other relevant 

documents, such as department budgets, policies, and project plans, that may have described or 

itemized activities and costs related to compliance. Depending on the institution, participants also 

shared detailed information such as the number of account openings and Regulation E complaints 

in a year, the cost of training modules for the in-scope regulations, time spent by call center 

personnel on compliance activities, the budget for the Compliance department, and the overdraft 

opt-in implementation plan. Participant institutions submitted additional information on a purely 

voluntary basis, and not all information collected during interviews was further substantiated by 

written documentation.
54 CONSUMER FINANCIAL PROTECTION BUREAU 

PHASE 3: ANALYZING AND VALIDATING DATA

Once the on-site visits were completed, we began to analyze data and compare the information, 

including a review of the quality of information across the seven participant banks. For each 

participant bank, we attempted to estimate incremental compliance costs for as many of the 140 

hypotheses we addressed while in the field. 

As part of our quality control efforts, we followed up directly with participants to verify certain 

pieces of information, correct any inconsistencies, and fill gaps in our data. Follow-up was 

conducted through e-mail and phone calls. To further verify certain costs, we contacted external 

industry experts. For example, we had conversations about pricing with external experts who had 

experience in pricing software compliance modules at several financial technology vendors. As a 

result of these conversations, we adjusted accordingly the Study’s estimates of IT core processor 

software costs related to compliance for several participant banks. The adjusted estimates were 

consistent with the results we received from the participant bank that had used actual invoices from 

their core processing vendor to parse out the incremental cost of software related to the Bureau’s 

deposit-related regulations.

The results from this and similar analyses are presented in the Key Findings section of this report.

2.2.4 Methodological Challenges

From our initial preparation for on-site information collection at participant banks to our post-visit 

follow-ups, we took steps to mitigate the challenges inherent in gathering information on 

compliance costs. Again, these challenges are rooted in the fact that there is no standardized 

method of measuring or collecting costs of business models and different approaches to compliance 

management. In the following section, we further describe the challenges of collecting cost 

information and of calculating incremental compliance costs at each participant. We also explain 

how we adapted the case study methodology to address these challenges. Similar to assumptions on 

baseline and incremental cost, the steps taken to mitigate the methodological challenges have 

implications for the costs measured. 

IDENTIFYING ALL RESOURCES INVOLVED IN COMPLIANCE ACTIVITIES

As discussed above, our preparation for the on-site interviews included developing a framework that 

represented all relevant compliance activities within a participant bank and identified how those 

activities were distributed across various business functions and sub-functions. We designed this

framework to ensure that no major compliance activity would be overlooked and that discussions 

with personnel at participant banks could focus on the compliance activities relevant to their 

respective sub-functions. As previously mentioned, prior to on-site visits, we held multiple 
55 CONSUMER FINANCIAL PROTECTION BUREAU 

conversations with executives and other personnel and reviewed organizational charts to identify 

the right individuals for initial interviews.

We refined our questioning as interviews with executives and staff progressed, combining “topdown” and “bottom-up” lines of inquiry and probing questions as appropriate. Pre-field preparation 

and communications ensured that all Study team members knew how each participant bank 

organized its functions and could ask about compliance activities in a standardized way. However, 

this approach assumed that an institution’s management had enough knowledge of the units they 

managed to connect the work they performed to the compliance activities and sub-activities that we 

described, which we believe that all seven participant institutions in the Study had. We may have 

missed some resources involved in compliance activities if the relevant activities were not described 

in enough detail, or if an interviewee failed to mention that certain personnel, systems, or vendors 

performed specific activities. We mitigated these risks by detailing beforehand our categorization of

business functions and how those functions support compliance activities.

Identifying all personnel and systems involved in compliance activities was more challenging for the 

larger institutions than for the smaller ones. At the larger banks participating in the Study, 

information about the same compliance activities and processes was often allocated among many 

people across multiple teams. Individual employees were often specialized within one aspect of a 

multi-step process. It could be difficult to identify all the relevant staff associated with that 

particular process, increasing the possibility that they may have been overlooked and that not all inscope compliance activities and costs may have been fully accounted for.

Among the smaller banks participating in the Study, fewer people were involved with compliance 

activities and processes, which made it easier to identify nearly all of the appropriate people to 

interview. In some cases, a single person at a smaller institution may have had comprehensive 

knowledge about the equivalent areas spread over many people at a larger institution. At the same 

time, as more compliance-related responsibilities are centralized under one department or 

individual, it may become more difficult to parse the labor costs for individual activities.

Identifying all of compliance-related vendors relevant to the Study scope was also a challenging, 

time-intensive exercise. While the Study participants could produce lists of vendor names from 

invoices or their vendor management databases, accurate identification of resources directly 

attributed to compliance activities was generally difficult, since the in-house staff managing the 

relationship with the vendor might not have the same granular knowledge of the work and systems 

as the vendors themselves. Gathering details about vendor-driven compliance activities was further 

complicated by the fact that the differently sized participant banks had vastly different numbers of 

relevant vendors, ranging from just a few contracted service companies for the smallest case study 
56 CONSUMER FINANCIAL PROTECTION BUREAU 

banks to many thousands of companies for the largest banks in the Study. However, every 

institution participating in the Study had staff who knew what the bank was buying and could 

identify the compliance functionality of different systems and services.

In particular, the smaller Tier 4 banks were able to discuss in relatively rich detail each system or 

product supplied by vendors and provide a specific percentage of the cost of each product that was 

allocated to the in-scope regulations. These participant banks were able to supply lists of vendors 

and systems involved with the deposits line of business. To estimate similar costs at Tier 2 and Tier 

3 banks, we typically used a combination of documentation provided by the bank on its vendor 

relationships and a framework we provided to participants to systematically detail which of their 

third-party costs were relevant to the in-scope products and regulations.

QUANTIFYING COMPLIANCE ACTIVITIES

Once compliance activities were identified, they had to be quantified in a standardized and 

informative way. This meant assessing the tasks and activities to determine the amount of staff time 

spent on certain compliance activities or share of a system or product that was used for compliance. 

Recognizing that circumstances varied across participants, we would accept answers in whatever 

form staff could provide them. We would ask about the number of personnel engaged in a particular 

compliance activity for a particular percentage of a week or for a certain number of hours per week. 

Most staff interviewees were able to describe their compliance-related activities in a weekly time 

frame, although in some cases answers were given as percentages of a week. Such responses would 

not necessarily have been consistent with the answers given as a number of hours. For activities 

performed via third-party vendors, we would ask directly about the share of spending associated 

with the part of the product or service engaged in compliance.

There are certain challenges in quantifying compliance activities. First, the same personnel, 

systems, and vendors might perform both compliance and non-compliance activities. Moreover, 

those personnel, systems, and vendors may be responsible for many different compliance activities. 

As such, it may be difficult to distinguish how much of some period of time or what particular 

portion of a certain system was dedicated specifically to the compliance activity within the 

regulatory scope of the Study. Staff interviewees were usually able to estimate the hours that they 

spent engaged in compliance activities in general. For example, staff in the Marketing function 

might know the times per year or number of weeks they spent interacting with the Compliance 

function for the purposes of reviewing marketing campaigns or designing new products. However, it 

was difficult to be precise in estimating the extent to which this interaction addressed specific 

requirements of the in-scope regulations. The accuracy of quantitative information provided by 

interviewees likely depended on the extent to which bank staff could check their intuition against 
57 CONSUMER FINANCIAL PROTECTION BUREAU 

corroborating or conflicting information, as well as the perceived importance of providing accurate 

answers. 

Certain rules require “smaller” compliance activities that are hard to measure. For example, it is 

difficult to quantify the cost of extra lines on a periodic statement attributed to the overdraft

disclosure rule; the cost would be a very small percentage of the annual maintenance fee paid to 

core processors to generate periodic statements. Similarly, the time spent replacing paper in ATM 

machines to ensure that banks can always provide a receipt to the consumer is an incremental 

compliance cost, but contributes only a tiny portion of the total time spent on ATM maintenance. 

We believed it was important to account for these costs so as not to ignore the types of cost that add 

up over multiple regulations. However, quantifying these small costs with any amount of precision 

is inherently challenging. 

Another challenge resulted from the fact that staff at different participant banks might have 

different perceptions of the general intensity of compliance activity over time. The Study only 

focused on “point-in-time” costs and did not compare these costs to the size and composition of 

compliance costs from previous periods. In general, we asked for answers for a typical week. When 

specifying year, we used 2012 as the benchmark and focus of a bank’s in-scope regulatory 

experience. Our assumption was that financial institutions had largely adjusted their products and 

services to the most significant recent regulatory changes in this market (the Regulations DD and E 

overdraft amendments).

44 However, it is possible that the different perceptions of bank personnel 

regarding the intensity of compliance activity in a typical week or year could lead to different 

answers across the seven participants in the Study.

Finally, as indicated earlier, there is an inherent challenge in trying to discern costs that are 

“reasonably necessary” to fulfill regulatory requirements from other factors, such as any 

discretionary costs financial institutions may incur based on the way they choose to respond to 

regulation. Institutions may employ any number of different strategies to satisfy regulatory 

requirements, and some courses of action and their associated costs may depend on how an 

institution decides to conduct its business. As we describe in the Key Findings section, some of the 

 

44 As previously mentioned, amendments to Regulation E associated with remittance transactions were not in-scope for 

the Study. In addition, costs related to any operations changes resulting from the amendment to the Electronic Funds 

Transfer Act (the “Durbin amendment”), which regulates interchange fees , were not captured in the Study. The Durbin 

amendment is implemented by the Federal Reserve Board's Regulation II (12 CFR part 235). Information about 

Regulation II is available at http://www.federalreserve.gov/paymentsystems/regii-about.htm.
58 CONSUMER FINANCIAL PROTECTION BUREAU 

differences in compliance costs among case study participants may be attributed to certain business 

decisions by institution, such as the choice to offer overdraft coverage or shorten the error 

resolution timeframe to resolve claims more quickly and improve customers’ experience. Business 

models can differ based on any number of decisions and contribute to the challenge of measuring 

compliance costs consistently across institutions.

MONETIZING COMPLIANCE ACTIVITIES

For in-house labor, participant institutions provided wage and salary information. We multiplied 

this information by the percentage of time personnel reported spending on a particular compliance 

activity to determine the compliance costs in different functions. Each participant also reported 

salaries at different levels of precision. At smaller institutions we received nearly individual-level 

salary information, while at larger institutions we obtained broad ranges by general position.

In order to monetize vendor-driven compliance tasks and activities, we needed to estimate expenses 

for systems and activities completed by third-party vendors. Pricing information for systems and 

vendors ranged from approximations to line items from invoices and contracts. Regardless of the 

precision of the pricing information, monetizing vendor systems and activities required confidence 

that the systems and activities truly provided some degree of functionality related to compliance 

with the in-scope regulations. Validating relevance of a third-party service to compliance required 

multiple follow-up discussions, especially with IT personnel. During interviews with IT personnel, 

we inquired about each system used in the retail deposit business and clarified how such systems 

supported specific compliance activities within this line of business.

CONTAINING THE COSTS OF THE STUDY TO ORGANIZERS AND PARTICIPANTS 

Executing a case study methodology with on-site interviews requires substantial effort on the part of

both our eight-member research team and Study interviewees. As the organizing researchers, we 

needed to be efficient in our collections. We took time to design an appropriate approach for 

uncovering and capturing data and identifying the right people to speak with at each participating 

institution. As previously indicated, using case studies to collect information balanced important 

factors affecting collection burden and quality, including the amount of time spent at each

participant, quality of information collected, and number of institutions visited.

Efficiency in a case study methodology also required some flexibility in research team composition. 

While we wanted to minimize the resource burden on participants, we also wanted to have enough 

time to collect information appropriate for analysis. Interviews and follow-ups depended to some 

extent on the availability of bank personnel and what information the research team gathered. A 

larger research team was more appropriate for larger banks with more personnel. For smaller banks

that often had the same individuals working in different business functions, it was more efficient to 
59 CONSUMER FINANCIAL PROTECTION BUREAU 

split the team and conduct interviews at smaller Study participant banks separately but 

simultaneously.

Participating institutions had to make managers and staff available for discussions lasting up to 90 

minutes and accommodate possible follow-up conversations with all interviewees. Effective 

information collection in this limited amount of time per interview required clear, advanced 

communication about the Study, methodology, and expectations to managers and personnel. As we 

completed interviews and site visits, we also actively incorporated feedback about clear 

communication so that we could make more effective at the next interview or visit.

STANDARDIZING DATA AND ANALYSIS

As noted in the previous sub-section, an efficient information collection process sometimes 

necessitated splitting up the eight-member research team. Sending different teams to different 

participants, or even splitting up teams within a single institution, is a potential source of 

inconsistency in the depth and accuracy of information collection. To manage interviewer 

heterogeneity, members of the research team were trained to pose questions and follow-up 

questions in similar ways. However, every interview was different, and interviewers had to adapt

based on the amount and quality of information produced during each interview.

We scrutinized the answers in the field and asked clarifying questions as necessary to limit error 

and any potential bias in those answers. In some cases (e.g., responses to questions on call center 

time, employee training time, certain IT systems), we could check the answers against other 

information provided by the bank. Due to the limited amount of time to collect information during 

on-site visits, we sometimes had to follow up with participants following the visits to fill in missing 

information and data gaps. 

Data standardization and analysis also involved identifying inconsistencies both internal (e.g., 

quantified hours spent on an activity at a participant bank did not match up with the bank’s 

qualitative explanation) and external (e.g., major quantitative and qualitative differences with 

respect to other participant banks). Any major discrepancies in data led to careful review of whether 

inconsistent information was possibly subject to the errors in identification, quantification, and 

monetization described above. We also examined whether any participant banks exhibiting data 

discrepancies were subject to the same degree of on-site questioning as at other participants. For 

example, one bank might report the share of different IT systems devoted to in-scope compliance 

activities while another bank might report the share devoted to all compliance activities.

Given the methodological and logistical limitations described above, we attempted to standardize 

the information in a number of ways. Standardization techniques were especially relevant for 
60 CONSUMER FINANCIAL PROTECTION BUREAU 

information that appeared to be major outliers. As previously described, we took steps to investigate 

certain outliers, such as consulting with Bureau and external experts to validate certain pieces of 

data and to ensure we were calculating costs in a consistent manner. In some instances, we received 

more granular data from certain banks that was not consistently collected from others. For example, 

at one participant bank, we collected very detailed information on the cost of third-party products 

and services on the Compliance function’s budget and time spent by staff outside the Compliance 

function liaising with an examiner during a supervisory exam. For such cases, we noted the 

information, but excluded it for the purposes of having consistent measures across all seven Study 

participants.

□ □ □

This section presented the scope and methodology of the Study, including steps we took to mitigate 

inherent challenges measuring compliance costs. Distinguishing incremental costs from baseline 

costs was one of the principal challenges of the Study. The judgments we made to distinguish 

incremental costs have implications for our estimates of these costs. 

Other researchers may wish to use, adapt, and refine the methodology we present here. To make it 

easier for researchers to build on this methodology, we summarize the incremental cost 

considerations and general techniques of the methodology in Appendix C: Incremental Cost 

Assumptions and Appendix H: General Techniques, respectively.
61 CONSUMER FINANCIAL PROTECTION BUREAU 

3.Key Findings

We executed the methodology described in the previous section by defining a framework for the 

information collection, conducting on-site interviews at various institutions, and analyzing the data. 

In this section, we discuss findings about the nature and extent of compliance activities and costs 

among our Study participants for the in-scope regulations. 

We report analyses of compliance costs from three different perspectives. To deepen understanding 

of the sources of compliance costs, we analyze costs in two ways – by business function and by type 

of regulation – and examine how these breakdowns vary across the seven participating institutions 

we studied. We also compare aggregate compliance costs for the regulations we studied across the 

seven institutions. 

We quantify costs at the level of the business function and at the level of the institution. We report 

the share of compliance costs for the in-scope regulations attributed to each business function and 

compare those shares across participant banks. We also report compliance costs at the institutional

level, using a common denominator to enhance comparability.

Quantification of costs helps sharpen understanding of their sources and how those sources may 

vary from institution to institution. All of these estimates are subject to the limits that we set forth in 

the Methodology section and key caveats we state at the end of this section. The most important 

caveat is these data reflect costs at seven banks for the regulations we studied – not necessarily for 

other financial institutions or for other regulations. Moreover, this report assumes that each 

participant bank considers a number of factors, such as the size of the geographic or customer 

footprint and operational efficiencies, prior to determining which business model is appropriate for 

their respective institution.
62 CONSUMER FINANCIAL PROTECTION BUREAU 

3.1 Overview of Key Findings

We analyze the sources of in-scope compliance costs for the seven case study banks from three 

different perspectives.

First, we examine costs by business function. Among the Study’s seven participant banks, 

compliance costs appear to be concentrated in Operations, Information Technology (IT),

Human Resources (HR) (as it relates to employee training), Compliance, and Retail

functions. We describe the compliance-related activities that each function engages in and also 

identify activities that entailed higher costs. Table 3 of Appendix B: Taxonomies provides details on 

the functions and sub-functions.

Second, we examine activities and associated costs for the types of regulatory requirements that 

caused the participant banks to incur the most costs among the requirements we studied. The four 

types of requirements we analyze are: authorization rights (which include opt-in for overdraft 

coverage under Regulation E and opt-out for sharing information with third-party affiliates under 

Regulation P), error resolution requirements, mandated disclosures, and advertising 

standards. We describe the activities conducted by banks to comply with these requirements and 

explain how these activities may have generated costs across different functions. The findings are 

consistent with a hypothesis that, for the in-scope regulations, authorization rights and error 

resolution are generally more costly to administer than advertising standards or disclosure 

mandates.

Third, we compare aggregate costs across the seven case study participants. We find that the two 

smallest institutions in the Study incur higher relative costs (as a portion of their total retail deposit 

operating expense) than the five larger participating institutions and offer potential explanations for 

possible economies of scale.

3.1.1 Quantitative Presentation of Compliance Costs

In this section, we present costs in two different ways. In sub-section 3.2: Compliance Cost by 

Business Function, we present the share of compliance costs in each function at each participant 

bank. The cost figures presented in this sub-section are largely in the format of percentage costs:

= Incremental compliance cost due to Function X at Bank Y

Total incremental compliance cost at Bank Y

Percentage incremental compliance cost 

(Function X at Bank Y)
63 CONSUMER FINANCIAL PROTECTION BUREAU 

Percentages provide a common unit of measurement. We frequently report a median figure – the 

median share of compliance cost in that function – in addition to the range of shares. We do not 

report an average, as the average is less meaningful within the small number of participants.45

The percentages we report should not be confused with absolute levels of cost. A small institution 

may have a higher fraction of its compliance costs in a specific function than a large institution, but 

it has a lower total compliance cost (in dollar terms) than the large institution. Further, a higher 

percentage of costs does not necessarily mean that dollar-level costs are higher. 46

In sub-section 3.3: Compliance Costs by Regulatory Requirement, we do not present quantitative 

costs for the types regulations. We did not collect the data in a way that would allow us to estimate 

those costs with sufficient accuracy.

In sub-section 3.4: Compliance Cost by Participant Bank, we quantitatively present the costs for 

the in-scope regulations at the institution level for each of the seven Study participants. We present 

the costs as a percentage of total retail deposit operating expense (i.e., a percentage of total 

incremental, in-scope compliance costs relative to the total that an institution spends to operate its 

retail deposits business). The intuition behind this denominator is that compliance costs are an 

operating expense. We also use other denominators to test for consistency of patterns.

We avoid reporting dollar figures for several reasons. A dollar figure has little meaning without 

comparison to a common denominator. Moreover, reporting dollar figures could risk revealing the 

identities of the otherwise anonymous participant banks or divulging proprietary information.

 

45 In general, at least one of the following three different statistics is used to summarize data: mode, average (mean), and 

median. In the Study, given that no two data points are the same, using mode would be unhelpful. With only seven 

observations, using average would give excessive weight to any outliers – even one outlier observation can significantly 

affect an average across seven participating institutions. The median value summarizing the data from the seven 

participant institutions is unlikely to change because of any outliers. Median is therefore preferable for expressing the 

Study’s findings.

46 This is especially evident when comparing large banks with very small ones. For example, assume a large bank has 

$1,000,000 in total incremental compliance costs and a small bank has $100,000 of total incremental compliance costs. A 

finding that Function X accounts for 1% of a large bank’s total compliance cost and 5% of a small bank’s total compliance 

cost requires nuanced interpretation. Although some readers may interpret this finding as a small bank experiencing five 

times as much cost as its large bank counterpart, the dollar costs for the smaller bank are actually lower ($5,000, versus 

$10,000 for the large bank).
64 CONSUMER FINANCIAL PROTECTION BUREAU 

3.2 Compliance Cost by Business Function

The Bureau set out to improve understanding of how regulation may affect operations within and 

across business functions. Appendix C: Incremental Cost Assumptions provides details on the 

particular activities in functions and sub-functions associated with incremental compliance costs for 

regulations within the scope of the Study. 

As mentioned in the description of the Study’s methodology, a function is a set of responsibilities 

and corresponding activities. A financial institution may organize this set of responsibilities and 

activities in a single department or divide them among several departments. In a smaller bank, one 

department or even one individual might be responsible for several functions. A functional analysis 

allows us to compare allocations of costs across institutions in a way that controls for at least some 

of the differences in the ways institutions organize themselves. Variations in functional shares of 

cost are not necessarily variations in responsibilities and activities. We may record costs for the 

same activity in different functions because banks vary in how they organize activities within their 

functions. 

Across the seven participant banks, 85% to 95% of the total in-scope, ongoing compliance costs 

were contained within five functions. We list them below in roughly descending order of the 

function’s median share of compliance costs. 

• Operations – Costs within Operations are driven primarily by fulfillment and management 

of disclosures, mandated error resolution processes, and consumer interactions in Call 

Centers. Across participants, the Operations function’s costs comprise 15% to 29% of total 

compliance costs identified (median = 23%).

• Information Technology (IT) – While they are mostly considered as business-as-usual 

expenses, core operating systems and software also address compliance needs. As a result, 

we consider a portion of the costs of these systems and their required maintenance as 

compliance-related costs. Across participants, IT function’s costs comprise 10% to 43% of 

total compliance costs identified (median = 22%).

• Human Resources (HR) – For the purposes of the Study, HR costs are principally 

determined by the development, deployment, and monitoring of employee trainings that 

include compliance content. Across participants, HR function’s costs of compliance-related 

trainings comprise 9% to 24% of total compliance costs identified (median = 16%). 

• Compliance – Costs within the Compliance function are driven by regulatory research, 

design of compliance policies and procedures, monitoring the activity of business units, 

advising business units on compliance-related issues, and preparation and facilitation of 
65 CONSUMER FINANCIAL PROTECTION BUREAU 

bank supervision. Across participants, Compliance function’s costs comprise 5% to 31% of 

total compliance costs identified (median = 13%).

• Retail – Retail costs are primarily driven by front-line staff time spent explaining certain 

disclosures to consumers, particularly during the account opening process. Across 

participants, the Retail function’s costs comprise 3% to 35% of total compliance costs 

identified (median = 10%).

TABLE 5. SUMMARY OF MEDIAN COMPLIANCE COSTS BY FUNCTION AND COST TYPE ACROSS SEVEN 

STUDY PARTICIPANTS (AS % OF TOTAL COMPLIANCE COSTS)47

Type of Cost

In-house 

Labor

In-house 

Non-labor

Thirdparty Overall

Operations 14.0% 9.0% 2.3% 22.6%

IT 0.2% 0.0% 21.4% 22.0%

HR 12.4% 0.0% 0.3% 15.7%

Compliance 12.6% 0.0% 0.0% 13.0%

Retail 9.5% 0.5% 0.0% 9.5%

Marketing 2.3% 0.0% 0.0% 2.3%

Audit 1.9% 0.0% 0.0% 1.9%

Legal 0.0% 0.0% 0.0% 0.5%

Overall 66.0% 14.3% 30.3%

 

47 Shading denotes overall high, medium, and low relative shares of compliance costs, where red = high, yellow = medium, 

and green = low. All costs of compliance are given in median percentages of the seven participating institutions and for 

individual sub-components of in-house labor, in-house non-labor, and third-party costs (include outsourced labor and 

non-labor costs). Please note that given numbers are reported as median, individual sub-components of cost across the 

seven institutions and will not sum to total overall median. Similarly, “Overall” median components will not sum to 100%.
66 CONSUMER FINANCIAL PROTECTION BUREAU 

Table 5 summarizes the median levels of cost by function, as a percentage of total compliance cost

indicating roughly which functional areas may incur relatively higher shares of compliance costs.

Appendix F: Compliance Cost Breakdown by Institution details the percentages of compliance cost 

by function and cost type at each participant bank.

3.2.1 Operations

Across most of the Study participants, the Operations function contained the largest share of 

compliance costs. Within Operations, four sub-functions emerged as most relevant to our scope: 

fulfillment of disclosures, back office support for customer activities, call centers, and error 

resolution. Each of these four sub-functions is discussed in detail later in this section. Customerfacing front office activities were captured within the Retail function, which is discussed later in this 

section.

Among the Study participants, the Operations function accounts for 15% to 29% (median = 23%) of 

the total costs of compliance. We further divided these costs into in-house labor costs (median = 

14% of total compliance costs), in-house non-labor costs (median = 9% of total compliance costs),

and third-party costs that include outsourced labor and non-labor components (median = 2% of 

total compliance costs).

Regulations requiring significant support processes or operational infrastructure to ensure 

compliance drive the majority of compliance-related Operations costs. For example, the 

authorization rights and error resolution requirements discussed later in sub-section 3.3: 

Compliance Costs by Regulatory Requirement entail a number of support processes, many of which 

fall in the Operations functions

Some of the Study participants also reported they were trying to increase efficiency in certain areas

of their Operations functions. Banks may pursue different paths for achieving new efficiencies – for 

example, by streamlining processes in back office operations or improving call routing at call 

centers. One Tier 4 bank senior executive interviewed for the Study shared that “[w]hoever on staff 

who doesn’t have a customer-facing service represents a chance to explore opportunities for 

greater operational efficiencies.”

Relative shares of compliance cost differ across the four Operations sub-functions. Two of the subfunctions contribute a substantive share of the Operations costs (median = 23% of total compliance 

costs): fulfillment of disclosures (median = 10% of total compliance costs) and back office 

support (median = 8% of total compliance costs). The other two sub-functions, call centers and 
67 CONSUMER FINANCIAL PROTECTION BUREAU 

fraud mitigation/error resolution, each represented a median value of 3% of total compliance 

costs.

