BANK REGULATORY REVIEWS:

Report to Congressional Committees

July 2026

GAO-26-108027

United States Government Accountability Office

A report to congressional committees.

For more information, contact: Michael E. Clements at clementsm@gao.gov.

What GAO Found

The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) requires the federal banking agencies to solicit and review public comments on their regulations to identify and eliminate outdated, unnecessary, or unduly burdensome regulations on insured depository institutions, as appropriate.

Outcomes from the EGRPRA reviews are often difficult to identify, and their connection to subsequent regulatory actions is often unclear. As a result, it can be difficult to determine the extent to which actions described in the EGRPRA report were driven by the review itself. For example, some actions described in the 2017 EGRPRA report were initiated in response to other statutory requirements, while other actions were initiated before or concurrently with the review. Representatives from six of eight organizations GAO interviewed said the reviews do not often lead to actions to modify or eliminate unnecessary regulations, and a public interest group representative noted that it is difficult to connect the EGRPRA reviews with concrete regulatory changes.

Another reason EGRPRA reviews’ outcomes are unclear is that the agencies do not have documented procedures for identifying outdated or unnecessary regulations or determining whether issues raised in the reviews warrant action. Two agencies have draft procedures that could help address these gaps, but they have not yet been fully developed or demonstrated in practice. Implementing documented procedures would help ensure that issues identified through the review are systematically evaluated and lead to clear determinations about whether they warrant action and, where appropriate, regulatory changes. Having documented procedures also is important given the long time frame between EGRPRA reviews.

Additionally, the agencies’ EGRPRA review processes reflect some leading practices for retrospective regulatory reviews, such as coordinating across agencies and soliciting public input, but do not fully reflect others. In particular, the agencies have not incorporated practices related to prioritizing which rules to analyze, conducting cost-benefit analysis, and assessing the combined burden of multiple regulations. As a result, they may not consistently focus on the most significant issues, assess regulatory impacts and trade-offs, or understand how multiple regulations collectively affect regulated entities.

Why GAO Did This Study

EGRPRA requires the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency to review their regulations at least once every 10 years and submit a joint report to Congress. As of July 2026, the agencies were conducting their third such review.

The Dodd-Frank Wall Street Reform and Consumer Protection Act includes a provision for GAO to report annually on financial services regulations. This report examines (1) how the federal banking agencies have conducted their EGRPRA reviews, (2) the outcomes of those reviews, and (3) the extent to which they reflect leading practices.

GAO reviewed reports by federal agencies; examined available documentation from the previous and current EGRPRA reviews, guidance, and regulations issued by the federal banking agencies; and interviewed agency officials and eight organizations selected because they submitted EGRPRA comments in the previous and current reviews.

What GAO Recommends

GAO is making six recommendations, specifically that each federal banking agency should (1) implement procedures for identifying outdated, unnecessary, or unduly burdensome regulations and taking actions to address them during their EGRPRA reviews; and (2) incorporate into these reviews a framework for prioritizing rules for retrospective analysis, cost-benefit analysis, and assessment of cumulative regulatory burden. While the agencies outlined some actions they have taken, they neither agreed nor disagreed with the recommendations.

 

 

 

ACUS                          Administrative Conference of the United States

CFPB                          Consumer Financial Protection Bureau

EGRPRA                     Economic Growth and Regulatory Paperwork Reduction Act of 1996

FDIC                            Federal Deposit Insurance Corporation

Federal Reserve         Board of Governors of the Federal Reserve System

FFIEC                          Federal Financial Institutions Examination Council

NCUA                          National Credit Union Administration

OCC                            Office of the Comptroller of the Currency

OMB                            Office of Management and Budget

 

July 23, 2026

Congressional Committees

Regulation is one of the principal tools the federal government uses to implement public policy. Following the 2007–2009 financial crisis, federal financial regulators issued hundreds of regulations to promote market stability and protect consumers, including 520 final rules from 2010 through 2016.[1] Although regulations may produce substantial benefits, they also can impose significant costs and, without careful oversight once implemented, may become outdated or create unnecessary burdens.

Retrospective regulatory reviews are a formal way for agencies to evaluate whether regulations have had their intended effects and whether changes may be warranted to better achieve benefits or reduce burden on regulated entities. The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) directs the Federal Financial Institutions Examination Council (FFIEC) and the federal banking agencies to review their regulations at least once every 10 years to identify and eliminate outdated, unnecessary, or unduly burdensome regulatory requirements imposed on insured depository institutions.[2] EGRPRA requires the agencies to solicit and review public comments on all their regulations and to identify ways to reduce regulatory burden while maintaining the safety and soundness of financial markets. The agencies are also required to report to Congress on the results of the reviews. The most recent completed EGRPRA review was in 2017 and a current review, expected to be completed in 2027, is underway.

Section 1573(a) of the Department of Defense and Full-Year Continuing Appropriations Act, 2011, amending the Dodd-Frank Wall Street Reform and Consumer Protection Act, includes a provision for us to annually review aspects of financial services regulations, including efforts to avoid duplicative or conflicting rulemakings.[3] This report examines (1) how the federal banking agencies conduct their EGRPRA reviews, (2) the regulatory outcomes of the EGRPRA reviews, and (3) the extent to which the agencies’ EGRPRA processes reflect leading practices for retrospective regulatory reviews. The agencies in the scope of our review were the Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC).

