Bank Director Training: What Board Members Need to Know

9/17/2026

Bank directors are usually chosen for what they know about something other than banking. A community bank board might include a business owner, a lawyer, an accountant, a physician and a retired executive, each bringing judgment and local knowledge. What none of them brought on day one was an understanding of what a bank board is legally required to do, which decisions only the board can make, and which of their own transactions with the bank are restricted by federal regulation.

That gap is why bank director training matters. Directors are expected to oversee a regulated institution, approve programs whose technical content is specialized, and stay out of the conflicts that insider lending rules exist to prevent. Examiners assess the board as well as management, and an examination report can and does criticize directors who did not understand what they approved.

This guide covers what board members need to know, organized around the duties that most often appear in regulation and examination: oversight, the programs the board must approve, insider lending under Regulation O, risk appetite, and how the board documents its own training.

What the Board Is For

The FDIC's long-standing Pocket Guide for Directors summarizes a director's core responsibilities: select and retain competent management; establish, with management, the bank's long- and short-term business objectives and adopt operating policies to achieve them in a legal and sound manner; monitor operations to make sure they are adequately controlled and comply with laws and policies; oversee the bank's business performance; and make sure the bank helps meet its community's credit needs. The OCC's Director's Book, revised in 2020, covers the same ground for national banks and federal savings associations in more detail.

The distinction running through both is between oversight and management. Directors do not run the bank day to day. They set direction, approve policies and risk tolerances, hire and evaluate senior management, and hold management accountable through reports and questions. Training is what makes those questions good ones.

Duties of care and loyalty

Directors owe the bank fiduciary duties under state corporate law and banking law. The duty of care requires directors to act in good faith, with the care an ordinarily prudent person would exercise, and on an informed basis. In practice that means reading the board package, attending meetings, asking questions and making sure the minutes reflect real deliberation. The duty of loyalty requires directors to put the bank's interests ahead of their own, which is where insider lending, conflicts of interest and confidentiality come in.

A director who approves something they did not understand has not met the duty of care simply by being present. That is the practical argument for training.

The Programs Only the Board Can Approve

Several federal rules require board approval of specific programs. Directors should know which ones, because approval without understanding is a common examination criticism.

The BSA/AML program

Each federal banking agency's rule requires a written BSA compliance program approved by the board and reflected in the minutes. For national banks and federal savings associations the requirement is at 12 CFR 21.21; for FDIC-supervised banks it is at 12 CFR 326.8. FinCEN's rule at 31 CFR 1020.210 sets the minimum program elements: internal controls, independent testing, a designated BSA officer, training for appropriate personnel, and risk-based customer due diligence.

Board-level BSA training should cover enough of the regime for directors to judge whether the program is adequate: what the bank's money laundering risk profile is, what the independent test found, what the BSA officer needs in authority and resources, and what the suspicious activity and currency reporting obligations are. Directors also need to understand that disclosure of a suspicious activity report is prohibited, which shapes how SAR information is reported to the board. Our post on BSA officer responsibilities describes the role the board must support.

The information security program

The interagency guidelines on safeguarding customer information, issued under the Gramm-Leach-Bliley Act, require the board or an appropriate board committee to approve the bank's written information security program and to oversee its development, implementation and maintenance, including assigning responsibility and reviewing management reports. Management must report to the board at least annually on the program's overall status and the bank's compliance with the guidelines. Our post on GLBA safeguards and information security programs covers what that report should address.

Other approvals

Depending on the bank's charter, size and activities, the board also approves or oversees the loan policy and lending limits, the investment and asset-liability policies, the compliance management system, the bank security program under the Bank Protection Act rules, capital and liquidity planning, and the audit program. Each carries its own regulatory expectations. The common thread is that a director should be able to explain, in plain terms, what each policy is for and what the reports on it are telling the board.

Insider Lending Under Regulation O

Regulation O, the Federal Reserve's rule at 12 CFR part 215, is the area where directors' own conduct is most directly regulated. It applies to member banks, and the FDIC applies its restrictions to FDIC-supervised banks through 12 CFR 337.3. Every director needs to understand it, because the director is personally covered.