FIGURE 3: RELATIVE OPERATIONS SUB-FUNCTION COSTS AS A PERCENTAGE OF TOTAL COMPLIANCE 

COSTS, BY PARTICIPANT BANK

FULFILLMENT

The fulfillment sub-function accounts for 10% of total compliance costs and includes the costs for 

production (e.g., materials, printing, assembly) and delivery (e.g., postage, mailing) of all regulatory 

disclosures. Fulfillment costs typically correlate with the number of disclosure mailings required (a 

number partly determined by the overall size of the institution), the number of customer deposit 

accounts served by the institution, and the geographic density of that customer base.48

Financial institutions in general may incur three major types of fulfillment costs, relative 

proportions of which vary depending on the business model: internal labor costs, production costs, 

and third-party vendor costs. The larger Tier 1 and 2 participants in the Study may leverage their 

own in-house production resources and vendor services to deliver mailings. One of the Tier 2 

 

48 Geographic density may be a driver of overall cost variance, as distribution costs (e.g., postage, transportation costs of 

collateral produced, etc.) are generally greater for institutions with larger geographic footprints.
68 CONSUMER FINANCIAL PROTECTION BUREAU 

institutions experienced relatively higher levels of fulfillment costs compared with its larger 

counterparts, possibly because it conducted fulfilling with in-house staff.

Meanwhile, the smaller Tier 3 and 4 institutions in the Study tended to rely on third parties for help 

with fulfillment activities. In general, smaller institutions interviewed (Tier 4) incur higher 

fulfillment costs of about 13% to 14% of total compliance costs. Smaller institutions may have to rely 

more on vendors, while larger institutions have a greater capacity to leverage in-house fulfillment 

capabilities and balance third-party services.

Participants of varying size in the Study indicated that they seek opportunities for efficiency, such as 

combining standard disclosure mailings (e.g., change in terms notice) with monthly statement 

mailings. However, all seven participants interviewed used dedicated mailings for certain 

communications, such as the annual privacy notice and major product change notifications.

BACK OFFICE SUPPORT

The back office support sub-function of Operations accounts for a median value of about 8% of total 

compliance costs across all seven institutions in the Study. Back office operations generally include 

all administrative activities required to support business functions, such as information verification 

(e.g., review and quality assurance of new account opening notices and forms) and information 

processing (e.g., scanning and uploading signature cards for overdraft opt-in forms). 

Participating institutions varied in how much they centralized compliance responsibility in the back 

office support sub-function. The Tier 1 institution took a centralized approach, where back office

staff receive and process all account-opening materials by courier or electronically from all the 

bank’s branches, including opt-in/opt-out signature forms and new application materials. In 

contrast, one Tier 3 institution adopted a more decentralized approach, encouraging each branch to 

conduct its own set of back office activities. In the two cases, the different approaches may partly 

explain the variance in back office compliance costs of 4% and 10% respectively.

Employees at the Tier 3 participant bank adopting a decentralized approach did perform particular 

“back office” activities, but only as a part of their other daily responsibilities as members of other 

functional and sub-functional offices. In fact, since employees had multiple responsibilities over 

several business functions, it was not entirely appropriate to categorize their labor in a back office 

support role. We recorded the costs in their respective principal business functions. As these back 

office examples from the Study’s participant banks demonstrate, the responsibilities of certain subfunctions can vary depending on the business model adopted by each respective bank.
69 CONSUMER FINANCIAL PROTECTION BUREAU 

CALL CENTERS

Call center sub-functional compliance costs represent a median value of 3% of total compliance 

costs across the Study participants. Three customer service representative activities contribute to 

these costs: 

1. Addressing issues or answering questions related to deposit regulations (mostly Regulations

E and P); 

2. Conducting quality checks on customer calls to ensure compliance; and 

3. Reading account opening disclosures (when applicable). 

The responsibility assigned to each participating institution’s call centers varies. At one end of the 

spectrum, the call center at the Tier 1 bank acts as an extension of its retail footprint, capable of 

opening and closing accounts. At the other end of the spectrum, one of the Tier 3 participant banks 

did not use call centers for compliance-related activities, choosing instead to route compliancerelated activities directly to staff at their branches. This is the reason why this particular Tier 3 bank 

effectively recorded no incremental compliance cost in their call center sub-function. Call center 

employees at this institution had essentially no compliance-related responsibilities because they 

served as a “pass-through” office that directed compliance issues to other branch employees. As a

senior executive respondent from one of the Study institutions pointed out, “Call centers will be 

given as much responsibility as [is] deemed [of] low risk. Today, everything’s recorded so if it’s too 

risky, we just don’t give it to our call centers.”

The two smallest Tier 4 participants had no incremental compliance costs associated with this subfunction because neither operates a call center. Their costs to handle compliance-related phone calls 

from their customers (such as claims of account errors) are captured in other business functions 

(such as the error resolution tasks under the Retail function).

FRAUD MITIGATION/ERROR RESOLUTION

The fraud mitigation/error resolution sub-function within the Operations function accounts for a 

median 3% of total compliance costs. 49 Due to the high visibility and potential risks associated with 

error resolution, it is one of the most tightly managed functions across the seven Study participants. 

An executive working in the Risk department of a Tier 2 institution expressed the view that “[o]nly 

 

49 The fraud mitigation/error resolution sub-function is related to, but should not be confused with, with the error 

resolution regulatory requirement discussed in sub-section 3.3.2: Error Resolution.
70 CONSUMER FINANCIAL PROTECTION BUREAU 

one error resolution or escalation issue needs to get out of hand for us to be in trouble, so we keep 

it very closely monitored.” The other Tier 2 participant in the Study has imposed more stringent 

error resolution timelines than are mandated by regulation. These approaches may lead to higher 

compliance costs.

Fraud mitigation/error resolution costs are driven primarily by Regulation E disputes and 

occasionally by Regulation P when consumers raise privacy concerns. Three activities account for 

these costs: 

1. Processing claims and disputes (primarily Regulation E);

2. Performing quality checks on handling claims and disputes (primarily Regulation E); and

3. Handling escalated claims.

An institution’s size and operating model for handling error resolution issues may affect the relative 

costs of these operational activities. For example, the Tier 1 participant incurred the highest relative 

share of fraud mitigation/error resolution compliance costs (8%), versus a range of 2% to 5% for 

Tier 3 and 4 institutions. These smaller institutions tend to address questions and disputes with the 

same resources they use for non-compliance-related issues that are outside the scope of the Study. 

For example, at one Tier 4 institution one Operations function associate was dedicated to handling 

not only debit card disputes, but also disputes regarding garnishments, levies, and loans. An 

estimated 15% of this associate’s total time was spent on Regulation E disputes.

In contrast, larger institutions assign dedicated resources to Regulation E disputes, in part as a riskmitigating measure. A senior Compliance executive at one case study institution observed that

“[t]he level of service and expertise needed to address Regulation E disputes is not the same as 

other issues.” The Tier 1 institution in the Study created separate dedicated groups to address 

Regulation E disputes and privacy issues, respectively.

50

Among the participants in the Study, separate groups dedicated to Regulation E disputes were

typically staffed with personnel who have more experience or additional training in the relevant 

 

50 The group dedicated to privacy issues was responsible for overseeing such issues across all business lines, not just 

deposit products alone.
71 CONSUMER FINANCIAL PROTECTION BUREAU 

regulation and customer service. They may be compensated more than their peers within the same 

institution may.

51

One of the Tier 2 banks in the Study has also adopted additional standards on its Regulation E 

dispute resolution staff by having more stringent timelines than are mandated by regulation. The 

bank’s respondent remarked, “We’d rather be over-compliant than under. By imposing tighter 

timelines, we ensure we are always compliant.”52

3.2.2 Information Technology (IT)

Given the importance of technology in banking, it is unsurprising that IT is one of the two business 

functions that incur the highest share of total compliance cost at four of the seven banks studied. 

We begin the discussion of Information Technology (IT) systems with some background 

information that characterizes the participating institutions more generally.

IT systems are comprised of both hardware and software. Within the context of the Study, we 

assume that hardware does not impose ongoing compliance costs, as it is purchased and incurs a 

one-time cost. We also assume that software can be developed internally, licensed from a third party 

and managed internally, or acquired through vendors (licensed and managed by a third party). The 

IT system enables activities in the IT function for the bank that range widely from issuing 

disclosures (e.g., automatic generation of initial disclosures), to enabling back-end operations (e.g., 

scanning and data retention of new application forms), to ensuring operational quality control (e.g., 

monitoring call center quality). 

The IT function bears a significant portion of compliance costs because the automation of 

compliance processes often requires incremental improvements in banking IT systems, whether 

they are proprietary or off-the-shelf systems. To facilitate these automated compliance activities, 

financial institutions generally rely on systems of core processors and applications to execute the 

processes. A core processor provides a software system that is effectively the bank’s information 

 

51 For example, one Tier 2 institution in the Study noted that they pay as much as an additional $10,000 annually for a 

Regulation E claims specialist, relative to a regular claims specialist.

52 For a discussion about how the Study distinguishes different types of costs, see sub-section 2.2.1: Defining Compliance 

Costs and Other Key Concepts.
72 CONSUMER FINANCIAL PROTECTION BUREAU 

technology backbone. Among other services, core processing software typically assists in 

maintaining and updating account information (e.g., deposits on-hand and accumulated interest)

and in processing and clearing check and ACH transactions. Financial institutions can also acquire

add-on software modules or applications to run more specialized tasks, such as those related to

debit card transactions or interfacing with the bank’s ATM. Whether developed internally or 

acquired from a third-party vendor, the specialized software applications interact with the core 

processing software to access and to update account information.

In addition to business-as-usual operations, both the core processing software and any add-on 

modules and applications provide compliance-related functionalities. For example, applications 

allow banks to draw data from the core system for generating periodic statements that comply with 

Regulations DD and E. Similarly, an add-on ATM application allows the bank to generate receipts 

for transactions, required by the deposit regulations within the scope of the Study. Thus, the cost of 

both the core processing software and at least some of the associated add-on applications are

partially within scope and can be considered an incremental compliance cost.

In general, many financial institutions do not design or implement their own proprietary IT 

software. Rather, they buy or license core processing systems and software applications from thirdparty IT providers. These third-party providers offer a variety of IT systems and services, which can 

be tailored to a given institution’s priorities and needs at additional cost. If banks buy the software 

systems outright, they are then responsible for managing and maintaining the systems themselves. 

If a financial institution chooses to license systems, it must also sign a contract with the providers 

under which they pay a monthly fee in exchange for use of the software, as well as any maintenance 

services or upgrades that may be needed.

Much like other financial institutions, the seven participant banks in the Study implement their 

general IT needs through any number of in-house and third-party options, which can make the task 

of estimating compliance-related IT costs very difficult. Most of the financial industry licenses their 

systems from vendors – for example, the Study’s Tier 4 participants relied exclusively on third-party 

providers. The largest banks typically design and maintain much of their IT systems in-house, as 

was the case with the Tier 1 participant in the Study. The Tier 2 and Tier 3 participant banks 

combined elements of both models. These institutions maintained some components of their 

systems with in-house personnel, and many also relied on multiple vendors, which required their IT 

departments to ensure that systems were integrated effectively.
73 CONSUMER FINANCIAL PROTECTION BUREAU 

While this division of in-house and vendor-contracted activities is not exclusive to the IT function 

alone, it is important to differentiate in-house incremental IT compliance costs from those

incremental IT compliance costs that are contracted with an outside vendor. Compliance costs 

represent a relatively small share of the total costs to maintain these IT banking systems, which are 

highly-integrated with “business-as-usual” functions. Only a small portion of the in-house resources 

dedicated to IT, as well as the charges that vendors directly bill to their banking customers, are 

considered as compliance-related. Parsing out the incremental costs from the available information 

is challenging for researchers and respondent personnel at each of the Study’s participating 

institutions. Particularly for the IT function, interviewed respondents reported wide-ranging 

perceptions of which incremental IT costs were attributable to the in-scope regulations, despite the 

fact that each participating institution described similar functions, activities, and IT systems. For 

example, in estimating the portions of a core system’s deposit components that were associated with 

compliance to the in-scope regulations, participant institutions’ responses ranged from 1% to 35% of 

various components of IT core system costs that service the in-scope deposit products.

The breadth of this range across the Study participants is a discrepancy that raises questions about 

the accuracy of the estimates. Inaccuracy would not be surprising since the seven participating 

institutions may not have reasons (apart from this Study) to separate baseline IT costs from 

incremental compliance IT costs nor sufficient records to separate them. In addition to applying the 

general techniques for mitigating measurement error (see sub-section 2.2.4: Methodological 

Challenges), the Study team also reviewed the estimates of costs with independent experts familiar 

with core system providers and the participant banks’ activities. Based on this feedback and 

validation from participants, we used a standard assumption that 4% of deposits-related IT costs 

are incremental, in-scope compliance costs.

With this assumption, we find that IT costs comprise 10% to 43% of total compliance costs (median 

= 22%) across the seven institutions interviewed. When broken into its components, the bulk of IT 

costs fall into the category of payments to third-party vendors (0% to 30% of total compliance costs;

median = 21%). Internal labor represents a smaller fraction, ranging from 0% to 12% of total 

compliance costs (median = 0.2%) amongst the participant banks. 

IT costs as a share of compliance costs did not have a simple relationship to the size of the 

participant. The IT costs at the largest two participating institutions were each 10% of total 

compliance costs. IT costs at Tier 3 banks reach 43% before dropping again among Tier 4 banks to 

22%. We observed that the middle-sized institutions amongst our participants had complex 
74 CONSUMER FINANCIAL PROTECTION BUREAU 

combinations of proprietary, in-house systems and licensed third-party systems that must be 

integrated by the respective teams in the IT function. The larger Study participants manage their IT 

systems in-house (allowing them to be tailored and perhaps to run more efficiently) and smallest 

participants rely primarily on a small number of external vendors (to which they pay a monthly

maintenance fee). However, the middle-sized Study participants may incur additional costs because 

they are overseeing a complex patchwork of systems which contain features of both models. This 

trend in compliance-related IT costs therefore may have less to do with bank size specifically than 

with the components of the IT function as they are organized in differently sized institutions.

While compliance represented a small share of ongoing IT costs, a change to regulations could 

entail a substantial one-time compliance cost for IT, due to the need to upgrade systems and 

purchase new hardware and software. Appendix G: Insights on One-time Implementation Costs 

provides details on one-time cost issues for this and other cost functions.

The two major components of IT costs can be disaggregated into the sub-functions of application 

development and maintenance (including that of core processors) and infrastructure 

management.

APPLICATION DESIGN AND MAINTENANCE

The sub-function of application design and maintenance costs account for most or all of total 

compliance costs in the IT function of each Study participant (median = 21%). Key activities 

involved in this sub-function include the development and design of software applications to 

execute specific compliance activities, and the maintenance of these applications to ensure that they 

remain compliant as products change (e.g., fee changes to products may trigger a new disclosure to 

be issued).

INFRASTRUCTURE MANAGEMENT

The key activities and tasks of infrastructure management include the set-up, support, and 

management of all IT hardware and software infrastructure systems, including network systems, 

servers, and computer and telecom systems. Costs associated with Infrastructure Management are 

captured at participant banks in substantially different ways; however, these costs are typically 

considered part of business-as-usual maintenance and not considered incremental due to 

compliance. As one senior IT executive at a Tier 2 bank remarked: “Infrastructure management is 

like maintaining highways. No matter how costly the cities are to build, the cost of maintaining 

the highways are [necessary and business-as-usual] to me.” Only the Tier 1 bank in the Study 

reported compliance-related costs in Infrastructure Management.
75 CONSUMER FINANCIAL PROTECTION BUREAU 

3.2.3 Human Resources (HR)

As the function primarily responsible for the development and deployment of employee training 

across an organization, HR bears a notable share of compliance costs. Across participating 

institutions, HR costs represent 9% to 24% (median = 16%) of total compliance costs identified.

This cost primarily originates from two component sub-functions: the design and development 

of compliance trainings and the deployment and monitoring of those trainings across a 

broad employee base. Employee training hours associated with the in-scope regulations comprise 

the majority of identified HR compliance costs, and for the purposes of the Study are captured as 

part of the deployment cost. As a result, the majority of HR-related compliance costs are internal 

labor costs; however, there are some non-labor and third-party costs associated with the production 

of customized training material and/or the purchase of off-the-shelf training materials and 

administrative software.

It is unsurprising that the cost of employee time spent in training appear to scale in a nearly linear 

fashion with the size of a bank’s employee base. Regulation P drives the majority of these training

costs, since privacy is typically a training topic for all bank employees, even if only a portion of the 

regulation is relevant to the scope of the Study. While Regulation E also demands a significant share 

of compliance-related training time for the in-scope regulations, the number of relevant employees 

requiring Regulation E training is typically smaller across the Study participants.

TRAINING DEVELOPMENT AND DESIGN

A small portion of total HR compliance costs comes from the continuous development and design

(and possible re-design) of compliance-related trainings. As referenced above, the Study suggests 

that financial institutions generally either purchase off-the-shelf trainings (in which case the bulk of 

design costs are third-party costs) or create trainings using their in-house (in which case the bulk of 

design cost are primarily internal labor costs from the collaboration of HR and Compliance 

departments). These costs differ significantly from participant to participant (ranging anywhere 

from less than 1% to 9% of total compliance costs, median = 2.4%), based on how much a 

participant bank chooses to customize its respective training program. The programs can range 

from a few thousand dollars for training on established disclosures within Regulation P to tens of 

thousands of dollars for a more integrated program that is customized for a particular bank’s 

learning priorities. For example, the Tier 1 bank developed a curriculum that sequenced training 

modules for new compliance officers in their first six months of employment so they could develop a 

basis of compliance knowledge as they acquired responsibilities for their role.

The smallest institutions in the Study found it more economical to use off-the-shelf trainings, even 

though the material was not necessarily adapted to their own products or internal procedures. As an 
76 CONSUMER FINANCIAL PROTECTION BUREAU 

institution grows, adaptation can reduce costs. One Tier 3 institution opted to design in-house 

trainings to replace the standard modules that they had purchased from a vendor for years. As that 

institution’s HR representative pointed out, “Training time really adds up. We’ve been purchasing 

off-the-shelf training modules from [a vendor], but the truth is those are too long – not all of that 

content is relevant for our employees, so starting next year we’re going to design our own, more 

efficient modules. It will be more work on the front-end, but employee time saved [from avoiding 

unnecessary training] will more than outweigh that additional cost.” Tier 4 participants in the 

Study did not customize the content of their third-party training modules. While the use of off-theshelf trainings may minimize development and design costs, the inability to streamline prepackaged curricula may cause employees to spend more time than is necessary with learning 

unrelated content, thereby increasing the costs of deployment and monitoring as described below.

TRAINING DEPLOYMENT AND MONITORING

Out of all individual sub-functions studied across business functions, deployment and monitoring of 

training represents the second highest portion of total compliance cost across the seven participant 

banks (ranging from 3% to 24% of total compliance costs, median = 11%). As mentioned previously, 

this cost is primarily generated by employees’ compliance training hours related to the in-scope 

regulations. The Study’s participating institutions required trainings to be taken by nearly all 

employees touched by regulation, ranging from the Retail function’s front-line employees (including 

bank tellers, personal bankers, and new accounts representatives) to back office support specialists, 

to call center representatives. Even when the in-scope deposit-related regulations do not change, the 

participant banks incur this cost annually, as they require all employees to re-certify compliance 

knowledge each year. This deployment and monitoring cost includes both fully incremental 

employee training hours (e.g., time spent on a Regulation P-specific module), as well as the 

portion(s) of operational, job-specific trainings that implement compliance at the bank (e.g., the 

portion of a Retail front-line employee’s training time spent on overdraft disclosure obligations

under Regulations E and DD). In an effort to avoid unnecessary training costs, one Tier 3 

participant recently elected to review its distribution list to ensure that only core employees were 

required to undergo the training.

In addition to the cost of conducting this employee training annually, some participants incur an 

incremental cost associated with delivering and monitoring that training. The largest institutions in 

the Study invest in infrastructure to distribute trainings and track employee completion rates (e.g., 

monitoring software, web conferencing). Maintaining such infrastructure for larger scale delivery 

and monitoring may be more substantial than designing the training. An HR executive at the Tier 1 

bank noted that the ongoing cost of designing (or purchasing) the training curriculum and materials 

are relatively small when compared to the cost of supporting the logistics and infrastructure 
77 CONSUMER FINANCIAL PROTECTION BUREAU 

required to administer the trainings to staff and record the outcomes on a regular basis. For banks

with many branches and employees, the costs associated with deploying and monitoring 

compliance-related training comprise a relatively large share of their ongoing HR function costs.

But the use and purpose of the delivery and monitoring of training also blurs the line between truly 

incremental costs and business-as-usual costs. Systems for monitoring training play a critical role in 

tracking employees’ completion and comprehension of required trainings. The experiences of the 

Tier 1 and 2 Study participants suggest that mid- and large-sized institutions would need to invest in 

tracking systems to standardize training on business processes, even if they did not have to train 

employees on the in-scope deposit-related regulations. Smaller financial institutions, however, may 

adopt tracking systems to provide examiners with a clear record of training their employees on 

specific regulations. The experience of the Study’s Tier 3 and 4 participants suggest that at least 

some smaller banks might use training monitoring systems to demonstrate compliance to their 

bank supervisors. They would not have necessarily purchased the systems without the need to train 

continually employees on regulatory requirements and to demonstrate compliance to a regulator. A 

Tier 4 institution shared that the purchase of its training administration software greatly enhanced 

HR’s ability to track the assignment and completion of employee training. The new training 

platform also established a more formal assessment of training results. These tracking, deployment, 

and monitoring processes all became more efficient and executable after the introduction of the 

software. The improved deployment and monitoring of employee training helped the bank to 

demonstrate compliance to its supervisory examiners across a variety of regulations, including those

beyond the scope of the Study.

Both small and large institutions in the Study appear to rely primarily on online trainings and webbased content to educate employees about compliance with specific regulations. One Tier 3 

participant bank conducts all of its compliance training online. The HR executive at one Tier 4 bank

also asserted a preference for the efficiency of remote training: “Our bank’s branches are pretty 

widely dispersed, so we try to conduct as many trainings as possible through video conference; we 

try to avoid in-person trainings because of the travel time and costs they require.” However, for

highly prioritized trainings (e.g., trainings about new or changing regulation), the session may be 

held in person, and therefore may generate additional costs. In general, financial institutions with 

geographically dispersed branches may find that travel time and associated costs are incremental 

costs. For example, in the event of significant regulatory change, a compliance officer at one of the 

Study’s Tier 3 participants may travel to other branches over a period of three to four months to 

speak directly to branch employees. Appendix G: Insights on One-time Implementation Costs

discusses in fuller detail these one-time costs associated with a change in regulation.
78 CONSUMER FINANCIAL PROTECTION BUREAU 

3.2.4 Compliance

As the primary corporate oversight group responsible for ensuring a financial institution’s

compliance with regulation, the ongoing costs incurred within the Compliance function can be a 

considerable portion of overall compliance costs within an institution. Across the Study’s seven 

participating institutions, Compliance function costs represent 5% to 31% (median = 13%) of total

in-scope regulatory compliance costs identified. These Compliance function costs are lower than the 

total incremental compliance costs incurred in other functional areas of the bank. The primary 

Compliance sub-functions contributing to the participant banks’ compliance costs are monitoring 

and reporting, providing business advice and counsel, conducting regulatory research 

and gap analysis, designing policies and procedures, and facilitating supervision.

Some institutions adopt a centralized model where their corporate compliance departments tightly 

direct compliance activities, while others have a more decentralized model that relies primarily 

upon compliance personnel embedded in the business lines. Some banks may have full-time 

employees dedicated to compliance activities; others may not have any personnel dedicated to 

compliance, much less a full “function” or “group”, and typically assign Compliance function tasks 

to a variety of existing bank staff. Regardless of the model, the Compliance function conducts a 

similar set of activities, both with external stakeholders (e.g., trade groups, regulators) and internal 

stakeholders (e.g., other business functions, other business lines).

The participants in the Study demonstrate variation in the organization of their Compliance 

functions. Although all Tiers 1 and 2 participants have first, second, and third “lines of defense” for 

implementing compliance with the in-scope regulations (i.e., front-line support, Risk and Audit), 

each participant structures differently the division of responsibilities amongst these three lines of 

defense. 53 This variation speaks to the tension between the benefits of a highly centralized, unified 

Compliance authority and the benefits of a decentralized, more nimble Compliance support system 

embedded within business units. An institution’s choice as to how much of the compliance activities 

to centralize within a Corporate Compliance function can affect the distribution of costs across 

functions. For example, information collected from a Tier 2 bank suggested that institution had 

relatively higher Compliance function costs than Tier 3 participants did. In Figure 4, this

 

53 Financial institutions commonly refer to the three “lines of defense” model when speaking of compliance and risk 

management. The “first line” typically refers to management of activities, while the “second line” addresses the 

institutional policies set at the enterprise-wide level. The “third line” is usually associated with audits to check that 

activities and policies are aligned. 
79 CONSUMER FINANCIAL PROTECTION BUREAU 

concentration of costs within the Compliance function makes this Tier 2 bank appear as if its 

Compliance function’s costs are far greater than other large banks. In fact, this “outlier” result in our 

group of Study participants was likely due to the bank’s decision to pursue a highly centralized 

model of regulatory compliance guided by their Compliance function organization.

54

FIGURE 4: RELATIVE COMPLIANCE SUB-FUNCTION COSTS AS A PERCENTAGE OF TOTAL COMPLIANCE 

COSTS, BY PARTICIPANT BANK

As we studied seven banks and did not attempt to measure the “success” of the Compliance 

function, we cannot compare cost or effectiveness of the decentralized versus centralized

approaches. However, three of the seven case study institutions were undergoing – or had recently 

undergone – a restructuring of the Compliance function moving from one approach to the other, 

with some banks moving towards a more centralized model and some moving away from it. It 

appears that, at least within cases in the Study, institutions continue to work to find the most

efficient and effective way to integrate compliance responsibilities.

 

54 We also note that the outlier results between the Study’s Tiers 2 and 3 participants may have been heightened due to 

peculiarities of labor costs at a Tier 2 bank and a Tier 3 bank. The Tier 2 bank exhibiting substantially higher Compliance 

function cost not only demonstrated a highly centralized Compliance function, but also had a very experienced staff who 

were paid relatively higher salaries (likely due to their extensive experience and geographical cost-of-living adjustments). 

On the other hand, one Tier 3 participant bank embedded much of their compliance activities in the Operations and Retail 

side of the business, and had relatively lower salaries due to their geographic area.
80 CONSUMER FINANCIAL PROTECTION BUREAU 

• At the Tier 1 participant, the Compliance function had recently decentralized, opting to 

embed first line Compliance personnel within each line of business and have those 

compliance officers report through their respective business lines. According to the 

corporate compliance officer responsible for consumer banking, “It made more sense to 

formally insert those individuals into the business lines they were supporting – their 

counsel and compliance expertise are too integral to how those groups function in day-today operations; we need them more readily available to the businesses.”

• A Tier 2 participant had recently made the decision to centralize Compliance. The Chief 

Compliance Officer explained the change, saying: “Our corporate Compliance function has 

doubled in the past few years – we pulled a few people out of the business units and into 

the corporate group to try to better coordinate and standardize the compliance support we 

provide those business units.”

• Lastly, a Tier 3 participant institution implemented a unique, though more centralized, 

approach. Compliance officers are embedded in branch offices as the first line of defense, 

while the traditional second and third lines of defense are comprised of enterprise-wide 

Compliance and Audit function specialists.

