How Banks Are Regulated

Banks are unusual businesses because much of what they owe can be payable on demand, while much of what they own consists of loans and securities that mature later or may be difficult to sell quickly without a loss. A bank can therefore be economically viable over the long term and still face serious trouble if too many depositors or wholesale funders demand cash at once. The same institution may also sit inside payment networks, extend credit to households and businesses, and hold assets whose value changes with interest rates and economic conditions.

Bank regulation is designed around those characteristics. It does not try to make failure impossible, and it does not mean that every bank receives a government guarantee. Instead, a modern regulatory system uses several layers, including minimum capital, liquidity standards, supervisory examinations, rules for risk management and governance, deposit insurance, consumer protection, anti-money-laundering obligations and procedures for handling a failed institution.

The details vary substantially by country and by the type, size and activities of the bank. This article uses the United States for many concrete examples because its regulatory structure is especially fragmented, while also referring to the Basel framework that influences prudential standards internationally. The useful way to understand the subject is not to look for one regulator or one ratio, but to see how the different safeguards address different kinds of risk.

Why banks require prudential regulation

A bank takes funds from depositors and other creditors, then uses those funds alongside its own capital to make loans, buy securities and provide financial services. That intermediation can be valuable because savers often want safety and ready access to cash, while borrowers may need money for years. The mismatch between short-term funding and longer-term assets is part of normal banking, but it creates liquidity risk that an ordinary nonfinancial company usually does not face in the same form.

A bank also differs from many other lenders because deposits can be an important funding source and because deposit-taking institutions participate directly in the infrastructure through which money is stored and transferred. A finance company funded mainly with long-term debt can still fail, but its creditors generally know they are providing term funding. A depositor using a transaction account expects to be able to pay a bill or withdraw cash without first assessing the bank’s loan book.

That combination creates a confidence problem. If customers believe a bank may not be able to meet withdrawals, each customer has an incentive to withdraw before others do, even when the bank owns assets that may eventually repay in full. A sufficiently fast run can turn a funding problem into an insolvency problem because the bank may have to sell assets at depressed prices, pledge scarce collateral or replace cheap deposits with expensive emergency funding.

Bank failures can also impose costs beyond the institution’s shareholders and creditors. A disorderly failure can interrupt payments, tighten credit, force asset sales and spread concern to institutions with similar balance sheets. The 2007-09 financial crisis showed how losses and uncertainty involving housing credit and mortgage backed securities could interact with leverage and short-term funding across the financial system. Regulation therefore focuses not only on whether one bank can earn a profit, but also on whether its risk-taking can create losses or disruption that other people did not agree to bear.

Who regulates banks

There is no single worldwide bank regulator, and even within one country responsibility may be divided among several agencies. A bank’s charter, ownership structure, activities and size can determine which authority supervises it, while separate agencies may enforce consumer, securities, competition or financial-crime laws. International bodies such as the Basel Committee develop common prudential standards, but national authorities decide how those standards are implemented in domestic law.

The United States is a clear example of overlapping responsibility. National banks and federal savings associations are chartered and regulated by the Office of the Comptroller of the Currency. State-chartered banks that are members of the Federal Reserve System are supervised federally by the Federal Reserve, while the FDIC is the primary federal supervisor for state-chartered banks that are not Federal Reserve members; state regulators also supervise state-chartered institutions. That division is one reason banking in the U.S. can look more complicated than a system in which one national authority supervises nearly all commercial banks^[1].

The Federal Reserve also supervises bank holding companies and certain other banking organizations, so the regulator for a banking group is not always the same as the chartering authority for an individual bank subsidiary. For consumer financial law, the Consumer Financial Protection Bureau has supervisory authority over banks, thrifts and credit unions with more than $10 billion in assets, as well as their affiliates, while smaller institutions are generally examined for federal consumer compliance by their prudential regulators. Financial institutions also have obligations under the Bank Secrecy Act and related anti-money-laundering rules administered through the Treasury Department and FinCEN.

A central bank and a bank regulator can therefore be the same institution in some respects without being the same concept. Central banks conduct monetary policy and provide core monetary and payment functions, while prudential supervisors examine bank safety and soundness and enforce applicable banking rules. The Federal Reserve does both in the United States, but the OCC and FDIC illustrate why bank supervision cannot be reduced to central banking alone.

Capital requirements absorb losses before creditors do

Capital is the part of a bank’s funding that can absorb losses without creating an immediate repayment obligation. In simplified terms, if a bank owns $100 of assets and owes $92 to depositors and other creditors, the remaining $8 represents equity capital. If the bank then suffers a $3 loss on its assets, that loss reduces the owners’ stake before it reduces the contractual amount owed to depositors. The more thinly capitalized a bank is, the smaller the loss needed to erase its equity.

Regulators do not normally rely on a single unadjusted capital percentage. Prudential frameworks distinguish among different forms of capital, place emphasis on higher-quality common equity, compare capital with risk-weighted assets and also use leverage measures that do not depend on risk weights. The purpose is to limit the amount of risk a bank can support with a very small equity cushion and to make it harder for apparently low-risk classifications to justify unlimited leverage.

