Proposed Revisions to the Uniform Financial Institutions Rating System

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-1 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation
RATIONALE OF BANK EXAMINATIONS ................... 2
CONDUCT OF EXAMINATIONS................................... 2
Prohibition Against Political Communication............... 2
RATING SYSTEM............................................................ 2
Introduction ................................................................... 2
UFIRS Overview........................................................... 3
Disclosure of Ratings .................................................... 3
Discussions with Management...................................... 3
Examination Letters ...................................................... 4
EXAMINATION FREQUENCY ...................................... 4
Alternate Examinations................................................. 5
Specialty Examination Intervals.................................... 5
Insured Branches of Foreign Banks............................... 5
EXAMINATION TYPES .................................................. 6
Risk-Focused Supervision............................................. 6
Full-Scope Examinations............................................... 6
Point-in-Time and Continuous Examination
Processes................................................................... 6
Limited-Scope Examinations and Visitations ............... 7
Institutions Subject to Corrective Actions..................... 7
Newly Chartered Insured Institutions............................ 7
Examination and Visitation Cycles........................... 8
Monitoring Activities ............................................... 8
Changes in Business Plans........................................ 8
Converting to Insured Nonmember Status .................... 8
Change of Ownership Control....................................... 9
COORDINATING EXAMINATION SCHEDULES........ 9
State Authorities............................................................ 9
Holding Company Inspections and Subsidiary
Institution Examinations................................................ 9
Interstate Banking and Chain Banks ............................. 9
SCHEDULING GUIDELINES........................................10
Forward-Looking Supervision.....................................10
Scheduling Considerations..........................................10
Offsite Analysis and Monitoring ............................10
Other Financial Indicators ......................................11
Applications or Other Bank-Provided Data............11
Known Characteristics............................................11
Other Bank Regulators ...........................................11
Media......................................................................11
Observations/Other.................................................11
RELYING ON STATE EXAMINATIONS.....................11
COMMUNICATION BETWEEN EXAMINATIONS....13
EXAMINATION PLANNING ACTIVITIES .................13
Reviewing External Audit Workpapers.......................14
Shared-Loss Agreements.............................................14
Examination Considerations...................................15
Other Examination Considerations.........................15
MEETINGS WITH BANK PERSONNEL......................16
Meetings with Management ........................................16
Examination Planning.............................................16
First Day ................................................................. 16
Follow-up on Prior Examination Issues..................17
Strategic Planning and Budget................................17
Loan Discussion..................................................... 17
Material Preliminary Findings ............................... 17
Management Meetings........................................... 17
Meetings with Directors.............................................. 17
Banks Assigned a Composite Rating of 4 or 5....... 17
Banks Assigned a Composite Rating of 3.............. 17
Banks Assigned a Composite Rating of 1 or 2....... 17
Matters Requiring Board Attention (MRBA) ........ 18
Other Considerations.............................................. 18
OTHER SOURCES OF INFORMATION ...................... 18
Trust Department........................................................ 19
Information Technology ............................................. 19
Bank Secrecy Act........................................................ 19
Consumer Protection................................................... 19
Summary..................................................................... 20
DISCLOSING REPORTS OF EXAMINATION............ 20
EXAMINATION WORKPAPERS ................................. 20
Introduction................................................................. 20
Safeguarding Examination Information...................... 20
Examination Documentation (ED) Modules............... 21
Substance of Workpapers ........................................... 21
Filing of Workpapers.................................................. 21
Retention of Workpapers............................................ 22
ADDENDUM TO SECTION 1.1.................................... 23
UFIRS RATINGS DEFINITIONS.................................. 23
Composite Ratings...................................................... 23
Composite 1 ........................................................... 23
Composite 2 ........................................................... 23
Composite 3 ........................................................... 23
Composite 4 ........................................................... 23
Composite 5 ........................................................... 23
Component Ratings..................................................... 24
Capital Adequacy................................................... 24
Asset Quality.......................................................... 24
Management........................................................... 25
Earnings................................................................. 26
Liquidity................................................................. 27
Sensitivity to Market Risk...................................... 28

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-2 RMS Manual of Examination Policies Federal Deposit Insurance Corporation RATIONALE OF BANK EXAMINATIONS The Federal Deposit Insurance Corporation conducts bank examinations to ensure public confidence in the banking system and to protect the Deposit Insurance Fund. Maintaining public confidence in the banking system is essential because customer deposits are a primary funding source that depository institutions use to meet fundamental objectives such as providing financial services. Safeguarding the integrity of the Deposit Insurance Fund is necessary to protect customers’ deposits and resolve failed banks. Onsite examinations help ensure the stability of insured depository institutions by identifying undue risks and weak risk management practices. Examination activities center on evaluating an institution’s capital, assets, management, earnings, liquidity, and sensitivity to market risk. Evaluating a bank’s adherence to laws and regulations is also an important part of bank examinations and is given high priority by Congress and bank supervisors. Finally, bank examinations play a key role in the supervisory process by helping the FDIC identify the cause and severity of problems at individual banks and emerging risks in the financial-services industry. The accurate identification of existing and emerging risks helps the FDIC develop effective corrective measures for individual institutions and broader supervisory strategies for the industry. ← CONDUCT OF EXAMINATIONS Given the fundamental reasons for conducting examinations, regulatory personnel must have access to all records and employees of a bank during an examination. Sections 10(b) and (c) of the Federal Deposit Insurance Act (FDI Act) empower examiners to make a thorough examination of a bank’s affairs. Examiners should contact their regional office for guidance if faced with serious impediments to an examination, including uncooperative executive officers, or restricted access to bank employees or records. The regional office will determine an appropriate solution to enable examiners to obtain the information needed to complete the examination. In such cases, examiners should document all significant examination obstacles and the regional office’s resolution of the situation. Prohibition Against Political Communication FDIC employees should avoid any form of political communication with insured depository institutions that could be perceived as suggesting the examination process is influenced by political considerations, or that the bank should take a particular position on legislative issues. Examinations must be kept free from political considerations, or the appearance of being influenced by political considerations, in order to maintain the integrity and effectiveness of the examination process. FDIC employees should promptly inform their regional office of any situation
they feel compromised this policy. ← RATING SYSTEM Introduction The Uniform Financial Institutions Rating System (UFIRS) was adopted by the Federal Financial Institutions Examination Council (FFIEC) on November 13, 1979, and updated in December 1996. Over the years, the UFIRS proved to be an effective supervisory tool for evaluating financial institutions on a uniform basis and for identifying institutions requiring special attention. Changes in the banking industry and regulatory policies prompted a revision of the 1979 rating system. The 1996 revisions to the UFIRS include the addition of a sixth component addressing sensitivity to market risk, the explicit reference to the quality of risk management processes in the management component, and the identification of risk elements within the composite and component rating descriptions. The UFIRS takes into consideration certain financial, managerial, and compliance factors that are common to all institutions. Under this system, the supervisory agencies endeavor to ensure all financial institutions are evaluated in a comprehensive and uniform manner, and that supervisory attention is appropriately focused on institutions exhibiting financial and operational weaknesses or adverse trends. The UFIRS also serves as a useful vehicle for identifying institutions with deficiencies in particular component areas. Further, the rating system assists Congress in assessing the aggregate strength of the financial industry and following risk management trends. As such, the UFIRS assists regulatory agencies in fulfilling their mission of maintaining stability and public confidence in the nation’s financial system.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-3 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation UFIRS Overview Under the UFIRS, each financial institution is assigned a composite rating based on an evaluation of six financial and operational components, which are also rated. The component ratings reflect an institution’s capital adequacy, asset quality, management capabilities, earnings sufficiency, liquidity position, and sensitivity to market risk (commonly referred to as CAMELS ratings). When assigning ratings, examiners consider an institution’s size and sophistication, the nature and complexity of its activities, and its general risk profile. Composite and component ratings are assigned based on a numerical scale from 1 to 5, with 1 indicating the highest rating, strongest performance and risk management practices, and least degree of supervisory concern. A 5 rating indicates the lowest rating, weakest performance and risk management practices, and highest degree of supervisory concern. A bank’s composite rating generally bears a close relationship to its component ratings. However, the composite rating is not derived by averaging the component ratings. Each component rating is based on a qualitative analysis of the factors composing that component and its interrelationship with other components. When assigning a composite rating, some components may be given more weight than others depending on the situation at an institution. In general, assignment of a composite rating may incorporate any factor that bears significantly on the overall condition of the financial institution. Composite and component ratings are disclosed to an institution’s board of directors and senior management. However, banks cannot, except in very limited circumstances, disclose the ratings or any part of a report of examination (ROE) without the prior written consent of their primary federal regulator. Management’s ability to respond to changing circumstances and address risks that result from new business conditions, activities, or products is an important factor in determining an institution’s risk profile and the level of supervisory concern. For this reason, the management component is given special consideration when assigning a composite rating. The ability of management to identify and control the risks of its operations is also taken into account when assigning each component rating. All institutions should properly manage their risks; however, appropriate management practices vary considerably among financial institutions depending on their size, complexity, and risk profile. Less complex institutions that are engaged solely in traditional banking activities and whose directors and senior managers are actively involved in the oversight and management of day-to-day operations may use relatively basic risk assessment, risk management, and internal control systems.
Institutions that are more complex need formal, multifaceted systems and internal controls to provide the information managers and directors need to monitor and direct higher risk activities. Consumer Compliance, Community Reinvestment Act, and specialty examination findings and ratings are also taken into consideration, as appropriate, when assigning component and composite ratings under the UFIRS. Specialty examination areas include: Bank Secrecy Act, Information Technology (IT), Trust, Government Security Dealers, Municipal Security Dealers, and Registered Transfer Agent. An addendum at the end of this section contains definitions and descriptions of the UFIRS composite and component ratings. Disclosure of Ratings The FDIC believes it is appropriate to disclose the UFIRS component and composite ratings to bank management. Disclosure of the UFIRS ratings helps ensure banks implement appropriate risk management practices by allowing a more open and complete discussion of examination findings and recommendations. Additionally, open discussion of the CAMELS ratings provides institutions with a better understanding of how ratings are derived and enables management to better address weaknesses in specific areas. Discussions with Management Generally, the examiner-in-charge (EIC) should discuss the recommended component and composite ratings with senior management and, when appropriate, the board of directors, near the conclusion of the examination. Examiners should clearly explain that their ratings are tentative and subject to the review and final approval by the regional director or designee. Examiners should follow regional guidance regarding the disclosure of component and composite ratings of 3 or worse. Generally, in these situations, examiners should contact the regional office overseeing the institution and discuss the proposed ratings with the case manager or assistant regional director prior to disclosing the ratings to management or the board. Examiners should discuss the key factors they considered when assigning component and composite ratings with management and the board. Examiners should also explain

