FFIEC Business Continuity Management Booklet: What Examiners Actually Check (and the Reported 2026 Reputation-Risk Edits)

In February 2026, the Federal Financial Institutions Examination Council made a change to its IT Examination Handbook that was quiet in word count and significant in implication: references to reputational risk were removed, including from the Business Continuity Management (BCM) booklet. The FFIEC’s IT Handbook “What’s New” page logged the update on February 27, 2026, describing it as removing references to reputational risk consistent with Executive Order 14331 and stating that the updates do not establish new requirements. One compliance vendor, Tandem, counted 92 instances removed across the Handbook. The FFIEC made a similar, separately reported change to the BSA/AML Examination Manual in March 2026.

The trigger was Executive Order 14331, “Guaranteeing Fair Banking for All Americans,” signed August 7, 2025. Section 4 directed each federal banking regulator, within 180 days, to “remove the use of reputation risk or equivalent concepts that could result in politicized or unlawful debanking” from its guidance and examiner materials. In the 2019 BCM booklet, reputation showed up mainly in the BIA and risk assessment sections, which listed reputational impacts alongside operational and financial ones.

In the BCM booklet itself, the edit comes down to exactly three sentences, and the FFIEC says none of it creates new requirements. We compared the archived 2019 text with the live booklet sentence by sentence; the before-and-after wording is on our FFIEC BCM booklet reference page. Either way, it’s a good reason to open the BCM booklet — and for many practitioners, that’s worth doing regardless.

TL;DR

• February 2026: the FFIEC removed reputational-risk references from the IT Handbook following Executive Order 14331. In the BCM booklet, three sentences changed (III.A.3, III.B.2, V.F.3); no new requirements. Our read: express reputational concerns as measurable operational and financial impacts.
• The BCM booklet (renamed from “Business Continuity Planning” in November 2019) governs how examiners assess governance, BIA, risk assessment, BCM strategy, BCP, testing, and board reporting.
• Appendix A contains the specific examination procedures — the closest thing to a pre-exam checklist examiners actually use.
• Examiners verify that RTOs, RPOs, and MTDs from the BIA are validated through actual testing — not just documented in a plan.

What Changed and Why It Matters Practically

Reputation risk wasn’t a major feature of the BCM booklet. Exactly three sentences changed:

The full sentences, side by side, are on the FFIEC BCM booklet reference page. The change has two practical implications.

First, consider how your BIA impact categories are framed. This is our interpretation, not FFIEC text: if your BIA scores reputation as a standalone dimension — “moderate reputational harm” or “significant public perception risk” — consider tying those tiers to measurable consequences. You don’t have to delete customer or reputational impact; customer harm is still a legitimate qualitative criterion. Translate those concerns into quantified financial impacts: revenue lost per hour of downtime, regulatory penalty exposure from missed notification deadlines, and contractual SLA breach costs with key clients. The underlying concern remains legitimate; the framing needs to become measurable.

Second, don’t overreact. The FFIEC says the updates do not establish new requirements. Institutions that had strong BCM programs before the update still have strong programs. The change affects how impact is framed in documentation, not whether you need a BIA, a BCP, or a tested recovery strategy.

Section-by-Section: What the FFIEC BCM Booklet Actually Requires

The BCM booklet is organized into an introduction and nine sections, plus four appendices (examination procedures, glossary, abbreviations, and references). Here is what each section covers and what examiners specifically assess.

Introduction and I. Business Continuity Management

Sets the foundation: the booklet applies to FFIEC member agency supervised institutions and service providers. BCM is defined as the process to ensure the availability of critical financial services — covering operations, personnel, technology, and resources. The renamed framing (from “Business Continuity Planning” to “Business Continuity Management”) signals a shift toward ongoing, enterprise-integrated management rather than a plan-on-a-shelf.

