Banking law is the body of federal and state rules that governs how banks and similar financial institutions operate, from how much capital they must keep on hand to how they treat the people who open accounts with them. It runs across dozens of statutes, several federal agencies, and all 50 state banking departments, but its purpose comes down to three jobs: keep banks solvent, keep customers safe, and keep criminal money out of the financial system.
The rules break naturally into those three tracks. What follows walks through each one, then covers who enforces them, who has to follow them, and what happens when a bank breaks the rules or fails outright.
Rules That Keep Banks Solvent
Prudential regulation is the part of banking law aimed at the health of the institution itself. The core idea is that a bank funded largely by borrowed money and customer deposits needs a cushion of its own capital to absorb losses before those depositors are at risk.
Federal regulators set minimum capital ratios that dictate how much of a bank’s funding must come from shareholders’ equity rather than debt. The FDIC’s Part 324, for instance, establishes minimum capital ratios and overall adequacy standards for the institutions it supervises.1Federal Deposit Insurance Corporation. Regulatory Capital Banks also have to manage liquidity, meaning they need enough cash or easily sellable assets to meet withdrawal demands and short-term obligations. The rules get stricter as banks get larger and more complex, with federal agencies sorting big banking organizations into risk-based tiers.2Office of the Comptroller of the Currency. Applicability Thresholds for Regulatory Capital and Liquidity Requirements – Final Rule
Stress Testing
The Dodd-Frank Act, passed after the 2008 financial crisis, added mandatory stress testing. Under Section 165, banks with $250 billion or more in total assets must model how they would perform under hypothetical economic crises, such as a severe recession or a housing collapse.3Office of the Comptroller of the Currency. Dodd-Frank Act Stress Test (Company Run) Banks that fall short have to plan how they will raise additional capital. Regulators want to know a bank can survive a crisis before one arrives.
The Volcker Rule
Section 619 of Dodd-Frank, codified at 12 U.S.C. § 1851, is known as the Volcker Rule. It prohibits banking entities from trading securities, derivatives, and certain other instruments for their own profit rather than on behalf of customers, and it bars them from owning or sponsoring hedge funds and private equity funds.4Office of the Law Revision Counsel. 12 US Code 1851 – Prohibitions on Proprietary Trading and Certain Relationships With Hedge Funds and Private Equity Funds The reasoning is that banks holding insured deposits shouldn’t be making speculative bets with that money.
Rules That Protect Customers
A large share of banking law exists to protect the people on the other side of the counter. Several federal statutes work in parallel to force fair lending, honest disclosure, and respect for financial privacy.
Fair Lending
The Equal Credit Opportunity Act makes it illegal for any creditor to discriminate against a loan applicant based on race, color, religion, national origin, sex, marital status, or age. It also prohibits discrimination because an applicant’s income comes from public assistance or because the applicant has exercised rights under consumer protection laws.5Office of the Law Revision Counsel. 15 US Code 1691 – Scope of Prohibition
Truth in Lending
The Truth in Lending Act, implemented through Regulation Z, requires lenders to disclose the true cost of borrowing before you sign. That covers the annual percentage rate, total finance charges, payment schedules, and the terms of adjustable-rate mortgages.6Consumer Financial Protection Bureau. 12 CFR Part 1026 – Truth in Lending (Regulation Z) The point is to let you compare offers from different lenders on equal terms.
Community Reinvestment
The Community Reinvestment Act requires federally insured banks to serve the credit needs of the communities where they do business, with particular attention to low- and moderate-income neighborhoods.7Office of the Law Revision Counsel. 12 US Code 2901 – Congressional Findings and Statement of Purpose Regulators grade banks on their CRA performance and use those ratings when the bank asks to open branches, merge, or expand. A poor rating can block growth plans, which gives the statute practical weight.
Financial Privacy
The Gramm-Leach-Bliley Act requires financial institutions to give customers a privacy notice explaining what personal information they collect, how they share it, and with whom. Customers can opt out of having their information shared with unaffiliated third parties, and institutions must give a reasonable window to exercise that right, typically at least 30 days.8Federal Deposit Insurance Corporation. VIII-1 Gramm-Leach-Bliley Act (Privacy of Consumer Financial Information) The law also includes a safeguards rule requiring institutions to maintain security programs protecting customer data from unauthorized access.
Rules That Block Financial Crime
Banks sit at the center of the financial system, which makes them useful to criminals and useful to law enforcement. Two statutes turn banks into gatekeepers.
The Bank Secrecy Act, codified at 31 U.S.C. § 5311 and following, requires financial institutions to keep records and file reports that help law enforcement detect money laundering, tax evasion, terrorist financing, and fraud.9Office of the Law Revision Counsel. 31 US Code 5311 – Declaration of Purpose The most visible piece is currency transaction reporting: banks must file a report for every cash transaction over $10,000, and multiple cash transactions in a single day that together exceed $10,000 count as one.10FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Currency Transaction Reporting Banks also file Suspicious Activity Reports when they detect potential criminal conduct, with reporting thresholds that vary by circumstance and drop to zero for insider abuse.11eCFR. 12 CFR 21.11 – Suspicious Activity Report
The USA PATRIOT Act, passed after September 11, 2001, amended the Bank Secrecy Act. Section 326 created the Customer Identification Program requirement: every financial institution must verify the identity of anyone opening an account by collecting and confirming their name, address, and other identifying information, and by checking government lists of known or suspected terrorists.12Federal Register. Customer Identification Programs, Anti-Money Laundering Programs, and Beneficial Ownership That is the reason opening a bank account requires a government-issued ID.
Who Enforces Banking Law
No single agency oversees the entire U.S. banking system. Authority is split among several federal agencies and 50 state banking departments, and a bank’s primary regulator depends on how it was chartered.