The smaller banks in the Study (Tiers 3 and 4) have a lower degree of organizational complexity in 

that they do not have defined employees separated by the three distinct lines of defense. Therefore, 

these banks do not face these challenges to the same extent – they may have just one or two lines of 

defense. However, smaller institutions generally may grapple with different challenges, including 

the higher price they pay for in-house compliance expertise on a relative basis. All participating 

organizations in the Study had at least one dedicated employee responsible for compliance, 

regardless of size, and for the smallest (Tier 4) participant banks, the cost of even a single 

compliance individual can contribute to a significantly higher percentage of total in-scope 

compliance costs (as well as overall retail deposit operating expense) than for a larger case study 

institution.

Institutions smaller than the ones we studied may not have a dedicated employee responsible for 

compliance. Rather, they may assign Compliance function activities to employees with another role. 

Some smaller institutions may also contract for part-time compliance officers, or (as with the case of 

more than one bank in the Study) employ on a contract basis recently retired Compliance function 

staff. In smaller institutions, compliance costs may follow different patterns based on the final 

business decisions on how to assign different compliance responsibilities.
81 CONSUMER FINANCIAL PROTECTION BUREAU 

Regardless of size or organizational structure, Compliance functions across all of the participant 

banks perform a similar set of activities for the organization. The activities can be categorized into 

the five sub-functions of the Compliance function.

MONITORING AND REPORTING

The Compliance function includes a critical corporate oversight sub-function that identifies

compliance risks, addresses those risks, and internally reports on the status of those risks. This subfunction has grown as senior management engages more deeply in the evaluation of risk. At the Tier 

1 institution, two first-line compliance staff members are 100% dedicated to quality control and 

perform a near constant cycle of compliance testing to ensure protocols are strictly observed. A 

second line compliance officer then spends a full week out of every month reviewing those reports, 

addressing issues identified, and preparing results for senior management. The amount of time 

spent on this particular activity contributes a substantial share of compliance costs for most banks 

participating in the Study (2% to 9% of total compliance costs; median = 5%).

BUSINESS ADVICE AND COUNSEL

Compliance officers spend a portion of each day advising personnel other business lines and 

functions on compliance-related matters. For the in-scope regulations, compliance officers may 

spend time weighing in on customer disputes pertaining to Regulation E (e.g., reviewing contested 

charges on a debit card), P (e.g., processing opt-outs of information sharing), or V (e.g., checking the 

accuracy of credit history that the bank relied upon when deciding to approve or deny a customer’s 

application for a new account). For example, a new advertising campaign for checking or savings 

accounts can also take significant time of a compliance officer due to Regulation DD requirements. 

When a bank changes a product, the compliance officer may also have to spend a considerable 

amount of time consulting with Marketing on the redesign of disclosure forms. The amount of time 

spent on these particular business counsel activities can translate to a substantial share of

compliance costs, as demonstrated by some of the participant banks in the Study (1% to 21% of total 

compliance costs; median = 4%).

REGULATORY RESEARCH AND GAP ANALYSIS

Interviews with staff at participant institutions suggest that compliance officers may spend a 

portion of each day filtering through industry and government news to remain updated on the latest 

regulatory developments and interpretations. As the regulations in the Study have not changed 

much for several years (apart from remittance transfer rules, which were out of scope), this activity 

represents only a relatively minor portion of total compliance costs (anywhere from less than 1% to 

10% of total compliance costs; median = 2%). However, when a specific regulation changes (or an 

existing interpretation of a regulation changes), compliance officers must perform a gap analysis to 

evaluate the status of an organization’s compliance with that new regulation or interpretation. This 
82 CONSUMER FINANCIAL PROTECTION BUREAU 

activity can generate a more substantial share of cost, as demonstrated by the information in

Appendix G: Insights on One-time Implementation Costs.

POLICY AND PROCEDURE DESIGN

Even in a stable regulatory environment, compliance officers may conduct an annual review of all 

policies and procedures to ensure compliance with regulations. All seven participant banks reported 

conducting such reviews, with key differences in intensity of effort. At the Tier 1 institution, the 

compliance officer dedicated to consumer deposits regulations reported spending two to three

weeks of every year reviewing official policies, revising those policies in response to any changing 

circumstances, and developing communication for new policies. The smallest Tier 4 bank in the 

Study also reported conducting similar policy and procedure reviews. The compliance officer at this 

Tier 4 participant bank, who is responsible for overseeing deposits as well as IT issues, reported

spending up to 90 minutes to review each policy and anywhere from one to 1.5 days to update those 

in need of an update (including updating any associated disclosures). Like regulatory research and 

gap analysis, this activity takes more time in an evolving regulatory environment but represents a 

relatively minor cost on an ongoing basis (anywhere from less than 1% to 5% of total compliance 

costs; median = 1.6%).

SUPERVISORY EXAMINATIONS

Facilitating supervisory activity – in the form of on-site examinations – requires particular attention 

from the Compliance function. At the participant banks, activities for facilitating supervisory exams 

include:

1. Pre-exam preparation, which typically lasts about 30 days among the participating

institutions and commands the equivalent of 50% to 100% of a Compliance function fulltime employee (FTE) to compile data and coordinate logistics for regulatory supervisors’ 

planned onsite activities ; 

2. On-site support, which typically lasts four to eight weeks and typically requires at least one

Compliance FTE to assist supervisors as needed; and

3. Post-exam follow-up, which typically involves answering any outstanding questions and

filling data gaps and varies in duration and intensity. 
83 CONSUMER FINANCIAL PROTECTION BUREAU 

Collectively, these compliance-related costs appeared to vary substantially by participant size. The 

largest banks in the Study faced higher supervision costs for the in-scope regulations.55 Across the 

seven case study participants, we estimated the costs of facilitating supervision to range anywhere

from less than 1% to 7% of total compliance costs (median = 1%). However, it is possible that these 

figures do not reflect the full scope of activities conducted by bank staff during related regulatory 

examinations.56

3.2.5 Retail

Two specific Retail sub-functions are relevant to compliance costs: front-line management and 

in-branch customer service (e.g., account opening), and product development and 

management.

57 The compliance costs in these sub-functions are discussed in detail later in this 

section. Depending on the organization of the bank, these costs may also include activities that may 

be typically found in other functions (e.g., error resolution activities that may be conducted in back 

office and call center operations in other banks).

For the banks interviewed for the Study, the Retail function accounts for a considerable share of 

compliance cost because it bears a substantial share of a bank’s responsibility to inform consumers 

 

55 The largest banks in the Study may experience higher supervision costs for the in-scope regulations due in part to the 

more frequent nature of examination by multiple regulators at larger institutions.

56 Bank personnel from affected/examined business units are often also responsible for facilitating supervisory exams, but 

the estimates presented for the costs of facilitating supervision are standardized for the staff within the Compliance 

function and may therefore reflect only a portion of the true compliance-related costs of undergoing a bank examination. 

Some participant banks were able to detail the involvement of Compliance and non-Compliance function staff for very 

specific activities related to pre-exam preparation (e.g., back office support staff preparing reports related to error 

resolution records or overdraft histories), on-site support (e.g., the amount of time that non-Compliance function staff 

spent in examiner interviews), and post-exam follow-up (e.g., bank executives writing response letters and participating in 

activities related to the release of the exam report). But not all seven of the case studies captured this level of detail, so the 

figures we report include only the Compliance function costs of facilitating exams. While we believe this captured a major 

portion of examination costs, we recognize that the Study results may systematically underestimate the full cost of 

examination by not fully accounting for the compliance-related time spent on examinations by personnel in other 

functions at the bank. 

57 The third major sub-function identified by the Study’s business function taxonomy is distribution, which is comprised 

of the participant banks’ activities to set up, manage, and maintain its distribution network – including its physical assets, 

such as ATMs and branches. However, this sub-function did not substantially contribute to the operational activities and 

costs for Study estimates. Many distribution costs were considered to be business-as-usual expenses or very small (and 

nearly negligible) relative to the overall in-scope compliance cost (e.g., the cost of paper for ATM receipts). 
84 CONSUMER FINANCIAL PROTECTION BUREAU 

about products, features, and services. Across participating institutions, Retail costs represent 3% to 

35% of total compliance costs (median = 10%), almost all of which are internal labor costs. The bulk 

of these labor costs are associated with front-line management and in-branch customer service (e.g., 

review of disclosures at account opening, explanation of adverse action disclosures if relevant). The 

remaining costs (median = 2% of total compliance cost) come primarily from personnel involved 

with product development and design, who interact with Compliance function staff throughout the 

product development process. Each executive within the Retail function confirmed it is essential to 

involve a compliance officer throughout the product development process. For some institutions, we 

include a non-labor compliance cost associated with Retail distribution (e.g., paper costs to print 

Regulation E disclosures at ATMs), but these costs were usually negligible. 

FRONT-LINE MANAGEMENT AND THE ACCOUNT OPENING PROCESS

Discussion of disclosures with consumers during the account opening process – particularly 

overdraft disclosures – was a source of the Retail function’s front-line compliance costs at

participating institutions.

58 The number of account openings that a participant bank performs 

annually and the amount of time accorded for each account opening determined the absolute 

magnitude of these costs. Many factors (e.g., a bank’s strategy and business model, geographic 

location, customer base) may determine the number of account openings . The amount of time 

spent with a customer per account opening reflects some of the same factors, as well as an

institution’s approach to compliance and customer service. 

Retail front-line employees interviewed at participant banks reported spending between one and 

ten minutes reviewing disclosures (primarily overdraft disclosures) with new customers. Small 

differences in time can add up in cost: as a hypothetical example, if a bank opened 100,000 new 

accounts per year, paid its employees handling new accounts $15 per hour59, and spent two minutes 

on compliance disclosures during the account opening process, the incremental cost of that time

spent explaining disclosures would be approximately $50,000. If the same bank chose to spend five

 

58 We assume that time spent by bank personnel to implement a regulatory requirement should count as an incremental 

cost. In the case of front-line staff and the account opening process, the incremental activity is explaining required 

disclosures to the customer. Such disclosures include those associated with overdraft opt-in, Regulation E error resolution, 

fee schedules required by Regulation DD, etc. 

59 The Department of Labor’s Bureau of Labor Statistics estimates the mean hourly wage of $15.85 for “New Accounts 

Clerks” (Occupation Code 43-4141) from the National Occupational Employment and Wage Estimates (May 2012).
85 CONSUMER FINANCIAL PROTECTION BUREAU 

minutes explaining the same disclosures, the cost would be over $125,000.60 Participants in this 

Study varied widely in time spent explaining required disclosures:

• High-touch example – A Tier 4 bank participant with frequent overdrafters shared that 

“easily the most time-intensive topic during account opening is explaining to our customers 

the overdraft opt-in rule. In a thirty-minute account opening process that can take a full 5 

to 10 minutes – some of our customers have a hard time understanding the concept or the 

disclosure itself.” This bank also chooses to spend an average of three minutes per account 

opening on the Regulation E Initial Disclosure forms and Regulation DD fee schedules to 

ensure that customers are informed about all fees they might incur as a result of electronic 

fund transfers. No other participant bank in the Study asks Retail front-line employees to 

actively review this disclosure with customers.61

• Light-touch example –The other Tier 4 institution in the Study had a substantially 

different approach to account opening, opting to let customers read and absorb disclosure 

information in their own time: “We don’t spend more than 15 to 20 minutes on account 

openings, and probably only 1 minute on all disclosures – my customers just aren’t 

interested. We’re neighbors – they trust me, and they know I’m not going to do 

anything...to betray that trust.”

Despite the widely different approaches, both Tier 4 participants believed that their protocols were 

adequate for achieving compliance. The two approaches imply that different costs are incurred not 

only at the Retail front-line, but also possibly from other functions, such as compliance-related 

 

60 The incremental compliance costs we capture that are associated with the Retail function include the time that Retail 

front-line employees – such as bank tellers, personal bankers, and new account representatives – take to provide certain 

disclosures for consumer deposit accounts at account opening, such as explaining the bank’s policy on overdraft coverage. 

Such activity may not create an additional out-of-pocket expense for the participant bank if no additional hours or new 

personnel are needed to explain these disclosures. Although the compliance-related costs for front-line employees might 

not be immediately out-of-pocket, for the purposes of the Study, we consider these costs to be incremental because they 

are related to incremental activities that would not be performed absent the regulation.

61 The amount of time used to explain required disclosures during account opening is reported by the Study participants. 

For each participating case study institution, we estimate the compliance costs related to the regulation based on the 

institutions’ reported average times. However, the Study does not make conclusions on the time, costs, or activities the 

Bureau considers “reasonably necessary” for compliance with the Bureau’s deposit-related regulations. The amount of 

time reported by participants and used to estimate costs in the Study do not constitute any guidance or standard for 

compliance.
86 CONSUMER FINANCIAL PROTECTION BUREAU 

training (if staff who spend more time explaining disclosures require more training about the 

disclosures). 

Differences among participants in the time spent explaining disclosures highlight the challenge of

distinguishing baseline costs from compliance costs. These differences are not necessarily explained 

by differences in compliance practices; instead, they may be the result of differences in business 

choices, such as the decision to provide and describe additional in-scope product features at the 

time of account opening. Some banks might have spent time to explain overdraft fees and practices

to their customers without Regulation E's requirements. But to calculate costs for this Study we 

used the time the participants reported spending to explain the required disclosures and opt-out 

rights. This was a relatively conservative approach.

PRODUCT DEVELOPMENT AND DESIGN

In addition to the costs associated with customer service and disclosure review, there are Retail 

function compliance costs associated with the sub-function product development and design. These 

costs are driven by how frequently a bank chooses to change its products. The pace of product 

change in the market also affects the frequency of these product changes and thus also the extent to 

which compliance officers are consulted in the product development and design process. The 

compliance-related time spent by the product development teams may be substantial, but it is 

usually concentrated within a small number of personnel and therefore represents a relatively 

minor cost. At the Tier 1 participant, a senior executive in Marketing described his relationship with 

compliance as follows: “We spend a lot of time liaising with Compliance when we design a new 

product. They are in almost every meeting. And we spend a lot of time revising product proposals 

based on their feedback.”

If a change in regulation (not necessarily a regulation that is the focus of the Study) prompts a need 

for new product development activities, this cost increases further on a one-time basis. For example, 

one Tier 4 participant bank typically redesigns three to four deposit products a year. Recently, they 

have undertaken additional projects in response to the electronic funds transfer requirement for

customers’ receipt of federal benefit payments, such as Social Security and Supplemental Security 

Income (SSI) benefits.

62 The participant’s changes to its products compelled by the new regulatory

change also required the bank to ensure the changed products remained compliant with the 

 

62 U.S. Department of the Treasury, “Management of Federal Agency Disbursements,” Federal Register 75, no. 245 

(December 2010): 80315-80335.
87 CONSUMER FINANCIAL PROTECTION BUREAU 

regulations in the scope of the Study. These types of one-time product design costs are discussed in 

greater detail in Appendix G: Insights on One-time Implementation Costs.

3.2.6 Other functions

Across the seven Study participants, the Marketing, Audit, and Legal functions account for

relatively small fractions of overall ongoing compliance costs. These functions primarily provide 

support to other functions dealing more directly with compliance-related concerns, serve as 

additional “lines of defense” for ensuring enterprise-wide compliance, and provide counsel on 

compliance-related inquiries and issues. Across participating institutions, Marketing function costs 

comprise anywhere from less than 1% to 8% of total compliance costs identified (median = 2%),

Audit function costs comprise anywhere from less than 1% to 7% of total compliance costs (median 

= 2%), and Legal function costs comprise 0% to 3% of total compliance costs (median = 1%).

MARKETING

On a day-to-day basis, the Marketing function may conduct research on consumer insights, analyze 

the state of the market for a specific consumer product, perform marketing analytics, develop 

marketing and brand strategies for bank products and services, as well as design and execute 

advertising campaigns. Banks without dedicated Marketing function personnel may divide these 

activities amongst a number of other bank employees (and the smallest institutions may not 

conduct these activities). Personnel within the Marketing function liaise with staff from other 

business functions (e.g., Compliance) to ensure that the strategies and campaigns developed in the 

course of these activities are compliant with in-scope regulations. Marketing also provides support 

to other business functions on compliance-related issues requiring marketing expertise, such as the 

design of forms, notices, disclosures, and other materials needed. As a result, the Marketing 

function’s compliance costs identified in the Study are almost all labor-related. To ensure consistent 

measurement, we re-categorized as Operations function costs any expenses associated with the 

fulfillment of marketing materials, which participants may have initially reported as Marketing

function expenses. 

Some of the compliance-related costs of the Marketing function stem from regular back-and-forth 

between employees designing and revising advertising campaigns and Compliance function 

personnel. Marketing’s compliance-related disclosure activities may also increase compliance costs

for other business functions: at one Tier 3 participating institution, an executive noted that changes 

adopted by the bank in the annual privacy notice resulted in such a spike in consumer questions and

concerns that the bank needed to adjust staffing and hours of branch employees and call center
88 CONSUMER FINANCIAL PROTECTION BUREAU 

support. In addition, there was a need for the Operation function’s call center and the Retail 

function’s front-line staff to handle increases in customer visits and call volume.

AUDIT

The Audit function at participant institutions typically serves as a “third line of defense,” ensuring 

that the various business units conducted effectively the activities necessary for implementing 

compliance. The Audit function’s compliance activities typically include enterprise-wide risk 

assessments and design of audit processes and tools. The Audit function is also typically 

responsible for an internal exam component, in which it schedules and carries out assessments and 

exams, potentially resulting in additional monitoring. Across the seven participating institutions, 

Audit function costs comprise anywhere from less than 1% to 7% (median = 1.4%) of total 

compliance costs. Study participants of varying sizes noted the trend away from “vertical audits” of 

multiple issues within a single business function (e.g., conducting an HR audit) and towards 

“horizontal audits” of a single topic or regulation across several functions (e.g., a Regulation E audit 

across all business lines of a bank).

Responsibilities in the Audit function may be conducted in-house, outsourced to third-party

accounting firms or other vendors, or conducted by both in-house labor and third-party vendors.

The seven participant banks exhibited a range of different approaches to implementing the Audit 

function. The Tier 1 and Tier 2 institutions largely relied upon dedicated in-house staff to 

implement risk assessments and the actual audits (plus related remediation, if necessary). One Tier 

4 bank employed one internal auditor (as opposed to a full-time staff of three to four individuals, 

which it had done in the past) who served principally as a vendor manager who directed the thirdparty contractors conducting most of the Audit function tasks for the bank. Combining elements of 

these two models, one Tier 3 bank noted that it would soon fully transition to a hybrid method of 

internal assessments and auditing – mixing the efforts of its small in-house Audit function staff with 

a third-party vendor specializing in audit services. In particular, this institution would conduct inhouse risk assessments, but assign the actual execution of audits to in-house personnel or its 

vendor, depending on the complexity of the audit and the relative expertise of bank employees. This 
89 CONSUMER FINANCIAL PROTECTION BUREAU 

participant bank’s experience provides some evidence that different institutions consider trade-offs 

between in-house resource investment and contract costs for compliance oversight.

63

LEGAL

Across the participating case study institutions, the Legal function was part of the Corporate 

Oversight suite of functions (including Risk and Audit) that typically operated alongside the 

Compliance function as a “second line of defense,” ensuring that business unit activities are 

compliant with regulations. As such, the Legal function’s compliance-related responsibilities fall 

into three key sub-functions: conducting research, reviews and assessments of legal 

requirements to guide compliance activities; providing product and policy reviews for other

business functions (e.g., Marketing function, product development processes, general business 

policy); and providing advice and counsel regarding potential compliance and litigation risks.64

Most of the Legal function’s compliance-related costs comprise of labor expenses. The participant 

banks reported legal costs of less than 1% of compliance costs associated with the in-scope 

regulations. All four Tier 3 and Tier 4 institutions participating in the Study outsourced a significant 

portion (if not all) of their legal-related activities, relying on professional legal services, accounting 

firms, and state bank associations for legal and compliance advice. These smaller institutions in the 

Study do not maintain a permanent, in-house Legal function, instead using outside legal services 

only on a retainer or on an as-needed basis. The experience of the smallest participating institutions 

suggest that they are also likely to rely on vendors, trade associations, regulators, and other sources 

for legal and compliance expertise rather than law firms.

 

63 Because this Tier 3 bank had not yet implemented the hybrid in-house/vendor auditing model at the time of the on-site 

interviews and follow-ups, we recorded only the in-house labor costs typically associated with auditing activities for the inscope regulations.

64 As noted in the Methodology section, we have excluded the costs from paying fines, penalties, damages, or settlements 

associated with accusations of non-compliance from the costs captured in the Study. However, the Legal function at the 

Tier 1 participant does generally consider potential litigation costs as a risk in their compliance-related reviews. One Tier 3 

institution said it had incurred litigation costs to defend a recent class action suit alleging a violation of Regulation E, but 

did not obtain estimates for use in the Study. 
90 CONSUMER FINANCIAL PROTECTION BUREAU 

3.3 Compliance Costs by Regulatory 

Requirement

In addition to reporting shares of compliance cost by business function, we draw inferences about 

compliance costs for different types of regulatory requirements. We draw these inferences from our 

own assessments about the cross-functional activities conducted by participants in complying with 

regulatory requirements.

As described in the Methodology section, we collected information on 140 areas that were 

hypothesized sources of in-scope compliance costs, focusing primarily on collecting information by 

business function, not regulatory requirement. As our on-site visits progressed, we observed that 

personnel at the participant banks were more likely to understand and report incremental 

compliance activities and costs by associated business function, not actions associated with specific 

regulatory provisions. More focused interviews would be required to disentangle components and 

costs of the specific regulatory requirements (e.g., percentage of IT systems costs specifically related 

to resolving Regulation E disputes).

However, with the detailed, business function-based information that we were able to collect from 

the seven case study institutions, it was possible to examine compliance costs by regulatory 

requirement at a qualitative level. To accomplish this, we assessed the activities required to comply 

with the nine requirement types in our regulation taxonomy (Table 1 in Appendix B: Taxonomies). 

We also considered the frequencies (i.e., how often they were triggered) and relative costs of these 

activities. Based on these considerations, we believe four types of regulatory requirement contribute

the most costs at the participants we studied. For these four requirement types, we sought to 

understand why certain types of requirements drove more costs in banks than others. We also 

studied operational differences in how some participant institutions had chosen to meet the 

requirements of a certain regulation. The four types of regulatory requirements we discuss in this 

sub-section are:

• Authorization rights require a bank to obtain a consumer’s consent (opt-in) or give a 

consumer the opportunity to decline (opt-out) before engaging in a specified activity. In the 

Study, we focus on customer choices to opt-in to an overdraft program that charges fees and 

opt-out of sharing certain customer information with an institution’s third parties and 

affiliates (if applicable). Significant cross-functional coordination is required to build optin/opt-out functionality (IT), inform customers about their options (Retail, Operations), and 

oversee adherence to their preferences (Operations, Compliance, Audit).
91 CONSUMER FINANCIAL PROTECTION BUREAU 

• Error resolution procedures set standards regarding the manner and timing with which 

consumer disputes must be resolved. Prescribed time tables and the need for assurance in 

meeting these time tables contribute to incremental compliance cost.65

• Disclosure mandates are requirements to provide information to consumers, either 

verbally or through written form. Disclosure design and especially delivery contribute 

towards related incremental compliance costs.

• Advertising standards govern the kind of language or content that can be used to 

advertise for consumer financial products or services. The interpretation and application of 

open-ended regulations require negotiation and coordination between Marketing and 

Compliance functions during campaign design.

3.3.1 Authorization Rights66

Requirements involving authorization rights stipulate a consumer’s ability to opt in or out of bank 

practices and services. We categorize the major components of cost for authorization rights as

activities and costs associated with:

1. The participant bank’s need to obtain the consumer’s opt-in to overdraft coverage for debit 

card and ATM transactions (Regulation E) in order for the bank to be permitted to assess 

fees for overdrafts;67 and

2. The consumer’s right to opt-out of the disclosure of non-public personal information to nonaffiliated third parties (Regulation P). 

The Study’s participant institutions incur a material portion of their compliance costs from activities 

in a number of business functions: the Retail function’s front-line activities (where consumers 

receive explanations of their opt-in/opt-out rights and elect preferences), the Operations function’s

 

65 The Study did not consider costs from error resolution activities that were not governed by federal regulations, such as 

check processing disputes.

66 In this report, “authorization rights” refer to the authority given by the consumer to the bank for participation in certain 

deposit products and deposit account-related services within the scope of the Study. For example, authorization rights 

granted to the bank can include authorization to pay an overdraft (opt-in) or to stop sharing non-public personal 

information with non-affiliated third parties (opt-out). “Authorization rights” in the Study are not related to any other 

payment authorizations specific to ACH payments.

67 Six of the seven banks participating in the Study have an overdraft opt-in program governed by Regulation E.
92 CONSUMER FINANCIAL PROTECTION BUREAU 

back office (where these preferences are coded and operationalized), and the Corporate Oversight 

functions (where these processes must be designed and monitored). The depth of cross-functional 

coordination necessitated by authorization rights is partially responsible for the relatively higher 

compliance costs attributable to this type of requirement.68

FIGURE 5: AUTHORIZATION RIGHTS PROCESS FLOW – OVERDRAFT COVERAGE OPT-IN

These compliance costs vary according to a number of factors. Back office support costs may depend 

on the complexity of IT systems (i.e., how applications and systems are integrated to implement 

compliance) and the efficiency of branch-support processes (which likely depend on a participant 

bank’s asset size and strategic priorities). Retail front office costs depend in part on the number of 

account openings, and oversight costs also vary with the depth and rigor of quality assurance efforts 

(which likely depend on a participant bank’s assessment of compliance risk and its decisions on how 

to manage it). Although costs to comply may vary, the seven Study participants share similar 

processes to implement overdraft opt-in and privacy opt-out rights, composed of the steps described 

below.

• Step 1: Explain opt-in/opt-out rights to customers and record their decision.

Typically this process is handled by participants’ Retail front-line employees in branches, 

customer service representatives in Call Centers, or through an integrated voice response (IVR) 

system or online channels (i.e., by the consumers themselves through the bank website).

• Step 2: Accept, check, and process forms. Study participants centralize and automate this 

effort to varying degrees. Some of the participant banks process forms manually in branches and 

store the information in an electronic spreadsheet; others mail all forms to a central location but 

still upload preferences manually into the corresponding database. Still, others image forms in 

 

68 Institutions may choose to enact more costly compliance processes for a number of reasons. For the example of 

overdraft opt-in, banks may have chosen their course of compliance in order to maintain their revenue from overdraft 

coverage or simply to continue offering a service so that customers could have the benefit of choice.

Explain to 

customer and 

record decision

(RETAIL)

Accept, check, 

process forms 

(BACK OFFICE 

OPS.)

Tracking 

customer 

preference 

(IT/OPS.)

Customer 

follow-ups

(Optional)
93 CONSUMER FINANCIAL PROTECTION BUREAU 

branches and digitally submit them. Each approach has different cost implications and scale 

benefits. 

• Step 3: Ensure that customers are served according to their authorization status.

At most participant banks this step is automated in the IT function, but some need to support 

automation with manual processes that can generate further costs (e.g., one participant 

manually verified Regulation P opt-out status for customers before distributing information or 

sending certain mailings).