Who is an insider

Reg O defines an insider as an executive officer, director or principal shareholder, including any related interest of such a person. A principal shareholder generally owns, controls or has the power to vote more than 10 percent of a class of voting securities, with shares held by immediate family members attributed to the individual. A related interest includes a company the insider controls, which can be triggered by owning or controlling 25 percent or more of its voting securities, among other tests. A director's operating business is often a related interest, which is why Reg O reaches far beyond loans to the director personally.

The core rules

Terms and creditworthiness. Credit to an insider must be made on substantially the same terms, including interest rates and collateral, as comparable transactions with non-insiders, following underwriting procedures no less stringent, and must not involve more than the normal risk of repayment or present other unfavorable features. There is an exception for benefit or compensation programs widely available to employees that do not prefer insiders.
Prior board approval. Credit to an insider that, aggregated with all other credit to that person and their related interests, exceeds the higher of $25,000 or 5 percent of the bank's unimpaired capital and unimpaired surplus must be approved in advance by a majority of the entire board, with the interested party abstaining. Credit above $500,000 in aggregate always requires that prior approval. A line of credit approved within the preceding 14 months does not need fresh approval for each draw.
Individual lending limit. Credit to an insider and their related interests is subject to the same limit as loans to one borrower: generally 15 percent of unimpaired capital and unimpaired surplus for credit that is not fully secured, plus an additional 10 percent for credit fully secured by readily marketable collateral.
Aggregate limit. Total credit to all insiders generally may not exceed the bank's unimpaired capital and unimpaired surplus. A bank with deposits of less than $100 million may raise the limit up to twice that amount by an annual board resolution meeting the rule's conditions.
A bank may not pay an overdraft of an executive officer or director except under a written, preauthorized interest-bearing credit plan or a written, preauthorized transfer from another account. Inadvertent overdrafts of $1,000 or less are permitted if the account is not overdrawn for more than five business days and the normal fee is charged.
Knowingly receiving credit. Insiders themselves are prohibited from knowingly receiving credit that Reg O does not authorize. The obligation is personal, not only the bank's.

Additional limits on executive officers

Executive officers face tighter rules. A bank may lend to its own executive officers in any amount to finance their children's education or a first-lien-secured residence they own, and in any amount secured by specified low-risk collateral; for other purposes, aggregate credit may not exceed the higher of 2.5 percent of unimpaired capital and unimpaired surplus or $25,000, and never more than $100,000. Credit to executive officers must be promptly reported to the board and preceded by a current financial statement.

Recordkeeping

The bank must keep records necessary to comply, including an annual survey to identify all insiders and records of the amount and terms of each extension of credit to them. Directors usually experience this as an annual questionnaire, and accurate answers about related interests are the director's contribution to compliance.

Reg O violations are among the most common board-level examination findings, and many arise from directors who did not realize that a business they control was a related interest. The Loans to Insiders (Reg O) course is built around this regulation and is a practical way for directors, executive officers and lending staff to learn it together.

Risk Appetite and Strategic Oversight

Boards set the level of risk the bank is willing to take in pursuit of its strategy, and then monitor whether management stays within it. At every bank this shows up in policy limits: concentration limits in the loan policy, interest rate risk limits, liquidity targets and capital ratios. Directors need enough understanding of each risk to judge whether the limits are sensible and whether the reports show the bank operating within them.

For the largest national banks, the OCC's heightened standards at 12 CFR part 30, appendix D, formalize this. They call for a written risk governance framework, a risk appetite statement and, notably, a formal, ongoing training program for all directors that considers each director's knowledge and experience and the bank's risk profile, covering complex products and risks, applicable laws and regulations, and other topics the board identifies. Community banks are not subject to those guidelines, but they describe what good board training looks like at any size. Our post on enterprise risk management explains how risk appetite connects to the rest of the framework.

