Credit Unions Regulatory Updates

Key dates

2020-04-27

NCUA published the interim final rule establishing the PPP risk-weighting, PPP Loan Facility total-asset exclusion, and commercial-loan treatment.

2022-01-01

NCUA’s 2015 risk-based capital final rule became effective; the December 2021 final rule had already carried forward the relevant PPP treatment into the then-current capital adequacy framework.

2026-11-04

The final rule adopting the April 27, 2020 IFR without change becomes effective and is published at 91 FR 69493.

Suggested considerations

• Compliance teams may wish to confirm that risk-based capital reporting continues to assign a 0 percent risk weight only to loans meeting the applicable SBA PPP eligibility and coverage criteria.
• Credit unions that pledged PPP loans to the Federal Reserve PPP Loan Facility may wish to verify that the loans remain appropriately identified and excluded from total assets solely for the net worth ratio calculation under 12 CFR 702.2.
• Regulatory reporting and finance teams may wish to reconcile PPP-loan classifications across the general ledger, capital calculations, Call Report processes, and supporting documentation.
• Lending compliance teams may wish to confirm that qualifying PPP loans are not included as commercial loans for purposes of 12 CFR part 723, while other applicable lending, documentation, servicing, SBA-guarantee, and record-retention requirements remain separately addressed.
• Credit unions may wish to retain evidence supporting SBA guarantees, facility pledges, non-recourse funding, and the basis for any regulatory capital exclusions, particularly where legacy PPP balances remain on the balance sheet.
• Policy owners may wish to update regulatory inventories to identify the 2026 rule as a finalization of the 2020 IFR rather than as a new operational requirement.

What changed

Under 12 CFR part 702, covered loans issued under the SBA Paycheck Protection Program continue to receive a 0 percent risk weight for risk-based capital purposes. PPP loans pledged as collateral for a non-recourse borrowing through the Federal Reserve’s PPP Loan Facility continue to be excluded from total assets when calculating the net worth ratio under 12 CFR 702.2. Under 12 CFR part 723, PPP loans remain excluded from the definition of commercial loans.

Key dates

2026-11-03

FCA and PRA published DP26/1: Credit unions: review of the regulatory regime.

2027-03-05 Deadline

Deadline for responses to DP26/1 to be sent to the FCA.

Suggested considerations

• Credit unions should consider whether to submit a response by 5 March 2027, addressing the questions and evidence relevant to their business model, size, complexity, growth plans and risk profile.
• Boards and senior management may wish to assess how potential changes to prudential requirements, permitted activities, governance expectations, operational resilience and resolution or exit arrangements could affect strategic plans, without treating the Discussion Paper as a change to current rules.
• Compliance and regulatory-policy teams should map the firm’s current obligations under the PRA Rulebook Credit Unions Part, applicable FCA conduct requirements and the Credit Unions Act 1979, then identify areas where proportionality or regulatory barriers create material costs or risks.
• Credit unions may wish to engage with representative bodies and credit union service organisations to develop evidence on member outcomes, access to affordable credit, innovation, consolidation, operational dependencies and barriers to orderly exit.
• Firms should monitor subsequent FCA and PRA consultation papers, policy statements and rule changes because any future implementation would require a separate policy process and could include differentiated requirements for smaller and larger credit unions.

What changed

No binding regulatory requirements or policy changes have been introduced. The regulators are seeking evidence on whether the existing prudential framework remains appropriate; whether risk-based and proportionate requirements could better support growth and complexity; whether the framework provides adequate safeguards while enabling competition and innovation; and whether credit unions have effective tools for orderly market exit. The publication is relevant to credit unions in Great Britain and Northern Ireland, their members, credit union service organisations and trade associations.

Key dates

2026-11-03

PRA and FCA publish the joint discussion paper and open the feedback period.

2027-03-05 Deadline

Deadline for responses to the discussion paper to be submitted to the PRA and FCA.

Suggested considerations

• Firms should assess the discussion paper against their size, growth trajectory, business model, lending mix, capital methodology, governance arrangements and operational-risk profile.
• Credit unions may wish to submit evidence to the PRA and FCA by 5 March 2027, including quantified costs and benefits of simplified requirements, risk-based capital treatment, revised reporting and any proposed thresholds.
• Compliance and risk teams should map current internal-audit, regulatory-documentation, capital, leverage-ratio, risk-weighted-asset, capital-add-on and stress-testing requirements so that the impact of possible future options can be assessed without assuming that any proposal is yet effective.
• Boards and senior management should consider whether planned growth, aggregator arrangements, mortgage or fixed-rate lending, outsourcing and technology investment are matched by appropriate governance, liquidity, credit-risk, operational-resilience and third-party oversight capabilities.
• Firms considering new products or services should identify statutory, prudential, conduct, systems and outsourcing barriers and document the safeguards that would be needed to support a credible response to the regulators.
• Credit unions should review current wind-down, transfer and restructuring plans and identify legislative or contractual barriers to sale of loan books, transfer of business or conversion to another mutual form.
• Industry bodies and service providers may wish to coordinate submissions on FCA fees, shared-service models, CUSO capability, third-party guidance and the practical consequences of applying Small Domestic Deposit Takers rules.

What changed

This is a discussion paper, not a consultation proposing or committing to specific policy changes, so existing PRA and FCA requirements continue to apply. The regulators are examining whether internal-audit and regulatory-document requirements could be reduced for smaller and simpler credit unions; whether larger or more complex credit unions should move to a risk-based framework with more flexible capital requirements; and whether relevant Small Domestic Deposit Takers rules, including the standardised approach for risk-weighted assets, could replace the current simple leverage-ratio...

Key dates

2026-11-03

PRA published CP15/26 for consultation.

2026-12-04

Northern Ireland Assembly consultation on the Credit Unions (Amendment) Bill closes; this is a legislative scrutiny date, not a stated PRA consultation deadline.

Suggested considerations

• Compliance teams may wish to track the Northern Ireland Assembly’s passage and final commencement provisions for the Credit Unions (Amendment) Bill rather than treating the consultation proposals as final requirements.
• Credit unions considering member referrals should assess governance, counterparty due diligence, member eligibility and service-specific responsibilities, and consider whether contracts prevent inappropriate transfer of credit risk back to the referring credit union.
• Credit unions considering loan participation should consider documenting originator and participant roles, borrower relationship ownership, underwriting and monitoring responsibilities, security and enforcement rights, default allocation, concentration limits, large-exposure treatment, provisioning and capital treatment.
• Boards and senior managers may wish to assess whether existing risk appetite, lending policies, management information, stress testing and internal controls are proportionate to the additional activities contemplated by the PRA.
• Firms may wish to map existing lending-limit, large-exposure, provisioning and capital processes against the proposed treatment of participation loans and identify data or systems changes needed before implementation.
• Credit unions that do not intend to undertake the new activities may wish to document that decision and retain evidence that their existing governance and control framework remains appropriate for their current business model.
• Affected firms may wish to monitor the PRA’s final policy statement and any revised SS2/23 or Rulebook text before committing to new products or contractual arrangements.

What changed

The PRA proposes amendments to the Credit Unions Part of the PRA Rulebook and SS2/23 – Supervising Credit Unions. Member referral arrangements would be treated as an additional activity; the receiving credit union would retain responsibility for the referred member’s credit risk, and firms would be expected to maintain effective governance, due diligence and clear contractual allocation of responsibilities.

Key dates

2026-11-03

PRA publication date for DP2/26 and FCA publication date for the parallel credit-union discussion paper DP26/1.

2027-03-05 Deadline

Deadline for responses to DP2/26, submitted to [email protected].