• Step 4 (optional): Follow-up with customers. Some participant banks will review 

customer data and follow up with customers to provide additional information and encourage 

them to change their opt-in/opt-out status. The bank then has to start again at Step 1. These 

additional customer follow-ups are likely based on a business decision and generate costs that 

are not necessarily an incremental compliance activity.

When customers decide to change their opt-in or opt-out status on their own and without 

prompting by the bank, the process is not wholly different than described above. Steps 2 and 3 are 

similar, but banks may not provide as extensive explanations as in Step 1. Follow-up with customers 

in Step 4 may not be as relevant when customers initiate the change in status.

CROSS-FUNCTIONAL INTERDEPENDENCIES

Regulatory requirements regarding authorization rights can affect multiple business functions at 

each of the Study’s seven participating institutions, creating interdependencies that may make daily 

operations more complex. For example, some institutions change consumers’ Regulation E opt-in

elections for overdraft in near real time, while others accept requests but only process them in 

batches at day's end. One senior executive at a Tier 3 participant institution commented on the

complexity for their bank: 

When we designed our new opt-in system, we had to think about it in terms of 

workflow – how we would pass information from function to function to ensure a 

customer’s choice was correctly recorded, implemented, and acted on. Customers 

can opt-in or -out through a number of channels – online, in our call center, in the 

branch. Whichever way they chose, we have to make sure to transfer that 

information from our front-line customer service reps to our back office processing 

folks and then ultimately into the right IT systems. And we have to involve 

Compliance and HR along the way to make sure those processes are designed 

correctly and that our staff is properly trained.

Different banks may implement authorization rights in different ways to fit their needs, 

organization, and available resources.
94 CONSUMER FINANCIAL PROTECTION BUREAU 

More cross-functional coordination may also require additional oversight. For example, at the Tier 1 

bank, the Compliance function performs regular quality assessments of its key compliance 

protocols. Adherence to overdraft opt-in and privacy opt-out protocols are at the top of the priority 

list during these assessments, as this bank judges that compliance risk is higher for more complex 

processes that involve more functions. In addition, the Audit function performs an independent

review of the institutional opt-in process every 12 to 24 months.

At both this Tier 1 institution and the larger Tier 2 institution, Compliance functions employ a 

dedicated privacy officer to provide constant oversight over privacy procedures across functions and 

product areas. The personnel working in the privacy sub-function may also have responsibilities for 

other activities related to other compliance, lines of business, and reputation that are outside the 

scope of the Study. The compliance officer who managed privacy issues at the Tier 1 bank estimated 

that 10% of his time is spent managing opt-out decisions for retail deposit customers. This work 

included routine quality assurance work (e.g., management of tasks originating from other business 

functions and lines of business, re-directing issues to appropriate bank offices) and regularly 

interfacing with the personnel from the IT function to evaluate or fix any system connections 

necessary to operationalize a customer’s opt-out preference.

3.3.2 Error Resolution

Error resolution regulations shape the way that financial institutions handle customer disputes and

the speed with which institutions resolve them. Without the regulatory requirements, error 

resolution procedures would likely vary between the currently mandated timelines and “baseline” 

levels of service.69 All of the banks participating in the Study indicated that, regardless of any 

regulation or payment network rules, addressing consumer errors was a business-as-usual activity 

provided as a matter of basic customer service.70 While “basic customer service” as a baseline cost 

may vary as a matter of institutional business practice, we consider any mandated actions or 

timelines stipulated by the in-scope regulations as sources of compliance cost.

 

69 State regulations and various network rules, such as those overseen by NACHA and other payment networks (e.g. Visa, 

MasterCard), also determine an institution’s error resolution timelines and procedures. For the purposes of the Study, the 

costs associated with these timelines and procedures are part of the baseline costs for the participant institutions.

70 This potentially means that an institution may choose to operate on a faster timeline than required by regulation or 

network rules as a matter of providing superior customer service.
95 CONSUMER FINANCIAL PROTECTION BUREAU 

The major error resolution regime that the Study addresses is the set of provisions for handling 

disputes regarding electronic fund transfers (EFTs) under Regulation E. The EFT error resolution 

provisions add compliance cost because of the requirements to meet specific deadlines and the 

higher perceived risk relative to claims for which there is no prescribed resolution timeframe.

Incremental costs vary based on the rate at which errors occur in a given participant bank and the 

incremental cost per claim, which is itself a result of differences in procedures that each bank 

designed to manage the risk around these claims. Components affecting differences in procedures 

and associated costs observed at the participant institutions include the activities and costs 

associated with:

1. The participant bank’s need to meet the federally mandated error resolution timelines; and

2. Costs related to quality assurance standards adopted by the financial institution.

FIGURE 6: ERROR RESOLUTION PROCESS FLOW

REGULATION-MANDATED TIMELINES

Across all participants interviewed, execution challenges arise from the timetables associated with 

mandated error resolution processes, including the evaluation of a complaint within 10 days of

being notified by a consumer and the awarding of provisional credit if the case is not resolved on 

certain timelines.

In trying to assess the incremental costs of the Regulation E timetable, we asked Study participants 

to compare their EFT error resolution process to the way they managed disputes or claims that were 

not governed by a federal regulation (e.g., complaints about check processing). For the larger 

participants, the mandated time table appeared to necessitate additional staffing. An executive with 

responsibility for fraud mitigation/error resolution activities at the Tier 1 institution manages a 

Regulation E claims assistance staff of approximately 30 full time employees, but he asserts: “I 

probably have to maintain a staff that is about one-third larger than I would ...were there not 

such stringent requirements in the rule.” 

Receive and record 

customer EFT 

claim

Research and 

investigate claim 

within 10 days of 

customer 

notification

Award provisional 

credit 

(if necessary)

Escalate 

(if necessary)
96 CONSUMER FINANCIAL PROTECTION BUREAU 

For smaller Study participants, the incremental cost manifests as overtime hours put in by the 

business-as-usual error resolution team. At one Tier 3 institution, the sole fraud investigation 

associate responsible for overseeing Regulation E disputes estimated that she worked 10 to 20 

additional hours each week (above a 40-hour work week) to meet the regulation timeline. This 

associate also believed that the deadlines create incremental responsibility for her: “If a customer 

files a complaint and then stops responding to my calls, I have to spend valuable time just trying 

to get them back on the phone to investigate before the ten day mark [by which a disputed account 

must be provisionally credited if not yet resolved]. In an unregulated world, I would assume that 

an unresponsive customer means he/she resolved the issue.” Smaller Tier 4 banks dealt with error 

resolution in a similar manner as this specific Tier 3 institution, except without the benefit of a 

dedicated associate. The investigation activities were part-time assignments to bank employees with 

other work responsibilities.

Finally, several of our Study participants maintained timelines for error resolution that were more 

stringent than those imposed by the rule. The banks may have adopted the abbreviated timelines in 

their official policy, or staff may have held themselves to shorter internal deadlines as an informal 

compliance practice. In some cases, these more stringent timelines were driven by a desire to 

provide exceptional customer service, and in other cases it was the result of seeking to manage risk 

and guarantee compliance. For example, one Tier 2 institution in the Study maintained a policy to 

resolve Regulation E disputes within eight days, ahead of the mandated ten-day period, in order to 

ensure that every dispute was handled in compliance with the rule. 

HIGHER QUALITY CONTROLS

The Study findings also suggested that participating institutions incur incremental cost due to the

higher quality controls they feel are needed for effective error resolution processes. Higher-skilled 

employees are assigned to deal with federally regulated claims processes. These employees may 

dedicate more time to resolve such claims than they might for claims not governed by federal 

regulations. The Tier 1 bank maintained a dedicated group for the management of Regulation E 

claims, asserting that “the unique requirements and risk profiles of those dispute types require a 

higher skill level for the individuals who handle them.” A Tier 2 participant also deploys more 

skilled personnel to handle Regulation E claims than it uses to handle unregulated claims. As a 

result, that particular Tier 2 participant institution pays individuals on the Regulation E claims 

team approximately $10,000 more per year. The call center manager at this institution noted the 

incremental complexity of the Regulation E disputes that come into the call center: these calls take 

“twice as long to handle as normal dispute calls because of the extra requirements and the extra 

quality assurances we build into call scripts given the risk of these kinds of claims.” Regulation E 

claims at this bank may also use more resources to reach a resolution – before denying a claim, the 
97 CONSUMER FINANCIAL PROTECTION BUREAU 

bank undergoes four rounds of case review. At one Tier 4 case study institution, the compliance 

officer noted that front-line employees spent significant time fielding questions about customer 

disputes at branches that were particularly susceptible to fraud. The front-line bankers’ direct access 

to Compliance function personnel ensures higher quality and efficiency in error resolution efforts 

due to clearer understanding of the regulatory requirements, but does generates additional labor 

cost from the compliance officer’s time to address inquiries. 

It appears likely that some of the Study participants employed higher-skilled staff and implemented 

higher quality controls at least in part to ensure compliance with mandated timelines. However, it is 

also possible that participant banks employed higher-skilled employees and more controls and 

reviews for EFTs because these transactions are more frequent and more complex than other types 

of transactions, such as checks. For example, consumer payments by EFT are much more common 

than consumer payments by check, and so a bank may receive more reported EFT errors than check 

errors, simply because of volume. Further, EFT claims may involve multiple parties (e.g., 

merchants, processors, payment networks, other banks, law enforcement) and may be associated 

with significant events (e.g. potential stolen account information, hacked accounts and systems)

that require extensive knowledge well beyond the regulatory realm. The Study does not further 

differentiate the reported costs into components associated with the regulatory requirements, the 

general complexities of EFT claims, and the interactive effects between the two. Nor does the Study 

determine whether the length of time for resolving non-Regulation E disputes was satisfactory for 

consumers. One could consider at least some of the costs of error resolution requirements that we 

treated here as incremental compliance costs to be baseline costs that banks would likely incur in 

business-as-usual practice.

3.3.3 Disclosures 

Compliance costs associated with disclosure requirements among the Study’s seven participating 

institutions can be disaggregated into the activities and costs associated with:

1. The participant bank’s efforts in designing disclosures; and 

2. Production and delivery of the disclosures. 

These costs vary across participants, depending on the extent of modifications to standard 

disclosure language or formats, the means of delivery (i.e., with mailings of other, unrelated 

materials, in an independent mailing, in-person, or electronically), as well as the nature and timing 

of disclosures (e.g., prompted by an irregular event or occurring at periodic intervals).
98 CONSUMER FINANCIAL PROTECTION BUREAU 

DISCLOSURE DESIGN

For those Study participants that develop forms in-house, disclosure design can generate pertinent 

compliance costs. The process is labor-intensive, typically undertaken jointly by a bank’s Marketing 

and Compliance functions, and tends to be iterative to ensure that disclosures are compliant while 

also tailored to meet a bank’s communication priorities. Even banks that utilize model forms or 

clauses may engage in design. At a Tier 2 participant, the Marketing function takes model disclosure 

clauses and translates them into bank-specific language. The Chief Marketing Officer commented: 

“[T]he irony is that the disclosure designed to protect consumers is written in a way that’s difficult 

for those consumers to understand. We end up investing a lot of resources into the development of 

customer friendly language: we test it, retest it and then roll it out, which is time consuming.” We 

did not verify whether the institution’s modifications made the disclosures more “customer 

friendly.” For the purpose of the Study, we observe that the participant found it in its interest to 

adapt the model disclosures to its business needs. 

DISCLOSURE PRODUCTION AND DELIVERY

In addition to design costs, participants incur non-labor costs to produce and distribute disclosures. 

These costs depend on the channel of delivery, as well as the nature and timing of the disclosure.

Disclosures are delivered through a number of channels and, in order of decreasing per item 

expense, they can be: mailed, provided in branches, or distributed electronically. Total printing 

costs for physical disclosures (both mailings and in-branch disclosures) can be sizeable; postage 

costs for the former increase expense. To reduce these costs, the participant banks embed 

disclosures within pre-existing mailings (e.g., monthly statements) whenever possible. However, 

disclosures that address sensitive customer information, such as the Regulation P annual privacy 

notice, are usually distributed independently and therefore incur additional costs. One Tier 3 

institution spent more than 15% of its total compliance-related fulfillment costs on production and 

postage for the Annual Privacy Notice alone . Electronic disclosure delivery is the most efficient, 

generating no incremental compliance cost: as one representative from the same Tier 3 bank stated, 

“Customers that go through the account opening process online just click a link to see the 

disclosures – it doesn’t take more than 30 seconds of time to upload those documents, so there 

really are no delivery costs.” Of course, electronic delivery does require a basic level of IT 

functionality, but we considered these costs business-as-usual for the participants in the Study.

The nature and timing of these disclosures can also contribute to cost – more specifically, cost will 

vary depending on whether these disclosures are unprompted (i.e., scheduled regularly by the bank) 

or prompted (e.g., triggered by an event or consumer action). Findings from participant banks 

suggest that prompted disclosures were generally more costly than unprompted disclosures, as the

prompted disclosures require banks to create processes that generate disclosures when triggered by 
99 CONSUMER FINANCIAL PROTECTION BUREAU 

a certain event (e.g., in response to a customer inquiry). Moreover, the participant banks prefer to 

bundle the unprompted disclosures with regularly planned mailings whenever possible, thereby 

preventing additional distribution costs.

3.3.4 Advertising Standards

Regulatory requirements that create a set of rules to govern advertising activities can generate 

incremental compliance costs, due to the iterative cooperation that was necessary between the 

Marketing and Compliance functions. For the purpose of the Study, the key source of compliance 

cost was the Regulation DD requirement neither to “be misleading or inaccurate or misrepresent a 

depository institutions’ deposit contract” nor to misrepresent when an account is “free” or “no 

cost.”71 Room to interpret this requirement may create variance in the cost identified at each 

participating institution. This variance is largely determined by the extent to which a participant 

chooses to invest in the activities and costs associated with: 

1. Analyzing and interpreting guidelines of the regulation, and 

2. Crafting advertising language to ensure customer understanding (and revisions thereof). 

Given the high-visibility of advertising language to consumers and regulators, Study participants 

indicated advertising standards to be an area in which they often concentrate efforts to ensure 

compliance. 

ANALYZING AND INTERPRETING GUIDELINES

Study participants cited correctly analyzing and interpreting guidelines as a key challenge. The 

Compliance and, at times Legal, functions incur costs for these compliance-related activities. An 

institution’s tolerance for compliance risk affects its investments in analysis and interpretation 

activities. Some standards that can require interpretation were mentioned above. Another example

is the requirement to state certain information “clearly and conspicuously” if an advertisement 

states the annual percentage yield. A compliance officer at a Tier 2 case study institution noted a 

concern that was common among other Study participants: “We want to make sure we are 

complying with the spirit and letter of the regulatory requirement, but how do I know if I’m being 

clear and conspicuous enough?” The experiences of the Study participants suggest that the analysis 

and interpretation of advertising standards often requires Compliance function personnel to invest 

 

71 12 CFR 1030.8(a).
100 CONSUMER FINANCIAL PROTECTION BUREAU 

time. High profile campaigns may involve additional efforts from the Legal function and the bank’s

high-level executives.

CRAFTING THE ADVERTISING LANGUAGE

Crafting and revising the appropriate language for an advertising campaign generates the bulk of 

the costs of complying with advertising standards, due largely to the iterations among Marketing, 

Compliance, and sometimes Legal functions at the participant banks. While model advertising 

clauses are somewhat helpful in achieving their aim of mitigating the costs of compliance, all banks 

interviewed for the Study expressed the opinion that this language is not always customer-friendly. 

As one compliance officer at a Tier 2 institution noted, “It doesn’t feel like regulations were written 

by a layman for a layman. I’m in the business, and I don’t understand the model clauses most of 

the time.” As such, the process of resolving the tension between meeting compliance requirements

in advertising and satisfying business needs can involve complex and, at times, contentious efforts

by the Compliance and Marketing functions to re-interpret the regulation and re-draft language for 

consumer comprehension while still remaining in compliance.

The different reviews required to reach consensus on advertising language can also extend 

considerably the total time from the beginning of the design process to the launch of the actual 

advertising campaign. One of the Tier 4 participant banks in the Study worked regularly with an 

outside advertising firm to develop its marketing campaigns. One of the bank officers responsible 

for Marketing function responsibilities72 stated that compliance-related review and revision delayed

the launch of a new advertising campaign. Without the Compliance functions’ need to review and 

revise, the bank officer claimed that the marketing materials would have likely been completed 

within one week; instead, compliance-related activities extended by an additional five weeks. 

During this time, multiple employees spent several hours each week revising language. The 

participant bank considered this additional review time to be an incremental cost that would 

otherwise not be incurred in the absence of the advertising requirements around clear and 

conspicuous language.

 

72 This participant bank did not have dedicated Marketing employees, but did have several bank officers act in a similar 

capacity through a Marketing Committee.
101 CONSUMER FINANCIAL PROTECTION BUREAU 

3.4 Compliance Cost by Participant Bank

The previous sections explored compliance cost by business function and regulatory requirement. 

We compared each function’s share of compliance costs across the seven case study banks. Here we 

compare each participant’s total compliance costs for the in-scope regulations. We present each 

participant’s incremental compliance costs as a percentage of its total retail deposit operating 

expense. 73 The retail deposit operating expense excludes operating expenses for product lines, such 

as consumer loans and mortgages, that are not within the scope of this Study.

At the smallest institutions (both Tier 4 participants), total compliance costs for the in-scope 

deposit-related regulations are 4% and 6% of their respective estimated total retail deposit 

operating expense. The five largest banks in the Study incurred costs to comply with these 

regulations roughly equal to 1% to 2% of their estimated total retail deposit operating expenses 

(Figure 7).

FIGURE 7: TOTAL COMPLIANCE COSTS AS A PERCENTAGE OF ESTIMATED RETAIL DEPOSIT OPERATING 

EXPENSE, BY PARTICIPANT BANK 

 

73 The Study calculated the retail deposit operating expense for each of the seven participant banks using publicly 

available information on total deposits at each bank and internal research conducted by McKinsey Global Concepts 

Institute. The model was most recently updated in 2012 and the data set includes all U.S. banks and credit unions.

0.9%

1.5%

1.3%

2.0%

1.1%

5.6%

3.9%

0%

1%

2%

3%

4%

5%

6%

Tier 1 Tier 2A Tier 2B Tier 3A Tier 3B Tier 4A Tier 4B

% of Retail Deposit Operating Expense

→ Banks by Decreasing Asset Size →
102 CONSUMER FINANCIAL PROTECTION BUREAU 

This pattern may suggest the existence of economies of scale in compliance costs. However, it could 

also indicate several other differences that may influence business models and compliance costs, 

such as a participant’s geographic location, customer demographics, and competitive position in the 

region. We cannot control for factors that could have contributed to these cost differences. 

Just as we cannot rule out other sources of cost differences aside from economies of scale, we also 

cannot rule out the possibility that the economies of scale are stronger than the results indicate. The 

factors described above could lead to diseconomies of scale as well. An example of such 

diseconomies of scale – in which larger banks may experience compliance costs that smaller 

counterparts may not – is the ongoing nature of supervision by multiple regulators at larger 

institutions.

FIGURE 8: POTENTIAL INDICATORS OF POSSIBLE SCALING EFFECTS IN COMPLIANCE COSTS, BY

PARTICIPANT BANK

Sources: Case Study Bank Estimates, Company 10-Ks, SNL Financial, McKinsey Global Concepts Institute
103 CONSUMER FINANCIAL PROTECTION BUREAU 

This observed pattern of higher costs for the smallest case study institutions for their compliance 

with the in-scope regulations is consistent across other measures of deposit operations. Figure 8

shows that, with a denominator of total retail operating expense (which includes lending costs and 

other non-interest expenses from the retail business that are outside the scope of the Study), the 

differences between the two smallest participant banks and the larger participant banks persist. We 

see similar patterns across the seven banks when we use a model estimate of retail deposit profits 

(which also includes components outside the Study scope).74

3.4.1 Possible Scale Effects in Compliance Costs

The evidence in this study should be considered in the context of the literature on scale efficiencies.

As previously indicated, several empirical studies have documented scale effects in compliance 

costs. Elliehausen (1998) provides a summary of such studies, some of which examine compliance 

with the Equal Credit Opportunity Act (ECOA), start-up costs of the Truth in Savings Act (TISA), 

and ongoing costs of complying with the Truth in Lending Act (TILA). By and large, these studies 

showed evidence of economies of scale. In general, our findings from the Study on costs for smaller 

institutions are consistent with those of previous studies: for example, Boyle (1983) finds that the 

cost per loan of complying with TILA was almost double at smaller banks.

Elliehausen and Lowrey (2000) specifically discuss economies of scale in start-up costs with 

implementing TISA and find that economies of scale at small, medium, and large bank groups 

actually diminish when moving up the asset size distribution. In other words, a 10% increase in 

deposits increases compliance costs by 5.6% for small banks, but a 10% increase in deposits at 

medium- and large-sized banks would yield 6.0% and 6.52% increases in compliance costs, 

respectively. In an environment where no economies of scale existed, a 10% increase in deposits 

would imply a 10% (or more) increase in compliance costs. Economies of scale are always present, 

but Elliehausen and Lowrey’s research finds that such effects may actually attenuate when moving 

up the asset size distribution.

 

74 The small number of cases in the Study limits the conclusions that can be drawn about scale efficiencies in compliance. 

Readers should not take the numbers in this report as representative of institutions generally or regulations generally. The 

scale findings are particularly tentative because we studied just two of over 6,000 institutions with assets under $1 billion 

and our comparisons across institutions could not control for factors other than size. It is possible that other differences 

besides size explain some or all of the cost differences we observed.
104 CONSUMER FINANCIAL PROTECTION BUREAU 

Other studies estimate economies of scale in the financial industry in general (without a focus on 

compliance costs). In this research, the same pattern often arises. For example, Wheelock and 

Wilson (2011) use the data from call reports to estimate significant economies of scale at banks of all 

sizes, and show significant cost savings even around the $1 trillion asset level.

There are many potential reasons – including, but not limited to, economies of scale – why the two 

smaller banks in the Study appear to incur higher compliance costs as a percentage of retail deposit 

operating costs, relative to larger banks. The general argument for economies of scale in the retail 

banking industry may be attributed to: 

• Fixed costs – A bank needs to procure real estate, hire employees, fill out many forms, and 

invest in various systems (e.g., hardware, software, vendor services – some of which play a 

role in regulatory compliance) to operate. A bulk of these costs is branch-related and is likely 

to scale with the size of the business. However, at smaller banks, this cost is spread over a 

much lower volume of business.

• Indivisibilities – While some fixed cost, such as the minimum amount of staffing, 

equipment, and space needed for branches, scale up or down depending on the size of the 

bank, there are certain costs that are minimally necessary for a bank to offer services. These 

minimum investments are the fixed costs required to meet the basic operational and 

compliance needs of a financial institution. These fixed costs are indivisibilities – costs that 

cannot be scaled down indefinitely. In fact, below the level of indivisible costs, there would 

be no functioning bank at all. These indivisible costs for operations include expenses for 

business-as-usual necessities, as well as for implementing compliance. For larger banks with 

a larger resource base, these indivisibilities likely do not make a material difference.

• Specialization – It can pay to specialize: if a bank has two dedicated compliance officers, it 

may be more efficient to have one person work on deposits and another on lending rather 

than to have both people work half time on each. Similarly, at a bank where a front-line 

employee in the Retail function may have been tasked with Compliance function 

responsibilities, specialization by having dedicated Compliance function personnel may yield 

greater efficiencies. Smaller banks may not be able take advantage of specialization to the 

same extent as larger banks.

Moreover, three additional factors need to be considered when examining potential economies of 

scale: outsourcing, vendor price discrimination, and bargaining power. These concepts 

are particularly important to keep in mind when contemplating a bank’s reliance on third-party 

vendors.
105 CONSUMER FINANCIAL PROTECTION BUREAU 

Some smaller banks outsource certain functions to third-party vendors. Instead of investing in 

and maintaining an in-house hardware system, a smaller bank may opt to contract certain 

computing functions from a cloud-based system. Similarly, instead of employing a full-time 

compliance officer, a smaller bank may employ a part-time compliance professional under contract. 

The use of third-party vendors may provide efficiencies for smaller institutions that would not 

otherwise be possible. However, the costs of contracting, the lack of specialization within banks (i.e., 

staff dedicated to specific compliance activities), and quality control issues may also render 

outsourcing to be impractical some of the time.

When it comes to price discrimination by vendors, larger banks do not necessarily benefit 

from their larger scale as much as one would expect. For example, a vendor may spend similar 

amounts of time and resources developing systems for large banks and small banks, and its costs 

might be lower providing services to a few very large customers instead of many smaller ones. 

However, there may be few vendors that can meet the needs of large banks for reliability, have the 

desired reputation, or be able to provide the range of services that a large bank may need. If 

relatively few vendors meet these demands, then large banks may not obtain per-unit discounts that 

are as large as one might expect. This may also be a reason why larger banks decide to hire their 

own in-house staff for certain business activities, thereby having higher relative shares of labor cost. 

The experience of some of the larger case study institutions (particularly within the hiring of inhouse IT employees) seems to support this concept.

Larger banks may receive additional benefits from their larger scale due to increased bargaining 

power.

75 For example, we heard from both Tier 4 participants in Study, and from software vendors

in other settings outside the Study, that larger banks are better able to bargain for price concessions 

for their core systems. This implies that vendor competition for smaller banks may not be as intense 

as it is for larger banks. This could be due to the possibility that smaller banks are

disproportionately more expensive to serve (or to bargain with) than bigger banks.

 

75 The potential lack of bargaining power of smaller banks vis-à-vis their vendors is not a recent public policy concern. The 

same concern was the driving force behind the Robinson-Patman Act of 1936 that prohibited price discrimination by 

producers. At the time, there was a concern regarding price discrimination, with chain retailers having more bargaining 

power with producers than smaller “mom-and-pop” stores. Interestingly enough, as Katz (1987) writes, “In recent years, a 

consensus has developed that the effects of intermediate good price discrimination are beneficial and thus such 

discrimination should not be proscribed. Consequently, the number of Robinson-Patman cases brought by the Federal 

Trade Commission fell markedly in the 1970s.” The situation has not changed since that time.
106 CONSUMER FINANCIAL PROTECTION BUREAU 

Any number of these basic overlying factors of economies of scale could be at play when examining 

the differences in functional compliance costs across participant banks. Other factors such as 

geography may further exacerbate these scale issues and other operational costs.76

The Study findings suggest that smaller Tier 4 banks participating in the Study tend to experience 

higher compliance costs (relative to their retail deposit operating expense) across more business 

functions than their larger bank counterparts (Table 6). Whether these higher costs were due to 

greater reliance on third parties, vendor pricing practices, lack of ability to negotiate the rate, or 

other factors the bank participants in Tiers 3 and 4 indicated that they had few choices other than to 

accept the prices as given by their vendors.

TABLE 6. COMPLIANCE COSTS BY FUNCTION RELATIVE TO RETAIL DEPOSIT OPERATING EXPENSE, BY 

PARTICIPANT BANK77

The small number of cases in the Study limits the strength of any conclusions that can be drawn, 

and further research and analysis will be required to validate any observations about the 

relationship between scale and cost.78

 

76 Banks with branches spread out across wide, sparsely populated geographies are generally less able to leverage roaming 

staff due to travel time. These complications may drive staffing levels higher, or reduce the efficiencies of traveling staff, 

thus potentially driving compliance costs higher.