What Board Training Should Cover

Pulling these duties together, a sound bank board training program covers:

Area	Why directors need it
Director duties and governance	Duty of care and loyalty, the board's role versus management's
BSA/AML	The board approves the program and must judge its adequacy
Information security	The board approves the program and receives the annual report
Regulation O	Directors are personally covered and must approve large insider credits
Credit and concentration risk	The board sets loan policy and limits
Interest rate, liquidity and capital	The board sets risk tolerances and monitors them
Compliance management	The board oversees the compliance program and examination remediation
Conflicts and ethics	Including the federal bank bribery statute and the bank's own code

Courses that support those areas include the Certificate in Risk Management, the Certificate in Compliance Management System (CMS), BSA/Anti-Money Laundering and the Bank Bribery Act course. Our post on compliance management systems explains what the board's compliance oversight involves.

Documenting the Board's Training

Board training is often delivered and rarely recorded well. The evidence standard matters: a record naming the date, the content covered and the directors who attended is defensible. A minute entry saying the board "received a compliance update" is not.

Good practice includes:

Orientation for new directors before or soon after they join, covering governance duties, Reg O and the bank's key policies
Annual training on BSA/AML and other areas where the board approves a program
Targeted sessions when regulations change, when the bank enters a new line of business or after an examination finding
A training log maintained by the corporate secretary or compliance officer, with materials retained
Self-assessment, so the board identifies its own knowledge gaps rather than waiting for examiners to do it

Getting Your Board Trained

For most community bank boards, the most urgent training is on the two areas where directors are personally exposed or must sign off: Regulation O and the BSA program. Start with the Loans to Insiders (Reg O) course for every director and executive officer, add BSA/AML and risk management training on an annual cycle, and record every session properly.

Frequently Asked Questions

Is training required for bank directors?

No federal rule sets a universal hour requirement for bank director training, but the duties directors carry make training a practical necessity. Directors must approve the BSA/AML program and the information security program, approve large insider credits under Regulation O, and oversee risk and compliance with enough understanding to meet their duty of care. For the largest national banks, the OCC's heightened standards specifically call for a formal, ongoing director training program. Examiners routinely assess whether the board understands what it approves.

What is Regulation O?

Regulation O is the Federal Reserve rule, at 12 CFR part 215, that limits a bank's extensions of credit to its insiders: executive officers, directors, principal shareholders and their related interests. It requires insider credit to be made on non-preferential terms, requires prior board approval above set thresholds, caps individual and aggregate insider credit, restricts paying insiders' overdrafts and imposes tighter limits on executive officers. The FDIC applies the same restrictions to the banks it supervises through 12 CFR 337.3.

When does a loan to a director need board approval?

Under Regulation O, prior approval by a majority of the entire board is required when credit to the director, aggregated with all other credit to the director and their related interests, exceeds the higher of $25,000 or 5 percent of the bank's unimpaired capital and unimpaired surplus. Credit above $500,000 in aggregate always requires prior approval. The interested director must abstain from the vote. Draws on a line approved within the past 14 months do not need separate approval.

What should new bank directors learn first?

New directors should start with their governance duties, the duty of care and the duty of loyalty, and with Regulation O, because it applies to them personally from the day they join. Next come the bank's major policies and the programs the board approves, especially BSA/AML and information security, followed by the bank's main risks: credit, interest rate, liquidity and capital. Regulator publications such as the FDIC's Pocket Guide for Directors and the OCC's Director's Book are useful companions to formal training.

How should board training be documented?

Record the date, the topics covered, the presenter or course, and the names of the directors who attended, and keep the materials. Note the training in the minutes with enough detail that an examiner can see what was covered. A vague entry stating that the board received an update is weak evidence. Many banks keep a director training log maintained by the corporate secretary or compliance officer and review it annually alongside the board's self-assessment.

Do Reg O rules apply to a director's business?

Yes. Regulation O covers an insider's related interests, which include companies the insider controls. Control can be established by owning, controlling or having the power to vote 25 percent or more of a company's voting securities, among other tests. A loan to a director's operating company is therefore treated as credit to the director for aggregation and approval purposes, and must meet the same terms and limits. Directors should report all related interests accurately on the bank's annual insider survey.