Suggested considerations

• Firms should consider whether to submit evidence or a response to DP2/26 by 2027-03-05, addressing the questions most relevant to their size, business model, activities and growth plans.
• Compliance teams may wish to map current prudential, reporting, governance and operational-resilience requirements against the proposed distinction between small and simple firms and larger or more complex credit unions.
• Credit unions considering growth should assess whether board expertise, senior-management capacity, capital and liquidity planning, credit-risk controls, member-servicing capability and operational resilience will scale with membership and lending volumes.
• Firms may wish to review governance and controls for aggregator-driven growth, mortgage lending, fixed-rate products, outsourced activities, third-party providers and CUSO relationships, because these are identified as areas where future safeguards or supervisory expectations may develop.
• Boards and senior managers should consider how existing responsibilities under Rule 11.5(3) of the Credit Unions Part of the PRA Rulebook are evidenced, including oversight of regulatory compliance, risk management and business growth.
• Credit unions may wish to evaluate their current solvent-exit and wind-down arrangements, including the feasibility of transferring business, selling a loan book, restructuring or maintaining continuity of member services.
• Trade associations and service organisations may wish to provide data on compliance costs, asset-based thresholds, barriers to permitted activities, common-bond expansion, CUSO use and the practical effects of different prudential models.
• Firms should monitor subsequent PRA and FCA consultations and any legislative proposals; no implementation plan or transition timetable has been established at this stage.

What changed

No rules, thresholds, permissions or supervisory requirements have been amended by DP2/26. The regulators are seeking evidence on six outcomes: proportionate regulation; consumer confidence and protection; competition and innovation; long-term sustainability; operational resilience and risk management; and orderly market exit.

Key dates

2026-10-07

PRA published CP13/26 proposing automatic indexation of in-scope regulatory thresholds every five years, with a proposed first update on 1 July 2031.

2026-10-14

PRA published PS19/26 setting out the final policy on high loan-to-income lending.

2026-10-22

PRA published CP14/26 consultation on phase 2 of SM&CR reform.

2026-10-26

Bank of England and FCA published the 2026 survey results on artificial intelligence and machine learning in UK financial services.

2026-10-28

PRA rules and supervisory statement on high-LTI lending commenced; the firm-specific 15% cap was removed and the revised monitoring and governance framework became effective.

2027-01-22 Deadline

Consultation deadline reported for the PRA and FCA phase 2 SM&CR consultations.

2027-02-07 Deadline

Consultation deadline for CP13/26 and the associated discussion of additional thresholds potentially suitable for indexation.

2031-07-01

Proposed date for the first automatic update of in-scope regulatory thresholds under CP13/26, subject to final policy and implementation.

Suggested considerations

• Mortgage lenders should assess their high-LTI lending strategy against risk appetite, capital and credit-risk tolerances now that the firm-specific 15% cap has been removed.
• Mortgage lenders should establish or validate rolling four-quarter calculations for individual high-LTI flows and retain evidence supporting any adjustments, limits or risk appetite decisions.
• Relevant firms should review governance, underwriting, affordability, concentration and stress-testing controls to demonstrate prudent management of high-LTI lending under the new PRA expectations.
• Compliance and regulatory-reporting teams should monitor the PRA’s quarterly aggregate high-LTI publications and assess whether lending plans remain consistent with the FPC’s aggregate 15% limit.
• PRA-regulated firms should map current Rulebook and supervisory-statement thresholds against the 128 proposed in-scope thresholds and identify systems, permissions, reporting and policy documents that would require future updates.
• Affected firms should consider submitting responses to CP13/26 and its associated discussion questions by 7 February 2027, particularly where indexation could alter regulatory categorisation, reporting, capital, liquidity, governance or investment-flexibility requirements.
• SM&CR compliance teams should assess CP14/26 against current senior-manager responsibilities, certification processes, fitness and propriety controls, governance maps, handover arrangements and recordkeeping, while treating the proposals as non-final.
• Firms should monitor the related FCA SM&CR consultation and coordinate any response because implementation may require changes across PRA and FCA regimes.

What changed

PS19/26 removes the firm-specific 15% limit on high-LTI mortgage lending, while retaining the Financial Policy Committee’s aggregate 15% limit as the benchmark for overall market lending. Firms’ individual high-LTI flows and any required adjustments will be assessed on a rolling four-quarter basis, whereas aggregate high-LTI lending will continue to be monitored quarterly. The final rules and supervisory statement also introduce governance and risk-management expectations, and the PRA intends to publish aggregate high-LTI flow data quarterly.

Key dates

2026-10-15

The proposed rule is published in the Federal Register.

2026-12-14 Deadline

Public comments on the proposed amendments to 12 CFR parts 704 and 713 are due.

Suggested considerations

• Compliance teams may wish to review the proposal against existing policies and procedures under 12 CFR 704.18, 12 CFR 713, and 12 CFR 741.201, distinguishing provisions that would be removed from obligations that would remain.
• Credit unions should continue to maintain existing fidelity-bond coverage, deductibles, renewal processes, and NCUA-related approvals unless and until a final rule becomes effective.
• Boards and management may wish to assess whether current coverage remains adequate for fraud, dishonesty, theft, burglary, robbery, and other covered losses, and preserve documentation supporting the required board review.
• Credit unions and insurers may wish to evaluate whether the proposed flexibility in coverage amounts and deductibles affects policy terms, underwriting, renewal timing, or internal risk assessments.
• Interested parties may wish to submit comments by December 14, 2026, addressing the proposed treatment of coverage calculations, deductibles, bond forms, purchase and renewal procedures, and any transition or implementation concerns.

What changed

The proposal would amend 12 CFR part 713 and related corporate-credit-union requirements in 12 CFR 704.18 by eliminating or modifying prescriptive procedural requirements concerning fidelity-bond purchases and renewals, simplifying the rules governing coverage amounts and deductibles, and removing outdated requirements. The proposal would preserve the requirement that a federally insured credit union maintain adequate fidelity-bond coverage against losses involving fraud, dishonesty, theft, and other covered risks.

Key dates

2026-10-28 Deadline

The PRA amendments to the Housing Part of the PRA Rulebook and SS2/26 commence; the FCA replacement general guidance also comes into effect and prior FCA high-LTI guidance is replaced.

Suggested considerations

• Firms should assess whether their high-LTI risk appetite, lending plans and business model support individual high-LTI flows above 15% from 28 October 2026.
• Firms should review and, where necessary, update board-approved policies, risk appetite statements, underwriting controls, affordability assessments, portfolio limits, stress testing and management information for high-LTI lending.
• Compliance teams may wish to map existing controls and reporting to the rolling four-quarter calculation for individual flows and distinguish this from the regulators’ single-quarter aggregate monitoring measure.
• Firms should establish a process to monitor the PRA’s quarterly aggregate high-LTI publication and the FCA’s notifications regarding expected adjustments, including escalation to senior management and the board where a reduction in lending may be required.
• Firms intending to operate above 15% should consider whether they can reduce high-LTI lending smoothly and predictably towards 15% if requested, including identifying practical management actions and avoiding abrupt changes to customer or intermediary pipelines.
• Firms should confirm that further advances and retirement interest-only mortgage contracts are correctly excluded from the relevant flow calculations and that other mortgage products are classified consistently with the final rules and guidance.
• Firms using the interim PRA modification by consent or FCA individual guidance should confirm that the relevant interim directions will fall away automatically on 28 October 2026 and align systems and procedures with the final framework.
• Senior managers and boards should document oversight of high-LTI strategy, risk appetite changes, portfolio performance, concentration risk and the potential effect of aggregate market developments on future lending.

What changed

The PRA will amend the Housing Part of the PRA Rulebook and the FCA will replace FG14/8, FG17/2 and FG25/4 with new general guidance. High-LTI lending remains lending at an LTI ratio of 4.5 times income or above, with the aggregate market limit remaining 15%; the individual firm-level 15% cap is removed. Individual firm high-LTI flows and any expected reductions will be assessed on a rolling four-quarter basis, while the regulators will monitor aggregate high-LTI flow using a single-calendar-quarter measure.

Key dates

2026-10-07

PRA consultation CP13/26 opens.

2027-02-07 Deadline

PRA consultation CP13/26 closes and responses are due.

2031-07-01

First proposed automatic threshold update would take effect, subject to the consultation outcome and final rules.