To address our first objective, we analyzed documentation related to the agencies’ current and most recently completed (2017) EGRPRA reviews. This included Federal Register notices soliciting public comments, planning documents and transcripts related to public outreach meetings, progress updates to agency management, summaries of public comments, documentation of interagency coordination, draft sections of the 2017 EGRPRA Joint Report to Congress, and draft agency rulemakings. We also developed a data collection instrument to gather and analyze information from the 2017 report, including how agencies evaluated and responded to public comments and determined appropriate regulatory actions. We assessed the agencies’ coordination during the EGRPRA review against our leading practices for interagency collaboration.[4] In addition, we reviewed prior GAO reports and a report from the Department of the Treasury’s Office of Inspector General on the degree to which OCC’s 2017 review complied with the statutory requirements of EGRPRA.[5]

To address our second objective, we reviewed Federal Register notices that cited EGRPRA, agency documentation, and the 2017 EGRPRA Joint Report to Congress. We used these sources to identify regulatory actions taken on issues identified as significant in the report and to assess the extent of explanation and analysis supporting those actions. We identified relevant Federal Register notices by searching for final rulemakings published by the banking agencies from January 2014 through December 2023 that cited EGRPRA.[6] After removing duplicates and irrelevant results, we identified 41 notices meeting these criteria.

To address our third objective, we identified key leading practices for retrospective regulatory reviews based on recommendations from the Administrative Conference of the United States, Executive Orders 13610 and 13563 on identifying and reducing regulatory burden, and the Office of Management and Budget’s (OMB) Circular A-4, Regulatory Analysis.[7] Of the leading practices, we selected six that we determined were relevant to the types of reviews and determinations required under EGRPRA. We then developed a scorecard to compare the three agencies’ EGRPRA-related activities against these practices.

We requested and reviewed documentation from the banking agencies on their review processes, including any analyses conducted for the 2017 and current EGRPRA reviews. Because the current review is ongoing and available documentation was limited, we primarily relied on documentation from the 2017 EGRPRA review to assess the extent to which agency processes reflected leading practices.

To address all objectives, we interviewed officials from the Federal Reserve, FDIC, and OCC on their processes for conducting EGRPRA reviews and actions taken as a result. We also interviewed representatives from six industry and professional associations and two public interest groups that submitted public comments in the current and previous EGRPRA reviews.[8] We discussed their perspectives on the agencies’ EGRPRA reviews.

We conducted this performance audit from January 2025 to July 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

EGRPRA Mandate

EGRPRA requires the federal banking agencies to conduct a decennial review in which they categorize their regulations by type and solicit public comments to identify outdated, unnecessary, or unduly burdensome regulations.

After collecting public comments, the agencies must

·        publish a summary of the comments received in the Federal Register,

·        identify and comment on significant issues raised in the public comments, and

·        eliminate unnecessary regulations as appropriate.

EGRPRA directs the agencies to submit to Congress a report that (1) summarizes significant issues that were raised in public comments and the relative merits of those issues and (2) analyzes whether the banking agencies can address the issues through regulatory action or whether legislative changes are needed.[9]

The National Credit Union Administration (NCUA) is not an appropriate federal banking agency and thus is not required to participate in the EGRPRA review process. However, in both 2007 and 2017, NCUA elected to participate and conducted parallel reviews of its regulations. NCUA’s reports were included as a separate addendum in the previous EGRPRA reviews. The Consumer Financial Protection Bureau (CFPB), although a member of FFIEC, is also not required to participate in the review process and has not contributed to the three EGRPRA reviews.[10]

Retrospective Regulatory Reviews

Retrospective regulatory reviews provide a formal way to assess the effects of existing rules. These reviews are intended to help agencies evaluate how regulations have performed and whether changes may be warranted.

EGRPRA is one example of a statutorily required retrospective review. Other retrospective reviews include those required under section 610 of the Regulatory Flexibility Act. That act calls for independent and other regulatory agencies to review, within 10 years of publication, final rules assessed as having a significant economic impact on a substantial number of small entities. The purpose of these reviews is to determine whether such rules should be maintained, amended, or rescinded to minimize their impact on small entities.

Section 553 of the Administrative Procedure Act sets out requirements for what is commonly referred to as notice-and-comment rulemaking, the process used for promulgating most federal regulations. Under this process, agencies publish a notice of proposed rulemaking in the Federal Register and provide an opportunity for public comment, generally 30 to 60 days.

The Administrative Conference of the United States (ACUS) is an entity in the executive branch charged with, among other things, identifying and promoting improvements in the efficiency, adequacy, and fairness of federal administrative procedures. These procedures include how federal agencies conduct regulatory programs, administer grants and benefits, protect the public interest, and perform other essential governmental functions. ACUS has published recommendations identifying leading practices for retrospective regulatory reviews, such as assessing whether regulations are achieving their intended goals and conducting cost-benefit analysis.[11]

In addition, Executive Orders 13563 and 13610 direct executive branch agencies to follow certain practices when conducting regulatory reviews, such as considering the cumulative effect of regulatory burden.[12]

Federal Banking Agencies

The three federal banking agencies are responsible for ensuring the safety and soundness of the institutions they oversee, protecting federal deposit insurance funds, and promoting stability in financial markets (see table 1). The agencies promulgate rules to implement banking laws, supervise banks to help ensure compliance with those rules, and take formal and informal enforcement actions against those that do not comply. The purpose of these activities is to help ensure that banks operate in a safe and sound manner and comply with applicable federal laws and regulations.

Agency	Basic regulatory function
Board of Governors of the Federal Reserve System	Supervises state-chartered banks that opt to be members of the Federal Reserve System, as well as bank and savings and loan holding companies. Also supervises certain other entities, including the U.S. operations of foreign banks.
Federal Deposit Insurance Corporation	Supervises insured state-chartered banks that are not members of the Federal Reserve System, state-chartered savings associations, and insured state-chartered branches of foreign banks. Also has backup supervisory responsibility for all federally insured depository institutions related to its role in insuring the deposits of all banks and thrifts approved for federal deposit insurance.
Office of the Comptroller of the Currency	Supervises national banks and federally chartered savings associations, as well as federally chartered branches and agencies of foreign banks.

