Preparing for an OCC examination in 2026 means building evidence, not assembling a binder. Examiners are now directed to focus on material financial risks and to support findings with objective facts, so the institutions that fare best can show quickly how a risk decision was made, who approved it, and what data stood behind it. This guide covers the exam cycle, what changed in 2026, the records worth having ready, a 90-day plan and what to do if you disagree with a finding.
A note on scope: the OCC supervises national banks and federal savings associations. Federally insured credit unions are examined by the NCUA, but the discipline described here (documentation, model governance, traceable data) applies equally to credit union risk teams, and many credit unions partner with or compete against OCC-supervised banks for the same loans.
TL;DR
Automate Regulatory Model Risk Governance
Examine models against 32 qualitative criteria and resolve risk Tiers with pre-deployment checklists per OCC 2011-12 guidelines.
- Full-scope, on-site exams run on a 12 or 18 month cycle under 12 USC 1820(d), so preparation should be continuous rather than a pre-exam sprint.
- Since January 1, 2026, community bank exams drop mandatory activities not required by statute or regulation and scale to size, complexity and risk profile.
- Revised PPM 5400-11 requires that Matters Requiring Attention rest on facts and sound reasoning, which makes your own audit-ready records your best defense.
- If you disagree with a finding, the informal appeal window is 10 calendar days, so know the process before you need it.
Table of Contents
- What an OCC examination actually tests
- What changed in 2026 and why it affects your preparation
- The records examiners reach for first
- A 90-day preparation plan
- Our perspective: exams reward traceability, not volume
- Where RiskInMind fits
- If you disagree with a finding
- FAQ
- Sources
What an OCC examination actually tests
The OCC describes examinations as fundamental to supervision: examiners evaluate bank activities and management processes to confirm that the bank operates safely and soundly, does not take excessive risk, and complies with laws and regulations. In practice that translates into a review of financial condition, risk management, and compliance, with the depth of testing set by the bank's size, complexity and supervisory status.
For national banks, 12 USC 1820(d) requires a full-scope, on-site examination of each insured depository institution every 12 or 18 months, and the OCC applies that requirement according to the bank's characteristics. Between those cycles, supervisory offices continue to monitor you, which means an examiner's picture of your bank is formed over the whole year, not only during fieldwork.
The practical consequence is simple. Whatever an examiner might ask for in week one of fieldwork should already exist, be current, and be retrievable by someone other than the one analyst who built it.
What changed in 2026 and why it affects your preparation
Two OCC bulletins reshape the environment, and both reward institutions that can document their reasoning.
Community bank exams are more risk-proportionate
Effective January 1, 2026, the OCC updated its policies to eliminate mandatory examination activities not required by statute or regulation, with the stated aim of reducing supervisory burden on community banks. Examiners tailor procedures to each institution, which allows streamlined testing and, where appropriate, reliance on bank-provided reports.
That last point deserves attention. Reliance on bank-provided reports is a privilege that depends on the reports being trustworthy. If an examiner is going to lean on your concentration report, your allowance schedule or your delinquency aging, the lineage of that report has to withstand a question like "where did this number come from?" Our piece on audit-ready data lineage describes how to start with one report and trace it end to end.
Matters Requiring Attention face a higher evidentiary bar
On August 27, 2026, the OCC released revised policies and procedures manuals, including revised PPM 5400-11, which governs MRAs. The bulletin states that the revised manual replaces the version issued on February 27, 2026, and that it ties to a joint OCC and FDIC final rule defining "unsafe or unsound practice." It also says examiners and institutions should prioritize material financial risks over concerns about policies, process, documentation and similar matters.
For violations of law, the PPM itself requires an MRA to include the legal citation and the supporting facts, such as dates or date ranges, dollar amounts and duration. Read that as a preview of your own file. If an examiner must state facts to cite you, you should hold the same facts, organized, before they arrive.