Suggested considerations

• Compliance teams may wish to review CP13/26 and identify which of the 128 proposed thresholds currently determine the firm's prudential categorisation, reporting obligations or application of specific rules.
• Firms should consider submitting consultation responses by 7 February 2027, particularly on the suitability of nominal UK GDP as the index, the five-year adjustment interval, the treatment of thresholds near business-planning boundaries and the thresholds excluded from the main proposal.
• Banks and building societies may wish to model how the proposed mechanism could affect future eligibility for the Small Domestic Deposit Takers regime and detailed capital-reporting requirements, while recognising that no 2031 value has been specified in the publication.
• Insurers may wish to assess potential future effects on Solvency UK scope and related governance, reporting and capital-planning assumptions.
• Credit unions may wish to inventory member-related monetary thresholds, including the £7,500 threshold, and assess whether systems and monitoring processes can accommodate future indexed values.
• Regulatory change teams should track the outcome of CP13/26 and the parallel Section 4 discussion on excluded and FCA-joint thresholds rather than treating the proposed increases as current law.
• Firms operating across UK and non-UK regimes may wish to consider potential divergence between UK automatic indexation and static or differently indexed thresholds in other jurisdictions.

What changed

CP13/26 proposes that 128 thresholds determining which PRA rules apply, how those rules apply and what firms must report should be indexed to nominal UK GDP published by the Office for National Statistics. The proposed indexation cycle is every five years, using nominal GDP because it captures both price changes and real economic growth.

Key dates

2027-02-07 Deadline

Deadline for responses to CP13/26 and the associated discussion-paper section.

2031-07-01

Proposed effective date for the first automatic update of in-scope thresholds, subject to finalisation of the framework.

Suggested considerations

• Consider submitting responses on the proposed framework, the proposed in-scope threshold list, the methodology and the separate discussion-paper thresholds by 2027-02-07.
• Map the firm's current and forecast assets, exposures, liabilities, lending and reporting metrics against relevant PRA thresholds, including proposed thresholds that may be revised before finalisation.
• Assess whether nominal GDP indexation could move the firm out of, or into, a threshold-defined prudential treatment from 2031 onwards, while recognising that firms growing faster than nominal GDP would still be expected to cross thresholds.
• Review regulatory reporting, capital, liquidity, governance, risk-management and policy systems that hard-code fixed threshold values or effective dates, and consider designing controlled update mechanisms for future indexed values.
• Assess the effect of the proposed five-year update cycle on business planning, acquisitions, balance-sheet growth, lending strategies and group-structure decisions.
• Consider providing quantitative evidence to the PRA on implementation costs, cliff-edge effects, reporting impacts and whether additional discussion-paper thresholds should be included.
• Monitor the final PRA policy statement, the final automatic-indexation statement of policy and the consolidated threshold list before treating any proposed uprating as a binding change.

What changed

The PRA proposes to replace the current predominantly ad hoc threshold-review process for eligible fixed nominal thresholds with a rules-based framework. In-scope thresholds would be indexed using UK nominal GDP, based on data produced by the Office for National Statistics, on a common five-year cycle; the first automatic update would take effect on 1 July 2031, subject to final policy.

Key dates

2026-10-06

Vice Chair Bowman delivered the speech announcing the Federal Reserve's planned five-region supervisory realignment and outlining proposed modernization initiatives.

2026-07-01

The revised Community Bank Leverage Ratio framework took effect, lowering the ratio from 9 percent to 8 percent.

2025-12-01

The FFIEC issued a request for information on streamlining the Call Report.

Suggested considerations

• Compliance teams may wish to monitor Federal Reserve, FDIC, OCC, and FFIEC proposals arising from the speech, particularly any proposal to index fixed-dollar thresholds, revise community-bank classifications, modify large-bank tailoring, or amend Regulation O.
• Community banks should consider assessing how a future increase in the Community Bank Leverage Ratio eligibility threshold or broader community-bank treatment could affect capital planning, reporting, examination scope, and supervisory expectations; the speech does not yet establish eligibility changes beyond the 8 percent ratio already effective July 1, 2026.
• Banks preparing mergers may wish to document the competitive effects of credit unions, nonbank lenders, Farm Credit institutions, branchless banks, and other local competitors in anticipation of possible changes to Federal Reserve merger analysis.
• Prospective de novo applicants should consider reviewing business plans, initial and ongoing capital assumptions, governance arrangements, and expected approval timelines against existing federal and state requirements while awaiting any clarification of standards or conditional-approval practices.
• Call Report filers may wish to review the December 2025 FFIEC request for information and preserve data on duplicative, low-value, or operationally burdensome reporting items for future comment opportunities.
• Banks may wish to map current supervisory issues and examination findings to material financial risks, recognizing that the Statement of Supervisory Operating Principles emphasizes prompt escalation and proportionate action rather than checklist-driven process findings.
• Community banks should consider comparing their third-party risk-management programs with the Federal Reserve's community-bank third-party risk-management guide and documenting due diligence, contract oversight, ongoing monitoring, and escalation practices.
• Boards and senior management may wish to track forthcoming CAMELS revisions and assess potential effects on management-rating governance, examination preparation, remediation prioritization, and communications with directors.

What changed

The Federal Reserve announced that it is beginning to realign its supervisory function into five geographic regions led by regional leaders accountable for all supervisory activity in each region, while retaining existing Reserve Bank staff and footprints. The speech states that the Board will later in 2026 consider increasing fixed-dollar asset thresholds in its regulations and establishing a five-year adjustment mechanism tied to inflation and economic growth.

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2026-08-12

Federal Register publication of the proposed rule at 91 FR 52114

2026-10-13 Deadline

Comments due on the proposed rule

Suggested considerations

• Compliance teams may wish to map the proposed changes against current CRA policies, exam procedures, public file practices, and community development grant approval workflows.
• Institutions may wish to assess how the proposed asset-size thresholds would change their CRA category and associated data collection, reporting, and evaluation obligations.
• Banks making grants or donations may wish to review documentation standards for recipient use of funds, overhead limits, and evidentiary support needed for CRA consideration.
• Community development and CRA governance teams may wish to identify which activities would still qualify under the revised CD definitions and performance tests.
• Legal and regulatory affairs functions may wish to prepare comments on the proposed lending focus, grant criteria, sunshine requirements, and technical changes to OCC public welfare and corporate activity rules.
• Banks subject to CRA-related agreements may wish to verify whether the proposed technical amendments would affect disclosure timing, content, or filing processes.

What changed

['The proposal would amend the OCC and FDIC Community Reinvestment Act rules to make substantive, technical, and process-oriented changes aimed at refocusing the statutory objective on meeting community credit needs and reducing burden, particularly for community banks.', 'The agencies propose to better ensure that community development grants reach intended communities and to provide greater clarity on how to obtain CRA consideration for activities.', 'The OCC and FDIC also propose technical changes to their CRA sunshine rules under the Federal Deposit Insurance Act, which govern disclosure...

Key dates

2025-12-29

NCUA published the proposed rule to remove 12 CFR 701.25(b)

2026-02-27 Deadline

Public comment period closed

2026-08-06

Final rule published in the Federal Register at 91 FR 50664

2026-09-08 Deadline

Final rule becomes effective and 12 CFR 701.25(b) is removed

Suggested considerations

• Compliance teams may wish to confirm that internal lending policies still reflect the remaining limits in 12 CFR 701.25(a) and any other applicable provisions, even though the separate policy requirement in paragraph (b) has been removed.
• Boards may wish to review whether any internal approval process for loans to other credit unions remains desirable as a governance control, particularly where state law, bylaws, or enterprise risk practices still support formal approval.
• State-chartered credit unions may wish to verify whether state law or state supervisory expectations still require board approval or written policies for loans to other credit unions.
• Monitoring teams may wish to update regulatory inventories, policy cross-references, and exam prep materials to reflect that 12 CFR 701.25(b) is no longer codified effective 2026-09-08.
• Training and procedure documents may wish to distinguish between the removed board-policy requirement and the continuing statutory and regulatory loan limits that still apply.

