What a $2bn Bank Spends on Regulatory Reporting That a $20bn Bank Does Not

The benchmark answers the wrong question

Ask what regulatory reporting costs a bank your size and you will get two kinds of answer. The first is a benchmark showing that small banks pay more for compliance as a share of expense than large ones. The second is a software demo that promises to close the gap.

The benchmark is right. The demo is aimed at the wrong line item.

The cost a 2 billion dollar bank carries and a 20 billion dollar bank does not is not a form, a filing fee, or a reporting tool. It is a person. Specifically, it is the senior generalist who owns the Call Report, HMDA, CRA, and the exam response at the same time, and whose hours are charged to none of them. At 20 billion dollars that work is four roles, each with a backup. At 2 billion it is one person with none.

That is why the expense never appears where a CFO would look for it. It shows up as risk, not as cost, until the day it shows up as both.

What the regulators have already measured

The scale effect is not a vendor claim. The Federal Reserve Bank of St. Louis analysed survey data from community banks collected with the Conference of State Bank Supervisors and found that compliance costs fell steadily as a share of noninterest expense as banks got larger: 8.7 percent at banks under 100 million dollars in assets, 4.2 percent between 500 million and 1 billion, and 2.9 percent between 1 and 10 billion.

The same analysis found that personnel was by far the largest category at every size, more than 60 percent of total compliance expense. A decade of follow-on CSBS survey data points the same way: smaller banks attribute 11 to 15.5 percent of personnel expense to compliance, against 5.6 to 9.6 percent at larger institutions, and consulting spend diverges most of all.

Read those two findings together and the shape of the problem is clear. Compliance is mostly people. Small banks cannot divide people into fractions. So a bank below the scale where a function justifies a dedicated role does not get a cheaper version of that role. It gets someone else's time.

Regulators have conceded part of this in rulemaking, too. Banks with domestic offices only and under 5 billion dollars in assets can file the streamlined FFIEC 051 Call Report, which cut roughly 37 percent of reportable data items in the first and third quarters. That relief is real. It also tells you what the agencies think the burden is: the form. The form was never the expensive part.

Where the hours actually go

A filing is the last hour of a long chain. Before it, somebody reconciles the general ledger to the regulatory schedules, chases the loan system for the fields it does not map cleanly, explains the variance from last quarter, and answers the three follow-up questions from the examiner who noticed a line moved.

At a 20 billion dollar bank, that chain has owners. Regulatory reporting sits in finance. HMDA data integrity sits in mortgage operations or compliance. CRA has an officer and usually an analyst. Exam management has a coordinator. Each of those people has a named backup and a documented procedure, because the institution is large enough that losing one person for a quarter is a scheduling problem, not an event.

At a 2 billion dollar bank, the same obligations exist, and most of them sit on one desk. Often it is a controller or a compliance officer who has been there fifteen years, who built the spreadsheets that bridge the core to the schedules, and who knows which HMDA fields the loan origination system fills wrong. Nobody asked them to become the reporting function. It accreted.

This is the cost that does not appear in any benchmark. Their salary is booked to finance or compliance. Their time on HMDA is invisible because it is spread across the week. Their time on exam response is invisible because it happens in bursts. And the knowledge that makes all of it work is stored nowhere except in them.

Why it is priced as risk and not as expense

A cost that shows up only when it fails is easy to underprice. Here is what failure looks like.

The person leaves, retires, or goes on extended leave in the six weeks before a filing. The bank discovers that the reconciliation logic lives in a workbook with formulas that reference a tab nobody else understands. An outside firm is brought in at consulting rates to reconstruct it, which is exactly the category the CSBS data shows small banks overspend on. The filing goes in, probably correctly. The next exam asks about controls over regulatory reporting, and the honest answer is that the control was a person.

None of that is a fine. Most of it is not even a finding. It is a quarter of distraction, a consulting invoice, and a management team that learns how thin the function was by watching it bend. The 20 billion dollar bank pays for four roles and four backups every year so it never has that quarter. The 2 billion dollar bank pays nothing every year until it does.

That is the actual spread between the two. Not the percentage in the benchmark, but the difference between a cost carried in the budget and a cost carried on one person's calendar.

Why software does not close the gap on its own

Reporting automation vendors will tell you that a regulatory reporting platform removes the key person. Sometimes it helps. It rarely removes them.

The reason is where the knowledge sits. Software can automate the mapping from ledger to schedule once someone has told it what the mapping is. It can validate edits and flag variances. What it cannot do is decide why a variance happened, which is the question the examiner asks. At a 2 billion dollar bank, the only person qualified to configure the platform is the same person the platform was bought to replace. The project goes onto their desk, on top of the work it was meant to relieve.

We see the same pattern in credit union data projects: the tool is sold as the fix for a problem that is really about a record nobody owns. And as with any automation business case, the return calculation only holds if it counts the hours of the one person who has to make it work. It usually does not.

This is not an argument against reporting software. It is an argument about sequence. Buy it before the knowledge is out of one head and you have automated a dependency rather than removed it. There is a certain irony in a function called Call Report that depends on nobody calling in sick.

The question to ask instead

The useful question for a bank between 1 and 10 billion dollars is not what reporting costs. It is how many of your regulatory obligations would be delivered on time, and explained correctly, if one named person were unavailable for ninety days.

An executive team can usually answer it quickly, and the answer is often uncomfortable. That answer is worth more than any benchmark, because it prices the thing the benchmark cannot see.

From there, the decisions are genuinely specific to the institution. Which obligations can be documented and cross-trained cheaply. Which ones justify a second person, and which should go to an outsourced provider with its own continuity. Where a reporting platform earns its fee and where it would just move the bottleneck. Whether the bank's growth plan is about to push it past the 5 billion dollar line where the streamlined Call Report stops applying, which adds work at precisely the moment the function is most stretched.

Those answers depend on your core, your loan systems, your exam history, and the person at the center of all of it. An article can name the pattern. It cannot sit with your controller for a week and find out how much of the bank's reporting lives in their head. If you are the institution we just described, the same mechanism shows up in other places, from which parts of onboarding to automate last to which controls should never be automated at all.

If your regulatory reporting has a single point of failure and you want to know what it would cost to fix before it costs you a quarter, let's talk it through.