The 10 Most Common GLBA Safeguards Rule Violations FDIC Examiners Are Citing in 2026

What This Year's Exam Findings Have in Common

The pattern is not subtle. The regulators are not citing novel technical failures. They are citing the same governance gaps repeatedly, often at banks whose IT teams are technically competent and whose tooling is current.

The reason for the consistency is that the GLBA Safeguards Rule and the FFIEC IT Examination Handbook describe a program. Examiners look for evidence the program operates. When the program exists on paper but not in operating discipline, the gap is visible to the examiner regardless of how strong the bank's technology stack is. The findings cite the gap, not the technology.

A community bank CEO who reads the visible exam findings will recognize the same ten violations cited at peer banks. The list below is what they look like in practice.

The Ten Violations Examiners Cite Most Often — And What Each Actually Requires

The first violation is an out-of-date or inadequate Risk Assessment. The Safeguards Rule requires a written Risk Assessment that identifies reasonably foreseeable internal and external risks to consumer information. Examiners cite assessments that are over a year old, that do not cover newer systems and vendors, or that exist only as a checklist without actual risk identification. The fix is a maintained assessment, updated when the bank adds systems or vendors, with a documented review cadence.

The second violation is missing or inadequate vendor risk management. The 2023 FFIEC guidance and recent enforcement have sharpened expectations. Examiners cite banks that signed BAAs and onboarded vendors without ongoing oversight, banks whose vendor inventories do not match their actual third-party relationships, and banks whose contracts do not flow down equivalent safeguards to subcontractors. The fix is a vendor risk program that operates as a recurring function, not a contracting exercise.

The third violation is failure to monitor and review audit logs. The bank's systems generate logs by default. The Security Rule and FFIEC guidance require the bank to monitor and review them. Examiners cite banks that have logs but no documented review function, no named owner, and no response procedure when the logs surface anomalies. The fix is to budget the review as a defined operational responsibility, internally or with an external monitoring partner.

The fourth violation is inadequate access controls. The Safeguards Rule requires the bank to limit access to consumer information based on need. Examiners cite banks where former employees retained access weeks after departure, where role-based access controls drifted, where privileged accounts were not separated from ordinary accounts, and where access reviews happened either rarely or never. The fix is a quarterly access review with documented outcomes and a privileged-access discipline that survives staff turnover.

The fifth violation is missing or inadequate multi-factor authentication. The 2023 Safeguards Rule revisions named MFA explicitly. Examiners cite banks where MFA covers some accounts but not others, where MFA configurations include exceptions that swallow the rule, and where the bank cannot demonstrate enforcement across all systems containing consumer information. The fix is enforcement at the policy level, with documented exceptions minimized.

The sixth violation is inadequate encryption. Encryption of consumer information in transit and at rest is required under the revised rule. Examiners cite banks where encryption is implemented inconsistently, where backups are not encrypted, where mobile devices and removable media lack encryption, and where the bank cannot produce evidence of encryption coverage across in-scope systems. The fix is universal encryption with a documented scope and inventory.

The seventh violation is inadequate change management. Examiners cite banks where IT changes happen without documentation, where the configuration drifts from the approved baseline, where security patches lag behind vendor release schedules, and where change records cannot be tied back to authorized requests. The fix is a change management discipline that produces evidence of authorization and review on every material change.

The eighth violation is inadequate disaster recovery and business continuity testing. The bank must test its recovery posture annually at minimum. Examiners cite banks whose tests are tabletop-only with no actual recovery exercise, whose tests do not cover newer systems, whose test results identify issues that are not remediated, and whose recovery time objectives are not measurable. The fix is annual full testing with documented outcomes and remediation tracking.

The ninth violation is missing workforce training. The rule requires training, and the rule's authors expect training to actually change behavior. Examiners cite banks where training is delivered once at hire and never repeated, where training does not cover the specific risks the bank faces, and where the bank cannot demonstrate completion or retention. The fix is annual training tailored to the bank's actual risk profile, with completion tracked and remediated.

The tenth violation is missing or inadequate written reports to the governing body. The rule requires the qualified individual to produce annual written reports to the board, the managing partner, or equivalent governing body. Examiners cite banks where the reports do not exist, where they exist but do not describe the program in operational detail, where they are received but not discussed, and where the board minutes do not reflect the discussion. The fix is a board-reportable document, on a defined cadence, with evidence of governing-body review.

Why the Real Gap Is Discipline, Not Technology

Read across the ten violations, the common thread is not technical inadequacy. It is the gap between the program a bank says it runs and the evidence that the program actually operates. Every cited violation is, at root, a documentation-and-discipline gap rather than a technology gap.

That pattern matters for the CEO because it changes what the budget needs to fund. If the violations were technical, the fix would be tooling. The fix is operating discipline, which means the budget needs to fund the people, the cadence, and the documentation that produce evidence the program runs. That is harder to justify than tooling, and it is what regulators actually examine.

A CEO who funds tooling without funding discipline produces a bank that looks well-equipped on the IT side and well-cited on the exam side. A CEO who funds discipline alongside tooling produces a bank that survives the exam.

Why "We Passed Last Time" Is the Most Expensive Assumption in the Budget

A community bank CEO will hear, somewhere in the budget conversation, this argument: the previous exam cycle found minor issues, the bank passed without significant remediation, and the right posture is to maintain the current investment level rather than expand it.

That is a false choice, and the FFIEC's enforcement record over the past three years has made it expensive to keep believing in. Examiner expectations move forward each cycle as new guidance issues, new threat patterns emerge, and recent enforcement actions raise the bar. A bank that funded its program to last cycle's expectations has not maintained its compliance posture. It has let its compliance posture decay relative to current expectations. The findings that follow are not a surprise. They are the gap between a budget anchored to the past and an exam anchored to the present.

The right framing is not whether the bank can pass an exam at the current budget. It is whether the bank's program tracks the trajectory of examiner expectations on a forward-looking basis. The first framing produces last cycle's program. The second framing produces a program the bank can defend.

The One-Page Benchmark That Changes the Board Conversation

A community bank should walk through a current-state benchmark against the ten common violations. The exercise produces a one-page status indicator for each violation, with evidence of the bank's current discipline (or the gap, where it exists). The CEO uses the document to set priorities for the next budget cycle and to brief the board.

Banks that complete this exercise on a recurring cadence find that the exam findings shift from "we did not know" to "we knew, and here is what we did about it." The first response invites a corrective-action plan. The second response usually closes the finding without one.

Fix the Ten Before the Examiner Finds Them

A community bank CEO who reads the ten common violations is reading the categories the next FFIEC IT exam is likely to evaluate. The bank that fixes each category before the exam arrives presents the regulator with a defensible program. The bank that does not fix them presents the regulator with the next chapter in the visible enforcement record.

If your bank has not produced a current-state benchmark against the ten common violations in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the next exam cycle.

Five Nines Technology Group is a Tech-Operations partner for community banks and credit unions. Translating regulatory frameworks into operating discipline at community bank scale is where our team focuses.