Source: GAO.  |  GAO‑26‑108027

FFIEC is an interagency body established by Congress in the Federal Financial Institutions Examination Council Act of 1978.[13] It is required to

·        establish uniform principles, standards, and report forms for examining financial institutions;

·        recommend additional ways to make supervision more uniform across agencies;

·        develop uniform reporting systems for federally supervised financial institutions, their holding companies, and certain subsidiaries; and

·        provide training for examiners and assistant examiners.

FFIEC seeks to harmonize the auditing principles and supervisory decisions of the various financial regulatory agencies but does not itself regulate financial institutions.

FFIEC comprises the Federal Reserve, FDIC, OCC, NCUA, CFPB, and the State Liaison Committee. Its chairmanship rotates among the five federal member agencies, each for a 2-year term. FFIEC holds regular meetings at least twice per year, and additional meetings may be convened by the chair or four or more members.

History of EGRPRA Reviews

As of May 2026, the agencies had completed two EGRPRA reviews and were in the process of completing their third. The agencies completed the first review in December 2006 and issued the Joint Report to Congress in July 2007. The agencies began their second review in summer 2014 and issued the corresponding report in March 2017.

The agencies issued the first Federal Register notice soliciting public comments for the current EGRPRA review in February 2024. As of May 2026, they had issued all four planned Federal Register notices and had held four public outreach meetings. The Federal Reserve, as the lead agency since April 2025, is generally responsible for the administrative aspects of the interagency coordination of the current review.[14] Each agency coordinates its own internal review of public comments relating to regulations it has issued.

Agencies’ EGRPRA Reviews Have Relied on Public Comments, Interagency Coordination, and Reporting of Significant Issues

Agencies Have Conducted EGRPRA Reviews by Soliciting and Reviewing Public Comments and Preparing a Final Report

The agencies’ EGRPRA reviews consist of three primary components: soliciting comments and conducting public outreach, summarizing and reviewing comments, and preparing the final report to Congress (see fig. 1). To describe these processes, we relied primarily on documentation from the agencies’ most recently completed review in 2017 because documentation from the current review was largely unavailable while that review was ongoing.[15] However, officials from each agency said the current review generally follows the same processes used in 2017.

Note: For the purposes of EGRPRA, the federal banking agencies are the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, and the Office of the Comptroller of the Currency.

Soliciting comments and conducting public outreach. The agencies begin the EGRPRA reviews by publishing the first of four Federal Register notices soliciting formal, written public comments on 12 broad regulatory categories. In these notices, the agencies request commenters to identify areas of regulations that are outdated, unnecessary, or unduly burdensome. In the 2017 and current reviews, the agencies issued four notices, each covering three of the regulatory categories:[16]

·        Applications and Reporting; Power and Activities; International Operations

·        Banking Operations; Capital; the Community Reinvestment Act

·        Consumer Protection; Directors, Officers, and Employees; Money Laundering

·        Rules of Procedure; Safety and Soundness; Securities

For the 2017 report, the agencies issued these Federal Register notices, each with a 90-day comment period, over the course of 1 to 2 years. For the current review, the agencies issued the first notice soliciting comments in February 2024 and the final notice in July 2025, with the final comment period concluding in October 2025. The agencies have made public comments received in response to their solicitations available at Regulations.gov and the Federal Reserve’s and FDIC’s public websites.

The agencies also solicited public comments on regulations at outreach meetings, which allow members of the public to present their views directly to agency senior management. During the previous EGRPRA review, the agencies held six meetings across the country. These meetings were livestreamed via a public webcast. For the current review, as of April 2026, the agencies had held four such meetings.

Reviewing and summarizing comments. Each agency reviews EGRPRA public comments following a similar, though not identical, process. Staff from all three agencies told us that the review process is iterative and not always documented at each step.

After receiving comments, agency staff review and summarize both written and oral comments by rule. Each agency is responsible for reviewing comments related to agency-specific rules. For the 2017 review, the agencies created a document assigning responsibilities among the agencies for drafting preliminary summaries of interagency rules and relevant comments.

Once comments are organized, agency subject-matter experts evaluate the comments in their area of expertise and prepare narrative summaries. They may also draft agency responses, request input from additional staff (such as legal counsel), and assess the viability of regulatory changes proposed in the comments.

After subject-matter experts complete their summaries, agency staff said they provide them, along with any recommendations for regulatory or other changes, to senior management or agency leadership for review. Agency leadership provides feedback and makes final decisions on staff recommendations, according to agency staff.

Preparing the final report. To produce the 2017 EGRPRA report to Congress, the Federal Reserve (as the lead agency for FFIEC during the final stages of the review) incorporated FDIC, OCC, and interagency comment summaries into a consolidated draft. Federal Reserve staff then provided the draft to OCC and FDIC staff for review. Once the agencies reached consensus, the Federal Reserve submitted the report to FFIEC members for a notational vote.[17] Finally, with approval from its members, FFIEC issued the EGRPRA Joint Report to Congress and published it in the Federal Register.

Agencies Have Coordinated Activities Across All Phases of the EGRPRA Reviews

The three federal banking agencies have coordinated their roles and responsibilities over the course of the EGRPRA reviews:

·        Comment solicitation and public outreach. Staff from the three agencies worked together and coordinated with other FFIEC member agency staff to develop and review a plan for the current EGRPRA cycle. FDIC and Federal Reserve staff said the agencies hold weekly or biweekly meetings to coordinate activities, plan joint outreach meetings, and draft interagency Federal Register notices, among other activities. The agencies signed a cost-sharing agreement for outreach meetings during the previous EGRPRA review, and FDIC documentation indicates the agencies worked to draft a new agreement for the current cycle. Senior leadership from at least one of the agencies attended each of the outreach meetings.