What changed

The final rule removes the documentation requirement in 12 CFR 701.25(b) that required board approval of all loans to other credit unions and written policies governing those loans. NCUA states that federal credit unions remain subject to statutory requirements on loans to credit unions, and the remaining limits and requirements in § 701.25 continue to apply. The rule does not change the aggregate loan limit in § 701.25(a), which remains 25% of the lending federal credit union’s paid-in and unimpaired capital and surplus.

Key dates

2026-02-25

NCUA published the proposed rule for public comment.

2026-04-27

Public comment period closed after NCUA received 15 comments.

2026-08-06

NCUA published the final rule in the Federal Register at 91 FR 50680.

2026-09-08 Deadline

Final rule becomes effective.

Suggested considerations

• Compliance teams may wish to review and update FCU written policies for purchases, sales, and pledges of eligible obligations so they no longer mirror the removed prescriptive checklist and instead reflect the board’s own risk-based framework.
• Credit unions may wish to confirm that internal governance documents still address conflicts of interest and compensation consistently with bylaws and fiduciary-duty expectations, even though the detailed regulatory text has been removed.
• Firms should consider updating any procedures, training materials, and control inventories that reference the old paragraph structure or the former 12 CFR 701.23(h) cross-reference.
• Compliance teams may wish to validate that transaction approval, due diligence, documentation, and agreement-review processes continue to be embedded in policy at a level appropriate to the institution’s risk profile, even though the rule is less prescriptive.
• Federal credit unions may wish to brief boards and relevant committees on the shift from a checklist-based rule to a principles-based framework so governance oversight remains aligned with supervisory expectations.

What changed

['The rule removes the mandated lists of items that FCU written policies must address for purchases, sales, and pledges of eligible obligations under 12 CFR 701.23(b)(6), (c), and (d). FCUs still must maintain written policies for these activities, but the regulation no longer prescribes a detailed checklist of required policy contents.', 'The rule removes the detailed conflicts-of-interest and compensation provision formerly in 12 CFR 701.23(g).

Key dates

2026-03-25

NCUA issued the proposed rule to remove the prescriptive requirements

2026-05-26 Deadline

Public comment period closed

2026-08-06

Final rule was published in the Federal Register at 91 FR 50677

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to review current indirect vehicle lending policies to confirm they no longer reference the removed 50% and 100% net-worth limits.
• Boards may wish to document a board-approved risk appetite and concentration framework for third-party serviced indirect vehicle loans.
• Credit unions may wish to align vendor oversight, due diligence, and servicing controls with their internal policies since the prior waiver pathway is no longer the operative framework.
• State-chartered federally insured credit unions may wish to verify any conforming updates needed to insurance-related procedures and governance materials.
• Compliance functions may wish to update training, policy manuals, and examination binders to reflect that supervision will now focus on principles-based oversight rather than the deleted rule text.

What changed

The final rule removes 12 CFR 701.21(h) in full, eliminating the existing concentration limits, the 30-month step-up to a higher limit, the waiver process to a Regional Director, the related response timeline, and the embedded definition framework tied to that paragraph. NCUA also states that it removed the parallel requirement in 12 CFR 741.203(c) and the related citation in 12 CFR 746.201(c), as part of the same deregulatory package.

Key dates

2026-08-06

Federal Register publication of the final rule at 91 FR 50661

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to update policies, procedures, and product templates that still reference the former segregated deposit and collateral formulas in 12 CFR 701.20.
• Institutions may wish to review surety and guaranty programs to ensure the obligation remains fixed in amount and duration and is structured as an otherwise permissible loan under the applicable lending regulations.
• FCUs may wish to confirm that any related lending analysis still addresses member lending limits and other applicable provisions, including where commercial lending rules apply.
• FISCUs may wish to confirm continued state-law authority to act as surety or guarantor and verify any state-specific constraints or approvals before offering these arrangements.
• Risk and compliance functions may wish to reassess collateral practices for these products in light of the new flexibility while preserving safety-and-soundness controls.

What changed

The final rule deletes the specific segregated deposit requirement in 12 CFR 701.20(c)(3) for suretyship and guaranty agreements. It also removes the detailed collateral standards in 12 CFR 701.20(d), including the prior 100 percent and 110 percent collateral categories and the requirement for a perfected security interest tied to those prescribed values.

Key dates

2026-02-25

NCUA issued the proposed rule removing 12 CFR 701.26; public comments were invited through April 27, 2026

2026-04-27 Deadline

Public comment deadline on the proposal

2026-08-06

Final rule published in the Federal Register at 91 FR 50674

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to remove references to 12 CFR 701.26 from policies, procedures, and training materials once the rule is effective.
• Firms should consider confirming that contract templates still include written terms addressing audit rights, information security, business continuity, indemnification, performance metrics, data ownership and return, termination, and dispute resolution.
• Credit unions involved in shared operational arrangements may wish to review whether documentation now reflects the updated clarification in 12 CFR 721.3.
• Firms may wish to confirm that third-party risk management, vendor oversight, and due diligence controls remain aligned with existing supervisory expectations despite the regulatory deletion.

What changed

The final rule rescinds 12 CFR 701.26, which had addressed FCU authority to enter written contracts for assets or services relating to daily operations and required those agreements to be in writing. NCUA states that the contractual authority already exists under the FCU Act and incidental powers authority, so the regulation was redundant. The Board also amended 12 CFR 721.3 to formally clarify that credit unions may act as representatives in shared operational arrangements with other credit unions or organizations, and that fixed assets may be shared.

Key dates

2026-08-06

FDIC published the notice of proposed rulemaking in the Federal Register

2026-10-05 Deadline

Comments on the proposal must be received by the FDIC

Suggested considerations

• Compliance teams may wish to map current insider-lending policies against the proposed $400,000 and $2,000,000 thresholds to assess operational impact if finalized.
• Firms may wish to review board-approval workflows and escalation triggers so systems can be updated quickly if the proposal is adopted.
• Institutions may wish to evaluate whether existing exception reporting, insider tracking, and credit administration procedures will need revision to reflect periodic indexing rather than fixed thresholds.
• Commenters may wish to submit feedback by the October 5, 2026 comment deadline if the proposed thresholds or indexing methodology would create implementation issues.

What changed

The proposal amends 12 CFR 337.3 for extensions of credit to insiders of FDIC-supervised institutions. It would increase the threshold for certain extensions of credit to executive officers not otherwise specifically authorized by statute from $100,000 to $400,000, and it would increase the threshold for extensions of credit to insiders requiring prior approval by the board of directors from $500,000 to $2,000,000. The FDIC also proposes to establish an indexing methodology to periodically update those dollar thresholds over time.

Key dates

2026-08-04

Publication of the Federal Reserve Board notice of proposed rulemaking ‘Regulatory Modernization and Relief for Mutual Holding Companies’ in the Federal Register (91 FR 49490; FR Doc. 2026-15774) amending Regulations Q (12 CFR part 217) and MM (12 CFR part 239).

2026-10-05 Deadline

Comment deadline for submitting responses to the Federal Reserve Board on the proposed amendments to Regulations Q and MM (Docket No. R-1895; RIN 7100-AH26).

Suggested considerations

• Compliance teams at mutual holding companies and savings and loan holding companies may wish to review the proposed amendments to Regulation MM (12 CFR part 239), particularly the sections on dividend waivers, mutual-to-stock conversion processes, post-conversion restrictions, chartering requirements for subsidiary holding companies, and updated model charters and bylaws, to assess operational and governance impacts.
• Firms planning or contemplating mutual-to-stock conversions should consider comparing their current conversion documentation, use of FR MM-PS, FR MM-OC and FR MM-OF forms, and liquidation account methodologies with the proposed streamlined forms, corrected liquidation account calculations, and revised rules on stock pricing, repurchases, offers and sales, employee stock ownership plan financing and benefit plans.
• Institutions that issue, or are considering issuing, mutual capital certificates should review the proposed Appendices B and C to Regulation Q (12 CFR part 217) to evaluate whether their existing or planned instrument terms align with the model key terms for qualification as Common Equity Tier 1 or Additional Tier 1 capital, including permanence, loss-absorption, distributions and redemption features.
• Subsidiary holding companies of thrift mutual holding companies may wish to analyze the proposed elimination of the federal charter requirement and related changes to Subpart C of Regulation MM to determine chartering options, corporate structure implications, and any needed updates to organizational documents and regulatory commitments.
• Governance and legal teams at MHCs could review the proposed revisions to membership rights, proxy processes, postal mail requirements, voluntary dissolution, and the model charter and bylaws in Appendices A, C and D to Regulation MM, with a view to aligning internal policies and corporate governance frameworks with the modernized regime once finalized.
• Risk and capital management functions at bank holding companies, savings and loan holding companies and state member banks should consider evaluating capital planning assumptions and buffers in light of the clarified eligibility of mutual capital instruments as regulatory capital under Regulation Q, and identify any systems or reporting changes that may be required if the proposal is adopted.
• All affected firms may wish to prepare internal impact assessments and, where appropriate, draft comment letters addressing specific elements of Regulations Q and MM (Docket No. R-1895; RIN 7100-AH26), including any perceived risks around conflicts of interest, reduced accountability, or adjustment costs noted in the economic analysis.
• Compliance monitoring teams should plan to track the rulemaking through the comment close date and subsequent Federal Reserve actions so that, if the proposal is finalized, implementation plans can be developed for policy updates, staff training and revisions to regulatory reporting and capital instrument documentation.

What changed

The NPR proposes targeted amendments to Regulation MM (12 CFR part 239) governing mutual holding companies (MHCs), including eliminating certain dividend waiver requirements that currently apply to MHCs and their subsidiary holding companies, and revising post-conversion restrictions to reduce burdens following mutual-to-stock conversions.

Key dates

2026-06-04

European Commission adoption of the 3rd FRTB Delegated Act under Article 461a CRR modifying own funds requirements for market risk for a three-year period

2026-08-03

EBA publication of no-action letter on the trading/banking book boundary and internal risk transfers, and technical considerations on FRTB application

2027-01-01

Start of modified calculation of own funds requirements for market risk under the 3rd FRTB Delegated Act for a three-year period

Suggested considerations

• Compliance teams at EU banks should consider reviewing the EBA no-action letter to understand which aspects of the FRTB boundary between banking book and trading book, internal risk transfers, and related reporting are currently deprioritised for supervisory or enforcement action, and how this interacts with national competent authority expectations.
• Risk and regulatory capital teams may wish to map their existing and planned FRTB implementation (standardised and internal models approaches) against the technical considerations published by the EBA, focusing on how the 3rd FRTB Delegated Act’s institution-specific multiplier and related boundary rules affect market risk capital calculations from 2027-01-01.
• Firms should consider identifying whether they fall within the scope of "multiplier banks" under the Delegated Act and assess operational implications, including whether their systems and data architecture can support a single, harmonised boundary framework rather than multiple versions during the three-year transitional period.
• Supervisory reporting and Pillar 3 disclosure teams may wish to analyse the EBA’s clarifications on reporting requirements linked to the trading/non-trading book boundary and internal risk transfers to determine whether current templates, data points, and governance need adjustment ahead of the Delegated Act’s entry into force.
• Institutions participating in the EBA supervisory benchmarking exercise should consider reviewing the clarified treatment of institutions in that exercise under the revised FRTB framework, and ensure their benchmarking submissions and internal controls are aligned with the EBA’s technical considerations.
• Legal and regulatory policy teams may wish to monitor the scrutiny process of the 3rd FRTB Delegated Act by the European Parliament and Council, as the practical relevance of the no-action letter and technical considerations is contingent on the Delegated Act entering into force as adopted on 2026-06-04.

What changed

The EBA has formally issued a no-action letter recommending that competent authorities do not prioritise supervisory or enforcement action regarding provisions of the FRTB framework that govern: (i) the boundary between the banking book and the trading book; (ii) internal risk transfers between these books; and (iii) certain related reporting requirements, during the transition to the revised market risk regime.

Key dates

2026-07-31

Policy becomes effective for authorized financial services provided to persons or entities located in Venezuela

2027-01-29 Deadline

End of the stated commitment period for the agencies’ enforcement-policy non-action position

Suggested considerations

• Compliance teams may wish to confirm whether any Venezuela-related activity is specifically authorized under applicable OFAC sanctions licenses or other authorizations before relying on the policy.
• Institutions may wish to verify that their BSA/AML compliance program is currently in place and that they continue to make reasonable efforts to meet applicable BSA Requirements during the relief period.
• Firms may wish to review whether they have had a final BSA-related enforcement action by FinCEN or their primary federal regulator within the prior 24 months, as that would disqualify reliance on the commitment.
• Operational teams may wish to document the basis for treating transactions as covered authorized financial services in Venezuela and retain evidence supporting reliance on the enforcement-policy statement.

What changed

The agencies announced a temporary enforcement-policy commitment covering authorized financial services provided to persons or entities located in Venezuela from 2026-07-31 through 2027-01-29. During that period, the agencies state they will not take supervisory action, including citing a violation of law, or pursue an enforcement action against a supervised financial institution for BSA Requirement issues arising from such authorized services. The commitment applies only if the institution is currently compliant with an applicable BSA compliance program requirement and continues to make...

Key dates

2026-06-24

Venezuela experienced a pair of strong earthquakes off the northern coast west of Caracas, triggering the humanitarian crisis referenced by the agencies.

2026-07-27

FinCEN issued a substantively similar statement of enforcement policy regarding Venezuela-related financial services.

2026-07-31

The OCC, Federal Reserve, FDIC, and NCUA issued the joint enforcement policy.

2026-07-31

Start of the period during which authorized financial services to persons or entities in Venezuela are covered by the enforcement commitment.

2027-01-29 Deadline

End of the covered period for the joint enforcement commitment.

Suggested considerations

• Compliance teams may wish to confirm whether current Venezuela-related activity falls within the scope of authorized financial services covered by the joint statement.
• Institutions may wish to verify that their BSA compliance program remains current and that ongoing controls reflect reasonable efforts to comply during the relief period.
• Firms may wish to check whether they have had any final FinCEN or OCC enforcement action involving BSA violations in the prior 24 months before relying on the policy.
• Sanctions teams may wish to confirm continued compliance with all applicable OFAC-administered sanctions regulations and authorizations.
• Institutions with Venezuela exposure may wish to document how they will evidence reliance on the policy and monitor the January 29, 2027 end date.

What changed

The agencies stated that eligible U.S. financial institutions that choose to provide authorized financial services to persons or entities in Venezuela will not be subject to supervisory action, including a citation for a violation of law, or enforcement action related to a Bank Secrecy Act requirement, for those services. The commitment is limited to authorized financial services provided from 2026-07-31 through 2027-01-29 and applies only to statutes or regulations specifically addressed in the joint statement.

Key dates

2026-07-31

FDIC Board approved the two notices of proposed rulemaking by notational vote

Suggested considerations

• Compliance teams may wish to review the forthcoming NPRM text and accompanying Financial Institution Letter for specific amendments to CRA and insider-lending requirements.
• Banks may wish to map current CRA policies, monitoring, and documentation against the existing regulation to identify where process changes could be needed if the proposal is adopted.
• Institutions may wish to review insider-credit approval, reporting, and conflict-management controls so they can assess whether the proposal would require policy or system updates.
• Stakeholders may wish to monitor the comment period and prepare submissions if the proposals raise operational, prudential, or conduct concerns.

What changed

The Board approved a proposed update to the FDIC’s **Community Reinvestment Act regulations**, which may affect how covered institutions are evaluated for community reinvestment performance and related compliance expectations. The Board also approved a proposed rule on **extensions of credit to insiders**, indicating possible changes to the FDIC’s insider lending restrictions, governance controls, and related reporting or approval requirements.

Key dates

2026-07-31

Federal Reserve Board requested comment on the proposed Regulation O modernization

2026-10-05 Deadline

Expected comment deadline stated in the Federal Register notice

Suggested considerations

• Compliance teams may wish to map current insider-credit controls, approval thresholds, and disclosure workflows against the proposed higher dollar limits.
• Banks may wish to identify products and systems affected by Regulation O exceptions, including credit cards, overdraft lines, and other-purpose loans.
• Institutions may wish to review whether any existing insider or related-interest procedures depend on legacy interpretations that the proposal would codify or reorganize.
• Firms with investment fund ownership structures may wish to assess whether the proposed relief for passive interests would change current principal-shareholder or control analyses.
• Interested parties may wish to prepare comments for the Federal Register comment period once publication occurs, as the proposal states comments are due 60 days after publication.

What changed

The proposal would increase several outdated dollar-based thresholds in Regulation O, including the amounts tied to certain credit card exceptions, overdraft exceptions, executive officer loans for other purposes, and the level at which prior board approval is required. It would also establish an indexing methodology so the thresholds are automatically adjusted over time based on cumulative nominal GDP growth, reducing the need for repeated rulemaking. The Federal Reserve also says the proposal would address unnecessary applications of the rule to passive interests in companies held by...

Key dates

2026-07-23

EBA launches consultations on draft ITS on depositor information, ITS on information exchange, RTS on DGS payouts of client funds deposits, and Guidelines on investment of available financial means under DGSD3

2026-09-21 Deadline

Registration deadline (12:00 CEST) for public hearing on all four regulatory products

2026-09-24

Public hearing on the four DGSD3-related regulatory products (10:00–13:00 CEST)

2026-10-23 Deadline

Deadline for submission of comments to the four consultation papers

Suggested considerations

• Compliance teams at EU credit institutions should consider reviewing existing depositor information sheets, account-opening documentation and ongoing communications to assess alignment with the emerging harmonised formats and content envisaged by the draft ITS on depositor information, particularly for merger and failure scenarios.
• DGSs and banks may wish to map current data flows and reporting processes for covered deposits, available financial means and bank failure events against the proposed ITS on information exchange, to identify gaps in data granularity, timeliness, and standardisation that could require system and process changes.
• Firms that hold client funds in pooled or intermediary deposit accounts (such as investment firms or payment institutions) should consider analysing how client identification and segregation data are captured and shared with DGSs, in light of the draft RTS on client funds that aim to ensure accurate and timely reimbursement of underlying clients and avoidance of duplicate payouts.
• DGS operators and finance teams may wish to review investment policies, risk limits, eligible instruments and liquidity management frameworks for DGS financial means, to anticipate adjustments needed to comply with the forthcoming Guidelines on diversification, low risk and liquidity, including readiness to support resolution financing within the DGSD3 mandate.
• All affected stakeholders should consider preparing internal positions and impact assessments and submit consultation responses to the EBA by the stated deadline, highlighting operational challenges, data availability issues, and any potential conflicts with existing national frameworks for depositor protection and crisis management.
• Risk and treasury functions in banks may wish to engage with DGSs and supervisors to understand how enhanced reporting on covered deposits and DGS financial means under the ITS on information exchange could affect crisis-preparedness expectations, stress-testing assumptions and disclosure practices.
• Legal and regulatory affairs teams should consider monitoring the progression of these four draft instruments alongside the remaining eight technical standards and guidelines mandated by DGSD3, to plan for a coordinated implementation programme once final texts and application dates are confirmed.

What changed

The publication launches consultations on four draft regulatory products mandated by DGSD3: (i) Implementing Technical Standards on depositor information, which define harmonised content and format for depositor information sheets at account opening and on a regular basis, and specify communication requirements in special situations such as bank mergers or failures; (ii) Implementing Technical Standards on information exchange between credit institutions, Deposit Guarantee Schemes (DGSs) and other relevant authorities, introducing standardised procedures, templates and minimum information...

Key dates

2026-07-17

EBA launches consultation on amendments to ITS for the 2027 market risk benchmarking exercise

2026-07-27 Deadline

Deadline (16:00 CEST) for registration to the public hearing on the consultation

2026-07-28

Public hearing on the consultation (14:00–15:30 CEST)

2026-09-03 Deadline

Deadline for submission of comments to the EBA consultation on the 2027 market risk benchmarking ITS amendments

2027-01-01

Application date of the European Commission’s FRTB Delegated Act referenced in the amended ITS

Suggested considerations

• Compliance teams at EU credit institutions using market risk internal models or the CRR3 Alternative Standardised Approach may wish to review the consultation paper and annexes (booking instructions, relevant dates, instruments and portfolios, template instructions, and templates) to understand proposed changes to the 2027 benchmarking data collection and reporting requirements.
• Firms applying or planning to apply CRR2 Internal Model Approach for market risk should consider the implications of the resumption of CRR2-IMA data collection and assess whether existing reporting processes and systems can be reactivated or need updating to meet the revised ITS templates.
• Institutions intending to use the CRR3 Alternative Standardised Approach for market risk may wish to assess the impact of being newly in scope of the EBA market risk benchmarking exercise, including internal governance, data availability, and operational readiness for participation in the second half of 2027.
• Firms that anticipate using the CRR3 Alternative Internal Model Approach may wish to monitor the postponement of AIMA data collection and evaluate how the uncertainty in the effective implementation date interacts with their internal model development timelines and supervisory expectations.
• Regulatory and reporting functions may wish to map current market risk reporting templates to the proposed reorganised and rationalised templates, identifying data gaps and system changes required once the final ITS enter into force.
• Compliance teams may wish to coordinate with risk and reporting teams to prepare a response to the EBA consultation by the 3 September 2026 deadline, particularly on practical aspects of template design, data availability, and timing of the 2027 benchmarking exercise.
• Institutions newly included in scope by virtue of using CRR3 ASA should consider whether additional internal documentation, model validation, and supervisory engagement are needed ahead of the second-half 2027 benchmarking exercise, given the EBA’s intention to adopt the final ITS earlier to give such institutions more preparation time.

What changed

The consultation proposes amendments to the ITS on supervisory benchmarking of market risk models for the 2027 exercise, updating the data collection framework and reporting templates used by institutions and competent authorities under Article 78 of Directive 2013/36/EU (CRD). The scope of the market risk benchmarking exercise would be expanded to include institutions applying the CRR3 Alternative Standardised Approach (ASA) for market risk, irrespective of whether they also use an Internal Model Approach (IMA).

Key dates

2026-07-16

FDIC, Federal Reserve Board, and OCC issued the joint statement on handling highly sensitive information during examinations

2026-07-16 Deadline

Affected banks must be notified of any potential or confirmed material data breach involving confidential supervisory information no later than 72 hours after discovery, unless legal restrictions apply

Suggested considerations

• Compliance teams may wish to review examination response procedures for materials that could be treated as highly sensitive, including technology diagrams, penetration test results, detailed control-weakness reports, and similar data.
• Banks may wish to establish an internal process for flagging sensitive examination materials to examiners and documenting the basis for the sensitivity designation.
• Firms may wish to confirm that exam-response playbooks address on-site review, direct-from-system access, redaction, and summarization options for especially sensitive documents.
• Compliance and information security teams may wish to ensure escalation paths are ready if examiners disagree about whether information should receive enhanced handling.
• Firms may wish to verify incident-response and supervisory-notification procedures can support rapid engagement if a material supervisory-information breach is suspected.

What changed

The agencies said they will use a coordinated approach to identify highly sensitive data and documents during examinations and will apply enhanced handling procedures to reduce cybersecurity risk while preserving examiner access. The statement says review may occur on-site rather than by transferring materials onto agency systems, and the agencies may use other protective methods such as direct digital review from the bank's own systems or review of redacted or summarized materials where appropriate.

Key dates

2026-06-08

CFPB issued the Statement on Ability To Repay and Immigration Status referenced by the agencies

2026-07-13

FDIC, OCC, and NCUA issued the interagency guidance on lending to individuals not legally authorized to work in the United States

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that capacity-to-repay analysis captures employment-authorization-related income instability.
• Firms should consider whether credit policy, risk grading, and portfolio monitoring procedures explicitly address elevated repayment uncertainty for non-work-authorized borrowers.
• Institutions may wish to reassess documentation and verification controls for income, employment, and supporting records in light of the agencies' stated focus on safe-and-sound lending.
• Teams should consider whether fair-lending, TILA, and ECOA controls are aligned with the CFPB's June 8, 2026 statement and the interagency guidance.
• Risk and finance functions may wish to evaluate whether allowance, concentration risk, and credit-loss assumptions need updating where exposure to this borrower segment is material.

