Credit Unions Regulatory Updates

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2026-08-12

Federal Register publication of the proposed rule at 91 FR 52114

2026-10-13 Deadline

Comments due on the proposed rule

Suggested considerations

• Compliance teams may wish to map the proposed changes against current CRA policies, exam procedures, public file practices, and community development grant approval workflows.
• Institutions may wish to assess how the proposed asset-size thresholds would change their CRA category and associated data collection, reporting, and evaluation obligations.
• Banks making grants or donations may wish to review documentation standards for recipient use of funds, overhead limits, and evidentiary support needed for CRA consideration.
• Community development and CRA governance teams may wish to identify which activities would still qualify under the revised CD definitions and performance tests.
• Legal and regulatory affairs functions may wish to prepare comments on the proposed lending focus, grant criteria, sunshine requirements, and technical changes to OCC public welfare and corporate activity rules.
• Banks subject to CRA-related agreements may wish to verify whether the proposed technical amendments would affect disclosure timing, content, or filing processes.

What changed

['The proposal would amend the OCC and FDIC Community Reinvestment Act rules to make substantive, technical, and process-oriented changes aimed at refocusing the statutory objective on meeting community credit needs and reducing burden, particularly for community banks.', 'The agencies propose to better ensure that community development grants reach intended communities and to provide greater clarity on how to obtain CRA consideration for activities.', 'The OCC and FDIC also propose technical changes to their CRA sunshine rules under the Federal Deposit Insurance Act, which govern disclosure...

Key dates

2025-12-29

NCUA published the proposed rule to remove 12 CFR 701.25(b)

2026-02-27 Deadline

Public comment period closed

2026-08-06

Final rule published in the Federal Register at 91 FR 50664

2026-09-08 Deadline

Final rule becomes effective and 12 CFR 701.25(b) is removed

Suggested considerations

• Compliance teams may wish to confirm that internal lending policies still reflect the remaining limits in 12 CFR 701.25(a) and any other applicable provisions, even though the separate policy requirement in paragraph (b) has been removed.
• Boards may wish to review whether any internal approval process for loans to other credit unions remains desirable as a governance control, particularly where state law, bylaws, or enterprise risk practices still support formal approval.
• State-chartered credit unions may wish to verify whether state law or state supervisory expectations still require board approval or written policies for loans to other credit unions.
• Monitoring teams may wish to update regulatory inventories, policy cross-references, and exam prep materials to reflect that 12 CFR 701.25(b) is no longer codified effective 2026-09-08.
• Training and procedure documents may wish to distinguish between the removed board-policy requirement and the continuing statutory and regulatory loan limits that still apply.

What changed

The final rule removes the documentation requirement in 12 CFR 701.25(b) that required board approval of all loans to other credit unions and written policies governing those loans. NCUA states that federal credit unions remain subject to statutory requirements on loans to credit unions, and the remaining limits and requirements in § 701.25 continue to apply. The rule does not change the aggregate loan limit in § 701.25(a), which remains 25% of the lending federal credit union’s paid-in and unimpaired capital and surplus.

Key dates

2026-02-25

NCUA published the proposed rule for public comment.

2026-04-27

Public comment period closed after NCUA received 15 comments.

2026-08-06

NCUA published the final rule in the Federal Register at 91 FR 50680.

2026-09-08 Deadline

Final rule becomes effective.

Suggested considerations

• Compliance teams may wish to review and update FCU written policies for purchases, sales, and pledges of eligible obligations so they no longer mirror the removed prescriptive checklist and instead reflect the board’s own risk-based framework.
• Credit unions may wish to confirm that internal governance documents still address conflicts of interest and compensation consistently with bylaws and fiduciary-duty expectations, even though the detailed regulatory text has been removed.
• Firms should consider updating any procedures, training materials, and control inventories that reference the old paragraph structure or the former 12 CFR 701.23(h) cross-reference.
• Compliance teams may wish to validate that transaction approval, due diligence, documentation, and agreement-review processes continue to be embedded in policy at a level appropriate to the institution’s risk profile, even though the rule is less prescriptive.
• Federal credit unions may wish to brief boards and relevant committees on the shift from a checklist-based rule to a principles-based framework so governance oversight remains aligned with supervisory expectations.

What changed

['The rule removes the mandated lists of items that FCU written policies must address for purchases, sales, and pledges of eligible obligations under 12 CFR 701.23(b)(6), (c), and (d). FCUs still must maintain written policies for these activities, but the regulation no longer prescribes a detailed checklist of required policy contents.', 'The rule removes the detailed conflicts-of-interest and compensation provision formerly in 12 CFR 701.23(g).

