CAMELS Rating System: Current Exam Prep and the 2026 FFIEC Proposal

TL;DR

• The FFIEC published proposed UFIRS/CAMELS revisions on May 19, 2026 under Docket OCC-2026-0562. Comments closed August 17, 2026.
• As of October 22, 2026, no final revisions had been published. Examinations still run on the UFIRS as last updated in December 1996.
• The proposal would demote Management from its “special consideration” role in the composite and tie 3-or-worse ratings to material financial risk. Track it as regulatory change, not operative criteria.
• Ratings already drive real outcomes: since September 14, 2026, banks under $6 billion can get an 18-month exam cycle — but only with a composite 1 or 2 and a Management rating of 1 or 2.

October 22, 2026 Status Update

The Federal Register notice identifies the action as a proposed revision to the Uniform Financial Institutions Rating System. The OCC’s Bulletin 2026-22 likewise describes a proposal that would retain the existing framework while modifying component and composite definitions and evaluation factors.

The comment period closed August 17. A Federal Register search on October 22, 2026 turned up no final UFIRS notice. The comment deadline was a rulemaking milestone, not an effective date. Until the agencies publish final revisions and they take effect, banks and exam teams remain governed by the existing UFIRS.

Two related actions are final and change the exam environment now:

That distinction — final versus proposed — should appear in board papers, exam-prep decks, policies, and FAQs.

What CAMELS Measures

CAMELS organizes supervisory assessment into six components:

1. Capital adequacy — the amount and quality of capital relative to the institution’s risks.
2. Asset quality — credit risk, problem assets, concentrations, underwriting, and allowance practices.
3. Management — board and management capability, governance, controls, risk management, and responsiveness.
4. Earnings — level, trend, quality, sustainability, and exposure to material risks.
5. Liquidity — funding capacity, contingent sources, concentration, and resilience under stress.
6. Sensitivity to market risk — exposure to interest-rate and other market movements and the quality of risk management.

Ratings range from 1, strongest, to 5, weakest. The composite is not a spreadsheet average. A material weakness in one component can affect the overall conclusion more than several stronger components.

The framework is old. The FFIEC adopted the UFIRS on November 13, 1979, and last updated it on December 20, 1996, when the “S” component was added. The NCUA adopted the sensitivity component for credit unions in 2021, effective 2022.

Why the Ratings Matter Beyond the Exam Letter

CAMELS ratings are confidential, but they aren’t just a grade. They drive:

• Exam frequency. Under the September 2026 interim final rule, an insured depository institution under $6 billion qualifies for an 18-month full-scope, on-site cycle only if it is well capitalized, rated composite 1 (or 2, under the agencies’ discretionary extension), well managed — which requires a Management rating of 1 or 2 — not subject to a formal enforcement proceeding or order, and has had no change in control in the prior 12 months.
• Expansion authority. The proposal itself notes that composite and Management ratings bear on “well managed” status under the Bank Holding Company Act and National Bank Act, which can allow certain expansionary activities without prior approval.

Worked example: A $4.2 billion bank is well capitalized and rated composite 2, but carries a Management 3 after a string of repeat audit findings and slow remediation. Under the old $3 billion threshold it was on a 12-month cycle regardless. Under the September 2026 rule it would be under the $6 billion line — but the Management 3 means it isn’t well managed, so it stays on a 12-month cycle. Getting Management back to a 2 is now worth an extra six months between full-scope exams.

What the 2026 Proposal Would Change

The proposal keeps the 1-to-5 scale and the six components. What changes is how examiners get to a rating.

The Management component

The FFIEC also asked (Question 7) whether a less-than-satisfactory Management rating should be “rare” when every other component is satisfactory. That’s a question for comment, not proposed text.

