Most fintechs, lenders, and community banks first meet a CFPB exam as a long list of requests. By then, the time to be ready was well over a year ago. So we built this workbook, the same one we use with design partners to get ready. Score honestly. Where you fall short, fix it with a workflow instead of another spreadsheet.
How examiners actually grade.
The exam manual is public. The way examiners weight it is not. We have spent time with former examiners and with CCOs who have lived through several exams. They all tell us the same thing: examiners are pattern-matchers, not auditors. Their first questions are about how you handle complaints, because complaints reveal whether the rest of your program is real.
If your complaint workflow is an inbox with hand-written tags, the rest of the exam goes badly. A thick policy manual will not save it. But if complaints run through a queue with named owners, SLAs, root-cause linkage, and a feedback loop into testing, the exam tends to go well. That holds even when your policy manual is thinner than the consultants told you it should be.
The domains they weight.
Every CFPB exam, regardless of product type, touches the same program domains. Most teams over-invest in one or two and under-invest in the rest. So the assessment distributes attention roughly the way examiners do, which is more evenly than most compliance leaders assume. Treat the relative weights below as directional guides rather than precise scores.
| Complaint Management | Intake, triage, root-cause & regulator visibility | HEAVIEST |
|---|---|---|
| UDAAP Risk | Marketing claims, billing accuracy, fee transparency | high |
| Fair Lending | ECOA/HMDA/Reg B, tested on a schedule | high |
| BSA/AML | Program, monitoring, and OFAC screening | high |
| Servicing & Billing | Statement accuracy, error resolution, SCRA | moderate |
| Third-Party Oversight | Vendor due diligence and ongoing monitoring | moderate |
| Governance | Policies, board reporting, and issue tracking | moderate |
What the score means.
Score each domain honestly against the anchored questions in the workbook. A strong program shows named owners, SLAs, evidence, and a feedback loop in every domain. A watch program has the workflow but not the evidence. An at-risk program is still running on spreadsheets and good intentions.
The number matters less than the shortlist of gaps you walk away with, and the order you close them in. Then re-score quarterly. The trend tells you whether the program is getting more defensible or just busier.
Where Guardial fits in.
Each domain maps to a workflow in Guardial. So the assessment doubles as a to-do list with a home.
- Complaints
- The Complaint Triage agent classifies and routes; findings live in Issues Home.
- UDAAP & fair lending
- Automated Compliance Monitoring runs the tests and opens an issue when a threshold breaks.
- Third-party oversight
- Third-Party Risk holds the DDQs and renewals.
- Governance
- Policies, board reporting, and every issue in one cross-module Issues Home.
Agents draft the first pass in each area, and a named person approves before anything takes effect. The audit trail is the program.