Key dates

2026-03-25

NCUA issued the proposed rule to remove the prescriptive requirements

2026-05-26 Deadline

Public comment period closed

2026-08-06

Final rule was published in the Federal Register at 91 FR 50677

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to review current indirect vehicle lending policies to confirm they no longer reference the removed 50% and 100% net-worth limits.
• Boards may wish to document a board-approved risk appetite and concentration framework for third-party serviced indirect vehicle loans.
• Credit unions may wish to align vendor oversight, due diligence, and servicing controls with their internal policies since the prior waiver pathway is no longer the operative framework.
• State-chartered federally insured credit unions may wish to verify any conforming updates needed to insurance-related procedures and governance materials.
• Compliance functions may wish to update training, policy manuals, and examination binders to reflect that supervision will now focus on principles-based oversight rather than the deleted rule text.

What changed

The final rule removes 12 CFR 701.21(h) in full, eliminating the existing concentration limits, the 30-month step-up to a higher limit, the waiver process to a Regional Director, the related response timeline, and the embedded definition framework tied to that paragraph. NCUA also states that it removed the parallel requirement in 12 CFR 741.203(c) and the related citation in 12 CFR 746.201(c), as part of the same deregulatory package.

Key dates

2026-08-06

Federal Register publication of the final rule at 91 FR 50661

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to update policies, procedures, and product templates that still reference the former segregated deposit and collateral formulas in 12 CFR 701.20.
• Institutions may wish to review surety and guaranty programs to ensure the obligation remains fixed in amount and duration and is structured as an otherwise permissible loan under the applicable lending regulations.
• FCUs may wish to confirm that any related lending analysis still addresses member lending limits and other applicable provisions, including where commercial lending rules apply.
• FISCUs may wish to confirm continued state-law authority to act as surety or guarantor and verify any state-specific constraints or approvals before offering these arrangements.
• Risk and compliance functions may wish to reassess collateral practices for these products in light of the new flexibility while preserving safety-and-soundness controls.

What changed

The final rule deletes the specific segregated deposit requirement in 12 CFR 701.20(c)(3) for suretyship and guaranty agreements. It also removes the detailed collateral standards in 12 CFR 701.20(d), including the prior 100 percent and 110 percent collateral categories and the requirement for a perfected security interest tied to those prescribed values.

Key dates

2026-02-25

NCUA issued the proposed rule removing 12 CFR 701.26; public comments were invited through April 27, 2026

2026-04-27 Deadline

Public comment deadline on the proposal

2026-08-06

Final rule published in the Federal Register at 91 FR 50674

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to remove references to 12 CFR 701.26 from policies, procedures, and training materials once the rule is effective.
• Firms should consider confirming that contract templates still include written terms addressing audit rights, information security, business continuity, indemnification, performance metrics, data ownership and return, termination, and dispute resolution.
• Credit unions involved in shared operational arrangements may wish to review whether documentation now reflects the updated clarification in 12 CFR 721.3.
• Firms may wish to confirm that third-party risk management, vendor oversight, and due diligence controls remain aligned with existing supervisory expectations despite the regulatory deletion.

What changed

The final rule rescinds 12 CFR 701.26, which had addressed FCU authority to enter written contracts for assets or services relating to daily operations and required those agreements to be in writing. NCUA states that the contractual authority already exists under the FCU Act and incidental powers authority, so the regulation was redundant. The Board also amended 12 CFR 721.3 to formally clarify that credit unions may act as representatives in shared operational arrangements with other credit unions or organizations, and that fixed assets may be shared.

Key dates

2026-08-06

FDIC published the notice of proposed rulemaking in the Federal Register

2026-10-05 Deadline

Comments on the proposal must be received by the FDIC

Suggested considerations

• Compliance teams may wish to map current insider-lending policies against the proposed $400,000 and $2,000,000 thresholds to assess operational impact if finalized.
• Firms may wish to review board-approval workflows and escalation triggers so systems can be updated quickly if the proposal is adopted.
• Institutions may wish to evaluate whether existing exception reporting, insider tracking, and credit administration procedures will need revision to reflect periodic indexing rather than fixed thresholds.
• Commenters may wish to submit feedback by the October 5, 2026 comment deadline if the proposed thresholds or indexing methodology would create implementation issues.

