How to build a compliance monitoring and testing plan for banks 

TL;DR 

• A compliance monitoring and testing plan for banks is a risk-based schedule of which requirements get checked, by whom, how often, and what happens to findings. 
• Monitoring is ongoing first-line self-review. Testing is periodic, independent second-line review. Keep the two separate. 
• Build it in six steps: scope, requirements library, risk ranking, monitoring, testing, and issue management backed by an audit trail. 
• Most failed plans ran on schedule. They failed because of what they never looked at. 
• Nearly every failure is a broken link between an obligation, its control and its evidence. Keep those links current all year. 

Last year’s plan finished on time. Every test closed, the committee signed off, and the findings log was almost empty. That is supposed to be good news. 

Bank of America had a program too. On October 13, 2026, the OCC fined it $750 million, the agency’s largest penalty ever, finding its monitoring system failed to properly monitor trillions of dollars in transactions and its BSA audit function missed long-standing concerns examiners later uncovered. FinCEN assessed $1.2 billion the same day, crediting the OCC’s amount. 

A compliance monitoring and testing plan for banks rarely fails in execution. It fails in what it never looked at, or never looked at hard enough. This guide builds one around that problem, as part of the compliance program your examiners already assess. 

What is a compliance monitoring and testing plan? 

A compliance monitoring and testing plan for banks is a board-approved, risk-based schedule that maps each applicable regulatory requirement to the controls that meet it. It then sets how the first line monitors those controls, how the second line tests them independently, how often, and how findings are fixed, validated and reported. 

It’s one piece of the bank’s compliance management system (CMS), alongside oversight, policies, training and complaint handling. 

Compliance monitoring vs compliance testing: what’s the difference? 

Monitoring is the ongoing review a business line runs on its own activity to catch problems early. Testing is a periodic, independent, sample-based check by compliance that the controls actually work. 

The first two columns get blurred most. When the business monitors and closes its own findings, nobody independent has checked the controls. 

What examiners expect your plan to show 

No regulator publishes a template, but recent guidance points one way. 

• OCC: in Bulletin 2025-24 (October 2025), the OCC said examiners will leverage a community bank’s audit and risk functions when appropriate, once they judge them reliable. Reliable testing means less duplicated exam work. 
• FDIC: its updated exam schedule (November 2025) puts well-rated institutions with $350 million or less in assets on 66 to 78 month cycles. Your own monitoring carries the load between exams. 
• FinCEN: an April 2026 proposed rule says independent AML/CFT testing should focus on effectiveness, use objective criteria, and be run by people truly independent of the AML/CFT function. It’s still a proposal. 

The plan is the evidence your CMS works. 

How to build a compliance monitoring and testing plan for banks in six steps 

Fix the scope, build the library, rank by risk, design monitoring and testing separately, then close the loop. 

Step 1. Set scope, objectives and governance 

Cover the period, entities, business lines, products, channels and regulations. Write testable objectives (“confirm Reg E error-resolution deadlines were met in sampled claims”), not “ensure compliance.” Add the line most plans miss: any process that makes or prepares a compliance decision is in scope, whoever or whatever performs it. The CCO drafts, the Compliance Committee approves. 

Step 2. Build the requirements library and link it to controls 

List every applicable obligation: BSA/AML, OFAC, Reg E, Reg Z, ECOA, UDAAP, fair lending, privacy, flood. Then link each one through the chain that makes it testable: obligation, policy, procedure, control, owner, evidence. An obligation with no control can’t be tested. This step decides whether the rest of the plan is honest. 

Step 3. Rank by risk and set frequency 

Score inherent risk on volume, complexity, consumer harm and regulatory focus, then adjust for control strength. Feed in the risk assessment, RCSA, exam and audit findings, complaints, new products and system changes. A common pattern: high residual risk twice a year, moderate annually, low every two to three years. 