·        Summarization and review of comments. During the previous EGRPRA review, the agencies divided the task of summarizing and assessing public comments on interagency rules. For the current review, they have used a file-sharing site to draft comment summaries and document changes, according to FDIC officials. These officials said the agencies reviewed the comments independently and worked together on each interagency rule comment summary. OCC staff similarly said the agencies regularly shared information and consulted with one another on these comments.

·        Preparation of the final report. The agencies work together to reach consensus on the final EGRPRA report. During the previous EGRPRA review, OCC staff shared comment summaries with Federal Reserve and FDIC staff to reconcile recommendations. As noted previously, the Federal Reserve, as the lead agency, incorporated FDIC, OCC, and interagency comment summaries into a single draft report. OCC staff said the agencies hold meetings to resolve disagreements that cannot be addressed through email.

The agencies’ actions during EGRPRA reviews generally reflected applicable leading practices for interagency collaboration that we have previously identified.[18] For example, the agencies ensured accountability by tracking the status of comment summaries for interagency rules. In addition, agency documentation and staff interviews indicate that the agencies worked together frequently and clarified roles and responsibilities over the course of the review.

Agencies Have Summarized and Responded to Comments in the EGRPRA Report, Focusing on Significant Issues

The EGRPRA statute requires the agencies to summarize significant issues raised in public comments and evaluate the relative merits in their final report. The agencies’ 2017 EGRPRA report summarized written comments submitted in response to Federal Register notices, as well as oral comments from public outreach meetings, with a focus on issues the agencies deemed significant. The report contains dedicated sections for each of these issues, summarizing relevant comments and presenting associated agency views.

The agencies identified significant issues for the 2017 EGRPRA review based on the regulatory topics that received the greatest number of public comments. The 2017 report identified the following issues as significant: capital rules, financial condition reporting (Call Reports), appraisal requirements, frequency of safety and soundness examinations, the Community Reinvestment Act, and the Bank Secrecy Act.[19] For the current review, agency staff said they are identifying significant issues based on the number and salience of comments received on a particular topic, among other criteria.

In addition to comments on significant issues, the 2017 EGRPRA report also summarized comments on other rules, including agency-specific rules, and described agency initiatives to update their rules and reduce regulatory burden. It also identified actions the agencies stated they had taken or planned to take in response to public comments and to address unnecessary regulatory burden.[20]

Outcomes from the EGRPRA Reviews Are Often Difficult to Identify

The connection between EGRPRA reviews and subsequent regulatory actions is often unclear. Based on our review of the 2017 Joint Report to Congress and Federal Register notices for rulemakings purportedly connected to the EGRPRA review, it can be difficult to determine the extent to which actions described in the EGRPRA report were driven by the review itself. As a result, outcomes of the EGRPRA reviews and their connection to subsequent regulatory actions are often difficult to identify.

First, although the 2017 EGRPRA report documents agency actions to address regulatory burden, many of these actions were taken either prior to or concurrently with the review. For example, in a report section highlighting agency efforts to address issues raised by commenters, OCC noted that it issued guidance clarifying expectations for certain savings associations and their examiners regarding risk assessments and corporate governance. OCC issued the guidance in July 2014, prior to the end of the comment period for the agencies’ first EGRPRA comment solicitation.

Similarly, some actions described in the EGRPRA report may have been initiated in response to other statutory requirements. For example, the Federal Deposit Insurance Act requires that the agencies review the information required in Call Reports and reduce or eliminate items deemed no longer necessary or appropriate every 5 years.[21] FDIC officials noted that this requirement overlapped with the 2017 EGRPRA review and that the final report described actions taken to address burden associated with Call Report requirements.

In addition, in some cases, the agencies did not directly respond in the report to summarized public comments, including for issues deemed significant. For example, although the agencies summarized public comments on issues such as capital ratios, short-term trade financing, and the role of the Community Reinvestment Act in merger applications, they did not provide a specific assessment of the merits of the comments raised on these issues or make determinations on the need to address them.

The 2017 report to Congress also includes statements about issues the agencies may consider in the future to address unduly burdensome regulations without specifying what actions would be taken or when. For example, regarding multiple, overlapping disclosure requirements for mortgage loan appraisals, the agencies noted that such requirements can create confusion and that they would consider ways to clarify them. However, the report did not provide details on potential actions or time frames for determining whether unnecessary regulations should be addressed.

Between January 2014 and December 2023, the federal banking agencies issued 41 final rulemakings that cited EGRPRA in the Federal Register notices. However, our review found that just seven of these 41 rulemakings (17 percent) specifically cited comments received during the EGRPRA review, indicating that the review was not commonly identified as a basis for subsequent rulemakings. For the remaining 34 rulemakings (83 percent), the agencies either did not explain the connection to EGRPRA, or stated that the rulemaking was consistent with the spirit of EGRPRA or complemented its goals, without describing how work performed for the EGRPRA review contributed to the action.

FDIC staff told us it is difficult to isolate outcomes attributable to EGRPRA from other regulatory actions because rulemakings may be prompted by multiple factors. For example, when agencies receive comments on issues for which they already have separate ongoing initiatives, subject-matter experts may combine those efforts into a single workstream. Similarly, OCC and Federal Reserve staff told us that actions taken in response to the EGRPRA review can be hard to separate from other actions.

Stakeholder perspectives were generally consistent with these observations. Representatives from six of the eight organizations we spoke with said EGRPRA does not often lead to actions to modify or eliminate unnecessary regulations, although representatives of four organizations said the agencies’ process for collecting public comments is effective.[22]

Representatives from one industry group also noted some benefits of the requirement for the agencies to conduct the review. For example, submitting comments provides an opportunity to revisit positions on regulations that have not been addressed by recent rulemakings. However, they also said their organization believes EGRPRA leads to incremental regulatory updates rather than meaningful burden reduction or modernization. A representative from a public interest group said that while the EGRPRA report itself is informative, it is difficult to connect the review with concrete regulatory changes.

EGRPRA Processes Do Not Include Procedures for Taking Actions and Do Not Fully Reflect Leading Practices

Agencies Have Not Implemented Procedures for Identifying and Acting on Unnecessary Regulations

The federal banking agencies have not implemented written procedures for identifying outdated, unnecessary, or unduly burdensome regulations through EGRPRA reviews. The agencies’ existing process includes steps for soliciting public comments and compiling them into the report for Congress. However, it does not include procedures to help agencies determine which issues identified in the public comments warrant regulatory action. All three agencies provided us with documentation from the 2017 EGRPRA review—such as comment summaries, draft report sections, and planning documents for outreach events—but did not provide documentation reflecting whether or how staff made determinations on whether regulations were outdated, unnecessary, or overly burdensome.

As noted above, the 2017 EGRPRA report sometimes notes actions that agencies say they plan to take or may consider in the future regarding unnecessary or unduly burdensome regulations. However, these descriptions often do not include details on when or under what circumstances they may take such actions or how the agencies reached their decisions.

FDIC also provided us with a high-level outline of its approach to soliciting and analyzing EGRPRA comments during the 2017 review. But the outline does not describe procedures or guidelines for determining whether regulatory changes or other actions are appropriate based on FDIC’s analysis of issues raised in the public comments. FDIC also issued a 2013 statement of policy on developing and reviewing regulations that identifies general factors agency staff should consider when determining whether regulations should be revised or eliminated. These factors include the continued need for the regulation; opportunities to simplify the regulation; the need to eliminate duplicative and inconsistent regulations; and the extent to which technology, economic conditions, and other factors have changed in the area affected by the regulation or policy. However, FDIC did not provide documentation demonstrating whether or how these factors were applied during its EGRPRA review.

The Federal Reserve provided a framework document developed for the current EGRPRA review outlining key objectives, inputs, deliverables, and project oversight roles, and a process for obtaining internal stakeholder views. The framework calls for staff to prepare policy option memorandums summarizing public comments and provide their views on options for addressing unnecessary regulations. However, it does not include procedures or factors for assessing issues raised in the comments or determining needed regulatory changes.

Agency representatives said decisions to initiate rulemakings to address such issues would occur through the agencies’ individual rulemaking processes, generally under the direction of agency leadership. However, the agencies do not have procedures for determining during the EGRPRA review whether a rulemaking is warranted.

In March and April 2026, the Federal Reserve and FDIC provided us with draft policies and procedures that, if finalized and implemented, could address some of these deficiencies. The Federal Reserve’s draft policies and procedures include questions agency subject-matter experts should consider when identifying outdated, unnecessary, or overly burdensome regulations; a methodology for determining significant issues; and a process for identifying regulatory categories with the greatest potential for reducing burden.

The steps described in the document could allow Federal Reserve staff to better identify outdated or unnecessary regulations by directing staff to consider the clarity and effectiveness of regulations and whether they may be obsolete or disproportionately affect smaller institutions. Further, the document provides staff with factors to consider when developing policy option memorandums, which could establish a systematic process for recommending actions to agency policymakers that could reduce regulatory burden. However, the Federal Reserve did not indicate the degree to which its draft policies and procedures were being followed in the current EGRPRA review. Additionally, because agency staff said most workpapers for the current review were still in development and thus generally unavailable to us, we could not verify the extent to which these processes have been incorporated into the current EGRPRA review.

FDIC officials noted that the agency’s new draft policies and procedures for conducting the EGRPRA review will not be finalized until after the completion of the review. The draft policies and procedures provide an overview of the agency’s review process, including relevant stakeholders, interagency meetings, and the solicitation of public comments. They also include a template for subject-matter experts to complete during their reviews of public comments, including considerations such as whether rules have overlapping or potentially duplicative requirements. However, neither the draft policies and procedures nor the template describe how staff should identify or act on outdated, unnecessary, or overly burdensome regulations, such as how to apply relevant evaluation factors, evaluations to perform, or steps for developing policy recommendations for consideration by agency leadership. As the agency continues to develop its draft policies and procedures, including such details could strengthen the effectiveness of future EGRPRA reviews.

OCC did not provide updated or draft policies and procedures for how agency staff should conduct their review, and agency officials did not indicate that they had plans to develop such documents. OCC officials noted that they generally follow the process established by the lead agency of the EGRPRA review. However, although EGRPRA is an interagency effort, each agency is responsible for its own internal review.

The EGRPRA statute directs agencies to “identify outdated or otherwise unnecessary regulatory requirements imposed on insured depository institutions” and to “eliminate unnecessary regulations to the extent that such action is appropriate.”[23] In addition, federal internal control standards state that management should implement control activities through policies and procedures. The policies are to be documented at the appropriate level of detail to allow for effective management review.[24]

Staff at all three agencies said they review their regulations on an ongoing basis, including outside the EGRPRA cycle, and that EGRPRA provides an additional opportunity to solicit comments and collect information. For example, Federal Reserve staff said the primary purpose of EGRPRA is to solicit public comments on regulatory burden to evaluate what regulations should be modified or eliminated and to gather information from the banking industry and other members of the public.

EGRPRA requires the agencies to identify outdated or unnecessary regulations and take actions to address them, to the extent that such action is appropriate. However, the agencies do not have documented policies and procedures for how to do so. As discussed earlier, outcomes from the EGRPRA reviews are often difficult to identify. This underscores the importance of procedures to help ensure that issues identified through the review are translated into clear decisions and, where appropriate, regulatory changes. Having documented procedures also is important given the long time frame between EGRPRA reviews.

By implementing a systematic process for identifying outdated or unnecessary regulations, the three agencies that are jointly responsible for executing EGRPRA would be better able to ensure that issues identified through the review are systematically evaluated and lead to clear determinations about whether regulatory actions are warranted. Such a process could increase the likelihood that EGRPRA reviews will result in meaningful regulatory changes.

Agencies’ EGRPRA Processes Do Not Fully Reflect Leading Practices for Retrospective Reviews

The agencies’ EGRPRA review processes are not fully aligned with selected leading practices for retrospective regulatory reviews. We assessed the agencies’ review processes against six selected leading practices identified by the Administrative Conference of the United States (ACUS) and executive orders related to retrospective review.[25] We selected these practices based on their relevance to EGRPRA reviews.

As shown in table 2, the agencies were fully aligned with three of the six leading practices for retrospective review. They were not aligned with practices related to prioritizing rules for review, conducting cost-benefit analysis, and assessing cumulative burden.

Key practice	Federal Reserve	FDIC	OCC
Adopt a framework for prioritizing rules for retrospective analysis	○	○	○
Conduct cost-benefit analysis	○	○	○
Leverage outside expertise	●	●	●
Explain how the review was conducted	●	●	●
Coordinate retrospective reviews	●	●	●
Consider cumulative regulatory burden	○	○	○

● = Fully aligned ◑ = Partially aligned ○ = Not aligned

EGRPRA = Economic Growth and Regulatory Paperwork Reduction Act; FDIC = Federal Deposit Insurance Corporation; Federal Reserve = Board of Governors of the Federal Reserve System; OCC = Office of the Comptroller of the Currency

Source: GAO analysis of FDIC, Federal Reserve, and OCC documentation and interviews with agency officials.  |  GAO‑26‑108027

Notes: The first three practices are based on Administrative Conference of the United States (ACUS) Recommendation 2014-5, Retrospective Review of Agency Rules, Adoption of Recommendations, 79 Fed. Reg. 75114 (Dec. 17, 2014). The next two practices are based on ACUS Recommendation 2021-2, Periodic Retrospective Review, Adoption of Recommendations, 86 Fed. Reg. 36075 (July 8, 2021). The final practice is based on Executive Order 13610, Identifying and Reducing Regulatory Burdens, 77 Fed. Reg. 28469 (May 14, 2012).

Leverage Outside Expertise

The agencies’ actions fully aligned with ACUS Recommendations 2021-2 and 2014-5, which state that agencies should leverage outside expertise, such as regulated parties, and integrate relevant information from the public when reassessing existing regulations. During the previous EGRPRA cycle, the agencies received over 230 comment letters from insured depository institutions, trade associations, consumer and community groups, and other interested parties in response to the Federal Register notices. They received additional comments from participants during public outreach meetings. The agencies have similarly requested comments and held outreach meetings during the current EGRPRA cycle. Federal Reserve staff said the addition of virtual meetings has helped to solicit participation across a wider geographic area.

Coordinate the Review

The agencies fully aligned with ACUS Recommendation 2021-2, which states that agencies should coordinate their periodic retrospective reviews with other agencies that have issued related regulations. For example, internal documents indicate that the agencies identified a lead agency, shared information, and established clear roles and responsibilities. As discussed earlier, we also found that the agencies generally adhered to our leading practices on interagency collaboration.

Explain How the Review Was Conducted

The agencies fully aligned with ACUS Recommendation 2021-2, which states that agencies should publish documents explaining how a periodic retrospective review was conducted, what information was considered, and what public outreach was undertaken. The agencies’ Federal Register notices explain how they solicit public comments, identify regulatory categories for review, and state that comments will be evaluated to determine whether action is appropriate. The notices also provide links to additional information on public outreach meetings. The 2017 EGRPRA report similarly provides an overview of how comments were solicited and notes that these comments form the basis of the final report.

Prioritize Rules for Retrospective Analysis

The agencies did not align with ACUS Recommendation 2014-5, which states that, given resource constraints, agencies should publicize a framework for prioritizing rules for retrospective analysis. The recommendation notes that such a framework should articulate selection criteria that enable the public to understand why the agencies prioritized certain rules for review.

The agencies do not have a framework for prioritizing rules for further analysis as part of the EGRPRA review. Specifically, they do not have a system for determining which rules warrant additional review after receiving public comments. For example, Federal Reserve staff said that although they consider factors such as materiality and urgency, they do not use a formalized set of criteria outside the Federal Reserve’s ordinary rulemaking process. However, having a framework for prioritizing certain rules for further analysis could help the agencies better determine if and when to initiate a rulemaking.

FDIC provided us with a draft management tool that agency staff said could be used for prioritizing rules for further analysis. The tool is a spreadsheet listing regulations, recent rulemaking actions, current or planned actions, and whether related regulations exist at other federal financial regulators. However, it does not identify which regulations have been prioritized for further analysis during the EGRPRA review or describe how such determinations are made.

In its draft procedures document, the Federal Reserve provided guidance on selecting priority topics—broad subject areas or regulatory categories—to focus resources on areas with the greatest potential for reducing burden. According to the document, priority areas are based on the volume of public comments, estimated regulatory burden, impact on institutions, and leadership priorities. However, the document does not describe how specific regulations within these areas would be prioritized for analysis.

OCC officials said the agency does not have an established system for prioritizing regulatory analysis or potential actions in response to EGRPRA and instead uses an iterative process based on professional judgement.

Because applying retrospective analysis to every issue raised in comments may be impractical, a prioritization framework could help agencies direct finite resources toward the most important issues. Without such a framework that sets forth selection criteria for prioritizing certain rules or groups of rules for review, the agencies may not consistently focus on the regulations that present the greatest burden, and issues identified through the EGRPRA review may not be systematically evaluated or advanced for potential action.