77 Shading denotes overall high, medium, and low relative shares of compliance costs, where red = high, yellow = medium, 

and green = low. The analysis is to compare the highest to lowest proportions of cost for all the functions across all seven 

participant banks.

Tier 1 Tier 2A Tier 2B Tier 3A Tier 3B Tier 4A Tier 4B

Operations 0.20% 0.22% 0.36% 0.45% 0.29% 1.42% 0.60%

IT 0.09% 0.15% 0.38% 0.86% 0.34% 1.22% 0.85%

HR 0.22% 0.25% 0.11% 0.24% 0.17% 0.28% 0.74%

Compliance 0.05% 0.41% 0.14% 0.25% 0.14% 1.49% 1.19%

Retail 0.32% 0.32% 0.11% 0.13% 0.11% 1.00% 0.13%

Marketing 0.01% 0.07% 0.10% 0.06% 0.00% 0.13% 0.08%

Corporate Oversight 0.01% 0.08% 0.02% 0.00% 0.02% 0.11% 0.26%

Legal 0.01% 0.01% 0.03% 0.00% 0.03% 0.00% 0.00%

TOTAL 0.91% 1.51% 1.25% 1.99% 1.11% 5.64% 3.85%
107 CONSUMER FINANCIAL PROTECTION BUREAU 

3.4.2 Evidence of Possible Scale Efficiencies 

We observed cost differences among the Study’s seven participant banks that may be associated 

with scale. The two smallest participants in the Study shared compliance experiences that differed 

from their larger bank counterparts, principally in outsourcing to third-party vendors and meeting 

minimum resource requirements.

OUTSOURCING AND INSTITUTIONAL SCALE

Third-party vendor expenditures comprise a larger share of costs at the smaller institutions in the 

Study. On average, estimated third-party expenses as a share of total compliance costs in Tier 3 and 

Tier 4 participants are approximately double that of Tier 1 and Tier 2 participants, with such 

expenses concentrated within IT and Operations.

The IT experiences among the smallest participants in the Study suggested that smaller banks were 

more likely to purchase off-the-shelf solutions after assessing the limits of their resources to develop 

and maintain in-house systems. As presented above in the general discussion about possible causes 

of scale effects, given their size and limited bargaining power, the smaller participants within the 

Study may have limited pricing leverage with their vendors. A smaller pool of possible vendors 

catering to small banks’ needs may also limit abilities to negotiate price. Such situations may 

generate additional incremental compliance costs in vendor-reliant functions. As a senior executive 

working in IT at a Tier 3 participant described, “It’s all 0s and 1s to us. We are tech people so if 

we’re told by Compliance we need to have a new compliance functionality in our system, we 

typically call our vendors and see if they have something for us and we pretty much pay what they 

tell us.” Similarly, in the fulfillment sub-function of Operations, a third-party vendor typically 

handles production capabilities (e.g., printing and assembly of mailings). Beyond any specific 

experience of the seven Study participants, larger institutions often issue Requests for Proposal 

(RFPs) for their fulfillment needs across a selection of large vendors who compete for the 

institution’s business. However, smaller banks may lack the size to generate the same competition 

 

78 The smaller the institution, the more difficult it may be to collect accurate information on labor costs that conforms to a 

function-by-function breakdown. Tracking costs by function is a useful way to ensure consistent data collection and 

interpretation, but these functions may be organized differently across banks. Different institutions may merge functions 

into one department (for example, Retail and Marketing in the case of one Tier 3 institution in the Study). The smallest 

institutions may have only one employee who performs activities across multiple functions. For example, the CEO of a 

small institution might also be the compliance officer and handle Marketing function activities, as well as some Retail 

function front-line responsibilities. The more that functions merge in single departments or individuals, the more difficult 

it can be to accurately measure compliance-required labor hours for a particular function or activity. Thus, the smaller the 

institution, the more caution should be exercised in interpreting the allocation of labor hours between business functions.
108 CONSUMER FINANCIAL PROTECTION BUREAU 

and possess smaller procurement organizations within their institutions to manage vendors. Less 

competition among firms and reduced in-house ability to dedicate to competitive shopping may

both contribute to increased compliance costs at smaller banks.

79

While larger banks typically have the resources and capabilities to adopt more proactive strategies

toward managing compliance (e.g., dedicating project managers to create more efficient compliance 

processes, or designing customized systems), many smaller institutions usually wait for vendors to 

develop, test, and then supply the new solutions, software, or other tools. For example, a smaller 

bank’s internal IT department (if they have one) may tailor the software, once acquired, to integrate 

the new system into its existing infrastructure. Waiting for competitors and third parties to develop 

solutions and then adopting them piecemeal can result in additional costs for many institutions, and 

perhaps more so for smaller banks.

One bank IT executive remarked, “The fact that we have to buy and then integrate all these 

acquired systems, means that we have a bunch of independent systems stitched together. It is not

the most efficient process.” This reliance on vendors may also have a downstream effect of higher 

technological and logistical inefficiencies, as smaller banks often wrestle with the complexities of 

trying to use a patchwork of systems that were independently developed by different vendors.80

The Study also provides some evidence that banks may at times choose to incur higher vendor costs 

for a mix of business and compliance reasons. In the Study, one of the Tier 4 banks had recently 

transitioned to a new core processor and associated applications, driven in part by general 

regulatory compliance needs. An extensive research and procurement process spanning almost two 

years ultimately resulted in a new system that was substantially more costly than the old core 

processor. However, the bank executive with responsibilities in both the Compliance and IT

functions at that bank noted that the extra one-time and ongoing costs of the new system were 

worth the operational efficiencies and greater assurance of compliance gained across multiple 

regulations and products.

 

79 Additional vendor contract analysis would be necessary to confirm these hypotheses. For purposes of the Study, vendor 

contract analysis was deemed to be out-of-scope.

80 Technological efficiency is not necessarily the same as economic efficiency: it may not be economically efficient for a 

small bank to install the latest and the most technologically efficient hardware or software.
109 CONSUMER FINANCIAL PROTECTION BUREAU 

MINIMUM LEVEL OF RESOURCE REQUIREMENTS 

Some processes are unrelated to size, and institutions of all sizes must commit a minimum 

threshold of time and resources to implement such processes. The discussion above suggests that 

fixed costs may contribute in part to relatively higher compliance costs at smaller banks. These fixed 

costs can be generally bucketed into labor (e.g., minimum number of compliance-related personnel 

needed to manage day-to-day tasks across all business functions) and non-labor (e.g., basic level of 

IT applications and infrastructure needed to run compliance applications). For example, the 

personnel and systems required by Compliance and Marketing functions to update existing 

disclosures or issue a new disclosure are unrelated to the number of customers that the disclosure 

will reach.

As noted by the senior officer working in the Marketing function of a Tier 2 institution, “There are a 

basic number of hours that it takes my staff to review and approve [marketing materials]. I don’t 

think that basic number changes significantly if you go from bank to bank.” At smaller banks, this 

minimum level of time and resources will naturally form a higher percentage of a bank’s total retail 

deposit operating expense.

For example, the smallest banks in the Study had the highest Compliance function cost shares as a 

percentage of their institution’s total compliance cost (e.g., 26% and 31% of total compliance cost at 

the two Tier 4 institutions in the Study, versus an overall median of 13% for the seven participant 

banks). The costs of the Compliance function were larger as a share of retail deposit operating 

expense for the smallest participants. Specifically, the Compliance function accounted for 1.2% to 

1.6% of Tier 4 institutions’ total retail deposit operating expense, compared to 0.05% to 0.4% at 

institutions from Tiers 1 through 3. One possible explanation is that all participants must maintain 

some minimal level of compliance resources, as certain compliance tasks must be performed at all 

financial institutions regardless of size. In the Study, even the smallest Tier 4 participants had at 

least one full-time employee who specifically addressed compliance issues for deposit products, 

although the Bureau is aware that many small institutions generally may not have dedicated 

compliance staff.

□ □ □
110 CONSUMER FINANCIAL PROTECTION BUREAU 

In presenting the Study’s key findings, we sought to present consistently and objectively the 

information we elicited from the seven case study subjects. This section offered findings about 

compliance costs for the seven case study institutions by business function, regulatory requirement, 

and participant bank. We observed that a substantial share of compliance costs for the depositrelated regulations that the Bureau inherited are concentrated in five of the eight business functions 

identified in the Study methodology, and principally in the Operations and Information Technology 

functions. The Study’s findings also suggested that four particular regulatory requirements –

authorization rights, error resolution, disclosures, and advertising standards – were associated with 

higher compliance costs for the product lines we studied. We also investigated potential scale effects 

in compliance. We observed that total compliance costs as a share of total retail deposit operating 

expense were larger for the two Tier 4 participants compared to the five larger participating 

institutions in the Study.

Interpretation of the findings requires important caveats both methodological and practical. 

Readers should not take the numbers in this report as definitive or as representative of institutions 

or regulations generally. 

However, the Bureau does believe that the business models of these seven participants are within 

the mainstream of retail deposits business models for banks within their respective asset tiers.81

While the estimates of compliance cost for the seven banks are not generalizable, the quality and 

depth of information shared by the bank participants were far richer than could have been collected 

via a survey. Past studies as well as this one suggest that there is a sharp trade-off between reliability 

and representativeness of data. For this foundational effort, we chose to err on the side of reliability.

We did not estimate the cost of compliance with other consumer regulations such as lending 

regulations. Nor did we estimate the cost of compliance with non-Bureau deposit regulations. The 

costs of complying with other statutes and regulations that apply to deposit products, such as Bank 

Secrecy Act/Anti-Money Laundering rules, may be significant. Thus, the figures reported in this 

report do not capture the participant institutions’ entire incremental costs to comply with all 

deposit-related regulations (including those not administered by the Bureau).

 

81 For a discussion about how we selected case study participants, see sub-section 2.2.2: The Case Study Approach –Bank 

Selection.
111 CONSUMER FINANCIAL PROTECTION BUREAU 

While we sought to measure costs consistently across institutions, care should be taken in 

comparing costs of one institution to costs of another. The seven banks may differ from each other 

in important ways that the Study did not consider. For example, some participant banks may be 

more profitable or more efficient in their retail deposit operations than other case study banks, an 

area that we did not measure independently. Some of the participant banks may also spend more 

resources than necessary to achieve adequate compliance, but the Bureau did not define or judge 

what constitutes “adequate” or “reasonably necessary” compliance for the Study. Separating the 

Study from the supervisory examination process and experience was critical to obtaining full 

cooperation with the participant banks.

Because the seven case study participants may differ in ways the Study did not measure, particular 

caution should be exercised in drawing conclusions about scale effects. Caution in drawing such 

conclusions is also warranted because we studied only two banks of the over 6,000 banks with 

assets of less than $1 billion. Thus, the Study provides only limited evidence of small bank retail 

deposit compliance costs or of scale effects in compliance. However, the limited evidence of scale 

effects we find is consistent with previous research and economic intuition. The findings from the 

Study reinforce the potential value of further research to confirm the existence, size, and causes of 

scale effects in compliance costs. We discuss this point and other possible implications of the Study 

in the next section.
(This page intentionally left blank)
113 CONSUMER FINANCIAL PROTECTION BUREAU 

4.Potential Implications

In this Section, we discuss the implications of the Study in four broad categories. First, the Study 

advances research on compliance operations and costs by producing some of the most rigorous 

information available, refining research methods, and helping interested parties identify potential 

areas for further research. Second, we discuss how research on compliance costs can contribute to 

understanding ultimate effects on consumers and markets, as well as the substantial challenges to

researching those effects directly. Third, we describe how the Study will inform and help the Bureau 

refine its ongoing efforts to reduce or avoid unnecessary compliance costs. Fourth, we suggest how 

stakeholders could use this report to improve their participation in the regulatory process.

(1) The Study advances research on compliance costs in several ways.

The Study advances research on compliance costs by producing data and qualitative information

based on rigorous methods, refining research methods for others to use, and helping researchers 

discern fruitful avenues for further study.

The Study produces some of the most rigorous information available about 

compliance costs. Several past studies have used the case study method to try to measure 

compliance costs. To our knowledge, this Study is the only published analysis using in-depth case 

studies with large numbers of field interviews to assess ongoing costs of a set of regulations that 

govern a set of products.

Moreover, the findings we report are based on research that is rigorous in each of three key 

dimensions: distinguishing incremental compliance costs from baseline costs, covering major 

sources of compliance cost, and measuring those costs consistently within each institution and 

across institutions. We believe our efforts in these three dimensions have produced reasonably 

reliable evidence of costs at the seven participant banks. At the time of publication of this report, we 

are not aware of more reliable evidence that is publicly available.

We believe the seven institutions we studied are not outliers among deposit businesses. Seven case 

studies do not, however, justify broad generalizations – especially about scale effects – so we are 
114 CONSUMER FINANCIAL PROTECTION BUREAU 

careful not to draw any. This is not a flaw of the methodology; rather, it is a necessary trade-off of 

careful research. This Study required substantial effort. A large-scale study of compliance 

operations and costs with anything approaching the depth or breadth of this Study would be 

exceedingly resource-intensive for both researchers and participants. Even a single regulatory 

requirement can impose costs in several functional areas of a financial institution, requiring 

estimates of labor costs for many different categories of typical employees. Collecting such 

information by survey is not nearly as reliable as collecting it by case study. Moreover, past studies 

show that achieving a meaningful response rate to a survey is very difficult.82

We refrain from offering subjective opinions on whether the institutions we studied spend “too 

much,” “just enough,” or “too little” on compliance. We did not evaluate the effectiveness of the 

seven institutions’ compliance operations in achieving compliance. This Study was not a supervisory 

exercise, and the staff who conducted the Study did not use or consult information about the

participant banks’ compliance records (e.g., examination reports). Nor did we evaluate the 

efficiency of participating institutions’ operations. We assumed the participant banks determined 

explicitly or implicitly that their compliance activities were reasonably necessary to achieve 

compliance.83 In short, we did not try to judge whether an institution was spending too much or too 

little to achieve the desired result.

This report shares practices other researchers can use while highlighting the 

persistence of major challenges to this type of research. As expected, we found that 

compliance costs can be quite difficult to measure. The processes, systems, and personnel that fulfill 

compliance obligations are closely interwoven with the processes, systems, and personnel that fulfill 

business needs. Separating employee time spent on regulatory activities versus baseline activities is 

both very important – because labor costs are more than half of compliance costs – and particularly 

difficult – because institutions generally do not track employee time this way. Labor costs must be 

gathered “from the ground up” – by finding out through in-depth interviews how employees spend 

their time. Technology is one of the major costs of compliance and difficult to measure because 

systems and applications are programmed to meet both business and regulatory needs 

simultaneously. 

 

82 For more on the challenges of surveys, see sub-section 2.2.2: The Case Study Approach and Appendix A: Review of 

Existing Research.

83 See sub-section 2.2.1: Study Scope and Key Concepts – Defining Compliance Costs and Other Key Concepts.
115 CONSUMER FINANCIAL PROTECTION BUREAU 

The methodology we used to tackle these challenges builds on work of Elliehausen and other

researchers – including its development, testing, and public disclosure – and is one of the Study’s 

principal contributions. This methodology can be adapted to study other products and regulations. 

For any regulation, the methodology can help researchers define carefully what they are trying to 

measure and determine systematically whom to interview and what questions to ask, as well as what 

documents to review.

We encourage other parties to adapt and use the methodology detailed in Section 2 of the report. 

Checklists provided in Appendix H: General Techniques distill the approach in a form that 

researchers may find useful for planning purposes.

But the checklist is not intended to suggest research on compliance costs is straightforward or 

mechanical. Major conceptual and practical challenges must be navigated in this type of research, as 

we detail richly in the Methodology section. 

Separating incremental compliance costs from baseline costs is a key example of both a practical 

challenge and a conceptual challenge. The distinction between incremental compliance costs and 

baseline costs depends on a counter-factual: What would institutions do without the regulation? 

Different beliefs about what an institution would do in the absence of regulation lead to different 

cost estimates. There may be more than one reasonable baseline for a given regulation and business. 

The best that researchers can do is make reasonable assumptions, specify them transparently, and 

apply them consistently.

Obtaining statistically valid results for a meaningful and useful set of hypotheses is also a major 

challenge, for the reasons discussed earlier. Researchers who attempt surveys can draw lessons 

from past studies that used surveys, as well as any useful insights about data collection from this

Study. In general, a survey is more likely to be effective and worthwhile if it has a narrow scope, 

such as a limited set of products and regulatory requirements (more limited than the scope of this 

study). Furthermore, a survey of compliance costs would likely benefit from an initial pilot study to 

refine the questions and methodology. Any researcher attempting a large-scale survey would be 

well-served to determine in advance which employees have the desired information, how to ensure 

that the survey reaches those employees, and how to craft questions that will effectively and 

unambiguously elicit the collection of the desired information.

This report may help researchers scope areas for further research, such as one-time 

costs and economies of scale. The Study only briefly addresses the one-time costs of 

implementing new regulations. However, the very limited evidence we adduce, is consistent with 

suggestions that these one-time costs can be significant relative to ongoing costs. Further research 
116 CONSUMER FINANCIAL PROTECTION BUREAU 

on implementation costs would be valuable to inform regulators, stakeholders, and the public about 

these costs and how to estimate them. In general, such research should follow the principles of this 

Study, such as distinguishing baseline costs (i.e., changes and upgrades institutions would have 

made anyway in the absence of regulatory requirements) from incremental costs (i.e., changes and 

upgrades institutions make only because of a change in regulation).

Moreover, the limited evidence of economies of scale we observed in the participant banks suggests 

further research on the sources of potential economies could be valuable. With only seven 

institutions in the Study, it is not possible, without making stringent assumptions, to reject the 

possibility that there are no quantitative differences in compliance costs between institutions with 

assets of more than $1 billion and smaller institutions. But the finding of even limited evidence for

economies of scale is consistent with evidence from previous studies and suggests further research 

is warranted because the question of scale is an important factor in policy decisions.

Investigation of smaller institutions’ costs to use third-party vendors may be particularly 

illuminating. The costs of technology in compliance are likely to correlate strongly with the costs of 

technology in the business overall. Smaller institutions that have difficulty getting the best price and 

service from technology vendors for general business purposes may also have higher associated 

compliance costs. Systematic information about how vendors compete for business and how 

effectively smaller financial institutions shop and negotiate for services could improve 

understanding of the potential to reduce costs, including compliance costs, associated with thirdparty vendors.

Future research could also help illuminate how the level and composition of compliance costs 

changes over time. Costs are not static – they change with the business and regulatory environment 

and with the market for compliance services. The consumer deposits business, which was the focus 

of the Study, is currently witnessing a decline in the number of branches and in branch activity (e.g., 

consumer visits,84 number of deposit accounts serviced,85 and teller transactions86) and an increase 

in online banking and electronic payments. Changes in products and services may increase the 

share of compliance costs in certain functions (e.g., advertising and disclosure, which have to be 

 

84 Celent (2013).

85 Cornerstone (2012).

86 FMSI (2013).
117 CONSUMER FINANCIAL PROTECTION BUREAU 

tailored to each new product), but increased reliance on technology may reduce shares of other 

functions (e.g., mailing disclosures). Moreover, technology for compliance has improved greatly 

over time and may continue to improve. At the same time, in certain markets, some financial 

institutions may have a harder time hiring highly qualified personnel for compliance jobs or for

front-line jobs that involve more compliance responsibilities. As a result of these or other factors, 

the level and composition of compliance costs can change over time. Research that would attempt to 

capture these changes would be particularly useful, although it would be difficult to execute because 

it would require consistent measurement not just across institutions but across time.

(2) The Study is just one step toward understanding the effects of regulations on 

consumers and markets, and further, more direct research on these effects may 

face even bigger obstacles.

The study of compliance operations and costs for individual firms is most valuable as part of a 

broader effort to understand how regulations affect consumers and markets.

This Study concerns the operational effects of regulations, which are among the most direct and 

immediate effects of regulation, and may be easier to measure than other benefits and costs.

Understanding the operational effects of regulation may nonetheless shed some light on its broader 

effects on consumers and markets. Two examples illustrate this point.

First, researchers and policy-makers can potentially determine whether costs of regulation will be 

passed to consumers by examining the proportion of operational costs that are fixed. Fixed 

compliance costs are not passed on to consumers to the extent that pricing is based on marginal 

cost. It appears that a high proportion of the costs we evaluated in the Study are fixed costs. 

However, a rigorous assessment of the effect of compliance operations on prices of checking 

accounts and related products and services was outside the scope of the Study.

Second, assessing operational effects of a rule can help the Bureau understand whether the effects 

may be significant enough to trigger substantial changes in product terms or availability. The Study 

provides the Bureau and the public with a methodical way to identify in other cases (e.g., proposals 

of new rules) the operational costs that may be significant enough to affect consumers and the 

greater marketplace.

As challenging as it may be to measure costs of regulations, they may be easier to measure than

benefits. Direct measurement of the benefits of regulations for consumers and markets is preferred 

but much more challenging. Researchers would have to determine the number of consumers who 
118 CONSUMER FINANCIAL PROTECTION BUREAU 

would receive the benefits and then assign a monetary value to the benefits, while also taking into 

account any non-monetary benefits. 

In addition, it is difficult to isolate and quantify in dollars the extent to which regulatory changes

produce observed changes in market outcomes. Regulatory change will not generally produce a

large and immediate change in market outcomes that researchers could attribute to the regulatory 

change itself. Measuring benefits in dollar terms generally requires data on a large number of 

transactions and on all of the major determinants of prices or product attributes besides the 

regulation, as well as information about consumer demand for the product. The model and data

would need to be developed for each particular circumstance of regulatory change, and this requires

extensive effort.

Alternatively, regulatory requirements may make consumers aware of certain product risks or may 

be intended to reduce directly the frequency of adverse outcomes like disruption to household 

budgets, delinquency, default, bankruptcy, or other unanticipated cost. Quantifying these benefits 

presents additional challenges because of the difficulty of measuring reduction in these outcomes 

and assigning a monetary value to this reduction. For example, a researcher might measure the 

impact of a disclosure on consumer awareness of risk, which is suggestive of the benefit of the 

disclosure, but it may not be possible to monetize the benefit.

Measuring the benefits of regulation for market growth and confidence is also very difficult. 

Mandated product characteristics and services from providers may allow the market for the product 

to grow as consumers trust the providers and products more. These effects may be large. However, 

they would also unfold over a period of time, and other determinants of the size of the market might 

also change in that time. Thus, again, the researcher would need data on a large number of 

transactions and on all the determinants of the demand for the product in addition to the mandated 

characteristic in order to measure the effects of these regulations on market size.

Understanding the costs of regulation for firms besides the operational costs we have studied is also 

important. From the perspective of an individual financial institution, the business opportunity it 

loses because of a regulation may exceed the operating cost of the regulation (i.e., the compliance 

cost). The Study did not evaluate the effects of in-scope deposit-related regulations on firm profits 

(e.g., profits from overdraft programs).

This limitation of not evaluating the impact of the in-scope regulations on firm profits should not be 

overstated. Some regulations might increase some firms’ profits. Five of the seven participant banks 

(all of whom offered overdraft programs in 2009) said they lost revenue because of the Regulation E 

opt-in requirement. However, one participant reported that when the Federal Reserve adopted the 
119 CONSUMER FINANCIAL PROTECTION BUREAU 

opt-in requirement, the bank reversed its earlier decision not to offer an overdraft program because 

having clear standards reduced its reputational concerns.87 In short, evidence that some firms lose 

profits can be entirely consistent with a positive outcome for consumers, markets, and many other 

firms. While information about individual institutions’ lost profits is useful and should be generated 

where feasible, it cannot be evaluated in a vacuum.

(3)This Study will inform, and help the Bureau refine, its ongoing efforts to reduce or 

avoid unnecessary compliance costs.

The Study will help the Bureau refine steps it has taken to reduce or avoid unnecessary compliance 

costs, without sacrificing the benefits of regulation. These steps include collecting information about 

costs, designing regulations that may reduce costs while still achieving desired benefits, and 

communicating effectively about regulations. While the Bureau will always strive to improve its 

ability to avoid or reduce unnecessary compliance costs, in some cases institutions themselves may 

have the ability to reduce their costs.

When the Bureau considers a potential new rule, it tries to assess the rule’s potential 

operational effects based on the available evidence so it can reduce costs where 

possible. The Study concerns compliance costs of existing regulations. We have explained why 

estimating those costs is quite difficult. Estimating costs of a regulation that does not yet exist is 

even more difficult and uncertain.

The techniques the Bureau used in the Study will not necessarily work to produce reasonable

estimates of the costs of a potential new regulation. Asking institution employees how they would 

spend their time differently several years hence if a hypothetical regulation became law may not 

elicit useful responses. Nor may asking them how much time they would spend implementing the 

regulation. Quantifying the labor costs associated with a new regulation that has not yet taken effect 

can require a fair degree of judgment and is necessarily indeterminate.

Thus, the Bureau generally conducts qualitative assessments of the potential effects of a regulation 

under consideration. The Bureau seeks to make these assessments as rigorous as possible by 

publishing them for public comment.

 

87 The seventh participant bank did not offer an overdraft program subject to the new Regulation E protections, either 

before or after the protections were adopted.
120 CONSUMER FINANCIAL PROTECTION BUREAU 

The Study will help the Bureau conduct these qualitative assessments. It provides a systematic 

framework for mapping the effects of a regulation on a typical institution’s operations. In the Study, 

we framed questions about rules’ operational effects in language that financial institutions use to 

describe their business functions and activities. We directed those questions to the most 

knowledgeable employees and sought to cover all affected functional areas of the institutions. These 

techniques will inform future Bureau efforts to assess potential new rules.

The Bureau considers ways to design regulations to avoid unnecessary or 

unwarranted operational costs. The Study sheds some light, but provides no definitive 

evidence, on two key regulatory design questions: How prescriptive should a regulation be? And 

should a regulation treat smaller institutions differently than larger institutions?

Prescriptive rules versus open-ended rules – The Bureau frequently is confronted with the 

question of whether to make a rule prescriptive (i.e., spell out in detail how to implement an 

obligation) or open-ended (i.e., leave it to the institution to figure out how to implement its 

obligation). Institutions and their representatives have often asked the Bureau for detailed 

prescriptions, citing a need for certainty. We have frequently accommodated these requests, 

although more detailed prescriptions can also prompt complaints about the length of a regulation. 

The Study elicits evidence that granting institutions discretion on how to comply with a regulation 

can lead them to spend more time coordinating and negotiating internally and with third parties 

about how to comply. For example, all of the participants reported spending time figuring out how 

to apply Regulation DD’s broad injunction against “misleading” advertisements. Institutions also 

reported spending time debating internally how to disclose fees, which Regulation DD requires to be 

disclosed “clearly and conspicuously” without specifying format or language. These findings help 

explain why institutions have often asked the Bureau to be more prescriptive.