Step 4. Design first-line monitoring 

Decide what runs continuously: alert aging, CTR timeliness, KYC refresh dates, complaint themes, third-party performance, exception reports. Give each monitor a threshold, an owner and an escalation path. AI agents can run many of these checks. Monitoring tells you something changed. It doesn’t prove a control works. 

Step 5. Design second-line tests 

Choose the method by control: transaction testing (sample and re-perform), walkthroughs (procedure versus practice), observation, or analytics over a full population. Write criteria before opening a file. Confirm the population is complete before sampling, because a clean sample from an incomplete population proves nothing. Keep workpapers an examiner could reperform. 

Step 6. Manage issues, keep an audit trail and report 

Log every exception with severity, root cause, owner, due date and required evidence. Compliance re-tests before anything closes. Keep an audit trail of every test, finding, fix and sign-off, so an examiner can follow any result from obligation to evidence. Report monthly to management and quarterly to the board. A plan that escalates nothing for a year isn’t looking hard enough. 

See how banks run dispute resolution with AI agents, with a full audit trail and decision replay built in. Read the BFSI dispute guide: 

Sample compliance monitoring and testing plan 

A few rows of a finished plan look like this. Yours carries one row per material requirement. 

The second row is the coverage check most plans skip. The last row is the one most plans still don’t have. 

Where compliance monitoring and testing plans quietly fail 

Plans rarely fail because tests weren’t run. They fail because the plan stopped matching the bank. 

Coverage gaps 

Products, channels or transaction types that never made it into scope. A new lending partnership can drop out as easily as a payment channel. 

Mappings that age 

The library gets built once and then drifts, though FinCEN’s proposal would require programs to stay current as risk evolves. Today the likeliest missing process is one an AI agent runs, often a shadow AI agent a vendor embedded. Since April 2026, SR 26-2 places agentic AI outside model risk guidance and under the bank’s broader risk management, so it belongs in this plan. 

Testing the procedure, not the outcome 

A walkthrough without a sample proves a document exists, not that anyone follows it. Soft testing ends where Bank of America’s audit function did: missing what examiners later find. 

Stale evidence 

A control passed once and its evidence was never refreshed. Nobody can say what still proves the duty today. 

Self-closed findings 

The business marks remediation complete and nobody re-tests. The OCC said Bank of America’s program “continues to have significant breakdowns” even after the bank committed to fixing its deficiencies. 

The pattern behind every failure: broken links 

These five failures are one problem. The obligation, its policy and procedure, its control and its evidence sit in different places: a regulatory tracker, a GRC inventory, a shared drive, an inbox. Someone links them during plan season, then they drift. 

That’s why testing one control takes weeks. The test is quick; finding which procedure the control belongs to, and whether its evidence is current, is slow. A plan is only as good as the links behind it. 

How Madison keeps your monitoring and testing plan connected 

Madison is Lyzr’s agentic governance, risk and compliance system for banks and credit unions. It holds obligations, policies, procedures, controls and evidence as one connected model, so your plan’s links stay current. 

Agents propose, your people decide. A named reviewer checks each proposed change, and a person attests to it against a specific object version. Madison never remediates on its own and doesn’t determine compliance. Your team does. 

It runs where your data lives. Madison deploys into your own cloud tenancy and reads from core, origination and document systems without writing back to core. 

It covers the processes your plan is adding. Third-party and AI governance is one of Madison’s domains, built on the same objects, so an agent-run process gets the same chain as any other. 

Next November, you don’t rebuild the library. You check three readouts: Are we covered? What are we exposed to? Can we prove it? 

Book a demo to see Madison trace one of your obligations from rule to evidence. 

Before the plan goes to committee 

Reconcile monitored activity against total activity by product and channel; a mismatch is your first finding. Add the scope line for every process that makes a compliance decision. Then trace your five highest-risk obligations to current evidence. Where the chain breaks, your plan is failing. 

Rules will keep moving. A compliance monitoring and testing plan for banks that keeps its links current won’t need rebuilding when they do. 

FAQ 

Book A Demo: Click Here
Join our Slack: Click Here
Link to our GitHub: Click Here