This does not mean documentation matters less. It means the documentation that counts is the kind that demonstrates how you identify, measure and control material risks, not volume for its own sake.
The records examiners reach for first
Exam request lists differ by bank, so treat the following as the core evidence set that supports most conversations, rather than a universal list. Where the OCC has not specified an item, this is our view of good practice.
Credit risk and underwriting. Current credit policy, exception reports with approvals, a sample of credit files showing the analysis behind each decision, and the portfolio reports that management and the board actually read. The credit memo is where reasoning lives, so consistency of memo structure across analysts is a quiet but real signal of control. See our guide to risk management documentation standards for what a defensible file contains.
Allowance and CECL. Data inputs, assumptions, qualitative adjustments, and the reconciliation from model output to booked reserve. Examiners will ask why an assumption changed, so the change log matters as much as the model. Our CECL data checklist lists the inputs worth confirming before fieldwork.
BSA/AML. Evidence that transaction monitoring works as intended: alert volumes, tuning decisions with rationale, and any vendor changes. We lay out a 90-day BSA/AML monitoring checklist for the period before an exam.
Compliance management. Regulatory change logs showing who reviewed each new requirement, what was decided, and when. Compliance accuracy is easiest to defend when every change leaves a trail.
Stress testing and capital planning. Scenario definitions, variable mappings and results presented to the board. If you work with supervisory scenarios, our walk-through of mapping 28 supervisory variables shows how to keep the mapping traceable.
Governance. Board and committee minutes that show challenge, not only approval. The OCC's Director's Book is the right reference for what directors are expected to oversee, and it is worth a reread by the board before exam week.
Models and AI tools. A current inventory of models, including those embedded in vendor products, with purpose, inputs, owner and validation status. As more banks use AI for underwriting and monitoring, expect questions about how outputs are reviewed by humans and logged.
A 90-day preparation plan
The cycle is 12 to 18 months, so you rarely get a surprise on timing, but you may get a short notice window for the request list. A 90-day rhythm keeps the work manageable.
Days 1 to 30: Find the gaps
Pull your last report of examination, any open MRAs, internal audit findings and regulatory commitments into a single tracker. For each open item, record the owner, the evidence of remediation and the date it was validated. Items closed on paper but not in practice are the ones that turn into repeat findings.
Then test retrievability. Ask someone outside the function that owns a report to reproduce it from source data. Where they cannot, you have found a lineage gap, which is cheaper to fix now than during fieldwork.
Days 31 to 60: Close the evidence
Focus on the material risks first, in line with the 2026 supervisory emphasis: credit quality and concentrations, liquidity and funding, interest rate risk, allowance adequacy, and BSA/AML where your profile warrants. For each, confirm that a current report exists, that management challenged it and that the challenge is minuted.
Refresh policies only where they are out of date or out of step with practice. A policy that describes a process you no longer follow is worse than a shorter policy that is accurate.
Days 61 to 90: Rehearse and organize
Run a mock request cycle. Assign a single point of contact, set a response standard and test it against a realistic list. Brief the board and senior management on the top risks, the open items and how each will be explained. Prepare a plain-language one-page summary of each material risk for examiners, with a pointer to the underlying evidence.
Our step-by-step risk assessment guide and the piece on closing audit gaps in one quarter go deeper on this phase.
Our perspective: exams reward traceability, not volume
We build risk software for credit unions, community banks and lenders, and the pattern we see in this topic is consistent: the pain in exam preparation is rarely the absence of a policy. It is the hours spent reconstructing how a figure, a decision or a regulatory interpretation was reached, usually from email, spreadsheets and memory.
The 2026 changes sharpen that point. When examiners are expected to cite facts and prioritize material financial risk, the institution that can produce a clean chain from source data to board report to decision has a structurally easier conversation. The one that cannot is asking examiners to take its word for things, which is precisely what a risk-based approach tries to avoid.