The composite rating

The proposal redefines composites around financial performance: a 1 has strong performance with only minor risk management weaknesses; a 2 has moderate weaknesses that generally don’t create material financial risk; a 3 reflects less-than-satisfactory performance or inadequate risk management that creates material financial risk (significant noncompliance may also support it). A 4 is “deficient financial performance,” and the preamble says risk management weaknesses without observable deterioration or material risk would not alone support a 4 or worse. A 5 is critically deficient. Existing caps stay — a composite 3 generally allows no component more severe than 4.

Specialty reviews and reputation risk

Specialty areas — consumer compliance and BSA/AML, CRA, information systems, trust, transfer agent, and government and municipal securities dealers — would count toward UFIRS ratings only to the extent they affect overall financial condition or pose material financial risk, with significant noncompliance as an exception. For trust banks, trust findings would generally still feed composite and component ratings. All reputation risk references would be removed.

What the proposal does not do

It sets no numeric thresholds or ratios. “Material financial risk” is described qualitatively, not defined numerically. Be skeptical of any vendor deck that turns the proposal into a scoring formula.

Every verb matters. The proposal would amend the framework. It does not amend the framework merely because the comment period has closed. The OCC also published a Comptroller statement explaining the policy rationale; that supplies context, and the Federal Register notice supplies the proposed text.

A Two-Track Exam-Prep Method

Track 1: Prepare for the current examination

Build the evidence examiners can test now:

• current board and committee reporting;
• approved risk appetite and limits;
• capital and liquidity stress results;
• criticized and classified asset trends;
• audit and independent-review coverage;
• issue root causes, owners, milestones, and validation;
• management responses to prior findings, including matters requiring attention (MRAs); and
• documentation that material risks change decisions.

Responsiveness to auditors and supervisors is a factor the proposal would drop — but it’s a current Management factor today. Don’t let an open matter requiring attention age because a proposal might deemphasize it.

Track 2: Assess the proposed change

For each proposed revision, record:

• current UFIRS language;
• proposed language;
• affected policies, reports, models, and owners;
• possible examination or governance impact;
• dependencies on final agency wording; and
• the trigger for implementation.

The implementation trigger is publication of final action and its effective date — not the close of comments.

Four Practical Tests

1. Can every material weakness be traced to financial condition or legal risk?

Connect issues to capital, earnings, liquidity, asset quality, customers, operations, or legal exposure. If the proposal is finalized, this mapping is what separates a 2 from a 3. Don’t manufacture a financial impact to fit expected proposal language.

2. Does issue closure prove sustainability?

A closed task is not necessarily a closed risk. Retain implementation evidence, testing, exception trends, and accountable validation. Issue aging and reopen-rate KRIs are the fastest way to show examiners remediation actually sticks.

3. Are KRIs mapped to decisions?

A CAMELS dashboard should show thresholds, owners, escalation, and management action — not only ratios. For liquidity, that means contingency funding plan triggers tied to actions. Calibrate thresholds to the institution; don’t present a template threshold as an agency requirement.

4. Can the team explain current versus proposed criteria?

Test the distinction in a mock exam. If owners describe the proposal in present tense, correct the deck before it reaches examiners or the board.

Component Prep Checklist

Note the Management row: compensation, self-dealing, and conflicts of interest are a proposed new factor, and related-party controls are good practice either way.

So What?

The 2026 CAMELS revision may become consequential, especially for Management and composite-rating analysis. As of October 22, 2026, however, it remains a proposal with no final text.

Prepare for today’s exam under today’s framework. Track the proposal under Docket OCC-2026-0562. And remember the rating already moves real levers — a Management 2 versus 3 now decides whether a sub-$6 billion bank gets 18 months between full-scope exams.

The KRI Library can help organize component-level monitoring. Each indicator still needs institution-specific calibration, ownership, and evidence of management response.

Primary sources: Federal Register proposal, Docket OCC-2026-0562 | OCC Bulletin 2026-22 | OCC Comptroller statement | Expanded examination cycle interim final rule | Reputation risk final rule