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-4 RMS Manual of Examination Policies Federal Deposit Insurance Corporation that the composite rating is not based on a numerical average but rather a qualitative evaluation of an institution’s overall managerial, operational, and financial performance. The management component rating may be particularly sensitive and important. The quality of management is often the single most important element in the successful operation of an insured institution. It is usually the factor most indicative of how well risk is identified and controlled. For this reason, examiners should thoroughly review and explain the factors considered when assigning the management rating. Written comments in support of the management rating should include an assessment of the effectiveness of existing policies and procedures in identifying and managing risks. Examiners should remind management that all examination findings, including the composite and component ratings whether disclosed verbally or in the written ROE, are subject to the confidentiality rules imposed by Part 309 of the FDIC Rules and Regulations. The regional office should inform management if there are material processing delays or substantive changes to the ROE that modify the preliminary examination findings or recommendations disclosed at examination exit meetings. Examination Letters The FDIC’s expectations for troubled institutions should be clearly communicated to bank management between the close of an examination and the issuance of an enforcement action. An examination letter should be delivered by FDIC field supervisors to chief executive officers/presidents during examination exit meetings, or earlier, for any bank newly assigned a CAMELS composite 3 rating or worse. Examination letters should notify management that the institution’s composite rating was tentatively downgraded and convey the expectation that management stabilize the institution’s risk profile and strengthen its financial condition. The letter should notify management that actions taken to materially expand the institution’s balance sheet or risk profile are inconsistent with supervisory expectations. The letter should also inform management they are required to obtain a non-objection from the regional director before engaging in any transactions that would materially change the institution’s balance sheet composition, such as significantly increasing total assets or volatile funding sources. If practical, state banking departments should be included as a joint issuer of examination letters relating to FDIC-supervised examinations. Furthermore, an examination letter should be arranged if a downgrade is anticipated due to a state examination. Immediate corrective measures, including the issuance of a temporary order requiring an institution to cease and desist, may be appropriate in higher-risk situations. If examiners believe
such action should be considered, they should discuss the situation with the field supervisor and regional case manager without delay. ← EXAMINATION FREQUENCY The first priority of the Division of Risk Management Supervision (RMS) is the effective oversight of banks requiring special attention. The identification and supervision of banks requiring special attention is best accomplished through the examination process.
Section 337.12 of the FDIC Rules and Regulations
implements Section 10(d) of the FDI Act and governs the frequency of examinations for insured state nonmember banks and state savings associations. Section 347.211 governs the examination frequency of branches of foreign banks.
Section 337.12 requires a full-scope, onsite examination of
every insured state nonmember bank and state savings association at least once during each 12-month period. Annual examination intervals may be extended to 18 months under the following conditions:

• The bank has total assets of less than $3 billion;
• The bank is well capitalized as defined in Section
  324.403(b)(1) of the FDIC Rules and Regulations;
• The bank was assigned a management component
  rating of 1 or 2 at the most recent FDIC or applicable state examination;
• The bank was assigned a composite rating of 1 or 2 at
  the most recent FDIC or applicable state examination;
• The bank currently is not subject to a formal
  enforcement proceeding or order by the FDIC, OCC, or Federal Reserve System; and
• No person acquired control of the bank during the
  preceding 12-month period in which a full-scope, onsite examination would have been required but for the above noted exceptions. These rules apply similarly to U.S. branches or agencies of a foreign bank with total assets less than $3 billion if the

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-5 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation office received a composite Federal Reserve ROCA1 rating of 1 or 2 at its most recent examination. In all cases, the FDIC reserves the right to examine more frequently if the agency deems it necessary. The FDIC strives to conduct risk management and specialty examinations of all state nonmember banks within prescribed intervals. If examination frequency requirements, other than a few nominal and non-recurring exceptions, cannot be met, regional directors should prepare and submit a memorandum to the Director of RMS. The memorandum should include a description of the nature and cause of the situation and a description of any needed, planned, or implemented corrective measures designed to maintain an adequate supervision program. Alternate Examinations Examinations may be conducted in alternate 12- or 18- month periods if the FDIC determines that a full-scope, onsite examination completed by the appropriate state supervisory authority during the interim period is acceptable. However, such alternate examinations should be accepted only for the following institutions: composite 1- or 2-rated institutions, and stable and improving composite 3-rated institutions if the composite rating is confirmed by an offsite review and no adverse trends are noted from other available information. The length of time between the end of one examination and the start of the next (whether one or both of the examinations are conducted by a state supervisory agency or the FDIC) should not exceed 12- or 18-months. For purposes of monitoring compliance with examination frequency schedules, the end of the examination is defined as the earlier of the date the EIC submits the report for review, or 60 calendar days from the examination start date as defined in the Report of Examination Instructions. Specialty Examination Intervals The statutory requirements in Section 10(d) of the FDI Act do not apply to specialty examinations. Thus, specialty examinations are governed by internal RMS policy. Specialty examinations should generally be conducted concurrently with risk management examinations, except when the size or arrangement of a department makes it impractical or inefficient to do so. Although there will be some differences, specialty examinations are generally 1 The ROCA components are: Risk management, Operational controls, subject to the same examination intervals, including appropriate extensions, as risk management examinations. In situations where rating differences or alternate state examinations result in examination intervals that are not conducive to scheduling concurrent examinations, regional directors can make reasonable adjustments to specialty examination intervals to accommodate concurrent examinations. Reasonable adjustments include extending the examination cycle for 1- and
2-rated specialty areas. Although not permitted by statute for safety and soundness examinations, internal policy allows regional directors to extend the examination cycle for 3-rated specialty areas. Specialty areas rated 4 or 5 should normally not be extended beyond a one-year interval. Additionally, since Municipal Securities Dealers are subject to a two-year examination cycle under Municipal Securities Rulemaking Board rules, any adjustment in this area should not exceed the two-year requirement. The possibility of conducting specialty examinations with state authorities should be explored if reasonable adjustments can be made. When the state supervisory authority has responsibility for conducting the safety and soundness examination, the FDIC is not required to conduct any specialty examinations that the state authority does not conduct, with the exception of Bank Secrecy Act (BSA) examinations. The FDIC is required to conduct a BSA examination if the state does not conduct a BSA examination. Insured Branches of Foreign Banks Insured branches of foreign banks must be examined every 12 months under Section 10(d) of the FDI Act. However,
Section 347.211 of the FDIC Rules and Regulations
specifies that domestic branches of foreign banks may be considered for an 18-month examination cycle when certain criteria are met and no other factors suggest more frequent examinations are necessary. To be eligible for an extended 18-month examination cycle, a U.S. branch of a foreign bank must:

• Have total assets of less than $3 billion;
• Have a composite ROCA supervisory rating of 1 or 2
  at its most recent examination;
• Not be subject to a formal enforcement action;
• Not have undergone a change in control during the
  preceding 12 months; and
  Compliance, and Asset quality.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-6 RMS Manual of Examination Policies Federal Deposit Insurance Corporation

• Have Tier 1 and total risk-based capital ratios (at the
  foreign bank) of at least 6 percent and 10 percent, respectively, when reported on a consolidated basis; or
• Have maintained on a daily basis (over the previous
  three quarters) eligible assets in an amount not less than 108 percent of the preceding quarter’s average third-party liabilities, and have sufficient liquidity currently available to meet its obligations to third parties. Additional factors may also be considered in determining examination frequency, including certain discretionary standards outlined in Section 347.211. ← EXAMINATION TYPES Risk-Focused Supervision Effective risk management is central to safe and sound banking. The objective of a risk-focused examination is to efficiently evaluate the safety and soundness of a bank. Examiners should focus their resources on a bank’s high￾risk areas when assessing risk management programs, financial conditions, internal controls, etc. The exercise of examiner judgment to determine the scope and depth of review in each functional area is crucial to the success of the risk-focused supervisory process. Examiners should make risk-scoping decisions on a case-by-case basis in consultation with their supervisory examiner, field supervisor, or the bank’s case manager. The most effective examination approach focuses examiner resources on assessing management’s ability to identify and control risks. Internal and external audits, loan reviews, and other control activities are integral considerations in an assessment of a bank’s risk profile. Refer to the Internal Routine and Controls section of this Manual for an in-depth discussion of this area. Examiners should consider the adequacy of audit and control practices in determining a bank’s risk profile and, when appropriate, try to reduce regulatory burdens by testing rather than duplicating the work of a bank’s audit and control functions. Transaction testing remains a reliable and essential examination technique for use in the assessment of a bank’s condition. However, the amount of transaction testing necessary to evaluate activities generally depends on the quality of the bank’s risk management processes. Once the integrity of the bank’s risk management system is verified through testing, conclusions regarding the extent of risks within an activity can often be based on the results of internal reports rather than in-depth, onsite assessments. The FDIC’s long-standing philosophy and methods for examining institutions are fully described within this manual in Section 20.1 Risk-Focused, Forward-Looking Safety and Soundness Supervision. Examiners should be conducting examination activities consistent with Section 20.1. Full-Scope Examinations The minimum requirements of a full-scope examination are defined as the procedures necessary to complete the mandatory pages of the uniform ROE and evaluate all components (Capital, Asset Quality, Management, Earnings, Liquidity, and Sensitivity to Market Risk) of the UFIRS rating system. The completion of additional steps and pages may also be appropriate. In a full-scope examination, all examination activities are considered in the overall assessment of the
  institution. These activities include the Risk Management, IT, BSA/Anti-Money Laundering (AML)/ Office of Foreign Assets Control, Trust, Registered Transfer Agent, Municipal Securities Dealer, and Government Securities Dealer examination programs. Examination ratings (when assigned) and summary comments should be included in the risk management ROE. Compliance and Community Reinvestment Act examination activities are included in the overall supervision program with separate reports and examination cycles. Point-in-Time and Continuous Examination Processes For most institutions, full-scope examinations are performed at a point in time. Examiners plan the examination; conduct examination procedures over a discrete period of time; complete ROE pages, assign the UFIRS ratings, and communicate examination findings. At the conclusion of this process and after appropriate review, an ROE is issued to the institution. For certain institutions that are larger, more complex, or present a higher risk profile, full-scope examinations are performed continuously over the course of a year. For continuous examinations, the planning phase describes the types of activities to be performed and evaluation of the UFIRS components over the year. The continuous examination process includes onsite targeted reviews of areas the examiner determines are necessary to complete a full-scope examination; ongoing monitoring and assessment of institution risks, policies, procedures, and financial condition; and frequent communication with institution management. A dedicated or designated EIC oversees the continuous examination

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-7 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation process and may be supported by additional dedicated examination staff and other staff depending on the size, complexity, and risk profile of the institution being examined. In addition to frequent communication with institution management, supervisory letters are issued to the board and institution management after each targeted review that convey the findings (including supervisory recommendations when appropriate). Other, ad hoc written communications to institution management may also be issued based on ongoing monitoring activities or other intervening supervisory events or activities. Additionally, at the end of the continuous examination cycle, an ROE is issued to the institution that aggregates and summarizes findings from examination and other supervisory activities performed throughout the cycle and assigns the UFIRS ratings. Limited-Scope Examinations and Visitations The terms limited-scope examination and visitation are interchangeable and may be defined as any review that does not meet the minimum requirements of a full-scope examination. Because the reviews are not full-scope examinations, they do not satisfy the requirements of
Section 10(d) of the FDI Act. Examiners may conduct the
reviews for a variety of reasons, such as to assess changes in an institution’s risk profile or to monitor compliance with corrective programs. Examiners may also conduct the reviews to investigate adverse or unusual situations, to determine progress in correcting deficiencies, or to assess compliance with supervisory requirements established through an order. Limited-scope reviews may address the overall condition of the institution, material changes since the previous examination, or areas that exhibit more than normal risk. Depending on the scope, purpose, and sufficiency of the reviews, examiners can assign composite ratings and component ratings. Component ratings for areas that were not sufficiently reviewed should be brought forward from the previous examination. Examiners are not required to complete standard ROE schedules when completing limited-scope reviews. However, they may include applicable schedules in their report to clarify findings or recommendations. Results should generally be conveyed in a memorandum from the EIC to the regional director. The results of a review, if sent to the institution, can be in any appropriate format. Institutions Subject to Corrective Actions Supervisory strategies for institutions operating under an enforcement action, particularly formal actions, should generally include limited-scope reviews. The onsite reviews should include an evaluation of management’s understanding of, and adherence to, the provisions of the corrective program. Limited-scope reviews should be scheduled within six months after an enforcement action is issued to evaluate an institution’s progress in implementing the corrective program. Particular attention should be focused on the primary cause of the institution’s problems and the principal objectives of corrective programs. If a decision is made to forego or delay an interim onsite review, the reasons should be documented in regional office files. Newly Chartered Insured Institutions Adverse economic conditions and other factors often affect newly chartered institutions more than established institutions, and the failure rates of de novo institutions exceed those of established institutions. Therefore, unseasoned institutions pose a material risk to the Deposit Insurance Fund (DIF) and warrant close regulatory oversight. Among noted concerns, de novo institutions that deviate from approved business plans, especially with respect to real estate and development loans, are of particular concern to supervisory personnel. Other, common risk factors observed at troubled or failed de novo institutions during their first three years of operation include:

• Non-compliance with orders approving deposit
  insurance,
• Inadequate risk management controls,
• Rapid growth,
• Concentrations in higher risk assets,
• Over reliance on volatile funding sources,
• Problematic third-party relationships,
• Weak compliance management systems, and
• Unseasoned loan portfolios.
  In all cases, major deviations from, or material changes to, approved business plans by newly insured institutions warrant in-depth analysis to assess risks to the institution and the DIF. In order to better identify risks and strengthen supervisory responses to identified risks, supervisory personnel should:
• Employ appropriate onsite and offsite supervisory
  practices;
• Carefully coordinate risk management, compliance,
  and interagency activities;
• Monitor activities, at least quarterly, for changes to, or
  deviations from, established business plans; and

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-8 RMS Manual of Examination Policies Federal Deposit Insurance Corporation

• Clearly define expectations to management regarding
  the timing, type, and documentation required to satisfy supervisory monitoring activities. Orders granting federal deposit insurance require bank management to seek prior approval for any major deviation, or material change, from the institution’s approved business plan. To ensure that this requirement is met, the board should monitor the institution’s performance for early signs that correction is needed or that a request for a change in business plan is necessary. If a major deviation or material change to approved business plans is identified by the FDIC during an examination or other review, the case manager or examiner-in-charge should document the deviation/change in a memorandum to the regional director and include an assessment of the riskiness of the deviation/change. In such circumstances, prompt communication to bank management is necessary, and proactive, supervisory action is appropriate. Examination and Visitation Cycles If a newly chartered and insured institution is a subsidiary of a multi-bank holding company that is in satisfactory condition, normal examination cycles should be followed at the regional director’s discretion; otherwise, a limited-scope examination should be conducted within the first six months of operation and a full-scope examination within the first twelve months of operation. Subsequent to the first examination and through the third year of operation, at least one examination should be performed each year. Extended examination intervals should not be applied in the first three years of operation. After the initial full-scope examination, examinations may be alternated with the state supervisory authority. Monitoring Activities During the three-year de novo period, examiners should emphasize the need for management to seek prior approval for any proposed material change(s) from the approved business plans. Regional offices have a responsibility to monitor de novo institutions’ activities, review compliance with any conditions of deposit insurance orders, and track performance in relation to approved business plans. Significant changes to business plans must be submitted to the appropriate regional office for approval. Examiners assist in monitoring activities by:
• Conducting general visitation and examination
  procedures,
• Assessing institutions’ overall risk profiles and
  management capabilities,
• Reviewing institutions’ conformity with business
  plans,
• Evaluating compliance with any outstanding
  conditions, and
• Documenting their findings in reports of examination.
  Changes in Business Plans
  There is a significant degree of judgment involved in determining a major deviation or material change in a business plan. Such changes may be evidenced by shifts in asset or liability mix; variances in loan, deposit, or total asset volumes from original projections; or the introduction or deletion of a specific business strategy (such as the initiation of subprime lending or the gathering of brokered deposits). Business plans generally address a number of factors that include, but are not limited to:
• Geographic markets;
• Loan products and services;
• Investment strategies and levels;
• Deposit products and services;
• Other services, such as private banking or trust
  services;
• Liquidity strategies and funding sources;
• Delivery channels, particularly through third-party
  relationships;
• Fixed assets (e.g., branches/loan production offices);
• Other activities (on- or off-balance sheet), including
  fee-for-service activities;
• Customer categories (such as money services
  businesses or foreign financial institutions); and
• Relationships with parent organizations and affiliates.
  State nonmember banks requesting deposit insurance must agree to obtain the prior approval of the FDIC for any material change to their business plan. Any significant change in the items listed above should generally be viewed as a material change in business plan. Such changes may be evidenced by significant (+/- 25 percent) deviation in asset growth projections; changes in the asset/liability mix or products and services offered; or the introduction of new business strategies such as an unplanned establishment of loan production offices or use of third parties to broker, underwrite, or originate credit on behalf of the institution. Converting to Insured Nonmember Status A full-scope examination should be conducted within twelve months of the last examination prior to conversion for national, state member, and thrift institutions. For noninsured institutions converting to insured status, a full￾scope examination should be conducted within twelve

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-9 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation months of the last examination prior to conversion. If the last examination was conducted by the state authority, the regional director has the discretion to accept it. However, such an examination should be accepted only for institutions rated composite 1 or 2. Change of Ownership Control A full-scope examination should be conducted within twelve months after a change of control. Thereafter, standard examination intervals apply. ← COORDINATING EXAMINATION SCHEDULES State Authorities Every effort should be made to coordinate examination schedules with state authorities to take advantage of state resources, to minimize duplications of effort, and to lessen business disruptions to institutions. A representative of the regional office should meet with representatives from each state banking authority to determine examination responsibilities for the upcoming year. Responsibilities may be defined by ratings, size, or location of institutions, or assigned by specific institutions as deemed appropriate. Such agreements should contain flexibility to allow either party to alter schedules with minimal notice. While state examination requirements should be considered in the coordination process, state requirements should not be the determining factor in the final agreement. Holding Company Inspections and Subsidiary Institution Examinations Examinations of holding company subsidiaries should be coordinated with other federal agencies whenever possible. Particular emphasis for coordinating examinations should be placed on banking organizations with over $10 billion in consolidated assets and those banking organizations (generally with assets in excess of $1 billion) that exhibit financial weaknesses. Examinations and inspections of insured subsidiary banks and bank holding companies that do not meet the foregoing criteria should be coordinated to the extent practical. Regional directors (or designees) should meet periodically with representatives from other federal agencies to develop coordinated schedules that will maximize the use of available resources and enhance the efficiency of bank examinations and bank holding company inspections. The coordination of examination and inspection activities should, when possible, focus on the use of common financial statement dates and allow for joint discussions with management. However, absolute concurrence, common as-of dates, and simultaneous starting dates are not required. Appropriate state regulatory agencies should be kept informed and encouraged to participate in the coordinated federal efforts affecting state-chartered institutions. Examinations of nonbank affiliates may be conducted at the discretion of the regional director, but independent examinations of holding companies supervised by the Federal Reserve may not be
conducted without prior approval of the Washington Office. Interstate Banking and Chain Banks A coordinated supervisory strategy for interstate banking organizations (both intra- and inter-regional) should be developed. The supervisory strategy developed should combine traditional supervision of individual units with an appropriate top-down approach to assess risks and to monitor and coordinate supervisory actions. For these organizations, the regional director has discretion to omit, delay, or modify existing examination frequencies if the financial condition of the holding company and lead bank is considered satisfactory; the condition of the subsidiary units is believed to be satisfactory; control over all insured banks in the organization is effectively centralized; and management is favorably regarded. Regional directors are responsible for designating a lead region to design an appropriate supervisory strategy for interstate banking organizations and for ensuring pertinent information is conveyed in a timely manner to other regions and to appropriate federal and state agencies. Chain banking organizations generally involve a group of financial institutions or holding companies that are controlled by one individual or company. Regional directors are responsible for maintaining a record system for chain banking organizations and for developing an overall supervisory strategy for these organizations. RMS policy is to supervise banks that are part of a chain banking organization in a manner that considers the financial impact of the consolidated chain on the individual institutions within that chain. Refer to Section 4.3, Related Organizations for additional details on, and a full description of, chain banking organizations.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-10 RMS Manual of Examination Policies Federal Deposit Insurance Corporation ← SCHEDULING GUIDELINES Periodic onsite examinations are critical to the supervisory process and are an integral part of the examination program. Diversified risks in the industry and the volatile performance and financial condition of individual institutions necessitate emphasis on more frequent and less￾structured supervision. Investigations, phone calls, emails, limited-scope examinations, correspondence, and other forms of customized contact should be made as necessary. The purpose is to identify and obtain corrections in an institution’s policies and procedures before serious financial problems develop. Examination planning activities should include efforts to determine the activities and condition of nonbank subsidiaries. If not determinable in advance, this information should be obtained early in the examination in order to assess the necessity for, and depth of, subsidiary examinations. A major component of the risk-focused supervisory approach is the flexibility to conduct examination activities at various times during the examination cycle based on risk or staffing considerations. However, it is anticipated that most examination activities will be conducted as of a single point-in-time near the end of the risk management examination cycle, particularly in well-rated institutions. Forward-Looking Supervision Risk-focused supervision employs a forward-looking supervisory approach where control weaknesses or other risk management conditions or problems are assessed early, and when necessary, corrected, in order to prevent or mitigate serious problems to an institution’s financial condition in the future. To address minor issues identified during an examination, examiners may present suggestions to management during discussions. For more significant problems, examiners should discuss the deficiencies with management and the board of directors during the examination and at subsequent exit meetings, and address the problems in the ROE. Such discussions and written commentary should clearly convey the issue that is cause for concern and explain the risks to the institution’s operations or financial performance if not addressed in a timely manner. Significant issues that require immediate attention should be identified as Matters Requiring Board Attention in the ROE. If circumstances warrant and after discussing with appropriate FDIC regional management, examiners should make recommendations for informal or formal agreements or actions if they identify unacceptable risk levels or risk management practices, even in 1 or 2 rated institutions. A forward-looking supervisory approach that identifies and seeks to correct objectionable conditions requires serious thought and a balanced response by examiners. Critical comments must be well supported and based on facts,
logic, and prudent supervisory standards. Although examiners cannot predict future events, they should consider the likelihood that identified weaknesses will cause material problems in the future, and consider the severity of damage to an institution if conditions deteriorate. In circumstances where formal action is considered, examiners should consult with the regional office while the examination is in progress regarding the material needed to support a potential action. Scheduling Considerations The success of a risk-focused examination program depends largely on the effectiveness of examination planning efforts and assignment scheduling. The objective of a risk-focused examination process is to identify problems early and devise solutions in the quickest, most efficient manner possible. In some instances, evidence of objectionable practices or conditions may indicate the need for an accelerated examination or visitation. In less severe situations, the information is retained and factored into the scheduling of future examinations. In order for examiners to proactively assess potential deficiencies, it is critical for field supervisors and other personnel to be aware of, and have access to, pertinent documentation. Regional directors should ensure copies of relevant correspondence and other information that may affect scheduling decisions is documented and made available to scheduling personnel. The following lists include sources of information that may influence examination schedules or activities. In some instances, the information may identify concerns that lead to immediate examinations. In less severe situations, the information may help identify risks that require follow-up or impact the scheduling of future examinations. The lists, while not all-inclusive, highlight the need for forward￾looking supervision. Offsite Analysis and Monitoring

• Statistical CAMELS Offsite Rating System
• Comprehensive Analytical Reports
• Interim Financial Reports
• Growth Monitoring System

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-11 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation

• UBPR Analysis
• Press Releases
  Other Financial Indicators
• Unusually high or fluctuating profit levels
• Significant operating losses
• Significant provision expenses to the allowance for
  loan and lease losses (ALLL) or allowance for credit losses (ACL), as applicable
• Significant levels of delinquent loans
• Significant changes in balance sheet composition
• Unusually elevated or rapidly growing asset
  concentrations
• High reliance on brokered funds
• Excessive trading
• Excessive dividends
• Unusually high or low ratios or numbers
  Applications or Other Bank-Provided Data
• Merger activity
• Large defalcation
• Change of control
• Adverse audit report findings
• Newly insured institution
• Change in external auditor
• New subsidiaries or business lines
• Cancellation of blanket bond insurance
• Exercise of a new power or profit center
• Acquiring party in an FDIC-assisted transactions
• Large paydown/payoff of previously classified loans
• Affiliation with a problem institution/holding
  company
  Known Characteristics
• Unusually high or low salaries
• Compensation linked to financial-performance metrics
• Significant litigation
• Infighting among officers or directors
• Officers or directors with past due loans
• Dominating or self-serving management
• Operating at the margin of laws and regulations
• Inexperienced or questionable management
• Substantial outside business interests of a key officer
• Conducting business with questionable firms
• Lack of diversity in business lines
• Higher-risk business strategies
• Refinancing poor quality loans
• Advertising above-market interest rates
• Large blocks of bank stock pledged as collateral
• Numerous or unusual affiliated loan participations
• Improper handling of correspondent bank accounts
• Sacrificing price or quality to increase loan volumes
• Hiring of a dismissed, unethical, or marginal officer
  Other Bank Regulators
• Improper handling of correspondent bank accounts
• Increased or unusual loan participations among
  affiliated or closely-held institutions
• Large blocks of stock pledged as collateral
• Affiliation with an institution or holding company
  rated 3, 4, or 5
• Large defalcation
• Banker with past due loans at another institution
• Loans classified at other institutions
  Media
• New chief executive officer or chief lending officer
• Adverse publicity
• Annual or interim period losses
• Adverse economic event in a community
• Natural disaster such as a flood, fire, or earthquake
• Large defalcation
• Large financial commitment as sponsor or lead bank
  in a major project or development
• Banker death or disappearance
• Announcement of major new activity or department
  Observations/Other
• Change in external auditor
• High or sudden employee turnover
• Significant litigation against the institution or insiders
• Unusual activity in stock of the institution (price
  movement up or down, or heavy trading volume)
• Institution advertising above-market rates
• Significant change in asset/liability compositions
• Questionable loans being booked
• Relationships with borrowers of questionable
  character
• Confidential or anonymous tips
  ←
  RELYING ON STATE EXAMINATIONS
  Section 10(d)(9) of the FDI Act requires the FFIEC to issue
  guidelines establishing standards for the purpose of determining the acceptability of state reports of examination. Under Section 10(d)(3-4), a federal banking agency may conduct an annual, onsite examination of an

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-12 RMS Manual of Examination Policies Federal Deposit Insurance Corporation insured depository institution in alternate 12- or 18-month periods if the agency determines that a state examination conducted during the intervening period is adequate. The standards issued by the FFIEC are to be used at the discretion of the appropriate federal banking agency. The FDIC and the Federal Reserve Board of Governors have a history of coordinating examination activities with state banking departments. This close cooperation improves the supervisory process by promoting a safe and sound banking system, maximizing examination efficiencies, and reducing the regulatory burden on state￾chartered, depository institutions. The federal and state banking agencies have worked together in the following areas:

• Conducting alternate, joint, and concurrent
  examinations of insured depository institutions, and of the branches and agencies of foreign banks that have been chartered by the states;
• Processing safety and soundness examination reports
  and applications on a timely basis;
• Using common examination report and application
  forms;
• Developing and issuing informal (e.g., board
  resolutions, memoranda of understanding or other similar agreements) and formal enforcement actions;
• Exchanging supervisory information;
• Offering federal agency training programs to state
  examiners; and
• Providing access to the federal agency databases.
  The FDIC intends to continue these cooperative efforts to the maximum extent possible. It is recognized, however, that the adequacy of state budgeting, examiner staffing, and training are important factors to enhancing federal and state coordination. The FDIC has entered into formal and informal arrangements with most state banking departments. These arrangements or working agreements generally address the following areas:
• The number of state-chartered, insured institutions to
  be examined on an alternating basis by the state banking department and by the FDIC;
• The frequency of safety and soundness examinations;
• The type of examinations to be conducted
  (independent, joint, or concurrent) by each agency;
• The examination procedures to be performed;
• The responsibilities of each agency for processing
  reports of examination;
• The responsibilities of each agency for conducting
  specialty examinations;
• The procedures for coordinating informal and formal
  enforcement actions;
• The procedures for processing joint applications; and
• The procedures for sharing supervisory information.
  These arrangements are structured to permit federal and state agencies flexibility in conducting independent examinations, subject only to notification to the other party. The flexibility allows the agencies to tailor activities based on the particulars of each state and the individual banks within a state. Generally, only institutions rated 1 or 2 are examined on an alternating basis allowing for a reasonable interval between examinations. The FDIC will accept and rely on state reports of examination in all cases in which it is determined that state examinations enable the FDIC to effectively carry out its supervisory responsibilities. The following criteria may be considered, in whole or in part, when determining the acceptability of a state report of examination under Section 10(d) of the FDI Act:
• The completeness of the state examination report.
  The state report of examination should contain sufficient information to permit a reviewer to make an independent determination on the overall condition of the institution as well as each component factor and composite rating assigned under the UFIRS and commonly referred to as the CAMELS rating system, or the ROCA rating system used for branches and agencies of foreign banks.
• The adequacy of documentation maintained by state
  examiners to support observations made in examination reports.
• The ability over time of a state banking department to
  achieve examination objectives. At a minimum, the FDIC will consider the adequacy of state budgets; examiner staffing and training; and examination reports, reviews, and follow-up procedures. Accreditation of a state banking department by the Conference of State Bank Supervisors will also be considered.
• The adequacy of any formal or informal arrangement
  or working agreement between a state banking department and the FDIC. The FDIC, as part of its routine review of state examination reports, will assess the quality and scope of the reports to determine whether they continue to meet the general criteria noted above. The FDIC retains the option to conduct a follow-up examination in cases in which a state examination report appears insufficient or the condition of an insured institution appears to be seriously deteriorating.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-13 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation If a state and the FDIC have cooperative examination programs, regional directors may involve FDIC examiners in state examinations if an institution’s condition is deteriorating, or areas of concern are identified. The FDIC will work with state banking departments to resolve any concerns regarding the acceptability of each other’s work, the operation of cooperative programs, or any other issues of mutual interest. ← COMMUNICATION BETWEEN EXAMINATIONS Interim contact with bank management is a critical form of communication and should be conducted within 30 days of the midpoint between risk management examinations (FDIC or state). Interim contacts provide a way to monitor the institution’s financial condition and gather insight into trends regarding the nature, scope, and risk of an institution’s activities. Interim contacts also help supervisory staff (including examiners) establish an appropriate examination scope and identify resources required for the next examination. The objective of an interim contact is to build and maintain effective communication with the institution. The contacts provide an opportunity for management to discuss financial trends, strategic initiatives, developing risks, and regulatory changes that may affect the institution. The contacts also help identify changes in the bank’s risk profile that may require an alteration in supervisory strategies. Supervisory staff can conduct interim contacts by phone or in person, depending on the matters to be discussed and travel proximity. Information derived from interim contacts and supervisory activities can be used as part of the risk-focused examination process. The process seeks to strike an appropriate balance between evaluating the condition of an institution at a certain point in time and evaluating the soundness of the institution’s risk management processes in all phases of the economic cycle. Given the purpose of this communication, the FDIC should coordinate with state supervisory counterparts who may also have interim contact procedures. The FDIC is also encouraged to share information with state banking departments if significant items are identified during contacts. Because case managers and other supervisory staff contact institutions that are under a supervisory action periodically between examinations, only institutions with Risk Management and specialty examination composite ratings of 1 or 2 require an “interim” contact. Regional directors have the discretion to designate regional- or field-office staff to be responsible for contacting bank management. A brief file memorandum summarizing the contact should be prepared and entered into the correspondence file as an Interim Bank Contact. The memo is an important, formal record of the Corporation’s supervisory efforts; comments
should be brief and factual. Case managers should review the contact memorandum if they are responsible for oversight of the institution and did not perform the contact themselves. Topics discussed during interim contacts generally focus on the nature of the institution’s operations and risks. The following topics are provided for illustrative purposes.

• Significant changes in bank products or services;
• Changes in bank management or key personnel;
• Changes in the strategic plan, business plan, or
  operations;
• Significant trends or changes in the local economy or
  business conditions as detailed in publicly available information, Division of Insurance and Research data, or other means;
• Purchase, acquisition, or merger strategies;
• Changes in technology, including operational systems,
  or plans for new products/activities that involve new technologies;
• Financial performance and trends, particularly
  unfavorable factors identified during off-site analysis;
• Progress in addressing any matters requiring board
  attention issued by the FDIC or the state banking authority, violations, or enforcement actions;
• Recent Financial Institution Letters, laws, rules, and
  regulations that may affect the institution’s operations;
• Any matters that may be of interest to regulators,
  including significant audit or security incidents; and
• Institution management’s concerns about the bank or
  FDIC supervisory activities.
  Other contacts with an institution that occur near the midpoint of examinations, such as a visitation or other direct communication with institution management, may serve as the interim contact. In such cases, the system of record should be updated by case managers to indicate that an interim contact was completed via alternate means. ← EXAMINATION PLANNING ACTIVITIES Thorough examination planning is critical to the efficient completion of an examination. Effective planning helps support risk-scoping decisions in terms of work performed and areas to receive special attention. It can also help

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-14 RMS Manual of Examination Policies Federal Deposit Insurance Corporation determine staffing needs in regard to the number and expertise of personnel required. Finally, it can enhance examination efficiencies and reduce disruptions at institutions. Examiners should consider the need for branch examinations when planning examinations. The FDIC examines branch offices on an as-needed basis only, and the regional director is responsible for deciding if a branch examination is necessary. The decision to conduct a branch examination may be delegated to the field supervisor or EIC of a particular examination. In general, examinations should reflect a comprehensive and coordinated effort between risk management and specialty examiners to assess an institution’s overall risk profile. Information request letters from various functions scheduled for the upcoming examination (for example, Risk Management, Information Technology (IT), Bank Secrecy Act (BSA), and Trust examinations) should be coordinated and combined whenever practical. Examiners should take special care to tailor information request letters to the unique risk profile and business model of the institution, and remove unnecessary and redundant information from request lists. As a general rule, field supervisors (FS) or supervisory examiners (SE) must call institution management at least 90 days ahead of the projected start date of the examination to inform them of the upcoming safety and soundness examination. The FS or SE will provide notice that profile scripts for general safety and soundness, which includes BSA, Trust (when applicable), and IT, will be sent to the institution. Exceptions to this general policy (such as no￾notice examinations, which require regional director approval) may include problem institutions, situations where management and ownership of the institution are identical, or in situations where conditions appear to be deteriorating rapidly. Supervisors should be mindful of an institution’s space and personnel limitations and schedule the number of examiners working on bank premises accordingly. Additionally, throughout the examination, examiners should make every effort to conduct as many examination activities as reasonably possible offsite in order to minimize disruptions to an institution’s normal business activities. The following items, while not all-inclusive, are well suited for offsite review when the related information is available.

• Policies and procedures
• Audit plan
• Audit reports and responses
• Strategic plan
• Board and committee minutes/reports
• Financial data
• Asset-related reports and documents
  An examination procedures module titled Risk Scoping Activities is included in the Examination Documentation Modules. This module identifies and lists several activities that may be completed by examiners during the examination planning process. Reviewing External Audit Workpapers An external audit workpaper review is intended to provide information relating to an institution’s internal control environment and its financial reporting practices. Thus, a workpaper review assists examiners in determining the scope of the examination and the procedures to be applied to different areas of operations. Examiners should review the workpapers of the independent public accountant or other auditor performing the institution’s external auditing program when an FDIC￾supervised institution has undergone a financial statement or balance sheet audit, and:
• Significant concerns exist regarding matters that
  would fall within the scope of the work performed by the institution’s external auditors, or
• The institution has been, or is expected to be, assigned
  a UFIRS composite rating of 4 or 5.
  However, when considering how best to use examination resources, examiners should exercise reasonable judgment with respect to performing an external audit workpaper review for these institutions. For example, it would be appropriate to conduct an external audit workpaper review for FDIC-supervised institutions when significant matters exist and the review is reasonably expected to provide an examination benefit. If examiners determine that a benefit would not be derived from performing an external audit workpaper review for an FDIC-supervised institution, examiners must document, and include in the examination workpapers, the reasons for not conducting the review. Shared-Loss Agreements A shared-loss agreement (SLA) is a contract between the FDIC and institutions that acquire failed bank assets. Under the agreements, the FDIC agrees to absorb a portion of the losses, if incurred, on specific assets (usually loans), purchased by an institution. If an institution makes recoveries on covered assets, they must reimburse the FDIC

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-15 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation for part of the recoveries. Shared-loss agreements cover specific timeframes and are often written so the FDIC absorbs 80 percent of incurred losses (up to a stated threshold), and receives 80 percent of recoveries. To maintain loss coverage, institutions must adhere to the terms of the agreement and make good faith efforts to collect loans. Note: The FDIC’s reimbursement for losses on assets covered by an SLA is measured in relation to an asset’s book value on the records of the failed institution on the date of its failure, not in relation to the acquisition-date fair value at which covered assets must be booked by an acquiring bank. The FDIC uses different types of agreements for commercial loans and residential mortgages. Both types cover credit losses and certain related expenses. However, for commercial assets, SLAs generally cover losses for five years and recoveries for eight years. For residential mortgages, SLAs generally cover losses and recoveries for ten years. At the inception of either type of agreement, the acquiring institution records an indemnification asset to reflect the expected FDIC loss reimbursement under the life of the SLA. Shared-loss agreements are designed to keep assets in the private sector, place failed bank assets with local acquirers, and preserve asset values while reducing resolution costs. Banks should not allow shared-loss considerations to unduly impact foreclosure decisions. Banks should only foreclose on properties after exhausting other loss￾mitigation and workout options. To avoid unnecessary home foreclosures, most residential SLAs specifically require institutions to engage in loss-mitigation efforts in accordance with the FDIC’s Mortgage Loan Modification Program or the national Home Affordable Modification Program. Examination Considerations Regional and field office personnel should regularly communicate with the Division of Resolutions and Receiverships (DRR) to coordinate activities and share SLA information. Pre-examination communication between examiners and DRR allows examiners to determine the type and extent of SLAs and the existence of any issues that might affect an institution’s safety and soundness. If any of a bank’s assets are covered by an SLA, examiners should review the agreement and consider its implications when:

• Performing asset reviews,
• Assessing accounting entries,
• Assigning asset classifications, and
• Determining CAMELS ratings.
  Risk management examiners should include a sample of SLA-related commercial assets in their loan scope. The number of loans sampled should be sufficient to allow examiners to assess whether the assets are administered in a manner consistent with commercial assets not covered by SLAs. Examiners may determine it is unnecessary to include SLA-related residential mortgages in their loan scope; however, SLA coverage should be considered when assigning adverse classifications to residential credits covered by SLAs. In most cases, the portion of an asset covered by an SLA should not be subject to adverse classification because loss sharing represents a conditional guarantee from the FDIC. Generally, the amount that would otherwise be adversely classified (Substandard, Doubtful, or Loss) should be reduced by the applicable coverage rate (often 80 or 95 percent). Risk management examiners should review management’s plans and efforts to ensure that the indemnification asset has a zero balance when the period for loss protection under an SLA expires. Examiners should discuss any potential SLA concerns with a regional SLA subject matter expert. Risk management examiners are not expected to evaluate an institution’s compliance with SLAs. Personnel from DRR evaluate compliance with SLAs; assess SLA-related accounting, reporting, and recordkeeping systems; and review loss-claim certificates. However, risk management examiners should notify their regional SLA subject matter expert and DRR staff if they identify potential problems or nonconformance with an agreement. Other Examination Considerations As noted above, if any of a bank’s assets are covered by an SLA, examiners should review the agreement and consider its implications during examinations or visitations. The following scheduling considerations apply to FDIC￾supervised institutions that received FDIC assistance, or were involved in purchase and assumption or deposit transfer transactions. Acquiring institutions with total assets in excess of ten times the deposits acquired, which are rated composite 2 or better are exempt from the following requirements. A visitation or limited-scope examination should be conducted at state nonmember institutions within 30 days of the transaction date to determine how funds from the FDIC are being used and whether the bank is in compliance with any applicable assistance agreement. A second visitation or

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-16 RMS Manual of Examination Policies Federal Deposit Insurance Corporation limited-scope examination should be conducted within six months of the transaction. A full-scope examination should be conducted within twelve months of the transaction. Thereafter, standard examination frequency schedules apply. A cooperative program should be established with the appropriate federal agency for national, state member, and thrift institutions to ensure that all institutions receiving FDIC funds are properly monitored and that the FDIC regional director is informed of important developments. ← MEETINGS WITH BANK PERSONNEL Open dialogue with institution management is critical to forward-looking, risk-focused supervision. Open communication helps ensure examination requests are met and disruptions to an institution’s daily activities are minimized. The EIC should extend an invitation (through senior management or directly to a board member if they meet a director during the examination) for directors to participate in regularly scheduled meetings with examiners or to schedule individual meetings with the EIC. Director attendance at examination meetings increases their knowledge of the examination process and provides directors with an opportunity to discuss their views on bank￾related matters with examiners. The meetings also allow examiners to gain insight into the experience levels and leadership qualities of bank management. While encouraging participation in examination meetings, the EIC should emphasize that director attendance is voluntary and that a lack of participation will not be viewed negatively. Examiners should promote open communication at board meetings and encourage director participation in future examination meetings. Other ways to inform bankers and promote open communication includes references in the ROE transmittal letter and discussions during interim contacts and outreach events, such as Directors’ Colleges. Meetings with Management Prior to the onsite examination, the EIC should communicate with management to coordinate examination activities. Such communication should address information requests (including the names of contact individuals), workspace plans, and the general scope of the examination. Other informal meetings should be held as needed throughout the examination to discuss various topics, gain management’s perspective on local economic conditions and bank-specific issues, and to keep management informed regarding the progress of the examination. Prior to the conclusion of the examination, examiners should thoroughly discuss their findings and recommendations with senior management. Such meetings are critical in communicating examination findings to the bank and providing management an opportunity to respond. Exit meetings should fully apprise bank management of all deficiencies and supervisory recommendations
that will be cited in the ROE. The following examples represent situations that will prompt meetings and encourage dialogue between examiners and management during the course of an examination. The circumstances of each examination will determine the type and number of meetings necessary, as well as the degree of formality required to schedule and conduct the meetings. Examination Planning The EIC should contact institution management approximately six to eight weeks ahead of the examination. The purpose of this contact is to discuss the preliminary description of the institution’s business model, risk profile, and complexity, and to describe how those definitions are being used to determine the planned examination scope and request list content. The meeting provides an opportunity to get management’s perspective on economic conditions, key challenges/risks, significant audit findings since the prior examination, and key risk￾management processes. Primary topics of conversation should generally include current financial conditions; significant changes (planned or completed) to bank policies, personnel, or strategic direction; and any other significant changes since the previous examination. The EIC should also discuss how and when information requests will be sent to the bank (electronic or hard copies), and the method and timing for any requested information to be delivered to examiners (FDICconnect, external media, or hard copies). Importantly, the EIC should facilitate the secure exchange of information between institution management and examiners, by ensuring that the delivery method(s) used meet the security measures discussed in the FDIC’s e-Exam policies for the exchange, use, and storage of electronic information. Finally, the EIC should conduct an onsite meeting with bank management, or conduct a telephone conversation with management if an onsite meeting is not feasible, in advance of the examination after reviewing the requested materials provided by management. The discussion should focus on examination logistics, including the size of the examination team; and plans for work to be completed off-site and on￾site. First Day Generally, the EIC and examination team should meet with senior management and staff during the first day