This is why we design around granular audit trails, real-time processing with response times under half a second, and a security posture that includes SOC 2® certification and no third-party exposure of your data. Automation helps only if it is explainable. Every AI-generated credit memo, compliance check or reserve calculation should carry its inputs, its reviewer and its timestamp, so that an examiner's question becomes a lookup, not a project. Our piece on audit-ready AI orchestration covers the architecture we think that requires.
Our advice to risk leaders is to treat exam readiness as an operating state. Choose the five reports an examiner is most likely to rely on, make their lineage provable, and expand from there.
— Raj
Where RiskInMind fits
If your team spends exam season assembling evidence by hand, our platform is built to produce it as a by-product of normal work. Specialized AI agents handle credit risk assessment, regulatory compliance and market analysis under a central director named Ava, while tools such as the AI credit memo generator and the document generator keep underwriting files consistent and traceable. Plans are listed on our pricing page, and you can see the full product range, including CECL modeling and the Regulatory Agent, on riskinmind.ai. For a view of how this supports supervisory conversations, read our article on AI exam readiness and bank market analysis.
If you disagree with a finding
Preparation includes knowing your options. The OCC's Bank Appeals Process provides an independent avenue for appealing certain supervisory actions, with deadlines that are short:
| Step | Deadline |
|---|---|
| Informal appeal to the supervisory office | 10 calendar days from the agency decision |
| Formal appeal to the deputy comptroller or Ombudsman | 60 calendar days |
| Second-tier appeal to the Ombudsman | 15 calendar days from receiving the appeal decision |
All appeals require written board approval, so decide in advance who will brief the board and how quickly a meeting can be convened. The OCC also stresses that the process is meant as a last resort and encourages early, informal resolution, including early conversations with the Ombudsman. In our experience of how institutions approach these situations, the strongest position comes from a precise factual rebuttal, which is where the records described above pay off. Reviewing published appeal summaries gives a sense of the kinds of disputes that have been raised.
For banks under heightened supervision, the Comptroller's Handbook booklet on problem bank supervision explains how examiners approach those institutions.
FAQ
What is an OCC exam?
It is a mandatory supervisory review of a national bank or federal savings association, covering its financial condition, risk management and compliance with law. Under 12 USC 1820(d), full-scope on-site exams occur every 12 or 18 months, depending on the bank's size, complexity and supervisory status.
How long before an exam should we start preparing?
Continuously, but a 90-day focused push is a sensible minimum for closing evidence gaps and rehearsing the request process. Because the cycle is 12 to 18 months, you can calendar the window and work backward from it.
Did anything change for community banks in 2026?
Yes. Effective January 1, 2026, the OCC eliminated mandatory exam activities not required by statute or regulation and moved to tailored, risk-based procedures. Examiners may rely on bank-provided reports where appropriate, so report accuracy and lineage matter more.
What is a Matter Requiring Attention?
An MRA is a supervisory communication about a practice or condition that the OCC expects management to correct. Revised PPM 5400-11, announced in August 2026, requires that MRAs be grounded in objective facts and sound reasoning, and for violations of law that they include the legal citation and supporting facts.
Can we appeal an examination finding?
Yes. Informal appeals go to the supervisory office within 10 calendar days, formal appeals within 60 calendar days, and second-tier appeals within 15 calendar days of the appeal decision. Written board approval is required, so confirm your internal approval path now.
Sources
- Examinations Overview, OCC
- Director's Book: Role of Directors for National Banks and Federal Savings Associations, OCC
- Examinations: Frequency and Scope for Community Banks, OCC Bulletin 2025-24
- Matters Requiring Attention: Revised Policies and Procedures Manuals, OCC Bulletin 2026-41
- PPM 5400-11, Matters Requiring Attention, OCC
- Bank Appeals Process, OCC
- Bank Appeals Summaries, OCC
- Problem Bank Supervision, Comptroller's Handbook, OCC