What changed

The proposal amends 12 CFR 337.3 for extensions of credit to insiders of FDIC-supervised institutions. It would increase the threshold for certain extensions of credit to executive officers not otherwise specifically authorized by statute from $100,000 to $400,000, and it would increase the threshold for extensions of credit to insiders requiring prior approval by the board of directors from $500,000 to $2,000,000. The FDIC also proposes to establish an indexing methodology to periodically update those dollar thresholds over time.

Key dates

2026-08-04

Publication of the Federal Reserve Board notice of proposed rulemaking ‘Regulatory Modernization and Relief for Mutual Holding Companies’ in the Federal Register (91 FR 49490; FR Doc. 2026-15774) amending Regulations Q (12 CFR part 217) and MM (12 CFR part 239).

2026-10-05 Deadline

Comment deadline for submitting responses to the Federal Reserve Board on the proposed amendments to Regulations Q and MM (Docket No. R-1895; RIN 7100-AH26).

Suggested considerations

• Compliance teams at mutual holding companies and savings and loan holding companies may wish to review the proposed amendments to Regulation MM (12 CFR part 239), particularly the sections on dividend waivers, mutual-to-stock conversion processes, post-conversion restrictions, chartering requirements for subsidiary holding companies, and updated model charters and bylaws, to assess operational and governance impacts.
• Firms planning or contemplating mutual-to-stock conversions should consider comparing their current conversion documentation, use of FR MM-PS, FR MM-OC and FR MM-OF forms, and liquidation account methodologies with the proposed streamlined forms, corrected liquidation account calculations, and revised rules on stock pricing, repurchases, offers and sales, employee stock ownership plan financing and benefit plans.
• Institutions that issue, or are considering issuing, mutual capital certificates should review the proposed Appendices B and C to Regulation Q (12 CFR part 217) to evaluate whether their existing or planned instrument terms align with the model key terms for qualification as Common Equity Tier 1 or Additional Tier 1 capital, including permanence, loss-absorption, distributions and redemption features.
• Subsidiary holding companies of thrift mutual holding companies may wish to analyze the proposed elimination of the federal charter requirement and related changes to Subpart C of Regulation MM to determine chartering options, corporate structure implications, and any needed updates to organizational documents and regulatory commitments.
• Governance and legal teams at MHCs could review the proposed revisions to membership rights, proxy processes, postal mail requirements, voluntary dissolution, and the model charter and bylaws in Appendices A, C and D to Regulation MM, with a view to aligning internal policies and corporate governance frameworks with the modernized regime once finalized.
• Risk and capital management functions at bank holding companies, savings and loan holding companies and state member banks should consider evaluating capital planning assumptions and buffers in light of the clarified eligibility of mutual capital instruments as regulatory capital under Regulation Q, and identify any systems or reporting changes that may be required if the proposal is adopted.
• All affected firms may wish to prepare internal impact assessments and, where appropriate, draft comment letters addressing specific elements of Regulations Q and MM (Docket No. R-1895; RIN 7100-AH26), including any perceived risks around conflicts of interest, reduced accountability, or adjustment costs noted in the economic analysis.
• Compliance monitoring teams should plan to track the rulemaking through the comment close date and subsequent Federal Reserve actions so that, if the proposal is finalized, implementation plans can be developed for policy updates, staff training and revisions to regulatory reporting and capital instrument documentation.

What changed

The NPR proposes targeted amendments to Regulation MM (12 CFR part 239) governing mutual holding companies (MHCs), including eliminating certain dividend waiver requirements that currently apply to MHCs and their subsidiary holding companies, and revising post-conversion restrictions to reduce burdens following mutual-to-stock conversions.

Key dates

2026-06-04

European Commission adoption of the 3rd FRTB Delegated Act under Article 461a CRR modifying own funds requirements for market risk for a three-year period

2026-08-03

EBA publication of no-action letter on the trading/banking book boundary and internal risk transfers, and technical considerations on FRTB application

2027-01-01

Start of modified calculation of own funds requirements for market risk under the 3rd FRTB Delegated Act for a three-year period

