On Nov. 25, 2025,the Federal Deposit Insurance Corporation (FDIC)officially adopted amendmentsto 12 CFR Part 363, which is the regulation to implement Section 112 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (known asFDICIA).The amendments, effective Jan. 1, 2026,updatecertainregulatory thresholds that govern audit and reporting requirements.
Aninsured depository institutionwill not needtocomply withtheapplicablePart 363requirementsineffectas ofDec.31, 2025,ifthe institutionwill not be subjecttotherequirementsunder the new thresholds effective Jan.1, 2026.
This modernization offers relief, particularly for smaller and mid-sized institutions that have investedsignificant timeand resources in FDICIA compliance.Asatrusted advisorto manyof these institutions,èƵhasafront-lineperspectiveonthe challengesbrought byrecent regulatory uncertaintyandishelping clientsidentifyclear, actionable next stepswith this final rule.
What’sChangedUnder theFinalFDICIA Rule?
The mostsignificantchangerelates to theasset size thresholds for certain audit requirements, summarized as follows:
Important: These thresholds will be evaluated and adjusted every two years based on changes in the non-seasonally adjusted Consumer Price Index for Urban Wage Earners and Clerical Workers (CPI-W). They will be adjusted sooner if CPI-W exceeds 8%. The first future adjustment is planned to be effective Oct. 1, 2027.
Additionalchangesinclude:
- increasesinasset size thresholdsforcertainaudit committee compositionrequirements
- an increase inthedirector independencecompensation threshold
Implications for Regional and Community Banks’ Internal Control Environment
While these updates offer relief,we acknowledge thatmaintainingstrong internal controlsremainsessential; not out of obligation, but becauseit’sfoundational tothe safety and soundness of any financial institution.
The Association of Certified Fraud Examiners’recent global studyofoccupational fraud,A Report to the Nations,finds thatmore than half ofoccupational frauds occur due to the lack of internal controls or override of existing controls.Institutionswitheffectivecontrol environmentswill remainwell-positioned to use them strategically for growth and resilience.
Theappropriateresponseto these regulatory changes willnaturallyvary based oneach institution’ssize and structure.However,acommon themeshould beembracingthisopportunity to thoughtfullyreevaluateandreassertdirectionoftheinstitution’soverall risk and internal controls framework.
How Should Banks with Assets Between $1 Billion and $5 Billion Respond?
In responding to these changes, itis important to keep in mind that management of institutionswithover$1 billionincurrent or projectedassets will still berequiredto attest to the effectiveness of internal controlsunder the new rule.Making and monitoring that attestationshould have a reasonable basisthat issupported byaninternal control monitoring function.
Even so,managementwill bemore empowered todrive and define the scope of internal controls, whichmight be refreshed to focus onwhat’smost important.Someexamples ofthis may include:
- Controls most critical to the bank’s operations and risk profile
- Areas important to management and those charged with governance
- Controls critical foridentifyingerrors in financial reporting
- Information technology(IT)controls
- Controls that helptomitigate fraud risks
For certain controlsdeemedimportant to the overall control structure but lower risk,management might consider formally testing them on a rotational basis (e.g., every twoyears instead of annually) tohelpnavigate competing priorities effectively.
We expect most institutionsof this asset sizetobenefitfromtime and cost savings associated with certaindocumentation andcompliance requirements and the increased flexibility to internally manage the timing and scope of monitoring activities.
OtherConsiderationsfor Banks Navigating the FDICIA Final Rule
Impact on External Audits
A point of discussion for institutions that have their financial statements auditedexternallyshould be whether there may be any scope changes if their auditors can no longer take a “control reliance” approach, meaning that they will have to increase testing performed on thefinancialstatements if internal controls aren’t in place and tested.
Strategic Planning & Growth
It is also important to considereach institution’soverallstrategyand whetheritplans to grow, make acquisitions, or getacquiredas this couldimpactregulatory requirements.Prior investments made toestablishstrong internal controland governancestructures ought not to be viewed as a sunk cost, but as afoundation for institutional resilience, regulatory confidence, and long-term strategic agility.
Next Steps: Questions for Leadership Teams
If your institutionis navigating how best to respond to these recent changes,considerthe following questions:
- Whatcompliance anddocumentationresponsibilities willmanagementand those charged with governancecontinue to have inmaintainingan effective internal control environment?
- What controls are beneficial tomyinstitution or determined criticalregardingfinancial reporting, ITsystems, fraud, and other bank-specific operational risks? How can we capitalize on this moment to right-sizeour overall risk and control structure?
- Howwillthisimpactour institution’s annual risk assessment processandinternal audit function?
- How will we involve key stakeholdersin these decisions and communicate with them in a way whichdemonstratesa continued commitment to sound governance?
- Is ourplanned approachin harmonywithouroverallstrategicplan?
Empoweryour institution’s leaders totake thisas anopportunityto rethinkthe status quo.To learn more aboutbest practices formaintainingmodernizedandeffectiveinternalcontrolandgovernance structuresin an ever-changing regulatory landscape, contact your èƵ advisoror clickhere.
Frequently Asked Questions About the FDICIA Final Rule
Q: Do banks under $1 billion still need external audits?
A:Banks under$1 billionin assetsare no longer required tohave independent external financial statement audits under the new FDICIA rule, though many maystillchoose to do so forstrategic,governanceor otherreasons.
Q: What happens if a bank’s assets fluctuate around the$1 billionor$5 billionthresholds?
A:Institutions shouldmonitortheir asset size closely and plan accordingly. The thresholds will be evaluated every two years based on CPI-Wchanges, so long-term strategic planning is essential.
Q: Can bankseliminateall internal control testing under the new rule?
A:No. Banks between$1 billionand$5 billionmust still attest to the effectiveness of internal controls, which requires a reasonable basis supported by internal monitoring. Strong controlsremainfoundationaltosafety and soundness.
Q: How can èƵ help my institution respond to the FDICIA final rule?
A:èƵ provides strategic advisory services to help banks assess their internal control environments, right-size compliance efforts, and align governance structures with long-term growthobjectives.