II. BCM Governance

Examiners look for evidence that the board and senior management actively oversee the BCM program — not just that a program exists. Specifically:

• A board-approved BCM policy with defined scope and objectives
• Clear accountability: who owns the BCM program and who is responsible for specific components
• Integration with enterprise risk management (ERM), so BCM findings and gaps surface in the institution’s broader risk picture
• Evidence of board-level engagement — BCM is discussed at the board, not only in operational committees

Many programs fail governance review not because the structure doesn’t exist, but because the documentation trail from BCM activities back to board-level awareness is thin. Board meeting minutes are the examiner’s primary evidence source here.

III. Risk Management — BIA and Risk Assessment

This section is typically the most thoroughly examined component. It contains two parallel requirements.

Business Impact Analysis (BIA):

The BIA must identify critical business functions, the resources they depend on, and the impact of disruption over time at varying recovery durations. The booklet names three “Common measurements” for recovery objectives, and Appendix A checks whether the BIA “produces sufficient information to estimate” them:

• Recovery Point Objective (RPO): The point in time before a disruption from which data can be recovered. How much data loss is acceptable — specifically, how old can your most recent clean backup be?
• Recovery Time Objective (RTO): The maximum time a system or process can be offline before the impact on business operations becomes unacceptable.
• Maximum Tolerable Downtime (MTD): In the booklet’s words, “the total amount of time the system owner or authorizing official is willing to accept for a business process disruption and includes all impact considerations.” It’s the outer boundary your RTO has to sit inside.

The RTO-MTD relationship is where many institutions have a gap: RTOs are set without establishing the MTD boundary, which means RTOs can drift upward in practice without a hard constraint. Examiners who read the booklet closely will ask about MTD separately.

Setting defensible RTOs and RPOs — with the methodology for quantifying and documenting them — is covered here.

Risk Assessment:

The risk assessment identifies potential threats and scenarios — natural disasters, cyber incidents, infrastructure failures, workforce disruptions, third-party failures — and assesses their likelihood and potential impact on critical functions. The output feeds directly into BIA prioritization and BCM strategy selection. Examiners expect the risk assessment to have been updated after significant events or organizational changes, not just on an annual schedule.

IV. BCM Strategies

Examiners assess whether recovery strategies are:

• Evaluated for each critical function (not selected once and never revisited)
• Chosen based on cost, feasibility, and alignment with RTOs from the BIA
• Verified to actually work — “failover to hot site” is insufficient if the hot site hasn’t been tested at peak transaction volumes

Concentration risk is assessed here: single points of failure in critical processes, technology infrastructure, or third-party dependencies. An institution whose payment processing depends entirely on one cloud provider with no documented failover path for that specific service is a concentration risk finding waiting to happen.

V. Business Continuity Plan

The BCP is the documented response framework. Examiners verify it covers:

• Activation criteria: what triggers the plan, who makes the call, and what authority they have
• Roles and responsibilities during an incident, with named backups for all critical positions
• Communication procedures — internal escalation chains, customer notification, and regulatory notification sequences
• IT recovery and disaster recovery procedures with reference to system-specific RTOs and RPOs
• Alternate operating procedures for periods when technology is unavailable (manual workarounds)
• Third-party coordination: which critical vendors are expected to do what, on what timeline

The crisis communication plan is a component that should be embedded in or annexed to the BCP, covering customer communication, media response, and regulatory disclosure. Its absence from the BCP document is a common exam finding.

VI–VIII. Training, Exercises and Tests, and Maintenance

Section VI covers training: management “should implement a business continuity training program for all stakeholders,” and the board “should be responsible for the training program’s effectiveness.” Sections VII (Exercises and Tests) and VIII (Maintenance and Improvement) are where most programs have their largest and most consequential gaps.

The booklet requires that BCM testing validates the objectives established in the BIA — specifically, that the institution can actually recover within its stated RTOs and RPOs. Appendix A is direct about this: examiners check whether test plans address validating RPOs, RTOs, and MTDs, and whether systems can support critical business processes at peak volumes during a recovery scenario.

What examiners look for in testing per Appendix A:

• Does the test plan have stated objectives that align with BIA recovery targets?
• Are test results documented with pass/fail determinations, not just “exercise completed”?
• Are issues identified during testing tracked to remediation with responsible owners and due dates?
• Is there evidence of progression — more rigorous testing over time, not annual tabletops indefinitely?