Suggested considerations

• Compliance teams at EU banks should consider reviewing the EBA no-action letter to understand which aspects of the FRTB boundary between banking book and trading book, internal risk transfers, and related reporting are currently deprioritised for supervisory or enforcement action, and how this interacts with national competent authority expectations.
• Risk and regulatory capital teams may wish to map their existing and planned FRTB implementation (standardised and internal models approaches) against the technical considerations published by the EBA, focusing on how the 3rd FRTB Delegated Act’s institution-specific multiplier and related boundary rules affect market risk capital calculations from 2027-01-01.
• Firms should consider identifying whether they fall within the scope of "multiplier banks" under the Delegated Act and assess operational implications, including whether their systems and data architecture can support a single, harmonised boundary framework rather than multiple versions during the three-year transitional period.
• Supervisory reporting and Pillar 3 disclosure teams may wish to analyse the EBA’s clarifications on reporting requirements linked to the trading/non-trading book boundary and internal risk transfers to determine whether current templates, data points, and governance need adjustment ahead of the Delegated Act’s entry into force.
• Institutions participating in the EBA supervisory benchmarking exercise should consider reviewing the clarified treatment of institutions in that exercise under the revised FRTB framework, and ensure their benchmarking submissions and internal controls are aligned with the EBA’s technical considerations.
• Legal and regulatory policy teams may wish to monitor the scrutiny process of the 3rd FRTB Delegated Act by the European Parliament and Council, as the practical relevance of the no-action letter and technical considerations is contingent on the Delegated Act entering into force as adopted on 2026-06-04.

What changed

The EBA has formally issued a no-action letter recommending that competent authorities do not prioritise supervisory or enforcement action regarding provisions of the FRTB framework that govern: (i) the boundary between the banking book and the trading book; (ii) internal risk transfers between these books; and (iii) certain related reporting requirements, during the transition to the revised market risk regime.

Key dates

2026-07-31

Policy becomes effective for authorized financial services provided to persons or entities located in Venezuela

2027-01-29 Deadline

End of the stated commitment period for the agencies’ enforcement-policy non-action position

Suggested considerations

• Compliance teams may wish to confirm whether any Venezuela-related activity is specifically authorized under applicable OFAC sanctions licenses or other authorizations before relying on the policy.
• Institutions may wish to verify that their BSA/AML compliance program is currently in place and that they continue to make reasonable efforts to meet applicable BSA Requirements during the relief period.
• Firms may wish to review whether they have had a final BSA-related enforcement action by FinCEN or their primary federal regulator within the prior 24 months, as that would disqualify reliance on the commitment.
• Operational teams may wish to document the basis for treating transactions as covered authorized financial services in Venezuela and retain evidence supporting reliance on the enforcement-policy statement.

What changed

The agencies announced a temporary enforcement-policy commitment covering authorized financial services provided to persons or entities located in Venezuela from 2026-07-31 through 2027-01-29. During that period, the agencies state they will not take supervisory action, including citing a violation of law, or pursue an enforcement action against a supervised financial institution for BSA Requirement issues arising from such authorized services. The commitment applies only if the institution is currently compliant with an applicable BSA compliance program requirement and continues to make...

Key dates

2026-06-24

Venezuela experienced a pair of strong earthquakes off the northern coast west of Caracas, triggering the humanitarian crisis referenced by the agencies.

2026-07-27

FinCEN issued a substantively similar statement of enforcement policy regarding Venezuela-related financial services.

2026-07-31

The OCC, Federal Reserve, FDIC, and NCUA issued the joint enforcement policy.

2026-07-31

Start of the period during which authorized financial services to persons or entities in Venezuela are covered by the enforcement commitment.

2027-01-29 Deadline

End of the covered period for the joint enforcement commitment.

Suggested considerations

• Compliance teams may wish to confirm whether current Venezuela-related activity falls within the scope of authorized financial services covered by the joint statement.
• Institutions may wish to verify that their BSA compliance program remains current and that ongoing controls reflect reasonable efforts to comply during the relief period.
• Firms may wish to check whether they have had any final FinCEN or OCC enforcement action involving BSA violations in the prior 24 months before relying on the policy.
• Sanctions teams may wish to confirm continued compliance with all applicable OFAC-administered sanctions regulations and authorizations.
• Institutions with Venezuela exposure may wish to document how they will evidence reliance on the policy and monitor the January 29, 2027 end date.

What changed

The agencies stated that eligible U.S. financial institutions that choose to provide authorized financial services to persons or entities in Venezuela will not be subject to supervisory action, including a citation for a violation of law, or enforcement action related to a Bank Secrecy Act requirement, for those services. The commitment is limited to authorized financial services provided from 2026-07-31 through 2027-01-29 and applies only to statutes or regulations specifically addressed in the joint statement.

Key dates

2026-07-31

FDIC Board approved the two notices of proposed rulemaking by notational vote

Suggested considerations

• Compliance teams may wish to review the forthcoming NPRM text and accompanying Financial Institution Letter for specific amendments to CRA and insider-lending requirements.
• Banks may wish to map current CRA policies, monitoring, and documentation against the existing regulation to identify where process changes could be needed if the proposal is adopted.
• Institutions may wish to review insider-credit approval, reporting, and conflict-management controls so they can assess whether the proposal would require policy or system updates.
• Stakeholders may wish to monitor the comment period and prepare submissions if the proposals raise operational, prudential, or conduct concerns.

What changed

The Board approved a proposed update to the FDIC’s **Community Reinvestment Act regulations**, which may affect how covered institutions are evaluated for community reinvestment performance and related compliance expectations. The Board also approved a proposed rule on **extensions of credit to insiders**, indicating possible changes to the FDIC’s insider lending restrictions, governance controls, and related reporting or approval requirements.

Key dates

2026-07-31

Federal Reserve Board requested comment on the proposed Regulation O modernization

2026-10-05 Deadline

Expected comment deadline stated in the Federal Register notice

Suggested considerations

• Compliance teams may wish to map current insider-credit controls, approval thresholds, and disclosure workflows against the proposed higher dollar limits.
• Banks may wish to identify products and systems affected by Regulation O exceptions, including credit cards, overdraft lines, and other-purpose loans.
• Institutions may wish to review whether any existing insider or related-interest procedures depend on legacy interpretations that the proposal would codify or reorganize.
• Firms with investment fund ownership structures may wish to assess whether the proposed relief for passive interests would change current principal-shareholder or control analyses.
• Interested parties may wish to prepare comments for the Federal Register comment period once publication occurs, as the proposal states comments are due 60 days after publication.

What changed

The proposal would increase several outdated dollar-based thresholds in Regulation O, including the amounts tied to certain credit card exceptions, overdraft exceptions, executive officer loans for other purposes, and the level at which prior board approval is required. It would also establish an indexing methodology so the thresholds are automatically adjusted over time based on cumulative nominal GDP growth, reducing the need for repeated rulemaking. The Federal Reserve also says the proposal would address unnecessary applications of the rule to passive interests in companies held by...

Key dates

2026-07-23

EBA launches consultations on draft ITS on depositor information, ITS on information exchange, RTS on DGS payouts of client funds deposits, and Guidelines on investment of available financial means under DGSD3

2026-09-21 Deadline

Registration deadline (12:00 CEST) for public hearing on all four regulatory products

2026-09-24

Public hearing on the four DGSD3-related regulatory products (10:00–13:00 CEST)

2026-10-23 Deadline

Deadline for submission of comments to the four consultation papers

Suggested considerations

• Compliance teams at EU credit institutions should consider reviewing existing depositor information sheets, account-opening documentation and ongoing communications to assess alignment with the emerging harmonised formats and content envisaged by the draft ITS on depositor information, particularly for merger and failure scenarios.
• DGSs and banks may wish to map current data flows and reporting processes for covered deposits, available financial means and bank failure events against the proposed ITS on information exchange, to identify gaps in data granularity, timeliness, and standardisation that could require system and process changes.
• Firms that hold client funds in pooled or intermediary deposit accounts (such as investment firms or payment institutions) should consider analysing how client identification and segregation data are captured and shared with DGSs, in light of the draft RTS on client funds that aim to ensure accurate and timely reimbursement of underlying clients and avoidance of duplicate payouts.
• DGS operators and finance teams may wish to review investment policies, risk limits, eligible instruments and liquidity management frameworks for DGS financial means, to anticipate adjustments needed to comply with the forthcoming Guidelines on diversification, low risk and liquidity, including readiness to support resolution financing within the DGSD3 mandate.
• All affected stakeholders should consider preparing internal positions and impact assessments and submit consultation responses to the EBA by the stated deadline, highlighting operational challenges, data availability issues, and any potential conflicts with existing national frameworks for depositor protection and crisis management.
• Risk and treasury functions in banks may wish to engage with DGSs and supervisors to understand how enhanced reporting on covered deposits and DGS financial means under the ITS on information exchange could affect crisis-preparedness expectations, stress-testing assumptions and disclosure practices.
• Legal and regulatory affairs teams should consider monitoring the progression of these four draft instruments alongside the remaining eight technical standards and guidelines mandated by DGSD3, to plan for a coordinated implementation programme once final texts and application dates are confirmed.

