Why Compliance Costs Small Banks 3x More, and the Part You Can Fix

October 31, 2026
Reading Time: 6 minutes

Listen to this blog

In an October 12 op-ed in The Washington Post, former House Financial Services Committee chairman Jeb Hensarling and Hudson Institute fellow Michael Solon argued that the 2010 Dodd-Frank Act has choked off new bank formation. By their analysis of FDIC data, an average of 149 new banks were chartered each year from 1990 until the 2008 crisis. From 2011 to 2025, the average was five.

You don’t have to share their politics to recognize one line they quote. Barney Frank, who co-wrote the law, once said that “small banks are spending too much money to show that they are in compliance.”

He said it in a 2016 interview, about the Volcker Rule, which limits proprietary trading. Few small banks did that kind of trading. They still paid to prove they didn’t.

That gap between doing the right thing and proving you did it is where a lot of compliance cost sits. It’s also the part a bank’s delivery teams can do something about.

Wichtige Erkenntnisse

What you'll learn in this article

The 3x gap: why compliance is largely a fixed cost, and why small banks carry it with far fewer people.
Where the hours go: the recurring effort of linking obligations, requirements, approvals and test results.
Why bigger banks pay too: DORA, PCI DSS 4.x, NYDFS Part 500 and Section 1071 raise the same evidence burden at scale.
How to make proof a by-product: five habits that keep the record current while the work happens.
How Modern Requirements helps: making compliance demonstrable inside Azure DevOps.

The 3x gap is a scale problem

Economists at the Federal Reserve Bank of St. Louis studied 2014 compliance spending at 469 community banks. Banks with less than $100 million in assets spent an average of 8.7 percent of their noninterest expenses on compliance. Banks with $1 billion to $10 billion spent 2.9 percent. Personnel made up more than 60 percent of compliance spending in every size group.

A regulation asks every bank for the same things: a policy, a control that implements it, a test showing the control works and a record an examiner can sample. A $90 million bank has to produce all of that just like a $9 billion bank, with far fewer people to share the work.

One more finding is easy to miss. Spending more didn’t earn the smaller banks better management ratings from supervisors. The authors suggested results depend less on how much a bank spends than on how well it focuses oversight.

Where the hours actually go

Interpreting a rule is real work, but it mostly happens once. The recurring effort goes into connecting things:

Which requirement implements this obligation?
Which change touched that requirement last quarter, and who approved it?
Which test proves the control works, and is that result from the current release?

At many institutions those links live in a mapping spreadsheet, a policy PDF and a change log. They only meet during exam prep, when someone spends weeks rebuilding the thread by hand. Then something changes and the thread goes stale again.

That’s what makes proof a fixed cost. You pay it every exam cycle, and again every time a new rule lands.

Bigger banks pay it too

Larger institutions face the same pattern at scale. DORA, PCI DSS 4.x and NYDFS Part 500 each arrive as obligations that have to become requirements across many systems. The CFPB’s revised Section 1071 rule, itself a Dodd-Frank provision, has covered lenders collecting small business lending data from January 1, 2028.

In July the House passed the Main Street Capital Access Act, which would tailor regulation to bank size. It still has to clear the Senate. But tailoring only changes which rules apply to you. You still have to show your work on the ones that do.

Make proof a by-product of the work

Teams that keep this cost down tend to share a few habits:

Obligations are captured as structured items with their source clause, not as paragraphs in a PDF.
Obligations are linked to requirements, controls and tests while the work happens, not at audit time.
A baseline is frozen at every release, so you can show what was true on a given date.
Segregation of duties is enforced in the workflow, so the approval trail builds itself.
Exam reports are generated from the live record instead of assembled by hand.

None of this needs a bigger compliance team. It needs the record to live where the engineering work already happens.

How Modern Requirements helps

Modern Requirements4DevOps runs natively in Azure DevOps, in your own tenancy or on Azure DevOps Server on-premises. Obligation registers and control narratives are written in Smart Docs, where every clause is a traceable, versioned work item. Trace matrices are built from live link data and reach down to test execution. Immutable release baselines can be compared with difference reports. Reviews carry e-signatures tied to the item version, and Smart Report turns the same data into control, trace and exam reports.

Compliance4DevOps adds the compliance layer. Teams manage the standards and clauses they’re held to, including internal policies, map evidence from their Azure DevOps work, assess clause by clause and generate a point-in-time audit package.

Neither product makes a bank compliant. They make compliance demonstrable without a war room before every exam. Our Banking and Finance page shows how that works for DORA, SOX ITGC and model risk.

The debate will go on. So will the evidence burden.

Not everyone accepts the op-ed’s diagnosis. A Kansas City Fed paper found new charters had been rebounding to lower peaks since 1983, long before Dodd-Frank. Whoever is right about the cause, examiners will keep asking banks of every size the same thing: show me. The cheapest way to answer is to have the answer ready.

Frequently asked questions

Why do small banks pay more for compliance?

Much of compliance is a fixed cost. A St. Louis Fed study of 2014 data found banks under $100 million in assets spent 8.7 percent of noninterest expenses on compliance, against 2.9 percent for banks with $1 billion to $10 billion.

What is the cost of proving compliance?

It’s the effort of showing that controls exist and work: linking obligations, requirements, approvals and test results, then assembling that evidence for examiners.

Does requirements management software make a bank compliant?

No. Compliance stays the bank’s responsibility. Modern Requirements4DevOps and Compliance4DevOps make it demonstrable by keeping obligations, requirements, approvals and test evidence linked inside Azure DevOps.

Beginnen Sie noch heute mit der Nutzung von Modern Requirements.

✅ Definieren, verwalten und verfolgen Sie Anforderungen innerhalb von Azure DevOps
✅ Arbeiten Sie nahtlos mit regulierten Teams zusammen
✅ Starten Sie KOSTENLOS – keine Kreditkarte erforderlich

Demo buchen