The most common gap: institutions conduct tabletop exercises annually but haven’t run an actual DR failover in years — or ran one without verifying that the recovered environment could handle realistic transaction volumes. A tabletop that ends with “we think we could recover” is not validation.

Running tabletop exercises that actually reveal gaps — rather than confirm assumptions — is covered here.

Maintenance requirements:

The booklet doesn’t set a fixed review cycle — Section IX says business continuity activities should be “reviewed periodically or as changes dictate.” In practice, examiners commonly expect the BIA, risk assessment, and BCP to be reviewed at least annually and after significant changes to business processes, technology, or organizational structure. “After significant changes” is not defined with precision, but examiners will ask whether a major product launch, a core banking system migration, a significant acquisition, or a key third-party relationship change triggered a documented BCM review. Document the trigger and the review outcome — not just the annual update date.

IX. Board Reporting

The Appendix A examination procedures are specific about board reporting content. Examiners review board minutes and determine whether reports include “a written BCM presentation, including the BIA, risk assessment, BCP, exercise and test results, and identified issues.” In practice that means:

• The BIA (summary level, not the full document)
• The risk assessment
• The BCP
• Exercise and test results
• Identified issues and remediation status

An examiner will ask to see board meeting minutes evidencing this presentation occurred. A BCM status update buried in a committee report that never reached the full board is unlikely to satisfy examiners. Section IX also says “Board minutes should reflect business continuity discussion (including credible challenges) and approvals.” The board presentation must be substantive enough to demonstrate that the board understands the institution’s BCM posture and any material gaps.

What the 2026 Change Means for Your Documentation

If you want to align with the February 2026 change, these are the three areas to review. This is our interpretation, not FFIEC text:

BIA impact scoring tables: Consider whether a standalone reputation dimension still earns its place, or whether those concerns are better expressed as measurable consequences: revenue per hour of downtime for each critical function, regulatory penalty exposure for notification deadline failures, and contractual breach exposure with material clients. These are defensible, auditable, and measurable. Reputational concerns are real — expressing them as customer and financial consequences makes them easier to defend, whatever the examiner’s lens.

Crisis communication plan language: The reputation risk removal (including V.F.3’s crisis-management sentence, which now refers to “the entity and personnel”) affects the examination framework, not the underlying regulatory obligations to communicate with customers and regulators during incidents. Your crisis communication plan should still address customer notification timelines (Reg S-P, state breach laws), regulatory notification protocols (36-hour rule, CIRCIA when finalized), and media response procedures. The change is in how examiners score your BCM documentation, not in whether you need the plan.

Program narrative and policy: Review your BCM policy and program description for any language that cites reputation risk as a primary driver or objective of the BCM program. Revising to focus on operational resilience, financial stability, and regulatory compliance alignment is straightforward and makes the program more defensible regardless of the examiner’s lens.

Appendix A: The Pre-Exam Checklist You Should Be Using

Appendix A of the BCM booklet contains the specific examination procedures. These are the questions examiners use when they evaluate your BCM program. Reading it is the most efficient BCM preparation available.

So What?

The February 2026 reputation risk change is a modest edit to an important document. The underlying FFIEC BCM framework — BIA, risk assessment, strategy, plan, test, board report — has not changed. What changes is the expectation that impact assessments speak in the language of measurable financial and operational risk, not subjective reputational considerations.

For institutions whose BCM documentation hasn’t been touched since 2022 or 2023, the update is a useful reason to do a full review. The Appendix A examination procedures haven’t changed either, but many programs haven’t been assessed against them with fresh eyes in a while.

The BCP/DR Kit includes Risk Assessment, Business Impact Analysis, Dependency Mapping, Recovery Procedures, Emergency Contacts, Test & Exercise Log, Action Items, Dashboard and Board Report (Quarterly) tabs, a 38-page guide, a Tabletop Exercise Kit and Case Study Walkthroughs. Its 5-level impact scale is built on customer, money-movement and regulatory consequences rather than a reputational category; map your evidence to Appendix A yourself.

If the question you’re dreading is “can you show me your test results validating your RTOs,” start there.