What changed

The publication launches consultations on four draft regulatory products mandated by DGSD3: (i) Implementing Technical Standards on depositor information, which define harmonised content and format for depositor information sheets at account opening and on a regular basis, and specify communication requirements in special situations such as bank mergers or failures; (ii) Implementing Technical Standards on information exchange between credit institutions, Deposit Guarantee Schemes (DGSs) and other relevant authorities, introducing standardised procedures, templates and minimum information...

Key dates

2026-07-17

EBA launches consultation on amendments to ITS for the 2027 market risk benchmarking exercise

2026-07-27 Deadline

Deadline (16:00 CEST) for registration to the public hearing on the consultation

2026-07-28

Public hearing on the consultation (14:00–15:30 CEST)

2026-09-03 Deadline

Deadline for submission of comments to the EBA consultation on the 2027 market risk benchmarking ITS amendments

2027-01-01

Application date of the European Commission’s FRTB Delegated Act referenced in the amended ITS

Suggested considerations

• Compliance teams at EU credit institutions using market risk internal models or the CRR3 Alternative Standardised Approach may wish to review the consultation paper and annexes (booking instructions, relevant dates, instruments and portfolios, template instructions, and templates) to understand proposed changes to the 2027 benchmarking data collection and reporting requirements.
• Firms applying or planning to apply CRR2 Internal Model Approach for market risk should consider the implications of the resumption of CRR2-IMA data collection and assess whether existing reporting processes and systems can be reactivated or need updating to meet the revised ITS templates.
• Institutions intending to use the CRR3 Alternative Standardised Approach for market risk may wish to assess the impact of being newly in scope of the EBA market risk benchmarking exercise, including internal governance, data availability, and operational readiness for participation in the second half of 2027.
• Firms that anticipate using the CRR3 Alternative Internal Model Approach may wish to monitor the postponement of AIMA data collection and evaluate how the uncertainty in the effective implementation date interacts with their internal model development timelines and supervisory expectations.
• Regulatory and reporting functions may wish to map current market risk reporting templates to the proposed reorganised and rationalised templates, identifying data gaps and system changes required once the final ITS enter into force.
• Compliance teams may wish to coordinate with risk and reporting teams to prepare a response to the EBA consultation by the 3 September 2026 deadline, particularly on practical aspects of template design, data availability, and timing of the 2027 benchmarking exercise.
• Institutions newly included in scope by virtue of using CRR3 ASA should consider whether additional internal documentation, model validation, and supervisory engagement are needed ahead of the second-half 2027 benchmarking exercise, given the EBA’s intention to adopt the final ITS earlier to give such institutions more preparation time.

What changed

The consultation proposes amendments to the ITS on supervisory benchmarking of market risk models for the 2027 exercise, updating the data collection framework and reporting templates used by institutions and competent authorities under Article 78 of Directive 2013/36/EU (CRD). The scope of the market risk benchmarking exercise would be expanded to include institutions applying the CRR3 Alternative Standardised Approach (ASA) for market risk, irrespective of whether they also use an Internal Model Approach (IMA).

Key dates

2026-07-16

FDIC, Federal Reserve Board, and OCC issued the joint statement on handling highly sensitive information during examinations

2026-07-16 Deadline

Affected banks must be notified of any potential or confirmed material data breach involving confidential supervisory information no later than 72 hours after discovery, unless legal restrictions apply

Suggested considerations

• Compliance teams may wish to review examination response procedures for materials that could be treated as highly sensitive, including technology diagrams, penetration test results, detailed control-weakness reports, and similar data.
• Banks may wish to establish an internal process for flagging sensitive examination materials to examiners and documenting the basis for the sensitivity designation.
• Firms may wish to confirm that exam-response playbooks address on-site review, direct-from-system access, redaction, and summarization options for especially sensitive documents.
• Compliance and information security teams may wish to ensure escalation paths are ready if examiners disagree about whether information should receive enhanced handling.
• Firms may wish to verify incident-response and supervisory-notification procedures can support rapid engagement if a material supervisory-information breach is suspected.

What changed

The agencies said they will use a coordinated approach to identify highly sensitive data and documents during examinations and will apply enhanced handling procedures to reduce cybersecurity risk while preserving examiner access. The statement says review may occur on-site rather than by transferring materials onto agency systems, and the agencies may use other protective methods such as direct digital review from the bank's own systems or review of redacted or summarized materials where appropriate.

Key dates

2026-06-08

CFPB issued the Statement on Ability To Repay and Immigration Status referenced by the agencies

2026-07-13

FDIC, OCC, and NCUA issued the interagency guidance on lending to individuals not legally authorized to work in the United States

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that capacity-to-repay analysis captures employment-authorization-related income instability.
• Firms should consider whether credit policy, risk grading, and portfolio monitoring procedures explicitly address elevated repayment uncertainty for non-work-authorized borrowers.
• Institutions may wish to reassess documentation and verification controls for income, employment, and supporting records in light of the agencies' stated focus on safe-and-sound lending.
• Teams should consider whether fair-lending, TILA, and ECOA controls are aligned with the CFPB's June 8, 2026 statement and the interagency guidance.
• Risk and finance functions may wish to evaluate whether allowance, concentration risk, and credit-loss assumptions need updating where exposure to this borrower segment is material.

What changed

The publication does not create a new lending ban or a new standalone rule. Instead, it restates that institutions should identify, measure, monitor, and control the credit risks associated with borrowers who are not legally authorized to work in the United States through underwriting practices that assess willingness and capacity to repay according to the credit terms. The guidance specifically links this issue to the CFPB's June 8, 2026 Statement on Ability To Repay and Immigration Status and reminds creditors of obligations under the Truth in Lending Act as implemented by Regulation Z,...

Key dates

2026-07-13

OCC, FDIC, and NCUA issued the interagency guidance

2026-06-08

CFPB issued its Statement on Ability To Repay and Immigration Status, referenced by the guidance

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that repayment capacity, source of repayment, and overall financial condition are assessed consistently for borrowers whose work authorization is uncertain.
• Firms may wish to test whether account management, credit classification, and allowance methodologies adequately capture elevated credit risk linked to employment authorization uncertainty.
• Institutions may wish to review consumer compliance controls for alignment with TILA, Regulation Z, ECOA, and Regulation B when evaluating applicants affected by immigration or work-authorized status.
• Risk and compliance teams may wish to update portfolio monitoring, concentration analysis, and documentation standards so that the identified credit risk factors are reflected in governance and reporting.
• Community banks may wish to verify that loan policy language and examiner-facing documentation clearly show how these risks are being identified, measured, monitored, and controlled.

What changed

The publication is guidance, not a new rule or statute, and it reinforces existing expectations rather than imposing a new legal prohibition. It states that lending to individuals not legally authorized to work in the United States may present elevated credit risk because their ability to generate income, maintain employment, and remain financially stable may be more uncertain.

Key dates

2026-07-13

Federal Reserve speech delivered in London on modernization of financial regulation

2026-07-22 Deadline

FSB public comment deadline for the consultation report on sound practices for responsible adoption of AI

2026-07-13

Speech states the FSB modernization consultation report will be published in the fall and then delivered to the G20

Suggested considerations

• Compliance teams may wish to map the speech to ongoing capital-rule workstreams, especially Basel III, stress testing, and G-SIB surcharge calibration.
• Large-bank firms may wish to assess whether current capital planning assumes overlapping stress-test and risk-based requirements that could be reduced or realigned.
• Community and regional banks may wish to review whether fixed-dollar regulatory thresholds continue to overstate burden as assets grow with inflation and nominal GDP.
• Supervised firms may wish to align internal issue-management processes with the Federal Reserve’s stated shift toward findings tied to material financial risk and more differentiated treatment of lesser issues.
• AI governance teams may wish to compare current model-risk, vendor-risk, and use-case controls against the FSB’s consultation themes on responsible adoption and use of AI.
• Boards and senior management may wish to review whether supervisory documentation, escalation, and risk reporting are sufficiently focused on material safety-and-soundness issues.

What changed

This speech does not itself impose binding requirements, but it signals several concrete regulatory and supervisory changes already underway. Bowman said the Federal Reserve is advancing a 2026 Basel III proposal and related capital framework reforms, including a single stack of risk-based capital requirements for large banks, recalibration of the G-SIB surcharge, reduced overlap between stress testing and risk-based capital requirements, and indexing the G-SIB surcharge to nominal economic growth going forward.

Key dates

2026-07-07

Federal Reserve Board issued the request for comment on the proposed AML program amendments

2026-09-05 Deadline

Indicative comment deadline if the proposal is published in the Federal Register on July 7, 2026; the Federal Reserve states comments are due 60 days after Federal Register publication

Suggested considerations

• Compliance teams may wish to review current AML/CFT program governance against the proposed minimum program components, including risk-based controls, independent testing, training, and designated accountable oversight.
• Firms may wish to map their current risk assessment methodology to the FinCEN AML priorities referenced in the proposal and identify any gaps in documentation or calibration.
• Banks may wish to assess whether resources are demonstrably weighted toward higher-risk customers, products, services, and activities, since the proposal emphasizes risk-based allocation.
• Compliance functions may wish to track the Federal Register publication date closely so the 60-day comment clock can be calculated once the notice is published.
• Commenting stakeholders may wish to compare the Federal Reserve proposal with the parallel proposals from the other agencies to identify alignment issues or operational inconsistencies.

