The compliance conversation boards and executives need to be having now.
Every bank compliance officer has heard some version of the same question: “Where does it say we can’t do that?” Or, just as often, “Where does it say we have to do that?”
For decades, that question made sense. U.S. banking compliance has long been shaped by detailed rules, supervisory guidance, examination manuals, FAQs, enforcement actions, advisory opinions, and regulatory speeches that helped define what “good” looked like. Business leaders and boards became accustomed to looking for the citation: the rule, the guidance, the supervisory expectation, or the enforcement action that answered the question.
But the supervisory environment is changing. Regulators are increasingly signaling a move away from highly prescriptive, process-driven supervision and toward a more risk-based, tailored, and judgment-driven model. That does not mean banks have fewer responsibilities. It means banks may have fewer step-by-step instructions, and more responsibility to determine, document, and defend how they will comply.
The Federal Reserve’s updated supervisory operating principles describe a “significant shift” in supervisory direction, emphasizing material financial risks, timely and proportionate action, and reasoned judgment by supervisory staff. The statement also tells staff not to assume that current or past operating practices should continue. Separately, the Federal Reserve’s October 2025 supervisory principles directed examiners to prioritize material financial risk and not become distracted by excessive attention to processes, procedures, and documentation that do not pose material safety-and-soundness risk.
The FDIC has used similarly direct language. In September 2025, Acting Chairman Travis Hill said the FDIC was working to reform supervision, so it is “less process-driven and more focused on core financial risks.” The same statement identified reforms involving CAMELS ratings, supervisory appeals, continuous exams, consumer compliance exams, BSA and IT exams, enforcement-order termination, fair lending exams, and consumer compliance supervision.
The CFPB has also reduced certain interpretive guard rails. In 2025, the Bureau withdrew multiple guidance documents, including policy statements, interpretive rules, advisory opinions, and other guidance materials. Its Federal Register notice stated that the Bureau was withdrawing many guidance documents issued since it began operations and that its current policy was to avoid issuing guidance except where necessary and where compliance burdens would be reduced rather than increased.
That creates a practical leadership problem. When guidance is withdrawn, the law does not necessarily disappear. The regulation, customer impact, litigation exposure, state-law risk, and future supervisory risk may remain. What changes is that the bank may have less agency-provided direction and must rely more heavily on its own legal analysis, risk assessment, control design, and governance record.
Recent rule and guidance changes reinforce the point. The OCC and FDIC finalized a rule eliminating reputation risk from their supervisory programs, prohibiting the agencies from criticizing or taking adverse action against an institution based on reputation risk. The banking agencies also revised model risk management guidance to emphasize a risk-based approach tailored to an institution’s model risk profile, size, complexity, and operations. These examples do not eliminate risk. They require banks to name the risk more precisely, decide what standard is appropriate, and document why.
The Supreme Court’s recent decision in Trump v. Slaughter adds another layer. The Court held that the FTC’s for-cause removal protection was unconstitutional, and commentary has described the ruling as expanding presidential authority over multi-member agencies previously designed to operate with more independence. For banks, the practical implication is regulatory volatility. Agency priorities may move more sharply from one presidential administration to the next. A compliance decision based only on today’s supervisory tone may not be durable tomorrow. That means boards and leadership teams need a mindset shift: