In September 2026, the FDIC and DOJ issued five enforcement actions highlighting governance failures at the board and executive level. A former bank CEO received a 112-month prison sentence for insider abuse and sanctions conspiracy. Three separate FDIC orders required boards to increase meeting frequency, assess management capabilities, and add independent directors with banking expertise.
This isn't a compliance trend you can delegate. When regulators mandate monthly board meetings and formal assessments of director competencies, they're signaling that passive oversight is no longer acceptable.
What This Checklist Covers
Use this checklist to evaluate whether your board and senior management structure meets current regulatory expectations for active oversight. Each item reflects requirements or findings from recent enforcement actions. You'll know you're done when you can produce documentation for each control and demonstrate that your board reviews the right information at the right frequency.
Prerequisites
Before starting this checklist, confirm you have:
- Access to board meeting minutes for the past 12 months
- Current organizational chart showing all senior executive officers and directors
- Most recent examination report and any outstanding supervisory findings
- Board package templates or materials distributed before each meeting
- Written position descriptions for board members and senior officers
Board Composition and Qualification
☐ Independent director assessment completed within past 12 months
Your board must include directors who are independent of management. Document how many current directors qualify as independent (no employment relationship, no material business relationships, no family ties to management). Ensure you have a written independence analysis for each director updated annually, with board minutes showing discussion of any potential conflicts.
☐ Banking and risk management expertise documented for each director
Regulators expect directors to have substantial banking and risk management experience. Create a skills matrix that maps each director's background against core competencies: credit risk, operational risk, compliance, financial reporting, IT governance. Review this matrix annually to identify gaps and drive recruitment priorities, with documented evidence supporting each competency claim.
☐ Staffing assessment covers both management and directors
Don't limit your capability review to executives. Recent orders require boards to assess the competencies and effectiveness of senior management and directors. Conduct an annual board self-assessment process that evaluates individual director contributions, attendance, preparation, and expertise, coupled with a management assessment that maps senior officer capabilities against strategic priorities and risk profile.
☐ Board-approved staffing plan addresses identified weaknesses
If your assessment reveals gaps, you need a written plan. Ensure board minutes show approval of a staffing plan that identifies specific skill deficiencies, sets timelines for adding qualified directors or officers, and assigns responsibility for recruitment and onboarding.
Board Meeting Frequency and Content
☐ Board meets at least monthly
Multiple September 2026 orders required boards to increase meeting frequency to monthly. Maintain a board calendar showing scheduled monthly meetings for the next 12 months, with documented attendance records demonstrating consistent participation from all directors.
☐ Board package includes delinquent and classified loans
Your board needs detailed credit data, not just summary reports. Include lists of all loans past due 30+ days, all classified loans (substandard, doubtful, loss), insider loans, and charged-off amounts in your board package, with trend analysis comparing current period to prior periods.
☐ Board reviews audit reports and internal control findings
Document board minutes that show discussion of each internal audit report, external audit management letter, and examination finding, with specific actions assigned to management and follow-up dates established.
☐ Board minutes evidence discussion and dissent
Regulators look for proof that directors are engaged, not just present. Ensure minutes capture questions directors asked, concerns raised, dissenting votes, and decisions to table items pending additional information. Avoid minutes that read like rubber-stamp approvals.
Senior Management Oversight
☐ Written authority delegated to management for order compliance
If you're operating under an enforcement action, management needs explicit authority to implement it. Have a board resolution that delegates specific authority to the CEO or compliance officer to take actions required by the order, with clear reporting lines back to the board on progress.
☐ Regulator approval obtained before hiring directors or senior officers
Recent orders require written regulator approval before adding any director or senior executive officer. Establish a documented process requiring compliance or legal to submit hiring proposals to regulators 30+ days before the anticipated start date, with written approval on file before the individual begins service.
☐ Qualified BSA Officer retained with direct board reporting line
The September 2026 amended order required a qualified Bank Secrecy Act Officer to oversee all aspects of its AML/CFT program. Ensure the BSA Officer's position description shows they report to the board (or board committee) as well as management, with documented quarterly reporting to the board on AML/CFT program effectiveness, suspicious activity trends, and regulatory changes.
Personal Accountability Controls
☐ Related-party transaction review process includes beneficial ownership analysis
The DOJ case involved a CEO and board chairman who concealed that certain investments and loans benefited themselves. Submit a quarterly related-party transaction report to the audit committee or full board that identifies not just direct loans to insiders, but also loans to entities where insiders hold beneficial ownership, with independent review by counsel or external auditor.
☐ OFAC authorization documented for any sanctioned party transactions
The CEO in the DOJ case arranged a foreclosure and resale involving an OFAC-designated individual, with only partial authorization. Implement a documented workflow requiring legal review and written OFAC license for any transaction involving a sanctioned party or their collateral, with licenses attached to the transaction file and periodic audits confirming no unauthorized sanctions-related activity occurred.
Common Mistakes
Treating board assessments as a one-time exercise. Regulators expect annual reassessment of board composition and management capabilities. Build this into your governance calendar as a recurring control, not a response to an examination finding.
Writing board minutes that protect against liability instead of demonstrating oversight. Minutes that say "the board reviewed and approved" without capturing discussion, questions, or dissent won't satisfy examiners looking for evidence of active participation.
Assuming your BSA Officer has sufficient authority. If your BSA Officer reports only to the CFO or COO, you may not meet the "qualified" standard regulators are enforcing. Direct board reporting and adequate resources matter.
Skipping the beneficial ownership analysis on insider loans. Reviewing only direct loans to directors and officers misses the concealment risk. Map family relationships, business entities, and beneficial ownership for any loan above your insider lending threshold.
Next Steps
If you checked fewer than 10 of the 11 items, prioritize the gaps that relate to board composition and meeting content. Those are the findings regulators are writing orders about right now.
If you're operating under an existing consent order or memorandum of understanding, cross-reference this checklist against your order's specific requirements. Any conflict between this checklist and your order means your order controls.
Schedule a board discussion of this checklist within the next 60 days. Don't wait for your next examination to discover that your governance structure doesn't meet current expectations.