What changed

The proposal would amend the Federal Reserve's requirements for banks to maintain anti-money laundering programs to align with parallel proposals from four other agencies. It would require banks to allocate AML resources based on risk, with greater attention to higher-risk customers and activities. It would also require banks to incorporate the Financial Crimes Enforcement Network's AML priorities into their risk assessment processes.

Key dates

2026-06-25

FDIC Board met in open session and approved three notices of proposed rulemaking

Suggested considerations

• Compliance teams may wish to assess whether the institution would fall above the proposed resolution-submission threshold if raised to $100 billion in assets.
• Firms may wish to inventory current resolution-planning, interim supplement, and public-section processes to identify work that could be reduced or repurposed if the proposal is finalized.
• Assessment and finance teams may wish to model the impact of a $10 billion to $30 billion threshold change and any indexed future adjustments on deposit insurance assessments.
• Legal and information-governance teams may wish to review confidentiality-agreement templates and third-party-sharing controls in anticipation of broader permitted disclosure under Part 309.
• Institutions currently subject to FDIC resolution submissions may wish to monitor whether the proposed filing-cycle change to every three years alters internal preparation calendars and governance approvals.

What changed

The Board approved a notice of proposed rulemaking to revise resolution-submission requirements for covered insured depository institutions; secondary reporting indicates the proposal would raise the applicability threshold from $50 billion to $100 billion in total assets, move covered institutions to a three-year filing cycle, eliminate certain interim supplements and public sections, and remove a substantial portion of current narrative content requirements.

Key dates

2026-06-02

FDIC, OCC, and Federal Reserve jointly announced updates to certain interagency documents removing references to reputation risk

Suggested considerations

• Compliance teams may wish to inventory supervisory manuals, internal policies, and model examination references that still mention reputation risk and assess whether any language should be updated for consistency with the agencies’ approach.
• Firms should consider whether account-closure, onboarding, or risk-acceptance frameworks rely on reputation-risk concepts that may now be less aligned with supervisory expectations.
• Banks may wish to review escalation criteria and decision records to ensure they are grounded in material financial, operational, or legal risk factors rather than vague reputational concerns.
• Supervisory response teams may wish to brief relevant business lines on the agencies’ stated focus on financial risk and the agencies’ concern that reputation risk can be used to pressure restrictions on lawful customer activity.
• Compliance functions may wish to monitor whether additional interagency documents are revised in subsequent FDIC, OCC, or Federal Reserve publications.

What changed

The publication says the agencies updated certain interagency documents and removed references to reputation risk. The stated scope of the change is narrow: the agencies said the updates are limited to removing references to reputation risk, not to imposing new obligations on banks. The agencies also reiterated that reputation risk can be misused to pressure banks to restrict access to financial services based on constitutionally protected political or religious beliefs, speech, conduct, or lawful business activities.

Key dates

2026-04-09

FSCA press release on Fusion Guarantees and unregistered insurance business

2026-03-23

Gauteng Division of the High Court delivered the judgment referenced in the press release

Suggested considerations

• Compliance teams may wish to assess whether construction, performance, or surety-style products could be characterised as non-life insurance under the Insurance Act.
• Firms may wish to review whether their current authorisations actually cover guarantee products that assume contingent obligations in exchange for consideration.
• Legal and compliance functions may wish to align product documentation, marketing language, and contractual mechanics with the true regulatory character of the instrument.
• Counterparty due diligence processes may wish to verify whether guarantee issuers are authorised as insurers before acceptance of the instrument.
• Boards and senior management may wish to review governance controls for regulatory classification risk around bespoke guarantee products.

What changed

The High Court granted the FSCA’s counter-application and declared Fusion’s construction guarantees to be non-life insurance policies under the Insurance Act. The court held that issuing those guarantees without insurance authorisation breached section 5(1) of the Insurance Act, and it interdicted Fusion from issuing construction guarantees going forward. The court also declared the guarantees referenced by Elasah to be insurance policies and ordered costs against Fusion and Elasah.