Why the FFIEC’s pandemic statement was an evidence checklist
The FFIEC’s March 6, 2020, statement restated pandemic expectations from the avian flu era. Its value lay in what examiners would later ask institutions to show: staged decisions, critical operations run with fewer people, and service providers coping with the same disruption.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 6, 2020, the Federal Financial Institutions Examination Council issued an updated interagency statement on pandemic planning for banks, credit unions and other supervised financial institutions. It pointed institutions to existing guidance, including interagency pandemic planning material from 2006 and 2007 and the FFIEC Business Continuity Management booklet revised in November 2019. The statement emphasized that plans should address the potential effects of a pandemic on operations, staffing and service providers, and should describe a scaled response as conditions changed. A few days later, federal and state financial regulators issued a joint statement encouraging institutions to work constructively with borrowers and customers affected by the outbreak. The World Health Organization characterized the outbreak as a pandemic on March 11.
The FFIEC statement created no new obligations. It restated expectations that had existed for more than a decade and asked institutions to make sure their plans reflected them. Read with hindsight, its most useful feature was that each expectation implied a record an examiner could later request. The statement asked boards and management to check three things. They are a staged response with clear triggers, critical operations with fewer people, and service providers facing the same disruption. Each maps to a different owner and produces different evidence.
A staged response with clear triggers
Pandemic guidance from the avian flu period expected plans to scale up as conditions worsened, from monitoring to restricted travel to split teams to widespread remote work. Many institutions had the stages written down but not the triggers: who decides to move from one stage to the next, on what information and how quickly. Without triggers, decisions are made ad hoc, at different speeds across business lines and locations.
A good plan names the decision-maker and the indicators for each stage, such as local public health orders, staff absence rates and the status of key suppliers. It also states what each stage changes in practice: which branches open and in what form, which staff work remotely, which processes pause and which customer messages go out.
The evidence is a decision log. Each entry records the date, the stage, the information relied on and who approved the move. A credit union board that can show a dated sequence of decisions is in a far stronger position than one that can show only the plan document. Board minutes should reflect the same sequence, since directors are expected to oversee the plan and not merely approve it once a year. The log also helps after the event, when management reviews which triggers worked and which were ignored.
Critical operations with fewer people
The statement asked institutions to consider the effect of significant staff absence over an extended period. In practice that means identifying critical operations, such as payments, deposit operations, lending operations and customer support, and confirming that each can run with reduced staff, including staff working remotely.
Remote capacity was the immediate technical question, and it had a measurable answer: concurrent remote sessions supported compared with the number of operations staff who would need them. Could the institution support most of its operations staff on remote access at once? Did it have enough laptops, authentication tokens and licenses? And could controls that relied on physical presence, such as dual control in vaults, wet signatures or paper approvals, be adapted without weakening them?
Each adaptation needed a record: the original control, the temporary version, the risk it introduced, the compensating measure and the approval. Examiners and auditors would later ask how controls operated during the period, and a contemporaneous record answers that question far better than reconstruction months later.
Smaller institutions faced a particular problem. Key functions such as BSA monitoring, wire release or core system administration might rest with one or two people. For a community bank or credit union, documented backups for those roles, with access already granted and tested, were the single most valuable preparation.
Customer-facing operations needed the same treatment. Branch closures shifted demand to phones and digital channels, and the joint statement encouraging work with affected borrowers created new requests for payment deferrals and fee waivers. Contact centers needed scripts, authority limits and a way to record every accommodation granted, so the institution could later show consistent and fair treatment.
Service providers facing the same disruption
Most banks and credit unions depend on core processors, card processors, call center vendors and technology service providers. The statement expected institutions to understand their providers’ pandemic plans. That is harder than it sounds. Providers serve many institutions and may prioritize in ways that individual clients cannot influence, and some depend on offshore operations subject to different public health measures.
Specific questions produce useful answers. Which critical services depend on a provider’s staff being on-site? Where are those staff? What is the provider’s plan if those sites close? How will it notify clients of degraded service? Answers to those questions are worth more than a copy of a generic continuity plan.
Institutions also have to plan for degraded service rather than outright failure. A core processor running with reduced staff might process files later than usual, answer support calls slowly or defer changes. Manual workarounds and member messaging for those cases are more realistic than plans for a complete outage, and degraded service is what most institutions actually experienced in 2020.
The evidence here is a file for each critical provider: the questions asked, the answers received, follow-up on gaps, and any service problems logged during the event. Institutions should check with counsel and their regulators on documentation expectations, but one principle holds: if a control or dependency changed, write down how, why and who approved it.
With hindsight
Within two weeks of the statement, most institutions had moved to their most severe planned stage, with branches limited to drive-through or appointment service and back-office staff largely remote. Core processing and payment systems held up well, which reflected years of investment in resilience. The weaker points were people-dependent processes and paper-based controls that had to be redesigned in days.
Supervisors drew conclusions quickly. In October 2020, the Federal Reserve, the OCC and the FDIC published sound practices to strengthen operational resilience, shifting attention from recovering systems to continuing critical operations within defined tolerances. In June 2023 the banking agencies finalized interagency guidance on third-party risk management. The records the March 2020 statement implied, decision logs, temporary control changes and provider files, are the same evidence those later frameworks ask for, now expected for any severe disruption rather than for pandemics alone.