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-17 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation of the examination for introductions, to request additional information, to discuss the areas that will be reviewed during the examination, and to cover other general examination requirements. Such meetings provide an opportunity to establish open lines of communication. Follow-up on Prior Examination Issues Early in the examination, it is useful for the EIC to meet with senior management and discuss the bank’s progress in responding to prior supervisory recommendations, as well as outstanding internal and external audit recommendations. This is also a good opportunity for examiners to gain management’s perspectives on other bank-specific concerns. Strategic Planning and Budget The EIC and management should discuss asset and/or capital growth plans, new business or business products, and other strategic and budget issues during the course of the examination. Loan Discussion Management should participate in loan discussions and the initial review of adverse classifications, as appropriate, considering the size and condition of the institution and loan portfolio. Material Preliminary Findings Normally, the EIC should notify senior management of major findings and possible recommendations before the final management meeting. This is to ensure that management has the opportunity to provide any additional information or clarification for examiner consideration before the conclusion of the examination. Management Meetings The EIC is expected to communicate with institution management regularly during the examination to inform management of the examination progress and findings. Further, all major examination issues should be discussed with senior management as soon as practical during an examination. Additionally, all significant issues should be discussed again at the end of the examination, prior to meeting with the board of directors. As noted in the Examination Letters for Troubled Institutions section above, the FDIC’s expectations for troubled institutions should be clearly communicated to bank management between the close of an examination and the issuance of an enforcement action. Regardless of the number or type of meetings held, it is critical that examiners ensure on-going two-way communication with management. Such communication enhances the effectiveness of the examination process by allowing all parties to freely exchange information. Meetings with Directors The policies in this section have been established for meetings with boards of directors. These policies are designed to encourage director involvement in, and enhance director awareness of, FDIC supervisory efforts and to increase the effectiveness of such efforts. The bank’s composite rating is the most important variable in deciding if and when these meetings should be held. Banks Assigned a
Composite Rating of 4 or 5 The EIC and the regional director or designee should meet with the board of directors (with the required quorum in attendance) during or subsequent to the examination. Additional meetings or contacts with the board of directors or appropriate board committee may be scheduled at the regional director’s discretion. Banks Assigned a Composite Rating of 3 The EIC should meet with the board (with the required quorum in attendance) during or subsequent to the examination. Regional office representation is at the discretion of the regional director. Additional meetings or other contacts with the board of directors or appropriate board committee may be scheduled at the discretion of the regional director or designee. Banks Assigned a Composite Rating of 1 or 2 The EIC will meet with the board or a board committee during or subsequent to the examination when 36 months or more have elapsed since the last such meeting; the management component of the CAMELS rating is 3, 4 or 5; any other CAMELS performance rating is 4 or 5; or any two performance ratings are 3, 4 or 5. It is important to note that meeting with a board committee (in lieu of the entire board) in conjunction with an examination is permissible only when the committee is influential as to policy, meets regularly, contains reasonable outside director representation, and reports regularly to the entire board. Other factors that may be relevant to the decision of holding a board meeting include recent changes in control, ownership, or top management; adverse economic conditions; requests by management or the board for a meeting; or any unique conditions or trends pertinent to the institution. Regional office participation in meetings with banks rated composite 1 or 2 is at the regional director’s discretion.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-18 RMS Manual of Examination Policies Federal Deposit Insurance Corporation Matters Requiring Board Attention (MRBA) The EIC will meet with the board of directors, or a board committee, during or subsequent to the examination whenever the EIC recommends including a MRBA in the ROE. To assist directors in prioritizing their efforts to address MRBA, discussions should cover the reasons for the MRBA, highlight the benefits and importance of addressing issues and the possible consequences of not taking action. Other Considerations When a meeting is held in conjunction with an examination, reference should be made on the Examination Conclusions and Comments (ECC) schedule as to the committee or board members, bank managers or personnel, and regulators in attendance. A clear but concise presentation of the items covered at the meeting, including corrective commitments and/or reactions of management, should also be included. If a meeting is held, but not in conjunction with an examination, a summary of the meeting, including the items noted above, should be prepared and a copy mailed to the institution, via certified mail, for consideration by the board and inclusion in the official minutes of the directorate’s next meeting. When it is concluded that a meeting with a board committee rather than the full board is appropriate, selection of the committee must be based on the group’s actual responsibilities and functions rather than its title. In all cases, the committee chosen should include an acceptable representation of board members who are not full-time officers. The success of a board meeting is highly dependent upon the examiner’s preparation. The EIC should notify bank management as soon as possible of any plans to meet with the board to present overall examination findings. A written agenda that lists all areas to be discussed and provides supporting documents or schedules generally enhances examiners’ explanations of findings and recommendations. Failure to adequately prepare for a meeting can substantially diminish the supervisory value of an examination. Both the written agenda, and the EIC discussions at the meeting, should be clear regarding items that senior management and the board are expected to address. To encourage awareness and participation, examiners should inform bank management that the examination report (or copies thereof) should be made available to each director for thorough and timely review, and that a signature
page is included in the examination report to be signed by
each director after review of the report. Management should also be reminded that the report is confidential, remains the property of the FDIC, and that utmost care should be exercised in its reproduction and distribution. The bank should be advised to retrieve, destroy, and record the fact of destruction of any reproduced copies after they have served their purpose. ← OTHER SOURCES OF INFORMATION The primary purpose of this Manual is to provide instructions to the field examiner that should be applied in the risk management examination process. Other policy manuals or other instructional materials pertaining to additional areas of examination interest, such as trust department operations, IT activities, transfer agent, and consumer compliance have also been developed. Those areas were not addressed significantly in this Manual in order to enhance the organization of the primary risk management material and to keep the document reasonable in length. However, exclusion of these topics in no way implies that these activities do not impact a safety and soundness examination. To the contrary, deficiencies in other aspects of a bank’s operations can have a major impact on an institution’s overall condition. Therefore, it is critical for examiners to be aware of the existence and understand the significance of deficiencies in other areas. Specialty examination findings should be addressed in the ECC section of the risk management ROE. The placement and length of related comments should be commensurate with the significance of the findings and the impact on the UFIRS ratings. Inclusion of specific specialty examination pages in the ROE in support of findings in the ECC section is addressed in Manual Section 16.1 – Report of Examination Instructions. If a specialty examination is conducted at a date substantially removed from other examination activities, examiners may communicate their findings through a visitation report and letter to the institution if warranted. However, summary comments should also be included in the risk management ROE and factored into the UFIRS ratings. In some situations, it may be necessary for examiners to conduct specialty examinations separately from the Risk Management examination. In these rare cases, a separate specialty examination report may be prepared, consistent with regional guidance and outstanding report preparation instructions. To emphasize and illustrate how weaknesses in these ancillary activities can adversely affect the whole bank, a brief overview of trust, IT, BSA, and consumer protection activities is provided.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-19 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation Trust Department A bank’s trust department acts in a fiduciary capacity when the assets it manages are not the bank’s, but belong to and are for the benefit of others. This type of relationship necessitates a great deal of confidence on the part of customers and demands a high degree of good faith and responsibility on a bank’s part. The primary objective of a trust department examination is to determine whether its operations or the administration of its accounts have given rise to possible or contingent liabilities, or direct liabilities (estimated losses), which could reduce the bank’s capital accounts. If the terms of trust instruments are violated, if relevant laws and regulations are not complied with, or if generally accepted fiduciary standards are not adhered to, the department, and hence the bank, may become liable and suffer losses. If the magnitude of these losses is very high, the viability of the bank may be threatened. To aid examiners in evaluating a trust department, the Uniform Interagency Trust Rating System was devised. Composite ratings of 1 (best performance) through 5 (worst performance) are assigned based on analysis of five critical areas of a trust department’s administration and operations. These include Management; Operations, Internal Controls and Audits; Earnings; Compliance; and Asset Management. Information Technology Information technology services apply to virtually all recordkeeping and operational areas in banks. These IT services may be managed internally on a bank’s own in-house computer system, or outsourced, wholly or in part, to an independent data center that performs IT functions. Although some or all IT services may be outsourced, management and the board retain oversight responsibilities. The potential consequences of receiving faulty data or suffering an interruption of services are serious and warrant comprehensive IT policies and procedures and thorough IT examinations. A primary objective of an IT examination is to determine the confidentiality, integrity, and availability of records produced by automated systems. Examination priorities include an evaluation of management’s ability to identify risks and maintain appropriate compensating controls. IT operations are rated in accordance with the Uniform Rating System for Information Technology (URSIT), which is based on an evaluation of four critical components: audit; management; development and acquisition; and support and delivery. The composite IT rating is influenced by the performance of the four component functions and reflects the effectiveness of a bank’s IT risk management and information security programs and practices. A scale of 1 through 5 is used, wherein 1 indicates strong performance and 5 denotes critically deficient operating performance. Most IT
examinations should be embedded in risk management ROEs. The URSIT composite and component ratings should be assigned at each IT examination and included in the ROE in accordance with Section 16.1 of the RMS Manual. Bank Secrecy Act The Financial Recordkeeping and Reporting of Currency and Foreign Transactions Act of 1970 is often referred to as the Bank Secrecy Act. The purpose of the BSA is to ensure U.S. financial institutions maintain appropriate records and file certain reports involving currency transactions and customer relationships. Several acts and regulations that strengthen the scope and enforcement of BSA, anti-money laundering (AML), and counter-terrorist-financing measures have been signed into law. Some of these include:

• Money Laundering Control Act-1986
• Annuzio-Wylie Anti-Money Laundering Act-1992
• Money Laundering Suppression Act-1994
• Money Laundering & Financial Crimes Strategy Act￾1998
• USA PATRIOT Act-2001
  Findings from BSA examinations are generally included within the risk management report; however, separate BSA examinations can be conducted. Although a separate rating system for BSA does not exist, BSA findings can affect both the management rating and the overall composite rating of the institution. Refer to the BSA section of this Manual for additional information. Consumer Protection The principal objective of consumer protection examinations is to determine a bank’s compliance with various consumer and civil rights laws and regulations. Consumer protection statutes include, but are not limited to, Truth in Lending, Truth in Savings, Community Reinvestment Act, and Fair Housing regulations. Noncompliance with these regulatory restrictions and standards may result in an injustice to affected individual(s) and reflects adversely on an institution. Moreover, violations of consumer laws can result in civil or criminal liabilities, and consequently, financial penalties. If significant in amount, such losses could have an adverse financial impact on a bank. As is the case for IT and trust operations, an interagency rating system for consumer compliance has been designed. It provides a general

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-20 RMS Manual of Examination Policies Federal Deposit Insurance Corporation framework for evaluating an institution’s conformance with consumer protection and civil rights laws and regulations. A numbering scale of 1 through 5 is used with 1 signifying the strongest performance and 5 the worst performance. A separate examination rating is assigned to each institution based on its performance in the area of community reinvestment. The four ratings are outstanding, satisfactory, needs to improve, and substantial noncompliance. Summary Risk management examiners must have a general knowledge of the key principles, policies, and practices relating to IT, BSA, consumer protection, trust, and other specialty examinations. Additionally, examiners should be knowledgeable of state laws and regulations that apply to the banks they examine; the rules, regulations, statements of policy and various banking-related statutes contained in the FDIC Rules and Regulations; and the instructions for completing Consolidated Reports of Condition and Income. ← DISCLOSING REPORTS OF EXAMINATION The ROE is highly confidential. Although a copy is provided to a bank, that copy remains the property of the FDIC. Without the FDIC’s prior authorization, directors, officers, employees, and agents of a bank are not permitted to disclose the contents of a report. Under specified circumstances, FDIC regulations permit disclosures by a bank to its parent holding company or majority shareholder. Standard FDIC regulations do not prohibit employees or agents of a bank from reviewing the ROE if it is necessary for purposes of their employment. Accountants and attorneys acting in their capacities as bank employees or agents may review an examination report without prior FDIC approval, but only insofar as it relates to their scope of employment. The FDIC believes the definition of agent includes an accountant or accounting firm that performs an audit of the bank. Reports of Examination are routinely provided to a bank’s chartering authority. Therefore, state bank examiners may review the bank’s copy of an FDIC examination during a state examination. ← EXAMINATION WORKPAPERS Introduction Examiners should document their findings through a combination of brief summaries, source documents, report comments, and other workpapers that clearly describe financial conditions, management practices, and examination conclusions. Documentation should generally describe:

• Key audit/risk-scoping decisions,
• Source documents reviewed, and
• General examination procedures performed.
  Documentation should include summary statements. Summary statements can take many forms, including notations on copies of source documents, separate hand￾written notes, and electronic or hard-copy memorandums. At a minimum, summary comments should:
• Detail examination findings and recommendations,
• Describe supporting facts and logic, and
• Record management responses and completion dates
  for promised corrective actions.
  Although examination documentation may be maintained in various ways, examiners must securely retain appropriate supporting records of all major examination conclusions, recommendations, and assertions detailed in the ROE. Safeguarding Examination Information Examination information may contain non-public customer information as defined in Section 501(b) of the Gramm￾Leach-Bliley Act. Therefore, examiners must carefully safeguard information and follow established procedures for accessing, transporting, storing, and disposing of electronic and paper information. The procedures, which may involve Washington-, regional-, and field-office practices, should include technical, physical, and administrative safeguards and an incident response program. Examiners must protect FDIC property and data and respond quickly to any security breech. Examiners should:
• Protect computer equipment and data in transit,
• Track data in transit, and
• Secure unattended equipment and data.
  Examiners must report unauthorized access to data and equipment on a timely basis. Examiners should contact the

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-21 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation FDIC’s Help Desk within one hour after discovery; their supervisor as soon as possible; and in instances where theft of equipment is involved, the local police. Examination Documentation (ED) Modules Examination procedures have been developed jointly by the FDIC, the Federal Reserve, and various state agencies to provide examiners with tools to scope examination activities, evaluate financial conditions and risk￾management practices, and document examination findings. The use of these modules is discretionary. When not used, examination findings should be documented as discussed above. The ED modules incorporate questions and points of consideration into examination procedures that specifically address a bank’s risk management strategies for each of its major business activities. The modules direct examiners to evaluate areas of risk and associated risk-control practices, thereby facilitating an effective supervisory program. The ED module examination procedures are generally separated into three distinct tiers: Core Analysis, Expanded Analysis, and Impact Analysis. The extent to which an examiner works through each of these levels of analysis depends upon the conclusions reached regarding the presence of significant concerns or deficiencies. Where significant deficiencies or weaknesses are noted in the Core Analysis review, the examiner should complete the Expanded Analysis section, but only for the decision factors that present the greatest degree of risk to the bank. On the other hand, if risks are properly managed, examiners can conclude their review after documenting conclusions concerning the Core Analysis Decision Factors and carrying forward any applicable comments to the ROE. The Expanded Analysis section provides guidance to examiners to help determine if weaknesses are material to a bank’s condition or if an activity is inadequately managed. The use of the modules should be tailored to the characteristics of each bank based on its size, complexity, and risk profile. As a result, the extent to which each module is completed will vary. Individual procedures presented for each level are meant only to serve as a guide for answering the decision factors. Each procedure does not require an individual response. Substance of Workpapers Appropriate documentation should be prepared and retained in the workpapers for each significant job task performed. A checklist of examination procedures performed may be used to document completed tasks and included as part of the examination workpapers. The checklist may also be used as the final documentation of lower-risk areas if findings are not material. Examiners should use standardized loan line sheets except in special situations where alternative forms, such as institution-generated line sheets, provide a clear and
substantial time savings and the same general loan information. Line sheets must contain sufficient, albeit sometimes brief, supporting data to substantiate a pass designation or adverse classification. For BSA examinations, examiners should document preliminary, core, and expanded procedures as needed, in accordance with current guidance relating to BSA/AML workprograms for examination procedures. Workpaper forms are available in ETS to supplement report pages for certain areas of review, such as risk-weighted assets and cash flow projections. When warranted, supplemental workpapers may be included in the ROE to the extent that they provide material support for significant findings. Filing of Workpapers Historically examiners maintained paper copies of documents to support examination findings. Generally, information can now be obtained electronically, or be captured electronically, using portable scanners. Examiners should scan documents that support examination findings unless technical or other issues require hard copies. Examiners should scan documents in a secure location within a reasonable time after receiving or developing them. Scanners should be turned off when not in use to clear the scanner’s memory of previously scanned information. Examiners should return hardcopy documents to their source or destroy them in a secure manner (onsite when possible) after completing the scanning process. Electronic documentation must be appropriately secured throughout the supervisory process to prevent disclosure of confidential or sensitive information to unauthorized individuals. Examiners should manage and store general examination documents using the Electronic Workpapers Module in the Regional Automated Document Distribution and Imaging System (RADD). Examiners must exercise sound judgment in determining which electronic workpapers to retain. Examiners should only retain final documents that support examination or other supervisory findings (not multiple versions of a document) and delete all other documents. The examiner￾in-charge is responsible for ensuring that only appropriate