Conduct Cost-Benefit Analysis

The agencies’ EGRPRA process does not align with ACUS Recommendation 2014-5, which calls for agencies to use statistical tools, as appropriate and to the extent that resources allow, to identify the impacts of regulations, including their costs and benefits, to help determine how to make regulations more effective. This recommendation is consistent with other sources of leading practices, such as OMB Circular A-4, which identifies cost-benefit analysis as the primary analytical framework for regulatory analysis.[26] The circular recognizes that some important benefits and costs may be inherently too difficult to quantify given current data and methods. For these cases, it recommends a careful analysis of qualitative benefits and costs.[27]

The agencies did not conduct or report quantitative analyses during the 2017 EGRPRA review, and the 2017 report does not cite examples of cost-benefit analyses used to inform regulatory actions prior to rulemaking. Additionally, the agencies did not provide internal documentation showing that they conducted cost-benefit analysis in response to issues raised in public comments.[28]

Federal Reserve staff provided us with a document discussing possible approaches for quantitative analysis for the EGRPRA review. The document describes challenges in quantitatively analyzing regulatory burden and approaches for determining when compliance costs may outweigh policy objectives. Implementing such approaches could help the Federal Reserve incorporate cost-benefit analysis, either quantitative or qualitative, in its EGRPRA review process. However, as previously noted, documentation from the current review demonstrating the implementation of such analysis was not provided, and staff did not indicate to what extent they are using these approaches in the current review.

FDIC provided an EGRPRA template document that includes a section for staff to summarize and analyze data, to the extent possible. FDIC subject-matter experts use the template when reviewing public comments and assessing regulatory burden for a particular rule. However, FDIC did not provide completed templates demonstrating the extent to which staff used them to incorporate cost-benefit analysis in the current EGRPRA review.

OCC officials provided a policy document describing the role of the agency’s Policy Analysis Division in conducting retrospective reviews. The document states that the division may, as needed, provide quantitative analysis to strengthen the rigor and transparency of the EGRPRA process. However, the agency did not indicate to what extent the division has contributed such analysis to the current review, and we did not receive documentation corroborating that such analysis has been performed.

Staff from each agency said empirical analysis generally occurs as part of the rulemaking process. However, such analysis typically evaluates specific proposed regulatory changes after an agency has decided to issue or change a rule. In contrast, incorporating cost-benefit analysis into the retrospective EGRPRA review could inform earlier decisions about whether issues raised in public comments warrant further analysis or action. In this way, analysis conducted during EGRPRA could complement, rather than duplicate, rulemaking analysis.

For the current review, the agencies—in response to a recommendation we made in a 2018 report on bank regulatory burden—requested in Federal Register notices that commenters provide quantitative analyses and data on the impact of rules, where available.[29] While such information could be informative, it does not substitute for agency-led analysis within the EGRPRA process.

By incorporating cost-benefit analysis into the EGRPRA review, the agencies could better assess regulatory impacts and trade-offs and determine whether regulations justify their costs and whether regulatory actions may be warranted. Without such analysis, the agencies have limited ability to distinguish between more and less significant concerns or to evaluate the cost and benefit trade-offs associated with potential changes. As a result, the EGRPRA review may be less effective in informing decisions about whether and how to revise or eliminate regulations.

Assess Cumulative Burden

The agencies’ EGRPRA process does not align with Executive Order 13610, which states that agencies should consider the cumulative effects of their regulations, including cumulative burdens, when conducting retrospective regulatory reviews.[30] In addition, we previously reported that congressional intent in tasking the banking agencies with the EGRPRA reviews was to review all regulations that could be creating undue burden on the institutions they regulate.[31]

During the previous EGRPRA review, the agencies did not assess the cumulative burden on regulated parties. In response to a recommendation we made in 2018, the agencies requested information from the public in Federal Register notices for the current EGRPRA cycle on the cumulative effects of regulation on insured depository institutions and holding companies.[32] However, they have not established plans for assessing cumulative burden within the EGRPRA process itself. For example, FDIC staff said they are still determining how they will incorporate comments on cumulative regulatory burden into their review. Although FDIC’s template contains questions for subject-matter experts to identify potentially overlapping or duplicative requirements, the document does not include a process for evaluating any associated cumulative burdens.

As we noted in making our 2018 recommendation, researchers often acknowledge that assessing cumulative burden is difficult.[33] However, without assessing cumulative burden, where feasible, as part of the EGRPRA process, the agencies may not fully understand how multiple regulatory requirements collectively affect regulated entities or the overall level of burden they face. As a result, the EGRPRA review may be less effective in identifying areas where the combined effects of regulations warrant changes to reduce unnecessary burden.

Conclusions

Regulations are a principal instrument for implementing public policy and can produce substantial benefits, but they also may impose significant costs. Retrospective regulatory reviews are a key tool for helping agencies evaluate regulations’ effectiveness and whether rules should be eliminated or modified to better achieve intended benefits or minimize burden on regulated entities.

However, the outcomes intended by EGRPRA—eliminating unnecessary regulations, as appropriate—are difficult to identify. By developing documented procedures for identifying outdated or unnecessary regulations and determining appropriate actions to address them, the agencies would help ensure that they systematically evaluate issues identified through the review and that the review leads to clear determinations about whether regulatory changes are warranted. This could improve the likelihood that EGRPRA reviews result in meaningful actions to reduce unnecessary burden while maintaining the safety and soundness of the institutions the agencies oversee.

In addition, the agencies’ EGRPRA review processes are not fully aligned with three leading practices for retrospective reviews: prioritizing rules for analysis, conducting cost-benefit analysis, and assessing cumulative regulatory burden. Draft documentation provided by the Federal Reserve and FDIC could help address these gaps but has not yet been fully developed or demonstrated in practice. Incorporating these leading practices into EGRPRA reviews, to the extent practicable, would help the agencies focus analytical resources on the most significant issues, better assess regulatory impacts and trade-offs, and understand how multiple regulations collectively affect regulated entities.