But the Study does not provide an adequate basis to compare the benefits and costs of prescriptive 

regulations with open-ended regulations. This is a complex topic beyond the scope of the Study, so 

we offer just a few examples to illustrate the complexity. Prescriptive regulations may reduce the 

cost of figuring out how to comply, but open-ended regulations may reduce the cost of complying by 

allowing an institution flexibility to comply at lower cost. Open-ended regulations also may require 

less frequent updating, while more frequent updates on prescriptive regulations could be essential 

to keeping up with changing market conditions and yet increase costs. Furthermore, prescriptive 

regulations might help ensure that consumers have a consistent experience with different 

institutions, but open-ended regulations may, in some cases, provide more protection than 

prescriptive regulations as they have a built-in capacity to adapt as products change. These are just a 

few examples of the complex trade-offs between open-ended and prescriptive regulations.
121 CONSUMER FINANCIAL PROTECTION BUREAU 

Adjustments or exemptions for smaller institutions – In several major rulemakings the 

Bureau has conducted to date, concerning mortgages and remittances, the Bureau has adopted a 

number of adjustments and exemptions for smaller institutions. Among other factors, the Bureau 

considered the extent of any estimated higher costs on smaller institutions and the consumer 

benefits of applying the rules to those institutions. The Study elicits limited additional evidence that 

regulations can have a minimum indivisible cost, which falls proportionally higher on smaller 

institutions. This evidence supports paying particular attention to the effects of rules on smaller 

institutions, though it is far from adequate to support a categorical policy of different treatment for 

smaller institutions. The mere existence of scale efficiencies does not necessarily support different 

treatment of small institutions. One must consider the effects of regulation on consumers and on 

the marketplace as a whole. The Bureau will continue to consider potential distinctions between 

smaller and larger institutions on a case-by-case basis.

The Bureau has sought to share its rulemaking plans publicly where feasible to try to 

reduce costs associated with uncertainty. Several participants in the Study cited the cost of 

uncertainty as to when or how regulations would change. The Bureau has sought to signal well in 

advance its potential future rulemakings, in part so institutions can plan. For example, the Bureau 

publishes a fairly detailed semi-annual rulemaking agenda with forecasts of schedules for its 

upcoming rules. When the Bureau convenes a panel of small businesses for a rulemaking (in 

accordance with the Small Business Regulatory Enforcement Fairness Act), it often releases to the 

public detailed materials about its plans for the proposed rule several months before publishing a 

proposed rule. This is not required by any statute.

At the same time, uncertainty about the Bureau’s path is unavoidable when it signals it is 

considering a regulation in an area. The rulemaking process necessarily takes time to develop 

careful proposals, consider public feedback, and formulate final rules, and the Bureau cannot and 

does not want to prejudge the outcome. The Bureau remains open to suggestions as to how it could 

provide more certainty, consistent with the imperative to remain open-minded throughout the 

rulemaking process.

The Bureau has translated new regulations into a plain language format to try to 

reduce institutions’ research and training costs. The Study highlights the broad range of

institution employees and executives – beyond compliance officers, attorneys, and auditors – who 

need to be familiar with regulations because they help implement them.

The Bureau has already taken steps to make its regulations easier for this broader audience to 

understand and use. For example, the Bureau has published plain language guides in both written 
122 CONSUMER FINANCIAL PROTECTION BUREAU 

and audio form of its recent mortgage and remittance regulations to date. We have also improved 

the Bureau’s website to make the regulations and these compliance aids more accessible to all.

Anecdotal feedback indicates that these aids have reduced some institutions’ costs to update their 

internal procedures and train their employees. The Bureau welcomes feedback on the Bureau’s 

efforts to assist industry with implementation from industry members and representatives. 

Feedback can assist the Bureau in making solid cost-benefit judgments about investments of this 

kind.

The Bureau will review major new regulations it adopts to determine their 

effectiveness. The Dodd-Frank Act requires the Bureau to review significant regulations it adopts 

within five years of the effective date to determine their effectiveness in meeting their goals. For 

example, the Bureau will review in the coming years the new remittance regulations and the more 

significant parts of the new mortgage regulations. The Study will provide the Bureau and 

stakeholders a foundation for assessing the operational impacts of those regulations when the time 

comes.

While the Bureau will strive to improve its ability to avoid or reduce unnecessary 

compliance costs, in many cases institutions themselves may be better able to reduce 

their costs. At some point after a regulation becomes law, compliance operations and business 

operations may become intertwined to such a degree that they are inseparable. In that case, the 

most significant potential savings may come from institutions’ increasing operational efficiencies 

rather than from the Bureau changing the regulation.

Where regulatory and business processes, systems, and personnel are interwoven, it is possible that 

institutions may be able to reduce regulatory costs by streamlining operating costs more broadly.

Institutions may find ways to reduce their operating expenses through better technology systems. At 

the same time, these more efficient processes may also reduce their compliance costs. For example, 

an institution that adopts a less costly system for producing periodic statements may also lower its 

costs for producing statements that comply with applicable regulations. To that extent, industry has 

at least some capacity to reduce its compliance operations costs independent of steps that regulators 

can take.

Indeed, a regulatory change intended to reduce burden may impose more short-term costs to 

implement the change than it produces in long-term savings to the financial institution. There may 

be a more clear-cut case for cost savings from regulatory or statutory amendments where an 

amendment simply removes a requirement (as opposed to substituting it for a new one) and gives 

an institution a long or indefinite period in which it can continue to comply with the requirement if 
123 CONSUMER FINANCIAL PROTECTION BUREAU 

it chooses.88 But in many cases removing a separable requirement could impose significant costs on 

consumers and markets, which as a result might not function as well.

(4) Stakeholders may find that this report helps them improve their participation in 

the regulatory process.

Stakeholders such as industry participants and consumer advocates may find that the findings 

presented in this report helps them improve their participation in the regulatory process – both 

during rulemakings and in anticipation of reviews of existing regulations. The traditional notice and 

comment process via the Federal Register has often fallen short of producing concrete and reliable 

information about compliance costs (or, for that matter, about costs more broadly). The Study 

points to a number of suggestions stakeholders may wish to consider when providing the Bureau 

information about compliance costs. These suggestions are purely voluntary and at the discretion of 

stakeholders.

Information about actual (or expected) compliance costs of existing (or potential 

new) regulations that reflects the methods used in this Study would be highly valuable 

to the Bureau. When stakeholders address costs of an existing or potential new regulation, they 

are invited to describe systematically, to the best of their ability, the effects of the regulation on an 

institution’s operations. One technique, illustrated by this report, is to describe the major business

functions of an institution affected by a regulation and trace the effects of the regulation through 

each function.

Stakeholders are also invited to consider several critical distinctions. Specifically, stakeholders 

providing input to the Bureau are invited to distinguish:

• Operational effects from effects on products and pricing (or point out where and how the 

effects are connected);

• Incremental costs from baseline costs (i.e., costs reflecting what an institution would do 

anyway, regardless of regulation, because of business practice, private standards, or other 

laws);

 

88 For example, after Congress removed the requirement to place a physical disclosure of ATM fees on ATMs, banks could 

choose to phase out the stickers on their own schedule with minimal, if any, effect on systems, processes, or personnel 

training.
124 CONSUMER FINANCIAL PROTECTION BUREAU 

• One-time costs to implement a regulation from ongoing costs to maintain and document 

compliance;

• Fixed costs from variable costs; and

• Labor costs from non-labor costs (e.g., third-party vendor costs).

The Bureau would particularly value detailed qualitative assessments of effects of regulations on 

operations and reliable quantitative estimates of associated monetary costs. Stakeholders interested 

in providing such assessments and estimates could consider following the basic methods of this 

Study. For example, to estimate labor costs, stakeholders could identify the affected types of 

employees and describe how each type would be affected, estimate the number of employees of each 

type, estimate the time that each type of affected employee would spend on compliance with the 

relevant regulation, and provide the average salary for each employee type so that labor hours can 

be translated to dollars. Validated estimates of non-labor costs with supporting documentation, 

including expenditures on outside vendors, would help to complete the picture. Furthermore, for 

stakeholders that consider conducting surveys, it is also important to provide information about 

how the survey was conducted and the key characteristics of respondents, such as size and scale.

Information that comes as early as possible in the rulemaking process would be 

particularly useful. Estimating the effects of a regulation that is only in proposed form requires 

resources that an institution might prefer to spend elsewhere until the regulation is final. But the 

Bureau and the general public both benefit substantially when institutions are willing to spend some 

effort to provide reliable information on anticipated regulatory impact before the regulation is final, 

when the information is still timely for advising the final regulation text. In advance of a final rule, 

we would welcome opportunities to work with institutions to better understand how they would 

implement the proposed regulation and what effort that would take on the part of the institution. 

Where that is not feasible, we welcome institutions to share with us, after the fact, concrete and 

detailed information about their processes and costs to implement new regulations. The Bureau can 

use this information in future rulemakings.

The Bureau also values vendors’ participation in the rulemaking process. Institutions of 

all sizes rely on vendors and large numbers of small institutions rely heavily on them, especially for 

technology services. Vendors often have better information than the financial institutions about the 

services they supply and the costs of these services. The Bureau welcomes vendors’ active 

participation in the regulatory process and sharing of information about the nature and cost of their 

services.
125 CONSUMER FINANCIAL PROTECTION BUREAU 

5.Conclusion

Assertions of regulatory burden are heard frequently in discussions of consumer financial policy, 

but reliable, publicly available data on the operating costs of complying with consumer financial 

regulations are relatively sparse. The Bureau hopes that this report provides a more solid factual 

basis, and a more systematic framework of analysis, to inform and elevate discussions about those 

costs. While the report does not support a conclusion about the size of these costs industry-wide, it 

provides insight into the sources and distributions of these costs within institutions. The report also 

offers a vocabulary to help describe the types of operations that implement many standard types of 

regulation, such as disclosure, advertising, authorization rights, and error resolution. Moreover, the 

Study provides researchers and stakeholders a field-tested method to estimate the cost of these 

operations in individual institutions.

At the very least, the methods we employed should help set guideposts for producing, or evaluating, 

estimates of compliance costs. We hope that this report – with its systematic distinction between 

baseline costs and incremental regulatory costs, mapping of costs across an institution, consistent 

measurement of costs across different institutions, and presentation of both quantitative data and 

qualitative anecdotes – may guide stakeholders to understand better the quality of analysis and 

information that the Bureau values.

It bears emphasizing that effects on institutions’ operations are but one of the wide range of effects 

of consumer financial regulation on consumers, firms, and markets that matter to policy-makers. 

Operational effects are among the most direct and immediate effects. Alone, however, estimates of 

these effects have limited value to policymaking. Operational effects matter more to the extent they 

suggest how a specific regulation might affect product pricing and availability or market structure 

and competition. Moreover, these types of effects on a market can be understood properly only in 

the context of the fundamental benefits of regulation to consumers and the marketplace.

The ultimate benefits and costs of a regulation are difficult to measure, and progress in their 

measurement is likely to come in small increments rather than major breakthroughs. Research on 

the effects of regulations is an ongoing priority for the Bureau, and we welcome opportunities to 
126 CONSUMER FINANCIAL PROTECTION BUREAU 

work with interested parties to enrich the body of evidence. Meanwhile, we will continue to address 

problems that we see in the marketplace and evaluate potential responses to those problems on the 

basis of the evidence that is reasonably available – mindful that, whatever the costs of regulation, 

the costs of not regulating adequately can be even larger.
6.Appendices
(This page intentionally left blank)
129 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX A: REVIEW OF EXISTING RESEARCH

This appendix offers a detailed review of some of the relevant research around the costs of 

regulation. These studies, along with others, helped frame the CFPB’s thinking around the Study 

methodology. Prior efforts used various methodologies to study the impact of regulations on 

financial institutions. We followed best practices from these studies and tried to mitigate some 

of the challenges when developing the CFPB’s Study methodology. We highlight some of the 

strengths and weaknesses of these studies below. 

Elliehausen (1998) offered a review of some of the empirical studies conducted on regulatory 

burden and compliance costs. He assessed the strengths and weaknesses of previous studies’ 

methodologies (e.g., case studies, surveys, and econometric analyses). Elliehausen also provided 

a taxonomy that defined sources and types of regulatory costs, such as operating costs and 

opportunity costs, among others, as they related to regulations.

Based on his assessments, Elliehausen found that researchers obtained reliable estimates by: 

 Identifying regulations and the specific regulatory requirements covered in the study;

 Suggesting activities that may have been undertaken to satisfy those requirements;

 Defining the types of costs that are being measured (e.g., ongoing costs versus start-up 

costs); and

 Providing specific instructions for estimating components of those costs.

In Elliehausen’s view, studies that were less likely to produce meaningful data and insights were 

those that attempted to estimate the aggregate cost of regulation for the banking industry. Such 

studies rarely specified the regulations in scope and did not identify the compliance activities 

that needed to be monetized.

With respect to the case study methodology, Elliehausen pointed out, one of the strengths of 

case studies is the higher level of reliability of the data given the focus on a limited number of 

financial institutions. He also noted that further research on regulatory costs should focus on 

trying to “explain the determinants of cost” instead of only measuring costs. 

Elliehausen also noted that many studies found evidence of economies of scale in compliance 

costs. They concluded similarly that compliance costs are “substantially greater for banks at low 

levels of output than for banks at moderate or high levels of output.”
130 CONSUMER FINANCIAL PROTECTION BUREAU 

Grant Thornton (1993) was a three-phase study prepared for the Independent Bankers

Association of America (now Independent Community Bankers of America). The first phase of 

the study (Phase I) was a national survey that sought to identify the costliest regulatory areas. 

Based on the responses of the survey, Grant Thornton identified the top 13 regulatory areas and 

developed case studies during the second phase of the study (Phase II) to investigate the costs 

related to these areas at nine community banks. In the third phase (Phase III), another survey 

asked respondents to estimate the total full-time employee (FTE) hours for one of the identified 

13 regulatory areas. Grant Thornton used the results from Phases II and III to extrapolate the 

total compliance cost and FTE hours for 13 regulatory areas across the community banking 

industry, which at the time of the study totaled more than 9,600 institutions. The researchers 

found that the annual cost of compliance for all community banks in these 13 areas was 

approximately $3.2 billion and required 48 million FTE hours.

The decision to narrow the scope to only the most burdensome regulations in subsequent phases 

helped avoid a blurring together of regulations for respondents, a shortcoming suffered by more 

general studies. In the case studies, Grant Thornton identified possible activities and 

responsible personnel in their collection instrument. This specificity allowed for comparative 

analysis between rules. However, the study was not able to separate the incremental cost of 

regulations, nor was it able to identify which types of activities or regulatory requirements were 

driving most of the FTE hours and compliance costs. Furthermore, the attempt to extrapolate 

estimates from Phases II and III results to the broader industry may have been subject to 

significant measurement error, given the lack of representativeness of the banks in Phase II and 

a 30% survey response rate for the Phase III surveys. 

Barefoot, Marrinan & Associates, Inc. Thakor, and Beltz (1993) offered a collection of 

observations and recommendations based on two surveys of commercial banks and thrifts that 

examined the compliance costs related to the Bank Secrecy Act, the Community Reinvestment 

Act, and the Real Estate Settlement Procedures Act. While the researchers attempted to gather 

data that were representative of the industry as a whole, response rates from the two surveys

were low. The first survey was a nine-page questionnaire that asked institutions to provide

estimates on costs and FTE hours related to, among other things, training, development of 

policies and procedures, use of vendors, monitoring, audit, and recordkeeping as they were

related to each of the three regulations. The survey had a response rate of about 3.5%. The 

second survey asked institutions to provide their best dollar estimates of total annual costs and 

non-recurring costs related to the three regulations. The survey did not specify which

components or variables the institutions should consider when calculating their costs. This 
131 CONSUMER FINANCIAL PROTECTION BUREAU 

second questionnaire had a response rate of 17%.

89 Barefoot, Marrinan & Associates, Inc. 

Thakor, and Beltz found that total regulatory costs represented approximately 18% of net 

income on average across all banks. The authors also found evidence of economies of scale, as 

compliance costs as a percentage of assets and also of net income decreases with larger banks. 

Elliehausen and Lowrey (2000) is among the existing studies that attempted to measure 

the costs associated with implementing a new regulation at financial institutions. This study 

focused on measure the one-time compliance costs related to implementation of requirements 

under the Truth in Savings Act (TISA). The researchers used data from a Board of Governors of 

the Federal Reserve survey of banks and thrifts regarding compliance costs of implementing 

new consumer deposit account practices to comply with Regulation DD. The researchers 

administered the survey during the implementation period of the regulatory change and asked 

participants about policies and practices prior to the new law and the compliance costs they 

incurred after it was put in place. To assist respondents in completing the survey, the 

researchers offered a list of possible compliance activities and provided instructions on how to 

calculate cost estimates. Based on their empirical analyses, Elliehausen and Lowrey found that 

implementation costs for compliance with TISA exhibited economies of scale. A significant 

portion of the implementation costs were fixed, such as software for disclosure production and 

time dedicated to learning the rule’s provisions. Of the total costs, IT system changes, 

managerial and legal resources, and training contributed to nearly 70 percent of the total burden 

of the regulation change. 

Federal Deposit Insurance Corporation (2012) is one of the more recent efforts to 

understand regulatory compliance costs, and it was conducted by the Federal Deposit Insurance 

Corporation (FDIC) as part of its ongoing research on community banks. The FDIC conducted 

interviews with nine community bankers from different banks as part of the FDIC Community 

Banking Study. These efforts were an attempt to identify specific regulations or supervisory 

practices that were significant drivers for compliance costs and to quantify the cost of regulatory 

compliance. The FDIC noted that the participants cited the cumulative effects of regulations as 

having an effect on their businesses, but also identified Bank Secrecy Act, Privacy Notices, and 

 

89 The nine-page survey was sent to 3,700 banks and thrifts, and 129 responses were received. The two-page survey 

was sent to 6,400 banks and 1,105 responses were received. The researchers determined that 445 of the responses 

from both surveys were sufficient enough to be used in their empirical analyses.
132 CONSUMER FINANCIAL PROTECTION BUREAU 

the Electronic Funds Transfer Act, among others, as “requir[ing] significant attention because of 

their business focus.” Participants also noted that they did not track regulatory compliance costs 

because of the difficulty in trying to separate costs that are “so interwoven into their operations.” 

However, the FDIC reported that, while tracking compliance costs was not regularly done, the 

participant banks said they could identify the direct costs associated with regulatory compliance 

(e.g., compliance personnel salaries, employee training, consulting fees, external and internal 

audit fees, and specific IT costs directly associated with compliance). The challenge for the 

banks in estimating total compliance costs was identifying the “indirect costs” that are difficult 

to allocate between Compliance and other parts of the bank (e.g., time spent by FTEs outside of 

the Compliance department on compliance-related duties).
133 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX B: TAXONOMIES

TABLE 1. REGULATION TAXONOMY

Regulation 

Requirement 

Category

Definition Requirement Definition

Regulation and 

Code (for 

Reference)

Advertising

Requirements or 

limitations on the form or 

content of information 

disseminated for the 

purposes of advertising 

products

Advertising 

requirements

Prohibits the use of inaccurate or 

misleading information in 

advertisements and requires 

institutions to represent interest 

rates as APY when referenced in 

advertising material

DD 1030.8

Overdraft rules 

around advertising

Requires institutions, in their 

advertisements regarding payment 

of overdrafts, to disclose any 

overdraft fees

DD 1030.11

Authorization 

Rights

Requirements to provide 

consumers with the option 

of accepting or declining 

participation in a given 

product

Issuance of access 

devices

Prohibits institutions from issuing 

access devices (i.e., debit cards) 

unless a consumer explicitly 

requests one or unless the device is 

not validated upon issue 

E 1005.5

Right to stop payment 

of preauthorized 

transfers

Requires institutions to allow 

consumers to stop the payment of a 

preauthorized electronic fund 

transfer if notice is given at least 

three days before the transfer

E 1005.10 

Opt-in requirements 

for overdraft

Prohibits institutions from assessing 

a fee for overdraft payment unless 

the consumer opts in to the 

overdraft program (either at account 

opening or at the point of 

transaction)

E 1005.17

Opt-out for use of 

non-public information

Requires institutions to give 

consumers the right to opt out of 

having their non-public personal 

information sent to a non-affiliated 

third party

P 1016.7

Calculation 

Methodologies

Requirements regarding 

methods for calculating 

rates, charges, fees, or 

other quantitative metrics

Payment of interest

Enumerates the methods with which 

an institution is allowed to 

determine the interested earned on 

an account balance

DD 1030.7

Contracting 

and 

Outsourcing

Requirements or 

limitations regarding the 

contracting or outsourcing 

of bank operations that 

affect consumers

Electronic fund 

transfer service 

provider not holding 

consumer's account

Requires institutions who use thirdparty providers for an electronic 

fund transfer service (i.e., to issue 

debit cards) to make available any 

information necessary for service 

provider to investigate errors

E 1005.14 
134 CONSUMER FINANCIAL PROTECTION BUREAU 

Regulation 

Requirement 

Category

Definition Requirement Definition

Regulation and 

Code (for 

Reference)

Error and 

Dispute 

Resolution

Requirements or 

limitations regarding the 

manner in which consumer 

disputes can be resolved

Procedures for 

resolving errors

Enumerates the way in which 

institutions must respond to and 

resolve error claims brought by 

consumers regarding electronic 

transfers, including a timeframe of 

10 business days for providing 

provisional re-credit to the consumer

E 1005.11

Error resolution for 

electronic fund 

transfer service 

provider not holding 

consumer’s account

Enumerates the way in which a 

party who offers an electronic 

transfer service for accounts that it 

does not hold must respond to and 

resolve error claims brought by 

consumers

E 1005.14 

Limitations on liability 

of consumer for 

unauthorized transfers

Enumerates the conditions 

determining an institution's ability to 

hold consumers liable for 

unauthorized electronic fund 

transfers

E 1005.6 

Direct disputes 

regarding credit 

information

Requires an institution respond to 

direct disputes from consumers 

regarding information that the 

institution reported to a Credit 

Reporting Agency (“CRA”)

V 1022.43

Information 

Exchange

Requirements or 

limitations regarding the 

provision or receipt of nonpublic consumer 

information to or from a 

third-party agent

Limits on redisclosure and reuse 

of information

Enumerates the conditions under 

which an institution can re-disclose 

and reuse non-public personal 

information about consumers

P 1016.11

Limits on sharing 

account number 

information for 

marketing purposes

Prohibits institutions from disclosing 

a consumer's account number to a 

non-affiliated third party, unless it is 

a CRA

P 1016.12

Reasonable policies 

and procedures 

concerning the 

accuracy and integrity 

of furnished 

information

Requires an institution to establish 

and implement reasonable written 

policies and procedures regarding 

the accuracy and integrity of 

information that is furnished to 

CRAs

V 1022.42

Duties of users 

regarding address 

discrepancies

Requires an institution to develop 

reasonable policies and procedures 

to apply when they receive a notice 

of address discrepancy from a CRA

V 1022.82
135 CONSUMER FINANCIAL PROTECTION BUREAU 

Regulation 

Requirement 

Category

Definition Requirement Definition

Regulation and 

Code (for 

Reference)

Information 

Retention

Requirements or 

limitations regarding the 

retention and storage of 

consumer information

Record retention

Requires institutions to retain 

records documenting evidence of 

compliance with all requirements in 

the regulation for two years

DD 1030.9

Record retention

Requires institutions to retain 

records documenting evidence of 

compliance with all requirements in 

the regulation for two years

E 1005.13

Prompted 

Disclosures

Requirements to provide 

information to the 

consumer prompted by an 

exogenous bank- or

consumer-driven event

Oral response to 

inquiries

Requires institutions to state the 

APY when responding to a 

customer's oral inquiry about the 

interest rate on his or her account

DD 1030.3

Prompted account 

disclosures

Requires institutions to provide 

account disclosures stating the 

interest rate, fees, and other key 

features of the account at account 

opening and at any time upon 

request of the consumer

DD 1030.4 

Subsequent account 

disclosures

Requires institutions to provide 

account disclosures before a term 

on an account is changed or before 

the maturity of time accounts that 

renew automatically

DD 1030.5

Overdraft rules on 

disclosure of account 

balances

Requires institutions to disclose an 

account balance that excludes any 

funds the institution may provide to 

cover an overdraft

DD 1030.11

Initial disclosures

Requires institutions to provide 

disclosures about fees, liabilities, 

and other terms of electronic fund 

transfer services before the first 

electronic transfer is made (i.e., at 

account opening)

E 1005.7

Change in terms 

notice

Requires institutions to provide a 

disclosure at least 21 days before a 

change in account terms is made 

explaining the nature of the change

E 1005.8
136 CONSUMER FINANCIAL PROTECTION BUREAU 

Regulation 

Requirement 

Category

Definition Requirement Definition

Regulation 

and Code (for 

Reference)

Prompted 

Disclosures

(cont’d)

Requirements to provide 

information to the 

consumer prompted by 

an exogenous bank- or 

consumer-driven event

Receipts at 

electronic terminals

Requires institutions to make 

available receipts for transactions 

made at electronic terminals for all 

amounts above $15

E 1005.9 

Preauthorized 

transfer notices

Requires institutions or designated 

payees to provide notice when a 

preauthorized transfer will vary in 

amount from the previous transfer 

under the same authorization

E 1005.10 

Disclosures for 

electronic fund 

transfer service 

provider not holding 

consumer’s account

Requires parties who offer an 

electronic transfer service for 

accounts that they do not hold to 

provide all the disclosures related 

to electronic fund transfers 

required of account-holding 

institutions

E 1005.14 

Initial privacy notice 

to consumers

Requires institutions to provide a 

disclosure explaining their privacy 

policies to a consumer before 

initiating a business relationship or 

sharing any non-public information 

about the consumer

P 1016.4, 

1016.6, 1016.9

Revised privacy 

notices

Requires institutions to provide a 

disclosure to consumers if they 

change their privacy policies 

P 1016.8, 

1016.6, 1016.9

Adverse action 

disclosure

Requires an institution to provide a 

disclosure to a consumer if they 

take any action deemed to be an

“adverse action” with respect to 

the consumer (i.e., denial of 

account approval) based in part on 

information obtained from a CRA.

Other disclosure requirements 

apply if institutions take an 

adverse action based on 

information obtained from another 

third party.