The Basel III reforms strengthened the international framework after the 2007-09 crisis by raising the quality and quantity of bank capital, adding a leverage backstop and introducing broader capital buffers and liquidity standards. Basel standards are minimum requirements for internationally active banks rather than a single global banking law, so actual requirements still depend on how each jurisdiction implements them and on any additional domestic rules^[2].

Large and complex banks may face additional capital expectations because their failure could create wider disruption, and stress testing can influence how much capital they are required to maintain. The important distinction is that capital protects against losses, not simply withdrawals. A well-capitalized bank can still have a liquidity crisis, and a liquid bank can still be insolvent if the economic value of its assets is too low to cover its liabilities.

Liquidity regulation addresses the risk of sudden withdrawals

Liquidity is the bank’s ability to meet cash obligations when they come due without taking losses that threaten its viability. Cash and reserves at the central bank are immediately liquid, while high-quality marketable securities may be turned into cash quickly under normal conditions. A long-term business loan or an illiquid security may be economically valuable but cannot necessarily be converted into cash at face value on short notice.

Modern prudential rules therefore examine both the stock of liquid assets and the stability of a bank’s funding. Large banks may be required to hold enough high-quality liquid assets to withstand a period of stressed cash outflows, and longer-term funding rules are intended to reduce dependence on unstable short-term financing. Supervisors also review contingency funding plans, access to collateral and the assumptions banks use when estimating how quickly deposits or other funding might leave.

Access to a central bank does not make liquidity risk disappear. A central bank may lend against eligible collateral and provide a backstop when private funding markets are under stress, but a bank still needs appropriate collateral, operational readiness and a balance sheet that meets the lending facility’s conditions. Heavy reliance on emergency borrowing can also be a sign that ordinary liquidity management has already failed.

Reserve requirements should not be confused with capital or modern liquidity regulation. In the United States, the Federal Reserve reduced reserve requirement ratios to zero in March 2020, yet banks remained subject to capital standards, liquidity requirements where applicable and supervisory expectations for liquidity risk management. The change illustrates why the old idea that a fixed fraction of deposits must simply sit unused in a vault is not a good description of how bank safety is regulated today.

The 2023 failure of Silicon Valley Bank is a useful reminder of the distinction. The Federal Reserve’s post-failure review identified serious weaknesses in interest-rate and liquidity-risk management, a concentrated business model, heavy reliance on uninsured deposits and shortcomings in supervision. The episode also demonstrated how quickly withdrawals can accelerate when depositors are highly connected and digital banking makes large transfers possible in minutes rather than days.

Supervision turns written rules into ongoing oversight

Regulation establishes requirements, but supervision asks whether a bank is actually operating safely within them. Examiners review financial condition, asset quality, liquidity, capital, governance, internal controls and risk-management practices, and they can assess whether management is identifying problems early enough to correct them. Supervisors also collect data and compare a bank with peers, which can reveal concentrations or trends that are not obvious from one quarter’s headline ratios.

The supervisory process matters because risk often changes before an accounting measure becomes alarming. A bank can satisfy a formal capital ratio while taking concentrated credit risk, mismanaging interest-rate exposure, depending heavily on a narrow group of depositors or assuming that unstable funding will remain available. Examinations are intended to identify those weaknesses before they turn into losses or a run, although the quality and speed of supervision are themselves important and can fail.

For the largest banks, stress tests provide another forward-looking tool. Instead of asking only whether current capital exceeds a minimum, a stress test estimates how capital might change under a hypothetical severe recession, large market moves and credit losses. The exercise is not a forecast of the next crisis, but it can show whether a bank would still have enough capital to absorb modeled losses and continue lending under difficult conditions.

Supervisors can respond to deficiencies with escalating measures ranging from required remediation to formal enforcement actions, depending on the law and the seriousness of the problem. Effective oversight is therefore partly about rules and partly about judgment: a supervisor has to distinguish a temporary weakness from a material threat, require timely correction and avoid treating compliance with a checklist as proof that the institution is safe.

Deposit insurance and resolution limit the damage from failure

Deposit insurance is intended to protect eligible customers and reduce the incentive for ordinary depositors to run at the first sign of trouble. In the United States, the standard FDIC insurance amount is $250,000 per depositor, per FDIC-insured bank, for each account ownership category. Coverage depends on how accounts are owned and titled, so a customer with substantial deposits should not assume that every dollar at a bank is insured merely because the institution carries FDIC insurance^[3].

The broader principle is familiar in many banking systems: eligible deposits covered by government sponsored insurance schemes receive protection up to the limits and conditions set by the local regime. Insurance protects depositors, not the bank’s shareholders, and it does not make every creditor whole automatically. Shareholders can be wiped out in a failure, and uninsured creditors can remain exposed depending on the institution, the claims hierarchy and the resolution method.