Recommendations for Executive Action

We are making a total of six recommendations, two each to the Federal Reserve, FDIC, and OCC:

The Chair of the Board of Governors of the Federal Reserve System should complete the development and implementation of documented procedures for identifying outdated, unnecessary, or unduly burdensome regulations and taking action to address them during the EGRPRA review. (Recommendation 1)

The Chair of the Board of Governors of the Federal Reserve System should incorporate into the agency’s EGRPRA review, to the extent practicable, (1) a framework for prioritizing rules for retrospective analysis; (2) cost-benefit analysis; and (3) an assessment of cumulative regulatory burden, where feasible. (Recommendation 2)

The Chairman of FDIC should complete the development and implementation of documented procedures for identifying outdated, unnecessary, or unduly burdensome regulations and taking action to address them during the EGRPRA review. (Recommendation 3)

The Chairman of FDIC should incorporate into the agency’s EGRPRA review, to the extent practicable, (1) a framework for prioritizing rules for retrospective analysis; (2) cost-benefit analysis; and (3) an assessment of cumulative regulatory burden, where feasible. (Recommendation 4)

The Comptroller of the Currency should develop and implement documented procedures for identifying outdated, unnecessary, or unduly burdensome regulations and taking action to address them during the EGRPRA review. (Recommendation 5)

The Comptroller of the Currency should incorporate into the agency’s EGRPRA review, to the extent practicable, (1) a framework for prioritizing rules for retrospective analysis; (2) cost-benefit analysis; and (3) an assessment of cumulative regulatory burden, where feasible. (Recommendation 6)

Agency Comments and Our Evaluation

We provided a draft of this report to FDIC, the Federal Reserve, and OCC for review and comment. They each provided technical comments, which we incorporated as appropriate.

The agencies neither agreed nor disagreed with our recommendations. In its written comments, reproduced in appendix I, FDIC stated that it has taken a number of steps to remove unnecessary regulatory requirements and streamline regulations, while continuing to promote safety and soundness at supervised institutions. FDIC also stated that it consistently documents the steps it takes to carry out the current EGRPRA review, including its procedures for identifying outdated, unnecessary, or unduly burdensome regulations and making recommendations for the next EGRPRA review. 

As stated in our report, while FDIC provided us with draft policies and procedures that provide an overview of the agency’s review process and a template for staff to use in conducting reviews, these documents do not describe key processes, such as evaluations to perform or steps for developing policy recommendations for agency leadership to consider. FDIC also noted that it has developed a prioritization tool that provides staff with information about the regulatory burdens that are not captured in public EGRPRA comments. As stated in our report, the draft tool FDIC provided us does not identify regulations to be prioritized for further analysis during the EGRPRA review or describe how the review would inform such determinations. Completing the development of documented procedures for how FDIC will identify and act on unnecessary regulations would help to make the EGRPRA process more effective in reducing unnecessary regulatory burden while maintaining the safety and soundness of financial institutions.

In its written comments, reproduced in appendix II, the Federal Reserve stated that it is reviewing our recommendations as part of a broader assessment of cost-benefit analysis and retrospective reviews of the agency’s regulations. The Federal Reserve noted that it will consider our recommendations and provide feedback in due course.

In its written comments, reproduced in appendix III, OCC stated that to address our recommendations, it will continue to rely on its current processes and also will document its practices to help inform future EGRPRA organizers and consider whether further changes to its processes are warranted. As we note in our report, implementing a systematic process for identifying outdated or unnecessary regulations would increase the likelihood that EGRPRA reviews will result in meaningful regulatory changes. Likewise, incorporating leading practices into EGRPRA reviews could help OCC focus analytical resources on the most significant issues, better assess regulatory impacts and trade-offs, and understand how multiple regulations collectively affect regulated entities.

We are sending copies of this report to the appropriate congressional committees, Chairman of the Federal Deposit Insurance Corporation, Chair of the Board of Governors of the Federal Reserve System, Comptroller of the Currency, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Michael E. Clements
Director, Financial Markets and Community Investment

List of Committees

The Honorable John Thune
Majority Leader
The Honorable Charles E. Schumer
Minority Leader
United States Senate

The Honorable Mike Johnson
Speaker
House of Representatives

The Honorable Steve Scalise
Majority Leader
The Honorable Hakeem Jeffries
Minority Leader
House of Representatives

The Honorable John Boozman
Chairman
The Honorable Amy Klobuchar
Ranking Member
Committee on Agriculture, Nutrition, and Forestry
United States Senate

The Honorable Tim Scott
Chairman
The Honorable Elizabeth Warren
Ranking Member
Committee on Banking, Housing, and Urban Affairs
United States Senate

The Honorable Ted Cruz
Chairman
The Honorable Maria Cantwell
Ranking Member
Committee on Commerce, Science, and Transportation
United States Senate

The Honorable Bill Hagerty
Chair
The Honorable Jack Reed
Ranking Member 
Subcommittee on Financial Services and General Government
Committee on Appropriations
United States Senate 

The Honorable Glenn “GT” Thompson
Chairman
The Honorable Angie Craig
Ranking Member
Committee on Agriculture
House of Representatives

The Honorable Brett Guthrie
Chairman
The Honorable Frank Pallone, Jr.
Ranking Member
Committee on Energy and Commerce
House of Representatives

The Honorable French Hill
Chairman
The Honorable Maxine Waters
Ranking Member
Committee on Financial Services
House of Representatives

The Honorable Dave Joyce
Chairman
The Honorable Steny Hoyer
Ranking Member
Subcommittee on Financial Services and General Government
Committee on Appropriations
House of Representatives

GAO Contact

Michael E. Clements, clementsm@gao.gov

Staff Acknowledgments

In addition to the contact named above, Kevin Averyt (Assistant Director), Jason Wildhagen (Analyst in Charge), Jackson Eckel, Jill Lacey, Alberto Lopez, and Jennifer Schwartz made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us