FCRA Section 

615 
137 CONSUMER FINANCIAL PROTECTION BUREAU 

Regulation 

Requirement 

Category

Definition Requirement Definition

Regulation 

and Code (for 

Reference)

Unprompted 

Disclosures

Requirements to provide 

information to the 

consumer on a recurring 

and/or ongoing basis

Periodic account 

disclosures

Requires institutions to provide 

periodic account disclosures or 

periodic notices alerting 

consumers of their ability to 

request account disclosures

DD 1030.4

Periodic statement 

disclosures

Enumerates certain information 

that must be contained in 

institutions' periodic statements 

(e.g., APY, fees imposed)

DD 1030.6

Overdraft rules for 

periodic statements

Requires institutions to separately 

disclose on each periodic 

statement the amount of all fees 

charged for overdraft programs

and for returning items unpaid

DD 1030.11

Periodic error 

resolution notice

Requires institutions to provide 

consumers with an error resolution 

notice at least once per calendar 

year or with the periodic statement

E 1005.8 

Periodic statements

Requires institutions to send a 

periodic statement to consumers 

for months in which an EFT has 

occurred and enumerate key 

account information (e.g., fees, 

account balances)

E 1005.9 

Periodic statements 

for electronic fund 

transfer service 

provider not holding 

consumer’s account

Requires account-holding 

institution to provide a periodic 

statement to the consumer that 

describes each EFT initiated by 

the consumer with the access 

device issued by the service 

provider

E 1005.14 

Disclosures at 

automated teller 

machines

Requires institutions to provide 

notice regarding fees for using 

ATMs on the screen of the ATM or 

by providing it on paper, before 

the consumer is committed to 

paying a fee

E 1005.16 

Annual privacy 

notice to customers

Requires institutions to send a 

notice to customers explaining 

their privacy policies at least once 

a year

P 1016.5, 

1016.6, 1016.9
138 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE 2. CUSTOMER LIFECYCLE TAXONOMY 

Stage of 

Customer Life 

Cycle

Activity Sub-Activities

Customer 

Acquisition

Product Design

Conduct consumer research (internal or external)

Develop consumer insights

Adjust existing products to better meet needs

Design a new product 

Design materials to support new product

Customer Selection and 

Product Matching

Conduct market segmentation

Identify desirable customer segments

Collect information about potential customers

Match products to desirable segments

Market and Reach Out to 

Consumers

Design and execute advertising campaigns

Design and place promotional material in bank branches or other locations

Receive and Manage 

Customer Inquiries

Receive and manage dial-in inquiries

Receive and manage in-person inquiries

Receive and manage online inquiries

Receive and manage written inquiries

Account 

Opening

Receive Account Application

Receive account application via website

Receive account application via bank branch 

Receive account application via mail

Process and Review Account 

Application

Read, scan, and check for errors on account application

Gather additional necessary information on application (e.g., credit bureau, 

ChexSystems, employer verification)

Verify consumer identity

Share information with third party

Make decision (system or human decision)

Notify Consumer of Decision 

(Approve or Decline)

Process Initial Deposit

Receive consumer information about initial deposit

Send ACH request to accept initial deposit (if transferring electronically)

Deposit initial cash or check (if physically depositing)

Create Account Enter account into internal systems and databases

Enter account into external systems and databases (e.g., ChexStystems)

Add Debit Card to Account

Notify consumer of debit card option

Receive and process consumer request for debit card

Create and emboss debit card

Send debit card

Add Overdraft Protection to 

Account

Notify consumer of overdraft protection options

Receive and process consumer request for overdraft protection

Add Other Products/Offerings 

to Account (Line of Credit, ESign)

Notify consumer of additional products/offerings

Receive and process consumer request for additional products/offerings
139 CONSUMER FINANCIAL PROTECTION BUREAU 

Stage of 

Customer Life 

Cycle

Activity Sub-Activities

Account 

Opening 

(cont’d)

Create and Distribute 

Account Opening Material

Develop and produce account-specific opening material

Deliver account opening material (e.g., add-on products, debit card, and

checks)

Activate Debit Card

Activate via phone

Activate via ATM

Activate online

Account 

Maintenance

Process Deposits

Process check and cash deposits (at ATMs)

Process check deposits (at tellers)

Process online deposits

Process mobile deposits

Process ACH deposits

Process Withdrawals

Process ATM withdrawals

Process teller withdrawals

Process online withdrawals

Process ACH withdrawals

Process Debit Card 

Payments

Process Transfers Process online transfers (e.g., wires, bill-pay, and automate transfers)

Process in-person transfer requests (e.g., wires)

Process Recurring 

Transactions

Set up recurring transactions

Manage and process recurring transactions

Issue Cash Alternatives

Issue travelers' checks

Issue cashiers' checks

Issue money orders

Issue gift cards and pre-paid debit cards

Calculate Interest and Post to 

Accounts

Calculate interest

Deposit interest-earned into accounts

Provide Account Information 

(Recent Transactions, 

Balance, Etc.)

Mail regular bank statements

E-mail regular e-statements

Provide account information through online portal

Provide account information through mobile portal

Provide account information at ATMs

Provide account information over the phone

Provide Customer Service

Provide level-one call center support for dial-in inquiries or complaints

Provide in-person customer service and level-one support (in branches)

Receive and process written requests

Follow-up on customer requests 

Provide consumers with proactive notifications (written and phone-based)
140 CONSUMER FINANCIAL PROTECTION BUREAU 

Stage of 

Customer Life 

Cycle

Activity Sub-Activities

Account 

Maintenance 

(cont’d)

Assess Overdraft Fees

Determine necessary overdraft fee

Collect overdraft fee 

Conduct Daily Posting 

Process

Post bank initiated events (e.g., print check fees and new account deposits)

Post deposits

Calculate OD credit limit

Post holds (e.g., debit, uncollected funds, and fraud)

Post transactions (depending on posting order policy)

Calculate fees

Create ending balance

Assess Fees

Assess regular service fees

Assess fee for new checks

Assess collections fees

Assess account research fees

Assess stop-payment fees

Assess other fees

Add or Remove New 

Products or Features

Add (or remove) debit card to existing account

Add (or remove) overdraft protection to existing account

Add (or remove) other products/offerings to account

Upgrade or downgrade accounts

Monitor Accounts for 

Upgrade Opportunities or 

Necessary Account Changes

Collect data on accounts

Review data on accounts for opportunities or necessary actions

Share data with third parties

Reach out or advertise to consumers about new products or upgrade 

opportunities

Change account terms

Prepare for and Conduct 

Audits

Prepare for and conduct internal audits

Prepare for and conduct external audits

Identify and Manage 

Exceptional Activities

Identify exceptional incident (e.g. non-payment, non-compliance)

Determine how best to respond to and control for incident

Respond to incident

Communicate response to consumer

Record and document response

Receive and Resolve 

Consumer Complaints/ 

Disputes

Receive consumer complaints/disputes

Determine appropriate resolution

Communicate resolution decision to consumer

Document resolution decision
141 CONSUMER FINANCIAL PROTECTION BUREAU 

Stage of 

Customer Life 

Cycle

Activity Sub-Activities

Account 

Closing

Receive and Process 

Initiation for Account Closing

Receive and process customer request for account closing

Receive and process bank-generated initiation for account closing

Communicate with Consumer

Notify consumer of receipt of account closing request

Charge closure fee (if applicable)

Notify consumer of decision to close account

Close Account

Disperse or escrow funds

Remove account from internal databases

Provide information to external providers (e.g., ChexSystems)

Store and maintain information

Turn Off Debit Card

Send Final Account Closing 

Information

Design final account closing information

Send final account closing information

Review for Potential 

Opportunities

Review details of account closing for potential follow-up opportunities

Follow-up with consumer
142 CONSUMER FINANCIAL PROTECTION BUREAU 

TABLE 3. BUSINESS FUNCTION TAXONOMY

Function Sub-Function Responsibilities

Operations

Call Centers Manage inbound and outbound calls for existing or potential customers

Fulfillment

Procure and manage supplies and materials, mailings, postage, packaging, 

and logistics; manage relationships with vendors who may provide some of 

these services

Back Office Support

Provide branch support (e.g., processing documents, compliance forms, 

transactions); internal helpdesk Q&A; support on research and adjustments 

(e.g., for disputes and complaints)

Fraud Mitigation/Error 

Resolution

Monitor accounts and customer activities to detect fraud incidents and other 

potential risks; develop and implement policies to prevent fraud and report 

fraud cases; receive, research, and manage customer inquiries, disputes, and 

complaints; resolve disputes in conjunction with relevant business functions 

and document resolution

IT

Application 

Development and 

Maintenance

Write, maintain, and check all computer code necessary to support an 

institution's software systems, including online accounts and services

Infrastructure 

Management

Set up and manage all IT infrastructure systems, including network systems, 

servers, and PC and telecom systems

Retail

Distribution Set up, manage, and maintain a bank's physical distribution network, including 

ATMs and bank branches

Front-line 

Management/Platform 

FTEs

Train, oversee, and manage all front-line employees who interface with 

customers to open or update accounts, provide banking services, and resolve 

disputes or concerns

Product Development 

and Management

Define product strategy roadmaps, develop and design new products/ 

services and supporting material, perform product demos; market the product 

to prospects, customers, and others

Corporate 

Oversight 

(Risk/Audit)

Enterprise-wide 

Standard Design

Prioritize areas for audit resources in accordance with risk assessment; 

prepare for and design audit process, risk categories, schedules, scorecards, 

etc.

Internal Exams Conduct enterprise risk assessment/exams and monitoring to identify risks 

(e.g., credit, legal, IT) and ensure compliance

Legal

Research Conduct legal research and draft legal document and memos; review and 

assess legal requirements and regulations to guide business compliance

Product and Policy 

Review

Provide legal advice and product/policy review for business functions (e.g., 

marketing/advertising, product development, business policy)

Advice and Counsel

Defend business against lawsuits or complaints brought by internal and 

external parties and provide pre-litigation counseling, conduct negotiations 

with external parties (note: only as related to reg. compliance)

HR

Training Design and 

Development

Design and develop trainings relevant to compliance for new and existing 

employees across company, liaising with third parties/vendors if necessary

Training Deployment 

and Monitoring

Execute trainings across the enterprise (including assigning trainings, 

monitoring trainings), by specific regulation or by job function
143 CONSUMER FINANCIAL PROTECTION BUREAU 

Function Sub-Function Responsibilities

Marketing Marketing Design 

and Implementation

Conduct research on consumer insights; perform marketing analytics and 

segmentation analysis; develop marketing and branding strategy for 

products and overall bank; manage sales force; design and execute 

advertising campaigns; provide services to other business functions on 

marketing-related needs (e.g., form design for Compliance function)

Compliance

Regulatory Research 

and Gap Analysis

Research and assess regulatory requirements/changes and implications on 

the enterprise (e.g., risk areas, potential areas lacking compliance)

Policy and Procedure 

Design

Design policies, procedures, and processes to ensure the organization is in 

compliance with all regulations; track and plan for changes in regulations

Monitoring and 

Reporting

Monitor compliance processes throughout the bank to identify compliancerelated risks; enforce compliance policies where necessary; review extent 

of compliance and any compliance deficiencies and report information to 

regulators; manage relationships with regulators

Business Advice and 

Counsel

Provide advice and respond to other business functions on compliancerelated issues (e.g., marketing/advertising, business policies)

External Exams Prepare for, facilitate, and oversee external supervisory activity, including 

time spent with business functions to ensure compliance
144 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX C:INCREMENTAL COST ASSUMPTIONS

TABLE 4. SUMMARY OF INCREMENTAL COST ASSUMPTIONS BY SUB-FUNCTION

Note: Unless otherwise indicated below, 100% of identified time and costs are included in the calculation 

of incremental compliance cost for the in-scope regulations.

Function Sub-Function Data Captured and Key Assumptions

Operations

Call Centers

• Incremental time to handle calls that are related to Regulation E 

disputes; if call center handles these disputes (assume 1/3 of time is 

incremental, based on interviews with Regulation E dispute center 

managers)

• Incremental time to answer questions that are driven by in-scope 

regulations (e.g., questions about OD opt-in, questions about 

privacy notices)

• Incremental time taken to quality check calls conducted by 

personnel to ensure compliance

• Time to read disclosures at account opening (Tier 1 only)

• Time to manage escalated complaints related to in-scope 

regulations (Tier 1 and Tier 2A)

Fulfillment

• Labor, materials, and/or third-party costs to mail the following 

documents (not comprehensive for each bank)

o Regulation P privacy notice 

o Change of terms notices (where this was a regular 

occurrence)

o Portion of new account packet (assumed 10%)

o Portion of monthly statement (assumed 5%)

• Where breakdowns were not available, assume 10% of outsourced 

cost to send statements and privacy notice (based on data from 

other banks)

Back Office Support

• Time to process documents received during account opening.

Generally two components:

o Time to check documents for accuracy and completeness

o Time to image documents

• Other back office costs (only in one bank)

o Internal helpdesk to answer front-line questions - assume 

100% of compliance questions are incremental (Tier 2A)

o Operations control group that does quality and control 

monitoring across Operations group (Tier 1)

Fraud Mitigation/Error 

Resolution

• Incremental time to manage claims and disputes related to 

Regulation E due to special timelines (assume 1/3 of time is 

incremental, based on interviews with Regulation E dispute center 

managers)

• Incremental time spent to quality check claims handling for 

Regulation E disputes

• Time spent managing escalated claims (assume 100% of time, 

since claims likely would not be escalated if not for the higher risk 

profile)
145 CONSUMER FINANCIAL PROTECTION BUREAU 

Function Sub-Function Data Captured and Key Assumptions

IT

Application 

Development and 

Maintenance

• Software, hardware, and labor cost for systems that directly support 

a compliance process (e.g., claims tracking) - for these systems we 

accepted interviewees judgments about appropriate proportions

• Software, hardware, and labor cost for systems that support core 

bank processes, but also include some compliance functionalities 

(based on expert interviews, we use a standard 4% ratio to 

determine the proportion relevant to in-scope regulations)

• Note: Because of differences in how data was reported, the 

allocations to Infrastructure vs. Application Development and 

Maintenance vary greatly; it is therefore most useful to compare IT 

data across banks at the function level.

Infrastructure 

Management

Retail

Distribution

• Proportion of paper and ink cost for receipts at ATMs (assume 20% 

of this cost)

• Cost to install and maintain Regulation E signs at ATMs

Front-line 

Management/Platform 

FTEs

• Time spent explaining disclosures and compliance forms at account 

opening. Forms included (not comprehensive across banks):

o Overdraft opt-in/opt-out

o Privacy notice and opt-in/opt-out

o TISA initial disclosures

o Regulation E initial disclosures

o Adverse action notices

• Printing cost to print the above notices

• Incremental time spent receiving and resolving disputes or claims in 

branches (for some participants)

Product Development 

and Management

• Time spent liaising with compliance personnel and revising product 

development plans/proposals/materials based on compliance 

recommendations. We calculated this in two ways:

o Top-down: Divide up total time into activities and then 

determine percent on deposits and percent on in-scope 

regulations

o Bottom-up: For each activity determine the number of 

hours devoted to compliance-related activities (e.g., 

meetings, calls, revising of materials)

Legal

Research • Time spent to keep abreast with in-scope regulations (research and 

meeting time)

• Time spent to review materials and counsel on product design with 

in-scope regulations and deposit products

• Time spent on disputes and complaints related to in-scope 

regulations

• Third-party vendor cost for advice relevant to in-scope regulations

Product and Policy 

Review

Advice and Counsel
146 CONSUMER FINANCIAL PROTECTION BUREAU 

Function Sub-Function Data Captured and Key Assumptions

HR

Training Design and 

Development

• Time spent to design individual training module (by regulation or by 

job function)

• Third party vendor cost for training materials by module

Training Deployment 

and Monitoring

• Time spent on each module for in-scope regulations

• Total # of FTEs for each module

• Time spent to allocate, monitor and track training

• System cost to track training

• Third party cost to monitor and track training

• Training materials cost if not web-base

• Instructor time to conduct training

Marketing Marketing Design and 

Implementation

• Time spent liaising with compliance and revising 

marketing/advertising materials based on compliance feedback. We 

calculated this in two ways:

o Top-down: Divide up total time into activities and then 

determine percent on deposits and percent on in-scope 

regulations

o Bottom-up: For each activity determine the number of 

hours devoted to compliance-related activities (e.g., 

meetings, calls, revising of materials)

• Third-party research on compliance-related matters

Compliance

Regulatory Research 

and Gap Analysis

• Time spent on each sub-function activity from both first line and 

second line of defense on in-scope regulations

• Third-party cost for compliance advice relevant to our scope

Policy and Procedure 

Design

Monitoring and 

Reporting

Business Advice and 

Counsel

External Exams

• Time spent within compliance function to prepare, conduct and 

follow-up on supervisory activity (adjusted by exam frequency)

• Time spent by other functions to support supervisory activity

(collected for some participants, but not reported in estimates)

Corporate 

Oversight 

(Risk/Audit)

Enterprise-wide 

Standard Design

• Time spent to conduct risk assessment on our scope (Most banks 

don't have significant incremental costs while Tier 2A specifically 

identified time spent by compliance function on risk assessment and 

work with internal risk management)

Internal Exams

• Time to prepare and conduct exam on each in-scope regulation 

(split by DD, E, P and V for some banks and others may combine 

all)

• Third-party cost to conduct scope related audit exam ( For Tier 4B 

which is the only bank using outside vendor, assume 20% of the 

cost is related to Study scope)
147 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX D: PRE-VISIT DOCUMENTS

Compliance Cost Study 

Pre-Visit Information

The Compliance Cost Study is a research effort of the Consumer Financial Protection Bureau 

(CFPB). This outreach is being conducted in order to build the Bureau’s knowledge base on costs 

to financial institutions of complying with consumer financial protection regulations. The 

information that you provide will help the CFPB better understand an institution’s cost of 

regulatory compliance activities for several regulations covering deposit accounts and 

transactions. We plan to cover Regulation DD (and Truth in Savings), Regulation E (and 

Electronic Fund Transfers), Regulation P (and Privacy of Consumer Financial Information), as 

well as portions of other regulations, such as Regulation V (and Fair Credit Reporting), to the 

extent that they are pertinent to this product space.

Our outreach will follow a general model as outlined below:

 Pre-visit Call(s)

o CFPB conference line provided

 Onsite visits

o Day 1 (half-day)

• At midday: In-person kick-off with key interviewees

• Afternoon: Pre-scheduled interviews (individual and group) with preidentified department executives, managers, and relevant representatives

o Day 2 

• All-day: Interviews (individual and group) with pre-identified department 

executives, managers, and relevant representatives

o Day 3 

• Interviews (individual and group) with pre-identified department 

executives, managers, and relevant representatives
148 CONSUMER FINANCIAL PROTECTION BUREAU 

• Additional interviews (individual and group) with additional executives, 

managers, and relevant representatives

o Day 4 

• Additional interviews (individual and group) with additional executives, 

managers, and relevant representatives

 Follow-ups

o By telephone, as necessary

We hope to have discussions with relevant executives, managers, and representatives from 

across your organization, including those from Operations and Compliance, and extending to 

those from IT, Marketing, Research, Legal, Risk, and other areas. Participation in these 

discussions will be voluntary, and we expect each conversation to last between 45 and 90 

minutes. The information collected will be used to develop anonymous case studies, and your 

bank and participating individuals will not be identified. As required by federal law, the Office of 

Management of Budget has approved the topics of these conversations under the Paperwork 

Reduction Act. The OMB control number for this collection is 3170–0032.

Most conversations will follow a consistent structure. First, we will confirm the 

organizational responsibilities of each executive, manager, or group (in the case of group 

interviews) and understand the business activities in which the executive, manager, or group is 

involved. Second, based on the scope of those responsibilities, we will identify specific activities 

that are affected by compliance with Regulations DD, E, P, and V. Next, for each affected 

activity, we will seek to understand the discrete compliance processes embedded into the 

execution of that activity. Finally, we will evaluate the above-baseline90 costs associated with 

each of these identified compliance processes. Specifically, we will ask about the labor costs and 

third-party costs required to drive these processes, as well as the non-labor costs and fixed 

investments required to enable those processes. Throughout each session, we will ask a number 

 

90 For the purposes of this study, “baseline” costs will refer to those operating costs a bank incurs for activities related 

to deposit products and/or services that it would likely continue to incur in the absence of the regulation or 

regulations being studied.
149 CONSUMER FINANCIAL PROTECTION BUREAU 

of questions to understand the qualitative context for these compliance costs and their broader 

strategic implications for the organization. 

For a few targeted conversations, we will ask additional questions to situate the 

quantified costs of compliance with Regulations DD, E, P, and V within the larger picture of total 

compliance costs (e.g., costs associated with Bank Secrecy Act/ Anti-Money Laundering, state 

law, NACHA operating rules, network rules). For example, we will broaden our interview with 

the leadership of the Compliance function to understand the total Compliance budget and 

related metrics (e.g., total number of Compliance personnel dedicated to specific activities).

The topics listed below will serve as the common interview guide, to be tailored to the 

specific functional leaders with whom we will conduct interviews. To ensure we tailor this guide 

appropriately, we will request a small amount of data in advance of our visit to strengthen our 

understanding of your organization and help us establish a denominator against which to assess 

these compliance costs (e.g., organizational charts, operating expenses for deposit products). 

COMMON INTERVIEW GUIDE

(A) Identification of compliance responsibilities and quantification of total costs.

In this section of the interview, we would like to learn more about how compliance factors into 

your business activities and attempt to quantify the cost of that impact for Regulations DD, E, P, 

and V. 

(1) Confirmation of organizational role and responsibilities. We would like to 

start with a brief introduction to your role/responsibilities and the 

business activities you manage.

(2) Identification of specific activities implicated by regulatory compliance. 

From the list of business activities mentioned in Section A1, we would like 

to identify those affected by compliance with Regulations DD, E, P, or V. 

(3) Deep dive into compliance processes. For each of the affected business 

activities identified in Section A2 above, we will want to better understand 

how the requirements of Regulations DD, E, P, or V (and the compliance 

processes they necessitate) shape the execution of those business 

activities. This will enable us to assess costs in Sections A4 and A5.
150 CONSUMER FINANCIAL PROTECTION BUREAU 

(4) Discussion of incremental labor costs. For each of the compliance 

processes identified in Section A3 above, we would like to better 

understand the incremental labor required to drive those processes. This 

will include incremental staff hired, incremental work required from 

existing staff, or incremental third-party outsourcing. We would also like 

to understand the components of those costs (e.g., are they ongoing

versus one-time, fixed versus variable).

(5) Discussion of incremental non-labor costs. For each of the compliance 

processes identified in Section A3 above, we would like to better 

understand the incremental non-labor costs required to enable those 

processes (e.g., IT systems and software, training collateral, mailing 

material). We would also like to understand the components of those 

costs (e.g., are they ongoing versus one-time, fixed versus variable).

(B) Context of compliance costs. In this section, we hope to understand the more 

qualitative implications those costs have on your business and its consumers.

(1) Organizational implications of regulatory compliance. In this section, we 

would like to qualitatively understand how regulatory implications may 

have resulted in modifications to your organization’s structure and/or 

individual roles/responsibilities.

(2) Strategic trade-offs. In this section, we would like to qualitatively 

understand the strategic implications these compliance costs have had for 

your business more broadly. 

(3) New product introduction. In this section, we would like to understand 

how regulations may affect the introduction of a new product. 

(4) Other concerns. In this section, we would like you to discuss any 

additional compliance costs/business impacts you deem important for us 

to understand. 

By addressing these topics, we hope to better understand the incremental, non-voluntary costs 

that result from compliance with Regulations DD, E, P, and parts of V. We hope that this effort 

will also help you learn something insightful about your own organization. 
151 CONSUMER FINANCIAL PROTECTION BUREAU 

As required by federal law, the Office of Management of Budget has approved the topics of these conversations 

under the Paperwork Reduction Act. The OMB control number for this collection is 3170–0032.

Also, a federal law called the Privacy Act directs how the federal government treats the information contained in 

your answers to these questions. To understand how and when your information may be shared, you can read the 

Privacy Act Statement on the CFPB’s website at www.consumerfinance.gov. The CFPB will also treat the 

information received consistent its confidentiality regulations at 12 C.F.R. § 1070.