What changed

The publication does not create a new lending ban or a new standalone rule. Instead, it restates that institutions should identify, measure, monitor, and control the credit risks associated with borrowers who are not legally authorized to work in the United States through underwriting practices that assess willingness and capacity to repay according to the credit terms. The guidance specifically links this issue to the CFPB's June 8, 2026 Statement on Ability To Repay and Immigration Status and reminds creditors of obligations under the Truth in Lending Act as implemented by Regulation Z,...

Key dates

2026-07-13

OCC, FDIC, and NCUA issued the interagency guidance

2026-06-08

CFPB issued its Statement on Ability To Repay and Immigration Status, referenced by the guidance

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that repayment capacity, source of repayment, and overall financial condition are assessed consistently for borrowers whose work authorization is uncertain.
• Firms may wish to test whether account management, credit classification, and allowance methodologies adequately capture elevated credit risk linked to employment authorization uncertainty.
• Institutions may wish to review consumer compliance controls for alignment with TILA, Regulation Z, ECOA, and Regulation B when evaluating applicants affected by immigration or work-authorized status.
• Risk and compliance teams may wish to update portfolio monitoring, concentration analysis, and documentation standards so that the identified credit risk factors are reflected in governance and reporting.
• Community banks may wish to verify that loan policy language and examiner-facing documentation clearly show how these risks are being identified, measured, monitored, and controlled.

What changed

The publication is guidance, not a new rule or statute, and it reinforces existing expectations rather than imposing a new legal prohibition. It states that lending to individuals not legally authorized to work in the United States may present elevated credit risk because their ability to generate income, maintain employment, and remain financially stable may be more uncertain.

Key dates

2026-07-13

Federal Reserve speech delivered in London on modernization of financial regulation

2026-07-22 Deadline

FSB public comment deadline for the consultation report on sound practices for responsible adoption of AI

2026-07-13

Speech states the FSB modernization consultation report will be published in the fall and then delivered to the G20

Suggested considerations

• Compliance teams may wish to map the speech to ongoing capital-rule workstreams, especially Basel III, stress testing, and G-SIB surcharge calibration.
• Large-bank firms may wish to assess whether current capital planning assumes overlapping stress-test and risk-based requirements that could be reduced or realigned.
• Community and regional banks may wish to review whether fixed-dollar regulatory thresholds continue to overstate burden as assets grow with inflation and nominal GDP.
• Supervised firms may wish to align internal issue-management processes with the Federal Reserve’s stated shift toward findings tied to material financial risk and more differentiated treatment of lesser issues.
• AI governance teams may wish to compare current model-risk, vendor-risk, and use-case controls against the FSB’s consultation themes on responsible adoption and use of AI.
• Boards and senior management may wish to review whether supervisory documentation, escalation, and risk reporting are sufficiently focused on material safety-and-soundness issues.

What changed

This speech does not itself impose binding requirements, but it signals several concrete regulatory and supervisory changes already underway. Bowman said the Federal Reserve is advancing a 2026 Basel III proposal and related capital framework reforms, including a single stack of risk-based capital requirements for large banks, recalibration of the G-SIB surcharge, reduced overlap between stress testing and risk-based capital requirements, and indexing the G-SIB surcharge to nominal economic growth going forward.

Key dates

2026-07-07

Federal Reserve Board issued the request for comment on the proposed AML program amendments

2026-09-05 Deadline

Indicative comment deadline if the proposal is published in the Federal Register on July 7, 2026; the Federal Reserve states comments are due 60 days after Federal Register publication

Suggested considerations

• Compliance teams may wish to review current AML/CFT program governance against the proposed minimum program components, including risk-based controls, independent testing, training, and designated accountable oversight.
• Firms may wish to map their current risk assessment methodology to the FinCEN AML priorities referenced in the proposal and identify any gaps in documentation or calibration.
• Banks may wish to assess whether resources are demonstrably weighted toward higher-risk customers, products, services, and activities, since the proposal emphasizes risk-based allocation.
• Compliance functions may wish to track the Federal Register publication date closely so the 60-day comment clock can be calculated once the notice is published.
• Commenting stakeholders may wish to compare the Federal Reserve proposal with the parallel proposals from the other agencies to identify alignment issues or operational inconsistencies.

What changed

The proposal would amend the Federal Reserve's requirements for banks to maintain anti-money laundering programs to align with parallel proposals from four other agencies. It would require banks to allocate AML resources based on risk, with greater attention to higher-risk customers and activities. It would also require banks to incorporate the Financial Crimes Enforcement Network's AML priorities into their risk assessment processes.

Key dates

2026-06-25

FDIC Board met in open session and approved three notices of proposed rulemaking

Suggested considerations

• Compliance teams may wish to assess whether the institution would fall above the proposed resolution-submission threshold if raised to $100 billion in assets.
• Firms may wish to inventory current resolution-planning, interim supplement, and public-section processes to identify work that could be reduced or repurposed if the proposal is finalized.
• Assessment and finance teams may wish to model the impact of a $10 billion to $30 billion threshold change and any indexed future adjustments on deposit insurance assessments.
• Legal and information-governance teams may wish to review confidentiality-agreement templates and third-party-sharing controls in anticipation of broader permitted disclosure under Part 309.
• Institutions currently subject to FDIC resolution submissions may wish to monitor whether the proposed filing-cycle change to every three years alters internal preparation calendars and governance approvals.

What changed

The Board approved a notice of proposed rulemaking to revise resolution-submission requirements for covered insured depository institutions; secondary reporting indicates the proposal would raise the applicability threshold from $50 billion to $100 billion in total assets, move covered institutions to a three-year filing cycle, eliminate certain interim supplements and public sections, and remove a substantial portion of current narrative content requirements.

Key dates

2026-06-25

The joint final rule was issued and published in the Federal Register as 91 FR 38246.

2026-10-01

The joint final rule becomes effective. Its standards become available for consideration in later agency-specific reporting requirements, but existing reporting requirements do not change solely because of this effective date.

Suggested considerations

• Compliance teams may wish to inventory all regulatory data collections submitted to the CFPB, SEC, CFTC, Federal Reserve, OCC, FDIC, NCUA, FHFA, or Treasury and identify the systems, vendors, data owners, and filing processes supporting each collection.
• Firms should consider assessing whether legal entities in their reporting perimeter already have active ISO 17442 LEIs, while recognizing that the joint rule does not presently impose an LEI-obtaining or renewal requirement.
• Data-governance teams may wish to map current entity, product, instrument, location, date, and currency fields to the joint standards and document data lineage, semantic definitions, validation controls, and taxonomy dependencies.
• Technology and regulatory-reporting teams should consider evaluating whether reporting platforms can produce machine-readable data and accommodate future agency-specific identifier, schema, taxonomy, or transmission requirements without duplicative migrations.
• Firms with SEC or MSRB reporting exposure may wish to monitor the SEC's agency-specific implementation and assess the potential effect on municipal securities data, including whether CUSIP remains acceptable.
• Compliance teams may wish to monitor each covered agency's rulemakings and other implementation actions rather than treating October 1, 2026 as a deadline to change all existing regulatory filings.

What changed

The final rule establishes common identifiers and technical conventions for certain regulatory data collections, including ISO 17442 as the common Legal Entity Identifier standard, identifiers for products or financial instruments, dates, geographic locations, states, countries, and currencies. It also establishes a principles-based standard for data transmission and schema and taxonomy formats, requiring data to be machine-readable, semantically defined, consistently identified in accordance with the applicable regulatory requirement, and based on nonproprietary or openly licensed standards...