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-22 RMS Manual of Examination Policies Federal Deposit Insurance Corporation electronic workpapers are retained and that the workpapers are retained in accordance with existing policies and procedures. At the conclusion of an examination or visitation, examiners should generally delete a bank's electronic workpapers from their laptops. However, electronic workpapers can be retained for longer periods if the information is needed to support ongoing business needs. In such instances, examiners should delete the electronic workpapers as soon as practical. Note: Non-FDIC issued laptops, desktops, or other electronic devices may not be used to store institution￾provided information or examination workpapers. If hardcopy documents are maintained, the documents should be appropriately stored and secured. Each folder, envelope, or binder should be labeled with the institution’s name and location, the date of examination, and a list of documents that were prepared for each category. At its discretion, each region and field office may designate the major documentation categories and supplemental lists for their respective office(s). The EIC is responsible for ensuring outdated workpapers are appropriately purged and current workpapers are properly organized and filed. If hardcopy documents are physically transported to another location, examiners must follow existing procedures to create logs of hardcopy documents that contain personally identifiable information. BSA workpapers must be retained for five years and should be maintained separately from the workpapers of the risk management examination. The separate retention of BSA workpapers will expedite their submission to the Treasury Department in the event they are requested. Retention of Workpapers Line sheets should generally be retained for one examination cycle, after which they may be purged from the active loan deck. Risk Management and Trust Officer’s Questionnaires should be retained for a minimum of ten years from the examination start date. Officer’s Questionnaires should be retained indefinitely when irregularities are discovered or suspected, especially if the signed questionnaire may provide evidence of these irregularities. The examiner may submit a copy of the Officer’s Questionnaire with the ROE if circumstances warrant, such as when the examiner suspects that an officer knowingly provided incorrect information on the document. Retention of other workpapers beyond one examination should generally be confined to those banks with existing or pending administrative actions, special documents relating to past insider abuse, documents that are the subject of previous criminal referral letters, or other such sensitive documents. While the retention of workpapers beyond one examination cycle is generally discouraged, major schedules and other pertinent workpapers can be retained if
deemed useful. Additionally, if a bank’s composite rating is 3 or worse, most workpapers should be maintained until the bank returns to a satisfactory condition.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-23 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation ← ADDENDUM TO SECTION 1.1 UFIRS RATINGS DEFINITIONS Composite Ratings Composite ratings are based on a careful evaluation of an institution’s managerial, operational, financial, and compliance performance. The six key components used to assess an institution’s financial condition and operations are capital adequacy, asset quality, management capability, earnings quantity and quality, liquidity adequacy, and sensitivity to market risk. The composite ratings are defined as follows:
Composite 1
Financial institutions in this group are sound in every respect and generally have components rated 1 or 2. Any weaknesses are minor and can be handled in a routine manner by the board of directors and management. These financial institutions are the most capable of withstanding the vagaries of business conditions and are resistant to outside influences such as economic instability in their trade area. These financial institutions are in substantial compliance with laws and regulations. As a result, these financial institutions exhibit the strongest performance and risk management practices relative to the institution’s size, complexity, and risk profile, and give no cause for supervisory concern. Composite 2 Financial institutions in this group are fundamentally sound. For a financial institution to receive this rating, generally no component rating should be more severe than 3. Only moderate weaknesses are present and are well within the board of directors’ and management’s capabilities and willingness to correct. These financial institutions are stable and are capable of withstanding business fluctuations. These financial institutions are in substantial compliance with laws and regulations. Overall risk management practices are satisfactory relative to the institution’s size, complexity, and risk profile. There are no material supervisory concerns and, as a result, the supervisory response is informal and limited. Composite 3 Financial institutions in this group exhibit some degree of supervisory concern in one or more of the component areas. These financial institutions exhibit a combination of weaknesses that may range from moderate to severe; however, the magnitude of the deficiencies generally will not cause a component to be rated more severely than 4. Management may lack the ability or willingness to effectively address weaknesses within appropriate time frames. Financial institutions in this group generally are less capable of withstanding business fluctuations and are more vulnerable to outside influences than those institutions rated a composite 1 or 2. Additionally, these financial institutions may be in significant noncompliance with laws and regulations. Risk management practices may be less than satisfactory relative to the institution’s size, complexity, and risk profile. These financial institutions require more than normal supervision, which may include formal or informal enforcement actions. Failure appears unlikely, however, given the overall strength and financial capacity of these institutions. Composite 4 Financial institutions in this group generally exhibit unsafe and unsound practices or conditions. There are serious financial or managerial deficiencies that result in unsatisfactory performance. The problems range from severe to critically deficient. The weaknesses and problems are not being satisfactorily addressed or resolved by the board of directors and management. Financial institutions in this group generally are
not capable of withstanding business fluctuations. There may be significant noncompliance with laws and regulations. Risk management practices are generally unacceptable relative to the institution’s size, complexity, and risk profile. Close supervisory attention is required, which means, in most cases, formal enforcement action is necessary to address the problems. Institutions in this group pose a risk to the deposit insurance fund. Failure is a distinct possibility if the problems and weaknesses are not satisfactorily addressed and resolved. Composite 5 Financial institutions in this group exhibit extremely unsafe and unsound practices or conditions; exhibit a critically deficient performance; often contain inadequate risk management practices relative to the institution’s size, complexity, and risk profile; and are of the greatest supervisory concern. The volume and severity of problems are beyond management’s ability or willingness to control or correct. Immediate outside financial or other assistance is needed in order for the financial institution to be viable. Ongoing supervisory attention is necessary. Institutions in this group pose a significant risk to the deposit insurance fund and failure is highly probable.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-24 RMS Manual of Examination Policies Federal Deposit Insurance Corporation Component Ratings Each of the component rating descriptions are divided into an introductory paragraph, a list of principal evaluation factors, and a brief description of each numerical rating. Some of the evaluation factors are reiterated under one or more of the other components to reinforce the interrelationship between components. The evaluation factors for each component rating are in no particular order of importance. Capital Adequacy A financial institution is expected to maintain capital commensurate with the nature and extent of risks to the institution and the ability of management to identify, measure, monitor, and control these risks. The effect of credit, market, and other risks on the institution’s financial condition should be considered when evaluating the adequacy of capital. The types and quantity of risk inherent in an institution’s activities will determine the extent to which it may be necessary to maintain capital at levels above required regulatory minimums to properly reflect the potentially adverse consequences that these risks may have on the institution’s capital. The capital adequacy of an institution is rated based upon, but not limited to, an assessment of the following evaluation factors:

• The level and quality of capital and the overall
  financial condition of the institution;
• The ability of management to address emerging needs
  for additional capital;
• The nature, trend, and volume of problem assets, and
  the adequacy of the allowance for loan and lease losses and other valuation reserves;
• Balance sheet composition, including the nature and
  amount of intangible assets, market risk, concentration risk, and risks associated with nontraditional activities;
• Risk exposure represented by off-balance sheet
  activities;
• The quality and strength of earnings, and the
  reasonableness of dividends;
• Prospects and plans for growth, as well as past
  experience in managing growth; and 2 This sentence was shortened from the similar sentence in the Uniform Financial Institution Rating System (UFIRS).
• Access to capital markets and other sources of capital
  including support provided by a parent holding company. Ratings A rating of 1 indicates a strong capital level relative to the institution’s risk profile. A rating of 2 indicates a satisfactory capital level relative to the financial institution’s risk profile. A rating of 3 indicates a less than satisfactory level of capital that does not fully support the institution’s risk profile. The rating indicates a need for improvement, even if the institution’s capital level exceeds minimum regulatory and statutory requirements. A rating of 4 indicates a deficient level of capital. In light of the institution’s risk profile, viability of the institution may be threatened. Assistance from shareholders or other external sources of financial support may be required. A rating of 5 indicates a critically deficient level of capital such that the institution’s viability is threatened. Immediate assistance from shareholders or other external sources of financial support is required. Asset Quality The asset quality rating reflects the quantity of existing and potential credit risk associated with the loan and investment portfolios, other real estate owned, and other assets, as well as off-balance sheet transactions. The ability of management to identify, measure, monitor, and control credit risk is also reflected here. The evaluation of asset quality should consider the adequacy of the allowance for loan and lease losses and weigh the exposure to counter￾party, issuer, or borrower default under actual or implied contractual agreements. All other risks that may affect the value or marketability of an institution’s assets, including, but not limited to, operating, market, strategic, or compliance risks, should also be considered.2

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-25 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation The asset quality of a financial institution is rated based upon, but not limited to, an assessment of the following evaluation factors:

• The adequacy of underwriting standards, soundness of
  credit administration practices, and appropriateness of risk identification practices;
• The level, distribution, severity, and trend of problem,
  classified, nonaccrual, restructured, delinquent, and nonperforming assets for both on- and off-balance sheet transactions;
• The adequacy of the allowance for loan and lease
  losses and other asset valuation reserves;
• The credit risk arising from or reduced by off-balance
  sheet transactions, such as unfunded commitments, credit derivatives, commercial and standby letters of credit, and lines of credit;
• The diversification and quality of the loan and
  investment portfolios;
• The extent of securities underwriting activities and
  exposure to counter-parties in trading activities;
• The existence of asset concentrations;
• The adequacy of loan and investment policies,
  procedures, and practices;
• The ability of management to properly administer its
  assets, including the timely identification and collection of problem assets;
• The adequacy of internal controls and management
  information systems; and
• The volume and nature of credit-documentation
  exceptions.
  Ratings
  A rating of 1 indicates strong asset quality and credit administration practices. Identified weaknesses are minor in nature and risk exposure is modest in relation to capital protection and management’s abilities. Asset quality in such institutions is of minimal supervisory concern. A rating of 2 indicates satisfactory asset quality and credit administration practices. The level and severity of classifications and other weaknesses warrant a limited level of supervisory attention. Risk exposure is commensurate with capital protection and management’s abilities. A rating of 3 is assigned when asset quality or credit administration practices are less than satisfactory. Trends may be stable or indicate deterioration in asset quality or an 3 This sentence was shortened from the similar sentence in the Uniform Financial Institution Rating System (UFIRS). increase in risk exposure. The level and severity of classified assets, other weaknesses, and risks require an elevated level of supervisory concern. There is generally a need to improve credit administration and risk management practices. A rating of 4 is assigned to financial institutions with deficient asset quality or credit administration practices. The levels of risk and problem assets are significant, inadequately controlled, and subject the financial institution to potential losses that, if left unchecked, may threaten its viability. A rating of 5 represents critically deficient asset quality or credit administration practices that present an imminent threat to the institution’s viability. Management The capability of the board of directors and management, in their respective roles, to identify, measure, monitor, and control the risks of an institution’s activities and to ensure a financial institution’s safe, sound, and efficient operation in compliance with applicable laws and regulations is reflected in this rating. Generally, directors need not be actively involved in day-to-day operations; however, they must provide clear guidance regarding acceptable risk exposure levels and ensure that appropriate policies, procedures, and practices have been established. Senior management is responsible for developing and implementing policies, procedures, and practices that translate the board’s goals, objectives, and risk limits into prudent operating standards. Depending on the nature and scope of an institution’s activities, management practices may need to address some or all of the following risks: credit, market, operating or transaction, strategic, compliance, legal, liquidity, and other risks.3 Sound management practices are demonstrated by:
  active oversight by the board of directors and management; competent personnel; adequate policies, processes, and controls taking into consideration the size and sophistication of the institution; maintenance of an appropriate audit program and internal control environment; and effective risk monitoring and management information systems. This rating should reflect the board and management’s ability as it applies to all aspects of banking operations as well as other financial service activities in which the institution is involved.