- The Office of the Comptroller of the Currency regulates banks chartered under the National Bank Act and federal savings associations. If a bank has “National” in its name or “N.A.” after it, the OCC is almost certainly its primary federal regulator.13Office of the Comptroller of the Currency. OCC Regulations
- The Federal Reserve supervises state-chartered banks that have joined the Federal Reserve System, and it has authority over all bank holding companies and savings and loan holding companies regardless of where their subsidiary banks are chartered.14Federal Reserve. Bank Holding Company Supervision Manual
- The Federal Deposit Insurance Corporation is the primary federal regulator of state-chartered banks that are not Fed members. It also insures deposits at virtually all U.S. banks and manages the resolution process when a bank fails.15Federal Deposit Insurance Corporation. About the FDIC
- The Consumer Financial Protection Bureau, created by Dodd-Frank, enforces federal consumer financial protection laws and supervises large banks and certain non-bank financial companies. Since early 2025, the CFPB has significantly reduced the size and scope of its operations, and the extent of those changes remains the subject of ongoing litigation.16Consumer Financial Protection Bureau. About the Consumer Financial Protection Bureau17Government Accountability Office. Consumer Financial Protection Bureau: Status of Reorganization
- State banking departments charter and supervise state-chartered banks and credit unions. A state-chartered bank will always have both a state and a federal primary regulator.
The overlapping structure means no single agency has unchecked power over the system. The trade-off is complexity: banks sometimes face examinations from multiple regulators covering different pieces of their operations.
Deposit Insurance
Deposit insurance is the most tangible piece of banking law for most people. The FDIC insures deposits up to $250,000 per depositor, per FDIC-insured bank, for each account ownership category.18Federal Deposit Insurance Corporation. Understanding Deposit Insurance A single person with a checking account and a savings account at the same bank is covered up to $250,000 total for those accounts, but a joint account sits in a separate category, so a married couple can effectively insure more by using different ownership structures at the same institution.
Coverage applies to checking accounts, savings accounts, money market deposit accounts, and certificates of deposit. It does not extend to stocks, bonds, or mutual funds, even if you bought them through your bank. The insurance is automatic. You don’t apply and don’t pay a premium; banks fund it through assessments paid to the FDIC.
Who Has to Follow Banking Law
Banking law applies most directly to traditional depository institutions, but its reach extends further.
- Commercial banks accept deposits, make loans, and offer checking accounts. Whether nationally or state-chartered, they face the full range of prudential, consumer protection, and anti-money-laundering requirements.
- Savings associations, sometimes called thrifts, historically focused on home mortgage lending and savings accounts. They are regulated by the OCC at the federal level and face capital and consumer protection requirements similar to commercial banks.
- Credit unions are member-owned cooperatives offering many of the same services as banks. They have their own federal regulator, the National Credit Union Administration, and a parallel but distinct set of rules.
- Bank holding companies fall under Federal Reserve oversight. The Fed examines the holding company as a whole, looking at how the parent’s activities and financial condition affect its bank subsidiaries.14Federal Reserve. Bank Holding Company Supervision Manual
- Fintech companies and non-bank financial firms can fall under specific pieces of banking law without holding a traditional bank charter. The OCC has granted limited-purpose national trust bank charters to fintech firms providing services like digital asset custody and settlement.19Office of the Comptroller of the Currency. Corporate Decision 1367 – Preliminary Conditional Approval for Foris DAX National Trust Bank
When Banks Break the Rules
Regulators have a wide range of enforcement tools, and the consequences escalate with the severity of the problem.
At the lower end, a regulator can enter into a formal agreement with a bank’s board, a written contract requiring the bank to fix specific problems by set deadlines. If a bank ignores warnings or engages in unsafe practices, regulators can issue cease and desist orders under 12 U.S.C. § 1818(b), which legally compel the bank to stop the harmful conduct and take corrective action. Those orders can also require restitution to harmed customers.20Office of the Comptroller of the Currency. Enforcement Action Types
For more serious violations, regulators impose civil money penalties under a three-tier system, with amounts adjusted annually for inflation. Penalties increase sharply based on whether the violation was inadvertent, knowing, or part of a pattern that caused substantial losses.21Federal Deposit Insurance Corporation. Section 14.1 – Civil Money Penalties Regulators can also remove individual officers and directors and permanently ban them from working at any insured institution. When capital falls dangerously low, prompt corrective action directives force increasingly severe restrictions, up to closure.
When a Bank Fails
Even with these safeguards, banks sometimes fail. For an ordinary bank, the chartering authority closes the institution and the FDIC steps in as receiver. The FDIC’s usual approach is to sell the failed bank’s deposits and loans to a healthy acquiring institution, so customers often experience little more than a name change on their accounts.15Federal Deposit Insurance Corporation. About the FDIC
The largest and most complex firms are different, because an ordinary bankruptcy of that scale could destabilize the financial system. Title II of the Dodd-Frank Act created the Orderly Liquidation Authority for that scenario. The Secretary of the Treasury must first determine that a firm is in default or close to it, and then evaluate whether its failure poses a systemic risk. If both conditions are met, the FDIC is appointed as receiver and takes control of the firm’s assets and operations. The FDIC can sell assets, create temporary bridge institutions to maintain critical functions, and wind down the company. Costs are covered by a dedicated fund paid for by the financial industry rather than taxpayers, and claims are paid according to a strict priority, with administrative costs and employee wages ahead of executive compensation and equity holders at the back of the line.
The two-track system reflects a lesson from 2008: the tools for closing a small community bank don’t scale to a trillion-dollar institution with global operations. The orderly liquidation process exists so regulators don’t again have to choose between a chaotic bankruptcy and a taxpayer bailout.