Resolution rules address what happens after a bank is no longer viable. Authorities may close the institution, transfer deposits and selected assets to another bank, create a bridge institution or use another legally permitted resolution method. In the United States, the FDIC is required to choose the least costly resolution method to the Deposit Insurance Fund unless a statutory exception applies, which is different from promising to keep every bank open.

Insurance and resolution work best as complements to capital, liquidity and supervision rather than substitutes for them. Very broad guarantees can reduce run risk but also weaken incentives for depositors and creditors to pay attention to bank risk, a problem commonly described as moral hazard. Coverage limits, risk-based insurance assessments, prudential requirements and resolution rules are ways of trying to preserve confidence without converting every private banking loss into a public obligation.

Consumer protection and financial-crime rules form another layer

A bank can be financially sound and still mistreat customers, discriminate unlawfully, fail to provide required disclosures or handle customer information improperly. Consumer regulation therefore sits alongside prudential regulation rather than inside it. The exact statutes vary, but the general purpose is to set standards for how banks market products, disclose terms, service accounts and loans, resolve certain errors and comply with fair-lending and other consumer financial laws.

In the United States, responsibility again depends on the institution. The CFPB supervises depository institutions with more than $10 billion in assets for compliance with federal consumer financial law, while the federal prudential regulators retain consumer-compliance roles for many smaller banks. State law and state enforcement can also matter, which is another reason a statement that a bank is ‘regulated’ does not identify one single set of obligations.

Banks are also part of the framework used to detect money laundering and other illicit finance. The Bank Secrecy Act requires financial institutions to keep specified records and file certain reports, including reports concerning large cash transactions and suspicious activity. These requirements are not primarily designed to prevent a bank run or absorb credit losses; they serve a different public-policy objective and require banks to maintain compliance systems alongside their financial-risk controls.

Market conduct, privacy, sanctions, cybersecurity and operational resilience can introduce further obligations depending on jurisdiction and business model. A bank that offers securities services, derivatives, trust activities or cross-border products may also be subject to rules administered by agencies outside the traditional banking regulators. The practical result is that bank regulation is better understood as an overlapping framework than as a single license followed by one annual inspection.

Rules are tailored to bank size, complexity and risk

A small community bank with straightforward deposits and local loans does not create the same operational or systemic risk as a global banking group with trading businesses, foreign subsidiaries and trillions of dollars in assets. Regulators therefore tailor many requirements by size, complexity, activities and risk profile. The Federal Reserve, for example, organizes supervision differently for community, regional, large and systemically important banking organizations rather than applying every supervisory program identically.

Larger institutions can face more demanding stress testing, capital planning, liquidity, risk-management and resolution-planning expectations. The reason is not that smaller banks are harmless, but that the failure of a highly interconnected institution can be harder to resolve without disrupting critical services or transmitting losses and funding pressure elsewhere. Complexity also makes it more difficult for managers, boards and supervisors to see aggregate exposures across a group.

Tailoring creates its own trade-off. Requirements that are unnecessarily complex for a simple bank can raise compliance costs without producing a proportionate safety benefit, while thresholds that are too permissive can allow a fast-growing institution to accumulate risk before stronger safeguards apply. Good regulation therefore has to consider both the cost of a rule and the cost of allowing a material risk to remain insufficiently controlled.

That trade-off is one reason banking rules change after crises, periods of rapid growth and new technology. Regulators learn from failures, banks adapt to existing rules, and new products can create risks that older requirements were not designed to address. Stability does not require rules to remain frozen; it requires changes to be justified by the risks they are intended to manage and by evidence about how banks actually behave.

What bank regulation can and cannot guarantee

Bank regulation lowers the probability and potential cost of failure, but it cannot eliminate uncertainty. Credit losses can exceed expectations, interest rates can move sharply, fraud can evade controls, technology can fail and depositors can behave differently from the assumptions used in liquidity models. A system that permitted failure only when regulators had predicted it in advance would require a level of foresight that no regulatory regime possesses.

The relevant test is therefore not whether a regulated bank ever fails. A stronger question is whether banks maintain enough financial resilience to absorb ordinary and severe losses, whether supervisors identify material weaknesses early, whether insured depositors retain access to protected funds and whether authorities can resolve a failed institution without needlessly spreading disruption. Those objectives are connected, but each requires a different tool.

Regulation also affects the price and availability of banking services. More capital can make a bank safer but can change shareholders’ returns and the economics of certain lending activities; more compliance can reduce abusive or illicit activity while increasing operating costs. Those costs should be compared with the losses that weakly controlled banking risks can impose on depositors, borrowers, competing institutions and the wider economy, rather than treated as evidence that either more or less regulation is automatically preferable.

The most durable lesson is that regulation works as a system of defenses rather than a single barrier. Capital absorbs losses, liquidity standards address cash-flow stress, supervision tests how risks are being managed, conduct rules protect customers and market integrity, deposit insurance protects eligible depositors, and resolution rules provide a way to close a bank when prevention has failed. No layer is sufficient on its own, which is why modern banking regulation remains both extensive and continuously revised.