Through the first three quarters of 2024, the FDIC issued 14 consent orders against banks with assets between $20 billion and $250 billion. Eleven of those orders included specific language about data governance deficiencies: incomplete data lineage, insufficient quality monitoring, inadequate governance of third-party data, and failure to demonstrate risk data aggregation capabilities. The pattern is unmistakable. Data governance is no longer a secondary concern in enforcement actions. It is a primary finding.
Yet most Tier 2 bank leadership teams still treat data governance as a back-office function. The consent orders tell a different story.
What the Orders Actually Say
The language in these orders is specific and recurring. Three themes dominate:
"Failed to demonstrate adequate risk data aggregation capabilities." This is BCBS 239 language showing up in domestic enforcement. The FDIC is not just testing capital adequacy. It is testing whether you can produce the data that feeds capital calculations with sufficient quality, timeliness, and completeness.
"Inadequate oversight of third-party data dependencies." The consent orders specifically cite banks that could not demonstrate governance over data flowing from fintech partners, data aggregators, and outsourced service providers. Your vendor management program is not the same as your third-party data governance program. Examiners are distinguishing between the two.
"Deficiencies in data quality monitoring and remediation." Not data quality problems. Monitoring and remediation deficiencies. The finding is not that the data was bad. It is that the bank could not demonstrate it was monitoring quality and responding to issues. The governance of data quality is the enforcement target.
Why This Escalation Matters
Ten years ago, data governance findings appeared in exam reports as informal recommendations. Five years ago, they appeared as MRAs. In 2024, they appear in consent orders. Each escalation reflects a shift in regulatory expectations.
The FDIC is not raising the bar arbitrarily. It is responding to a pattern of failures where inadequate data governance contributed directly to risk management breakdowns. The 2023 bank failures provided the case studies. The 2024 enforcement actions provide the consequences.
For Tier 2 banks, the message is clear: data governance is now examinable at the same level of seriousness as capital adequacy and liquidity management. The consent orders prove it.
The Documentation Trap
The typical response to regulatory pressure is documentation. More policies, more procedures, more reports. For data governance, this is the wrong response.
Consent orders do not cite missing policies. They cite missing capabilities. You can have a comprehensive data governance policy framework and still receive a finding if you cannot demonstrate that governance is actually functioning. The documentation is necessary but insufficient. What examiners want is evidence: lineage records that can be traced, quality metrics that can be verified, attestation cycles that have substance, and third-party data governance that extends beyond the vendor contract.
The gap between documentation and evidence is where consent orders live.
What Capability Looks Like
To meet the standard these consent orders are setting, banks need four capabilities:
Provable lineage. For every critical data element used in risk reporting, you should be able to trace the data from source system through every transformation to the final report. Not in a document. In a system that an examiner can query.
Active quality monitoring. Quality is not a quarterly check. It is a continuous process with automated alerts, documented thresholds, and escalation paths that actually fire when thresholds are breached.
Substantive attestation. Attestations should be backed by evidence that the attester reviewed: quality reports, lineage records, and exception logs. An attestation without supporting evidence is a signature, not a governance act.
Extended third-party governance. Every data feed from a third party should carry the same governance as internal data: defined ownership, quality thresholds, lineage documentation, and attestation cycles. The vendor contract is not governance.
The CoComply Response
CoComply delivers these four capabilities continuously. Lineage is traced and queryable. Quality is monitored with automated escalation. Attestations are evidence-backed. Third-party data carries the same governance weight as internal data. When the FDIC asks for proof, the evidence is in the system, not in a file cabinet.
Read the Orders Yourself
Go to the FDIC enforcement action database. Filter for banks in the $20-$250 billion range. Read the most recent consent orders. Count how many mention data governance specifically. That number is your regulatory context. It is not trending down. It is trending up. The question for your bank is whether you are ahead of that trend or about to become part of it.