If the responses you provide to this study are requested under the Freedom of Information Act, the Bureau will 

withhold such responses to the extent that it determines that they constitute trade secrets or confidential 

commercial information that you would not ordinarily make public. The Bureau will deem any such trade secrets or 

confidential commercial information to be “confidential information” for purposes of the Bureau’s confidentiality 

rules at 12 C.F.R. § 1070.40 et seq.
152 CONSUMER FINANCIAL PROTECTION BUREAU 

Pre-Read for Distribution to 

Participants
153 CONSUMER FINANCIAL PROTECTION BUREAU 
154 CONSUMER FINANCIAL PROTECTION BUREAU 
155 CONSUMER FINANCIAL PROTECTION BUREAU 

Advance Requests Document
156 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX E: ONGOING COST DATA SHEET

TABLE 6. ONGOING COST DATA SHEET FOR INFORMATION COLLECTION

FUNCTION / Sub-Function Labor Cost Non-labor cost Third party cost TOTAL COST

OPERATIONS 

Call Centers

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure

Fulfillment

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure
157 CONSUMER FINANCIAL PROTECTION BUREAU 

FUNCTION / Sub-Function Labor Cost Non-labor cost Third party cost TOTAL COST

OPERATIONS (cont'd)

Back office support

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure

Fraud mitigation/Error resolution

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure

IT

Application development and maintenance

Reg DD

Reg E

Reg P

Reg V/FCRA

Infrastructure management

Reg DD

Reg E

Reg P

Reg V/FCRA
158 CONSUMER FINANCIAL PROTECTION BUREAU 

FUNCTION / Sub-Function Labor Cost Non-labor cost Third party cost TOTAL COST

RETAIL/FRONT OFFICE

Distribution

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure

Front-line management (FTEs)

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure

Product development and management

Reg DD

Reg E

Reg P

Reg V
159 CONSUMER FINANCIAL PROTECTION BUREAU 

FUNCTION / Sub-Function Labor Cost Non-labor cost Third party cost TOTAL COST

LEGAL

Research

Product and policy review

Reg DD

Reg E

Reg P

Reg V/FCRA

Advice and counsel

Reg DD

Reg E

Reg P

Reg V/FCRA

CORPORATE OVERSIGHT (RISK/AUDIT)

Enterprise-wide standard design

Internal exams

Reg DD

Reg E

Reg P

Reg V/FCRA

HR

Training design and development

Reg DD

Reg E

Reg P

Reg V/FCRA

Training deployment and monitoring

Reg DD

Reg E

Reg P

Reg V/FCRA
160 CONSUMER FINANCIAL PROTECTION BUREAU 

FUNCTION / Sub-Function Labor Cost Non-labor cost Third party cost TOTAL COST

MARKETING

Marketing design and implementation

Reg DD

Advertising requirements

Prompted account disclosures

Periodic account disclosures

Reg E

Opt-in requirements for overdraft

Procedures for resolving errors

Initial disclosures

Receipts at electronic terminals

Periodic error resolution notice

Disclosures at automated teller machines

Reg P 

Opt-out for use of nonpublic information

Initial privacy notice to consumers

Annual privacy notice to customers

Reg V/FCRA

Adverse action disclosure

COMPLIANCE

Regulatory research and gap analysis

Policy and procedure design

Reg DD

Reg E

Reg P

Reg V/FCRA

Monitoring and reporting

Reg DD

Reg E

Reg P

Reg V/FCRA

Business advice and counsel

Reg DD

Reg E

Reg P

Reg V/FCRA

External exams

TOTAL
161 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX F: COMPLIANCE COST BREAKDOWN 

BY PARTICIPANT BANK
162 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 1

TABLE 7. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 10.9% 9.0% 2.3% 22.1%

Call Centers 2.8% 0.0% 0.0% 2.8%

Fulfillment 0.4% 4.7% 0.0% 5.1%

Back office support 1.9% 4.3% 0.2% 6.4%

Fraud mitigation/Error resolution 5.8% 0.0% 2.1% 7.8%

IT 0.0% 9.0% 1.1% 10.2%

Application development and maintenance 0.0% 0.0% 1.1% 1.1%

Infrastructure management 0.0% 9.0% 0.0% 9.0%

RETAIL/FRONT OFFICE 34.2% 0.8% 0.0% 34.9%

Distribution 0.0% 0.0% 0.0% 0.0%

Front-line management (FTEs) 32.6% 0.8% 0.0% 33.4%

Product development and management 1.5% 0.0% 0.0% 1.5%

LEGAL 0.8% 0.0% 0.0% 0.8%

Research 0.0% 0.0% 0.0% 0.0%

Product and policy review 0.7% 0.0% 0.0% 0.7%

Advice and counsel 0.1% 0.0% 0.0% 0.1%

CORPORATE OVERSIGHT (RISK/AUDIT) 1.2% 0.0% 0.0% 1.2%

Enterprise-wide standard design 0.0% 0.0% 0.0% 0.0%

Internal exams 1.2% 0.0% 0.0% 1.2%

HR 23.6% 0.2% 0.3% 24.1%

Training design and development 0.3% 0.0% 0.0% 0.3%

Training deployment and monitoring 23.3% 0.2% 0.3% 23.8%

MARKETING 1.3% 0.0% 0.0% 1.3%

Marketing design and implementation 1.3% 0.0% 0.0% 1.3%

COMPLIANCE 5.3% 0.0% 0.0% 5.3%

Regulatory research and gap analysis 0.1% 0.0% 0.0% 0.1%

Policy and procedure design 0.1% 0.0% 0.0% 0.1%

Monitoring and reporting 3.0% 0.0% 0.0% 3.0%

Business advice and counsel 1.3% 0.0% 0.0% 1.3%

External exams 0.9% 0.0% 0.0% 0.9%

TOTAL 77.4% 18.9% 3.7%

TYPE OF COST
163 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 2A

TABLE 8. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 14.0% 0.5% 0.0% 14.5%

Call Centers 5.8% 0.0% 0.0% 5.8%

Fulfillment 1.0% 0.5% 0.0% 1.5%

Back office support 4.3% 0.0% 0.0% 4.3%

Fraud mitigation/Error resolution 2.9% 0.0% 0.0% 2.9%

IT 1.2% 2.9% 5.9% 10.0%

Application development and maintenance 1.2% 0.0% 5.9% 7.1%

Infrastructure management 0.0% 2.9% 0.0% 2.9%

RETAIL/FRONT OFFICE 21.5% 0.0% 0.0% 21.5%

Distribution 0.6% 0.0% 0.0% 0.6%

Front-line management (FTEs) 16.2% 0.0% 0.0% 16.2%

Product development and management 4.6% 0.0% 0.0% 4.6%

LEGAL 0.5% 0.0% 0.0% 0.5%

Research 0.1% 0.0% 0.0% 0.1%

Product and policy review 0.0% 0.0% 0.0% 0.0%

Advice and counsel 0.4% 0.0% 0.0% 0.4%

CORPORATE OVERSIGHT (RISK/AUDIT) 5.5% 0.0% 0.0% 5.5%

Enterprise-wide standard design 4.6% 0.0% 0.0% 4.6%

Internal exams 0.9% 0.0% 0.0% 0.9%

HR 16.3% 0.2% 0.1% 16.6%

Training design and development 0.3% 0.0% 0.1% 0.3%

Training deployment and monitoring 16.0% 0.2% 0.0% 16.3%

MARKETING 4.4% 0.0% 0.0% 4.4%

Marketing design and implementation 4.4% 0.0% 0.0% 4.4%

COMPLIANCE 27.1% 0.0% 0.0% 27.1%

Regulatory research and gap analysis 6.8% 0.0% 0.0% 6.8%

Policy and procedure design 2.8% 0.0% 0.0% 2.8%

Monitoring and reporting 8.6% 0.0% 0.0% 8.6%

Business advice and counsel 5.4% 0.0% 0.0% 5.4%

External exams 3.5% 0.0% 0.0% 3.5%

TOTAL 90.4% 3.6% 6.0%

TYPE OF COST
164 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 2B

TABLE 9. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 14.0% 14.8% 0.0% 28.8%

Call Centers 3.1% 0.0% 0.0% 3.1%

Fulfillment 4.9% 14.8% 0.0% 19.7%

Back office support 3.9% 0.0% 0.0% 3.9%

Fraud mitigation/Error resolution 2.1% 0.0% 0.0% 2.1%

IT 11.7% 0.0% 18.7% 30.4%

Application development and maintenance 11.7% 0.0% 18.7% 30.4%

Infrastructure management 0.0% 0.0% 0.0% 0.0%

RETAIL/FRONT OFFICE 8.0% 0.5% 0.0% 8.5%

Distribution 0.0% 0.0% 0.0% 0.0%

Front-line management (FTEs) 7.6% 0.5% 0.0% 8.1%

Product development and management 0.3% 0.0% 0.0% 0.3%

LEGAL 2.1% 0.0% 0.0% 2.1%

Research 0.6% 0.0% 0.0% 0.6%

Product and policy review 0.8% 0.0% 0.0% 0.8%

Advice and counsel 0.8% 0.0% 0.0% 0.8%

CORPORATE OVERSIGHT (RISK/AUDIT) 1.9% 0.0% 0.0% 1.9%

Enterprise-wide standard design 0.0% 0.0% 0.0% 0.0%

Internal exams 1.8% 0.0% 0.0% 1.8%

HR 9.0% 0.0% 0.1% 9.1%

Training design and development 1.2% 0.0% 0.1% 1.3%

Training deployment and monitoring 7.8% 0.0% 0.0% 7.8%

MARKETING 8.3% 0.0% 0.0% 8.3%

Marketing design and implementation 8.3% 0.0% 0.0% 8.3%

COMPLIANCE 11.0% 1.2% 0.0% 11.0%

Regulatory research and gap analysis 2.2% 0.2% 0.0% 2.2%

Policy and procedure design 1.6% 0.2% 0.0% 1.6%

Monitoring and reporting 3.3% 0.3% 0.0% 3.3%

Business advice and counsel 2.7% 0.3% 0.0% 2.7%

External exams 1.1% 0.1% 0.0% 1.1%

TOTAL 66.0% 16.4% 18.8%

TYPE OF COST
165 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 3A

TABLE 10. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 14.0% 14.8% 0.0% 28.8%

Call Centers 3.1% 0.0% 0.0% 3.1%

Fulfillment 4.9% 14.8% 0.0% 19.7%

Back office support 3.9% 0.0% 0.0% 3.9%

Fraud mitigation/Error resolution 2.1% 0.0% 0.0% 2.1%

IT 11.7% 0.0% 18.7% 30.4%

Application development and maintenance 11.7% 0.0% 18.7% 30.4%

Infrastructure management 0.0% 0.0% 0.0% 0.0%

RETAIL/FRONT OFFICE 8.0% 0.5% 0.0% 8.5%

Distribution 0.0% 0.0% 0.0% 0.0%

Front-line management (FTEs) 7.6% 0.5% 0.0% 8.1%

Product development and management 0.3% 0.0% 0.0% 0.3%

LEGAL 2.1% 0.0% 0.0% 2.1%

Research 0.6% 0.0% 0.0% 0.6%

Product and policy review 0.8% 0.0% 0.0% 0.8%

Advice and counsel 0.8% 0.0% 0.0% 0.8%

CORPORATE OVERSIGHT (RISK/AUDIT) 1.9% 0.0% 0.0% 1.9%

Enterprise-wide standard design 0.0% 0.0% 0.0% 0.0%

Internal exams 1.8% 0.0% 0.0% 1.8%

HR 9.0% 0.0% 0.1% 9.1%

Training design and development 1.2% 0.0% 0.1% 1.3%

Training deployment and monitoring 7.8% 0.0% 0.0% 7.8%

MARKETING 8.3% 0.0% 0.0% 8.3%

Marketing design and implementation 8.3% 0.0% 0.0% 8.3%

COMPLIANCE 11.0% 1.2% 0.0% 11.0%

Regulatory research and gap analysis 2.2% 0.2% 0.0% 2.2%

Policy and procedure design 1.6% 0.2% 0.0% 1.6%

Monitoring and reporting 3.3% 0.3% 0.0% 3.3%

Business advice and counsel 2.7% 0.3% 0.0% 2.7%

External exams 1.1% 0.1% 0.0% 1.1%

TOTAL 66.0% 16.4% 18.8%

TYPE OF COST
166 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 3B

TABLE 11. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 20.0% 0.0% 6.5% 26.5%

Call Centers 1.6% 0.0% 0.0% 1.6%

Fulfillment 0.0% 0.0% 6.5% 6.5%

Back office support 13.8% 0.0% 0.0% 13.8%

Fraud mitigation/Error resolution 4.6% 0.0% 0.0% 4.6%

IT 0.0% 0.0% 30.4% 30.4%

Application development and maintenance 0.0% 0.0% 30.4% 30.4%

Infrastructure management 0.0% 0.0% 0.0% 0.0%

RETAIL/FRONT OFFICE 9.5% 0.0% 0.0% 9.5%

Distribution 0.0% 0.0% 0.0% 0.0%

Front-line management (FTEs) 9.5% 0.0% 0.0% 9.5%

Product development and management 0.0% 0.0% 0.0% 0.0%

LEGAL 0.0% 0.0% 2.7% 2.7%

Research 0.0% 0.0% 0.0% 0.0%

Product and policy review 0.0% 0.0% 0.0% 0.0%

Advice and counsel 0.0% 0.0% 2.7% 2.7%

CORPORATE OVERSIGHT (RISK/AUDIT) 1.6% 0.0% 0.2% 1.9%

Enterprise-wide standard design 0.2% 0.0% 0.2% 0.5%

Internal exams 1.4% 0.0% 0.0% 1.4%

HR 12.4% 0.0% 3.2% 15.7%

Training design and development 0.3% 0.0% 3.2% 3.5%

Training deployment and monitoring 12.1% 0.0% 0.0% 12.1%

MARKETING 0.3% 0.0% 0.0% 0.3%

Marketing design and implementation 0.3% 0.0% 0.0% 0.3%

COMPLIANCE 11.7% 0.0% 1.3% 13.0%

Regulatory research and gap analysis 0.0% 0.0% 0.0% 0.0%

Policy and procedure design 0.2% 0.0% 1.3% 1.5%

Monitoring and reporting 5.8% 0.0% 0.0% 5.8%

Business advice and counsel 4.3% 0.0% 0.0% 4.3%

External exams 1.4% 0.0% 0.0% 1.4%

TOTAL 55.6% 0.0% 44.4%

TYPE OF COST
167 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 4A

TABLE 12. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 16.6% 0.0% 8.5% 25.1%

Call Centers 0.0% 0.0% 0.0% 0.0%

Fulfillment 4.6% 0.0% 8.5% 13.1%

Back office support 10.1% 0.0% 0.0% 10.1%

Fraud mitigation/Error resolution 2.0% 0.0% 0.0% 2.0%

IT 0.2% 0.0% 21.4% 21.6%

Application development and maintenance 0.2% 0.0% 21.4% 21.6%

Infrastructure management 0.0% 0.0% 0.0% 0.0%

RETAIL/FRONT OFFICE 16.7% 1.0% 0.0% 17.7%

Distribution 0.0% 0.4% 0.0% 0.4%

Front-line management (FTEs) 14.9% 0.7% 0.0% 15.6%

Product development and management 1.8% 0.0% 0.0% 1.8%

LEGAL 0.0% 0.0% 0.0% 0.0%

Research 0.0% 0.0% 0.0% 0.0%

Product and policy review 0.0% 0.0% 0.0% 0.0%

Advice and counsel 0.0% 0.0% 0.0% 0.0%

CORPORATE OVERSIGHT (RISK/AUDIT) 2.0% 0.0% 0.0% 2.0%

Enterprise-wide standard design 0.0% 0.0% 0.0% 0.0%

Internal exams 2.0% 0.0% 0.0% 2.0%

HR 3.7% 0.0% 1.3% 4.9%

Training design and development 0.0% 0.0% 0.0% 0.0%

Training deployment and monitoring 3.7% 0.0% 1.3% 4.9%

MARKETING 2.3% 0.0% 0.0% 2.3%

Marketing design and implementation 2.3% 0.0% 0.0% 2.3%

COMPLIANCE 26.4% 0.0% 0.0% 26.4%

Regulatory research and gap analysis 2.0% 0.0% 0.0% 2.0%

Policy and procedure design 1.0% 0.0% 0.0% 1.0%

Monitoring and reporting 1.8% 0.0% 0.0% 1.8%

Business advice and counsel 21.2% 0.0% 0.0% 21.2%

External exams 0.3% 0.0% 0.0% 0.3%

TOTAL 67.8% 1.0% 31.2%

TYPE OF COST
168 CONSUMER FINANCIAL PROTECTION BUREAU 

Tier 4B

TABLE 13. FUNCTION/SUB-FUNCTION COMPLIANCE COSTS AS % OF TOTAL COMPLIANCE COSTS

FUNCTION / Sub-Function Labor Cost Non-labor 

cost

Third party 

cost TOTAL COST

OPERATIONS 1.7% 13.8% 0.0% 15.5%

Call Centers 0.0% 0.0% 0.0% 0.0%

Fulfillment 0.0% 13.8% 0.0% 13.8%

Back office support 0.0% 0.0% 0.0% 0.0%

Fraud mitigation/Error resolution 1.7% 0.0% 0.0% 1.7%

IT 0.0% 0.0% 22.0% 22.0%

Application development and maintenance 0.0% 0.0% 22.0% 22.0%

Infrastructure management 0.0% 0.0% 0.0% 0.0%

RETAIL/FRONT OFFICE 2.9% 0.5% 0.0% 3.4%

Distribution 0.0% 0.5% 0.0% 0.5%

Front-line management (FTEs) 0.7% 0.0% 0.0% 0.7%

Product development and management 2.2% 0.0% 0.0% 2.2%

LEGAL 0.0% 0.0% 0.0% 0.0%

Research 0.0% 0.0% 0.0% 0.0%

Product and policy review 0.0% 0.0% 0.0% 0.0%

Advice and counsel 0.0% 0.0% 0.0% 0.0%

CORPORATE OVERSIGHT (RISK/AUDIT) 2.2% 0.0% 4.5% 6.7%

Enterprise-wide standard design 0.0% 0.0% 0.0% 0.0%

Internal exams 2.2% 0.0% 4.5% 6.7%

HR 17.8% 0.0% 1.5% 19.3%

Training design and development 6.9% 0.0% 1.5% 8.4%

Training deployment and monitoring 10.9% 0.0% 0.0% 10.9%

MARKETING 2.2% 0.0% 0.0% 2.2%

Marketing design and implementation 2.2% 0.0% 0.0% 2.2%

COMPLIANCE 27.3% 0.0% 3.6% 31.0%

Regulatory research and gap analysis 6.0% 0.0% 3.6% 9.6%

Policy and procedure design 3.1% 0.0% 0.0% 3.1%

Monitoring and reporting 5.6% 0.0% 0.0% 5.6%

Business advice and counsel 6.0% 0.0% 0.0% 6.0%

External exams 6.7% 0.0% 0.0% 6.7%

TOTAL 54.1% 14.3% 31.6%

TYPE OF COST
APPENDIX G: INSIGHTS ON ONE-TIME 

IMPLEMENTATION COSTS

This Study focused on the ongoing costs of regulations, but relatively recent overdraft 

amendments to Regulations E and DD provided the Bureau an opportunity to examine one-time 

compliance costs, or the costs to implement new regulations. In 2009, changes to Regulations E 

and DD caused many banks to change how they enrolled customers in an overdraft program. 

The Regulation E amendment moved banks from a prevailing practice of “opt out” to an “opt in” 

regime that required explicit customer consent to charge overdraft fees in certain situations. The 

Regulation DD amendment added disclosures of overdraft fees to account opening disclosures 

and periodic statements. Despite a lapse of several years since the effective date of the rule, 

challenges in standardizing information, and practical constraints on the Study, we were able to 

obtain useful insights about the impact of one-time regulatory implementation costs.

When the amendments were adopted, five of our seven participants already offered overdraft 

programs governed by Regulation E. The sixth participant, one of the Tier 3 institutions, 

implemented an overdraft program for the first time when the amendments were adopted. The 

seventh participating institution did not have an overdraft program of the type covered by 

Regulation E before or after the regulation took effect. It incurred no additional regulatory costs 

with respect to the 2009 changes. During our on-site interviews with the six Study participants 

offering or implementing overdraft when the amendments took effect, we asked specifically 

about their experiences in implementing the 2009 changes. Bank responses focused principally 

on experiences in implementing the Regulation E changes, which may have required more effort 

than the Regulation DD changes.

During their respective implementation periods, participating banks primarily incurred material 

one-time costs to (1) operationalize an opt-in functionality and (2) prepare employees and 

customers for the changes. All banks were given the same period to implement the regulations 

(nine months from the date of publication of the final rule for Regulation E changes, and 12 

months for the Regulation DD changes91), but the banks in the Study reported to us widely 

 

91 The final rule for the Regulation E overdraft opt-in amendment was published on November 19, 2009 with an 

effective date of January 19, 2010 and mandatory compliance by July 1, 2010. The final rule for the Regulation DD 

overdraft fee disclosure was published on January 29, 2009 with an effective date of January 1, 2010.
170 CONSUMER FINANCIAL PROTECTION BUREAU 

varying implementation periods. The Tier 1 participant’s implementation of the new 

requirement took place over the course of 14 months, while the Tier 2 participants spent about 

six to nine months. Both Tier 3 participants had implementation periods of three to four 

months. The smallest Tier 4 institution with a Regulation E overdraft regime implemented the 

overdraft changes over the course of three months.

In general, the larger financial institutions in the Study began planning for regulatory change 

before smaller ones (even in advance of the final rule). Smaller banks in the Study were more 

likely to implement manual processes to comply with the opt-in requirements while waiting for 

long-term vendor solutions. Executing these short-term manual processes increased labor costs 

for these banks temporarily. 

The Operations and IT functions typically bore the heaviest shares of one-time cost for most of 

the banks in the Study. Activities in the Operations function at the six participating banks 

accounted for a median value of 39% of one-time implementation costs, with values ranging 

from 8% to 84%. These one-time costs within Operations primarily included the costs of 

outreach (via informational mailings and/or calls) to customers and increased customer 

inquiries about opt-in to the call center sub-function. Some of these costs may be attributed to 

institution-specific business decisions. For example, the Tier 4 bank noted the importance of 

overdraft fees as revenue and incurred the highest proportional cost in Operations (84%) due to 

its extensive outreach conducted to inform its customers about opting into the service. 

Conversely, it is notable that the bank incurring the lowest proportional Operations one-time 

costs (8%) was the Tier 3 bank implementing the overdraft program for the first time. Its 

Operations implementation costs consisted primarily of printing materials to inform consumers 

about the new overdraft program.

The IT function incurred one-time costs because of reprogramming or system upgrades 

necessary to capture and implement the customer’s choice. The median value of IT costs relative 

to overall one-time overdraft implementation costs was 21%, with costs ranging from 0.55% to 

61% of one-time cost over the six participants. Banks with larger IT organizations and more 

complex technology systems (with proprietary or in-house components) incurred higher levels 

of IT costs.

IT costs for smaller banks in the Study may have been comparatively lower because much of the 

technological upgrades were vendor-driven as opposed to internally developed. The use of thirdparty solutions may have allowed for some cost-sharing with other institutions using the same 

vendor. Dependency on vendor solutions likely caused the smaller institutions in the Study to be 
171 CONSUMER FINANCIAL PROTECTION BUREAU 

more reactive to the rule changes – these banks have little choice other than to wait for a third 

party in order to both test and begin implementation of the requirements. For the Tier 4 bank

offering overdraft coverage, its use of manual processes during the implementation period also 

created additional work when the bank had to input manually the customer decisions into their 

new IT system that tracks these decisions.

The Retail and Compliance functions also bore considerable portions of the one-time costs of 

implementation. Bank personnel from these two functions were primarily responsible for 

researching the re-design of the overdraft program and ensuring that the service was ultimately 

compliant with the new rule changes. Retail one-time costs associated with product 

development comprised about 2% to 52% of total one-time cost (median = 9%) across the six 

banks. The Compliance function was responsible for less than 1% to 34% of the one-time cost, 

with expenses concentrated in policy and procedure (re)design and business advice and counsel.

At the banks that already operated an overdraft program, the Retail and proportions of 

Compliance functions’ one-time costs were lower than those experienced at the small Tier 3 

bank that was implementing the overdraft program for the first time.

The six case studies suggest that one-time expenses for implementing regulatory changes can 

comprise a substantial share of regulatory costs.92 The Study did not collect information about 

ongoing compliance costs in 2010. We can compare only ongoing costs in 2012 with one-time 

costs in 2010 (in each case as a proportion of total retail deposit operating expense in each 

respective year). The Tier 1 participant’s one-time cost was 1.7% of its 2010 total retail deposit 

operating expense (while 2012 ongoing costs were 0.9% of 2012 total retail deposit operating 

expense). The Tier 2 banks had one-time costs of 0.5% and 0.9% of total retail operating 

expense (compared with ongoing costs of 1.51% and 1.25% in 2012). The relevant banks in the 

Study incurred costs within time periods ranging from three to fourteen months. The reasons 

for the wide variation in reported implementation periods are not entirely clear but highlight the 

importance of defining “implementation” consistently in future research.

Implementation costs reported by the participant banks in the Study depended heavily on their 

respective business decisions. For example, banks may have chosen to invest relatively more in 

 

92 However, in order to compare it with the ongoing costs, the one-time cost is annualized across a number of years

(i.e., divided by the number of years between the date of the final rule publication and the effective date of the rule). 

Otherwise, the one-time cost is not directly comparable to the annualized ongoing cost that is the focus of the Study.
172 CONSUMER FINANCIAL PROTECTION BUREAU 

the outreach to customers to get an opt-in agreement for their overdraft programs because of 

the importance of overdraft fees as revenue. Five of the six participant banks who had overdraft 

programs at the time of the 2009 Regulation E amendment mentioned this as a factor in their 

intensity of their outreach. These five banks may have also experienced higher relative costs in 

the Operations and IT business functions because their systems had long been adapted to the 

“opt-out” overdraft regime. On the other hand, the one Tier 3 bank that was implementing an 

overdraft program for the first time had relatively lower portions of cost attributed to 

Operations and IT. Instead, this bank used in-house expertise to design the new overdraft 

program and develop new policies and procedures around it. These costs were incurred 

primarily by the Retail and Compliance functions.

The quality of the information collected varies across the participant banks and was dependent 

on institutional memory, staff turnover, and availability of documents. Moreover, it appears the 

banks had different implementation experiences, due in part to differences in organizational 

complexity and possibly by differences in their experience with overdraft programs. This 

compounded our limitations in collecting and analyzing information in a standardized manner.
173 CONSUMER FINANCIAL PROTECTION BUREAU 

APPENDIX H: GENERAL TECHNIQUES

Planning & Development of 

Methodology

 Develop early hypotheses as to which activities of the firm are affected by the regulations at 

issue and which parts of the firm perform these activities;

 Establish early what you already know and what you want to know, and incorporate this 

into how you approach data collection;

 Decide early which denominator(s) to use for standardizing cost data, how to measure the 

denominator(s), and how to obtain consistent data for the measure(s);

 Decide early whether the efficiency and effectiveness of the operation (not just its associated 

monetary costs cost) will be in the scope of the study and, if they will be, how they will be 

measured; and

 Try to identify “baseline” operations and costs of the institution against which to measure 

the incremental cost of the regulation at issue.
174 CONSUMER FINANCIAL PROTECTION BUREAU 

Executing Data Collection at 

Financial Institutions

 (In advance of data collection) Establish a fundamental understanding of the institution and 

its potential interviewees through general research and a thorough review of organizational 

charts;

 (In advance of data collection) Conduct a training session for all interviewers and project 

team to ensure that everyone understands purpose of the Study and has standard, effective 

approach to data collection;

 Articulate clearly the study goals and design to respondents – including the scope of the 

operations and costs studied and the difference between compliance costs and baseline 

costs;

 Provide interviewees with written templates of the information sought before, during, or 

after the interview (each choice has its benefits and risks);

 Create a spreadsheet or other easy-to-use tool for researchers (or respondents) to record 

information in the field on a granular and systematic basis, and plan for a systematic way to 

capture qualitative insights and comments;

 Plan for ways in which you may need to adapt to the methodology to each institution;

 Start with relevant executives and work down the hierarchy through managers and 

employees;

 Ask interviewees both “top down” questions (identify all the interviewee’s responsibilities 

and narrow them down to the relevant daily activities) and “bottom up” questions (ask 

interviewees about very specific activities hypothesized to be compliance-related activities);

 Ask employees about hours spent on compliance activities in different ways – both as a 

proportion of the workweek and in absolute hours;
175 CONSUMER FINANCIAL PROTECTION BUREAU 

 Ask what types of documents are available to confirm information, including internal 

tracking documents and documentation of third-party costs;

 Specify the relevant time frame for respondents and ask about events that might have made 

that time frame atypical; and

 Send the same interviewers to different institutions or have the interviewers talk and share

information frequently during the field phase.

Standardizing & Analyzing Data

 Synthesize information frequently and as quickly as possible after initial collection, and 

account for potential follow-up with interviewees and/or institutions for quality control;

 Compare data across interviewees and across institutions to identify potentially erroneous or 

incomplete information that requires follow-up; and

 Validate key information with interviewees and independent experts.
176 CONSUMER FINANCIAL PROTECTION BUREAU 

Sources

Barefoot, Marrinan & Associates, Inc., Anjan V. Thakor, and Jess C. Beltz, Common Ground: 

Increasing Consumer Benefits and Reducing Regulatory Costs in Banking, Madison, Wisc.: 

Herbert V. Prochnow Educational Foundations, (1993).

John Boyle, A Survey of the Mortgage Banking Industry Concerning Costs and Benefits of 

Regulations. Washington: Government Printing Office, (1983).

Celent, Branch Boom Gone Bust: Predicting a Steep Decline in US Branch Density, (April 2013)

Cornerstone Advisors, Inc., The Cornerstone Report: Benchmarks and Best Practices for MidSize Banks, Fifth Edition, (2012).

FMSI, 2013 FMSI Teller Line Study, (May 2013).

Grant Thornton, Regulatory Burden: The Cost to Community Banks, Study prepared for the 

Independent Bankers Association of America, (Jan. 1993).

Gregory Elliehausen, The Cost of Bank Regulation: A Review of the Evidence, Working paper 

series 171. Board of Governors of the Federal Reserve System, (1998).

Gregory Elliehausen and Barbara R. Lowrey, The Costs of Implementing Regulatory Changes: 

The Truth in Savings Act, Journal of Financial Services Research, vol. 17, no. 2, at 165-172 

(2000).

Michael Katz, The Welfare Effects of Third-Degree Price Discrimination in Intermediate Good 

Markets, American Economic Review, vol. 77, no. 1, at 154-167 (1987).

Federal Deposit Insurance Corporation, FDIC Community Banking Study, at B-1 – B-3, (Dec. 

2012).

David C. Wheelock and Paul W. Wilson, Do Large Banks Have Lower Costs? New Estimates of 

Returns to Scale for U.S. Banks, Federal Reserve Bank of St. Louis Working Paper Series (May 

2011).