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-26 RMS Manual of Examination Policies Federal Deposit Insurance Corporation The capability and performance of management and the board of directors is rated based upon, but not limited to, an assessment of the following evaluation factors:

• The level and quality of oversight and support of all
  institution activities by the board of directors and management;
• The ability of the board of directors and management,
  in their respective roles, to plan for, and respond to, risks that may arise from changing business conditions or the initiation of new activities or products;
• The adequacy of, and conformance with, appropriate
  internal policies and controls addressing the operations and risks of significant activities;
• The accuracy, timeliness, and effectiveness of
  management information and risk monitoring systems appropriate for the institution’s size, complexity, and risk profile;
• The adequacy of audits and internal controls to:
  promote effective operations and reliable financial and regulatory reporting; safeguard assets; and ensure compliance with laws, regulations, and internal policies;
• Compliance with laws and regulations;
• Responsiveness to recommendations from auditors
  and supervisory authorities;
• Management depth and succession;
• The extent that the board of directors and management
  is affected by, or susceptible to, dominant influence or concentration of authority;
• Reasonableness of compensation policies and
  avoidance of self-dealing;
• Demonstrated willingness to serve the legitimate
  banking needs of the community; and
• The overall performance of the institution and its risk
  profile.
  Ratings
  A rating of 1 indicates strong performance by management and the board of directors and strong risk management practices relative to the institution’s size, complexity, and risk profile. All significant risks are consistently and effectively identified, measured, monitored, and controlled. Management and the board have demonstrated the ability to promptly and successfully address existing and potential problems and risks. A rating of 2 indicates satisfactory management and board performance and risk management practices relative to the institution’s size, complexity, and risk profile. Minor weaknesses may exist, but are not material to the safety and soundness of the institution and are being addressed. In general, significant risks and problems are effectively identified, measured, monitored, and controlled. A rating of 3 indicates management and board performance that need improvement or risk management practices that are less than satisfactory given the nature of the institution’s activities. The capabilities of management or the board of directors may be insufficient for the type, size, or condition of the institution. Problems and significant risks may be inadequately identified, measured, monitored, or controlled. A rating of 4 indicates deficient management and board performance or risk management practices that are inadequate considering the nature of an institution’s activities. The level of problems and risk exposure is excessive. Problems and significant risks are inadequately identified, measured, monitored, or controlled and require immediate action by the board and management to preserve the soundness of the institution. Replacing or strengthening management or the board may be necessary. A rating of 5 indicates critically deficient management and board performance or risk management practices. Management and the board of directors have not demonstrated the ability to correct problems and implement appropriate risk management practices. Problems and significant risks are inadequately identified, measured, monitored, or controlled and now threaten the continued viability of the institution. Replacing or strengthening management or the board of directors is necessary. Earnings This rating reflects not only the quantity and trend of earnings, but also factors that may affect the sustainability or quality of earnings. The quantity as well as the quality of earnings can be affected by excessive or inadequately managed credit risk that may result in loan losses and require additions to the ALLL, or by high levels of market risk that may unduly expose an institution’s earnings to volatility in interest rates. The quality of earnings may also be diminished by undue reliance on extraordinary gains, nonrecurring events, or favorable tax effects. Future earnings may be adversely affected by an inability to forecast or control funding and operating expenses, improperly executed or ill-advised business strategies, or poorly managed or
  uncontrolled exposure to other risks. The rating of an institution’s earnings is based upon, but not limited to, an assessment of the following evaluation factors:
• The level of earnings, including trends and stability;

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 RMS Manual of Examination Policies 1.1-27 Basic Examination Concepts and Guidelines (10/2025) Federal Deposit Insurance Corporation

• The ability to provide for adequate capital through
  retained earnings;
• The quality and sources of earnings;
• The level of expenses in relation to operations;
• The adequacy of the budgeting systems, forecasting
  processes, and management information systems in general;
• The adequacy of provisions to maintain the allowance
  for loan and lease losses and other valuation allowance accounts; and
• The earnings exposure to market risk such as interest
  rate, foreign exchange, and price risks.
  Ratings
  A rating of 1 indicates earnings that are strong. Earnings are more than sufficient to support operations and maintain adequate capital and allowance levels after consideration is given to asset quality, growth, and other factors affecting the quality, quantity, and trend of earnings. A rating of 2 indicates earnings that are satisfactory. Earnings are sufficient to support operations and maintain adequate capital and allowance levels after consideration is given to asset quality, growth, and other factors affecting the quality, quantity, and trend of earnings. Earnings that are relatively static, or even experiencing a slight decline, may receive a 2 rating provided the institution’s level of earnings is adequate in view of the assessment factors listed above. A rating of 3 indicates earnings that need to be improved. Earnings may not fully support operations and provide for the accretion of capital and allowance levels in relation to the institution’s overall condition, growth, and other factors affecting the quality, quantity, and trend of earnings. A rating of 4 indicates earnings that are deficient. Earnings are insufficient to support operations and maintain appropriate capital and allowance levels. Institutions so rated may be characterized by erratic fluctuations in net income or net interest margin, the development of significant negative trends, nominal or unsustainable earnings, intermittent losses, or a substantive drop in earnings from the previous years. A rating of 5 indicates earnings that are critically deficient. A financial institution with earnings rated 5 is experiencing losses that represent a distinct threat to its viability through the erosion of capital. Liquidity In evaluating the adequacy of a financial institution’s liquidity position, consideration should be given to the current level and prospective sources of liquidity compared to funding needs, as well as to the adequacy of funds management practices relative to the institution’s size, complexity, and risk profile. In general, funds management practices should ensure that an institution is able to maintain a level of liquidity sufficient to meet its financial obligations in a timely manner and to fulfill the legitimate banking needs of its community. Practices should reflect the ability of the institution to manage unplanned changes in funding sources, as well as react to changes in market conditions that affect the ability to quickly liquidate assets with minimal loss. In addition, funds management practices should ensure that liquidity is not maintained at a high cost, or through undue reliance on funding sources that may not be available in times of financial stress or adverse changes in market conditions. Liquidity is rated based upon, but not limited to, an assessment of the following evaluation factors:
• The adequacy of liquidity sources compared to present
  and future needs and the ability of the institution to meet liquidity needs without adversely affecting its operations or condition;
• The availability of assets readily convertible to cash
  without undue loss;
• Access to money markets and other sources of
  funding;
• The level of diversification of funding sources, both
  on- and off-balance sheet;
• The degree of reliance on short-term, volatile sources
  of funds, including borrowings and brokered deposits, to fund longer-term assets;
• The trend and stability of deposits;
• The ability to securitize and sell certain pools of
  assets; and
• The capability of management to properly identify,
  measure, monitor, and control the institution’s liquidity position, including the effectiveness of funds management strategies, liquidity policies, management information systems, and contingency funding plans. Ratings A rating of 1 indicates strong liquidity levels and well￾developed funds management practices. The institution has reliable access to sufficient sources of funds on favorable terms to meet present and anticipated liquidity needs. A rating of 2 indicates satisfactory liquidity levels and funds management practices. The institution has access to

BASIC EXAMINATION CONCEPTS AND GUIDELINES Section 1.1 Basic Examination Concepts and Guidelines (10/2025) 1.1-28 RMS Manual of Examination Policies Federal Deposit Insurance Corporation sufficient sources of funds on acceptable terms to meet present and anticipated liquidity needs. Modest weaknesses may be evident in funds management practices. A rating of 3 indicates liquidity levels or funds management practices in need of improvement. Institutions rated 3 may lack ready access to funds on reasonable terms or may evidence significant weaknesses in funds management practices. A rating of 4 indicates deficient liquidity levels or inadequate funds management practices. Institutions rated 4 may not have or be able to obtain a sufficient volume of funds on reasonable terms to meet liquidity needs. A rating of 5 indicates liquidity levels or funds management practices so critically deficient that the continued viability of the institution is threatened. Institutions rated 5 require immediate external financial assistance to meet maturing obligations or other liquidity needs. Sensitivity to Market Risk The sensitivity to market risk component reflects the degree to which changes in interest rates, foreign exchange rates, commodity prices, or equity prices can adversely affect a financial institution’s earnings or economic capital. When evaluating this component, consideration should be given to management’s ability to identify, measure, monitor, and control market risk; the institution’s size; the nature and complexity of its activities; and the adequacy of its capital and earnings in relation to its level of market risk exposure. For many institutions, the primary source of market risk arises from nontrading positions and their sensitivity to changes in interest rates. In some larger institutions, foreign operations can be a significant source of market risk. For some institutions, trading activities are a major source of market risk. Market risk is rated based upon, but not limited to, an assessment of the following evaluation factors:

• The sensitivity of the financial institution’s earnings
  or the economic value of its capital to adverse changes in interest rates, foreign exchange rates, commodity prices, or equity prices;
• The ability of management to identify, measure,
  monitor, and control exposure to market risk given the institution’s size, complexity, and risk profile;
• The nature and complexity of interest rate risk
  exposure arising from nontrading positions; and
• Where appropriate, the nature and complexity of
  market risk exposure arising from trading and foreign operations. Ratings A rating of 1 indicates that market risk sensitivity is well controlled and that there is minimal potential that the earnings performance or capital position will be adversely affected. Risk management practices are strong for the size, sophistication, and market risk accepted by the institution. The level of earnings and capital provide substantial support for the degree of market risk taken by the institution. A rating of 2 indicates that market risk sensitivity is adequately controlled and that there is only moderate potential that the earnings performance or capital position will be adversely affected. Risk management practices are satisfactory for the size, sophistication, and market risk accepted by the institution. The level of earnings and capital provide adequate support for the degree of market risk taken by the institution. A rating of 3 indicates that control of market risk sensitivity needs improvement or that there is significant potential that the earnings performance or capital position will be adversely affected. Risk management practices need to be improved given the size, sophistication, and level of market risk accepted by the institution. The level of earnings and capital may not adequately support the degree of market risk taken by the institution. A rating of 4 indicates that control of market risk sensitivity is unacceptable or that there is high potential that the earnings performance or capital position will be adversely affected. Risk management practices are deficient for the size, sophistication, and level of market risk accepted by the institution. The level of earnings and capital provide inadequate support for the degree of market risk taken by the institution. A rating of 5 indicates that control of market risk sensitivity is unacceptable or that the level of market risk taken by the institution is an imminent threat to its viability. Risk management practices are wholly inadequate for the size, sophistication, and level of market risk accepted by the institution.