To read a consent order, start with four things: who issued it and under which law, what the regulator found, which clauses limit new partners or products, and whether it is still in force. This guide walks through each part using real sponsor-bank orders from the FDIC, the OCC and the Federal Reserve, and shows where to check an order’s status before you sign with a bank or renew a program.
What a consent order is
Under 12 U.S.C. 1818(b), a federal banking agency can order a bank to cease and desist from an unsafe or unsound practice or a violation of law, and “to take affirmative action to correct the conditions resulting from any such violation or practice”. When the bank agrees to the order instead of going to a hearing, the order is issued upon consent. The FDIC titles these orders “Consent Order”.
In the stipulation that comes with the order, the bank typically consents “without admitting or denying” the charges. That wording appears, for example, in Sutton Bank’s 2024 order, FDIC-23-0110b.
Consent orders are one of several formal actions:
| Action | Who uses it | What it is |
|---|---|---|
| Consent order or cease-and-desist order | FDIC, OCC, Federal Reserve | An order under 12 U.S.C. 1818(b) to stop a practice and take corrective action |
| Formal agreement | OCC | A written agreement signed by the OCC and the bank’s board |
| Written agreement | Federal Reserve | A written agreement between the Federal Reserve and the bank or holding company |
| Civil money penalty | FDIC, OCC, Federal Reserve | A fine under 12 U.S.C. 1818(i)(2), in three tiers by severity |
Source: 12 U.S.C. 1818, OCC Policies and Procedures Manual 5310-3, revised August 27, 2026 · checked September 2, 2026
The OCC’s revised enforcement manual says its formal agreements “are not enforceable through the federal court system”, and that when it escalates to a formal action it “generally seeks a C&D order”.
Where to find an order
The statute requires each agency to publish final orders, enforceable written agreements and “any modification to or termination of any order or agreement made public” every month (12 U.S.C. 1818(u)).
- FDIC: the Enforcement Decisions and Orders database and a monthly press release.
- OCC: the Enforcement Action Search and a monthly news release.
- Federal Reserve: enforcement action press releases with the order attached.
Orders become public about a month after they are signed. Cross River Bank’s order is dated March 8, 2023 and was made public on April 28, 2023; Community Federal Savings Bank’s is dated April 24, 2026 and was made public on May 21, 2026. Our sponsor bank enforcement actions tracker links each order and its status.
The parts of an order
- Caption. The bank, its location, the docket number and, for joint orders, the state regulator. Sutton Bank’s order carries both the FDIC number FDIC-23-0110b and the Ohio number BA2023-01.
- Findings. What the examiners found, often by reference to a report of examination. The OCC’s order against Community Federal Savings Bank finds that it “has significantly grown its payment processing line, relative to its size”.
- Governance. Board oversight, a compliance committee and qualified staff, such as a BSA officer who reports to the board.
- Programs with deadlines. Sutton had 180 days to adopt a revised anti-money-laundering program and 90 days to adopt third-party risk management policies.
- Restrictions. Limits on new partners, products or growth. These are the clauses that matter most to a fintech.
- Lookbacks. A review of past customers or transactions, such as Sutton’s customer identification lookback of prepaid card customers from July 1, 2020.
- Reporting. Reports to the regulator, such as Sutton’s quarterly reporting on third parties’ compliance.
Clauses that limit fintech partners
These clauses decide whether a bank can take on a new program while the order is in force:
| Type of clause | Example | Order |
|---|---|---|
| Regulator non-objection before a new partner or product | “without first receiving the Regional Director’s written non-objection” | Cross River Bank, FDIC-22-0040b |
| Supervisors’ prior approval for new fintech partners | New fintech partners, program managers or products need “the prior written approval of the Supervisors” | Evolve Bank & Trust, Federal Reserve |
| Onboarding freeze until a process exists | No new fintech partners until the formal onboarding process is approved and implemented | Lineage Bank, FDIC-23-0041b |
| Freeze on a channel | No new ISOs or sub-ISOs until the ISO review plan is implemented | FFB Bank, FDIC-24-0112b |
| Board approval | No new or renewed third-party relationship without the board’s prior written approval | Piermont Bank, FDIC-23-0038b |
Source: the orders linked in the enforcement tracker · checked September 2, 2026
Of the 17 actions in our tracker, seven limit new partners or products without a regulator’s approval or until controls are fixed, and five of those seven were still in force on September 2, 2026. An order without such a clause, like Sutton’s, can still require the bank to tighten its oversight of every existing program.
How orders end
An order stays in effect until the regulator modifies or terminates it, and the termination is published like the order. The OCC’s revised manual says it terminates an action on “substantial compliance”, when “the deficiency has substantively been cured, even if the bank has not satisfied all technical requirements of the action”. The FDIC also allows termination on substantial compliance under a policy update dated September 8, 2025, according to its enforcement manual.
In our tracker, the seven terminated actions lasted between about 9 and 26 months. Hatch Bank’s order ran from April 2025 to January 2026; Metropolitan Commercial Bank’s Federal Reserve order ran from October 2023 to December 2025.
What changes in November 2026
From November 2, 2026, an OCC and FDIC final rule defines “unsafe or unsound practice” for enforcement under 12 U.S.C. 1818. As restated in the OCC’s manual, a practice is unsafe or unsound if it is contrary to generally accepted standards of prudent operation and, if continued, is likely to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund. The rule was published at 91 FR 56004 on September 1, 2026. The Federal Reserve is not a party to it.
A checklist for reading an order
- Find the issuing agency, the docket number and the date.
- Read the findings to see which business line triggered the order.
- Look for words such as “non-objection”, “prior written approval” or “shall not onboard”.
- Note the deadlines and any lookback periods.
- Check the regulator’s latest monthly release for a termination or amendment.