Key dates

2026-06-02

FDIC, OCC, and Federal Reserve jointly announced updates to certain interagency documents removing references to reputation risk

Suggested considerations

• Compliance teams may wish to inventory supervisory manuals, internal policies, and model examination references that still mention reputation risk and assess whether any language should be updated for consistency with the agencies’ approach.
• Firms should consider whether account-closure, onboarding, or risk-acceptance frameworks rely on reputation-risk concepts that may now be less aligned with supervisory expectations.
• Banks may wish to review escalation criteria and decision records to ensure they are grounded in material financial, operational, or legal risk factors rather than vague reputational concerns.
• Supervisory response teams may wish to brief relevant business lines on the agencies’ stated focus on financial risk and the agencies’ concern that reputation risk can be used to pressure restrictions on lawful customer activity.
• Compliance functions may wish to monitor whether additional interagency documents are revised in subsequent FDIC, OCC, or Federal Reserve publications.

What changed

The publication says the agencies updated certain interagency documents and removed references to reputation risk. The stated scope of the change is narrow: the agencies said the updates are limited to removing references to reputation risk, not to imposing new obligations on banks. The agencies also reiterated that reputation risk can be misused to pressure banks to restrict access to financial services based on constitutionally protected political or religious beliefs, speech, conduct, or lawful business activities.

Key dates

2026-04-09

FSCA press release on Fusion Guarantees and unregistered insurance business

2026-03-23

Gauteng Division of the High Court delivered the judgment referenced in the press release

Suggested considerations

• Compliance teams may wish to assess whether construction, performance, or surety-style products could be characterised as non-life insurance under the Insurance Act.
• Firms may wish to review whether their current authorisations actually cover guarantee products that assume contingent obligations in exchange for consideration.
• Legal and compliance functions may wish to align product documentation, marketing language, and contractual mechanics with the true regulatory character of the instrument.
• Counterparty due diligence processes may wish to verify whether guarantee issuers are authorised as insurers before acceptance of the instrument.
• Boards and senior management may wish to review governance controls for regulatory classification risk around bespoke guarantee products.

What changed

The High Court granted the FSCA’s counter-application and declared Fusion’s construction guarantees to be non-life insurance policies under the Insurance Act. The court held that issuing those guarantees without insurance authorisation breached section 5(1) of the Insurance Act, and it interdicted Fusion from issuing construction guarantees going forward. The court also declared the guarantees referenced by Elasah to be insurance policies and ordered costs against Fusion and Elasah.

Key dates

2023-10-12

CFPB and DOJ issued the joint statement concerning fair lending and credit opportunities for noncitizen borrowers; it was published in the Federal Register on October 18, 2023.

2026-01-12

CFPB and DOJ withdrew the October 2023 joint statement. The withdrawal was published at 91 FR 1138 and became effective on this date.

Suggested considerations

• Compliance teams may wish to identify underwriting, eligibility, pricing, servicing, and adverse-action processes that reference immigration, citizenship, visa, residency, or work-authorization status.
• Firms should consider documenting the legitimate credit, repayment-risk, creditor-rights, remedies, or legal-compliance rationale for collecting or using immigration-related information, rather than treating the withdrawal as an unrestricted authorization to use the information for any purpose.
• Firms may wish to reassess policies adopted in response to the 2023 joint statement, while preserving controls designed to prevent intentional discrimination or unjustified disparate treatment based on race, color, religion, national origin, sex, marital status, or age.
• Compliance teams may wish to test whether immigration-related variables or proxies produce inconsistent eligibility, pricing, or servicing outcomes across protected groups and whether decisioning documentation supports the stated legitimate purpose.
• Firms should consider retaining existing fair-lending governance, adverse-action notice, data-quality, model-risk, and complaint-monitoring controls because the withdrawal does not amend ECOA or Regulation B or eliminate consumer rights.
• California creditors and other firms operating under state or local fair-lending laws may wish to separately assess obligations that are not displaced by the federal withdrawal, including potentially broader state civil-rights protections.

What changed

The nonbinding October 2023 joint statement is withdrawn effective January 12, 2026; no new statutory or regulatory obligation, safe harbor, or mandatory underwriting standard is created. The agencies state that creditors may consider immigration or citizenship status, including when assessing creditworthiness, financial risk, creditor rights and remedies regarding repayment, or compliance with other laws.

Key dates

2025-12-15

The CFPB and Federal Reserve announced and issued the final threshold amendments based on the 2.1% CPI-W increase as of June 1, 2025.

2026-01-01

The $73,400 Regulation Z and Regulation M thresholds became effective.

2026-12-31

The stated $73,400 thresholds apply through the end of the 2026 calendar year, subject to the applicable transaction-date rules.

Suggested considerations

• Compliance teams may wish to update underwriting, product-classification, and regulatory-coverage logic so that transactions of $73,400 or less are treated as within the applicable Regulation Z or Regulation M framework for the relevant 2026 transaction date.
• Firms should consider reviewing transaction-value calculations, including the total contractual obligation for consumer leases, to confirm that threshold determinations are made using the applicable regulatory definitions and the amount in effect at consummation.
• Lenders and lessors may wish to test disclosures, notices, document generation, and exception handling for transactions close to $73,400, including boundary cases and rounding controls.
• Compliance teams should consider retaining the prior $71,900 threshold for transactions governed by the 2025 threshold and applying $73,400 only to transactions covered by the 2026 period.
• Mortgage and private education lending teams should consider confirming that their systems do not incorrectly treat the $73,400 threshold as an exemption, because those Regulation Z categories remain covered regardless of loan amount.
• Firms may wish to document the annual CPI-W-based threshold change in regulatory inventories, procedures, monitoring scripts, and quality-assurance testing. Independent commentary from Sheppard Mullin characterized the change as an inflation-driven update to the exemption amount rather than a substantive change to TILA or CLA coverage, which supports focusing implementation on system and classification controls.

What changed

Effective January 1, 2026, the Regulation Z exemption threshold under 12 CFR 1026.3(b) and the Regulation M exemption threshold under 12 CFR 1013.2(e) increased to $73,400 from $71,900. The adjustment is based on the annual percentage increase in CPI-W as of June 1, 2025, reported as 2.1%, and is reflected in Regulation Z comment 3(b)-3.xvii and Regulation M comment 2(e)-11.xvii. Regulation Z and Regulation M generally apply to covered consumer credit transactions and consumer leases at or below $73,400; transactions above that amount are generally outside the relevant coverage.

Key dates

2025-02-07

The Fifth Circuit stayed the Section 1071 rule pending appeal in Texas Bankers Association v. CFPB and tolled compliance deadlines only for the case’s plaintiffs and intervenors, subject to further court modification.

2025-04-30

The CFPB published the policy statement announcing that it would not prioritize enforcement or supervision against entities outside the Fifth Circuit stay.

2025-05-12

The CFPB withdrew the policy statement as part of its broader withdrawal of policy statements, interpretive rules, advisory opinions, and other guidance.

2025-06-18

The CFPB issued an interim final rule extending Section 1071 compliance dates for all regulated entities by approximately one year; the earliest revised date for the highest-volume tier was July 1, 2026.

2026-05-01

The CFPB issued a final reconsideration rule revising Regulation B subpart B and extending the revised framework’s general compliance date to January 1, 2028.

Suggested considerations

• Compliance teams may wish to avoid treating the 2025-04-30 announcement as a formal repeal, exemption, or safe harbor, and should document the distinction between enforcement prioritization and continuing statutory or regulatory obligations.
• Covered lenders should consider preserving existing Section 1071 governance, data mapping, recordkeeping, and implementation work where proportionate, while assessing whether the 2026 final reconsideration rule changes the applicable scope, data points, procedures, or implementation timetable.
• Firms should consider identifying whether they are plaintiffs, intervenors, or members of an association covered by the Texas Bankers Association stay, because the original court order did not apply uniformly to all covered institutions.
• Compliance teams may wish to monitor the CFPB’s Section 1071 rulemaking, the status of Texas Bankers Association v. CFPB, and subsequent Federal Register amendments rather than relying on the withdrawn policy statement as current guidance.
• Lenders should consider retaining an audit trail for any decision to pause, scale, or continue implementation, including legal analysis of the applicable rule version, court orders, CFPB amendments, and operational or fair-lending risks.
• Covered institutions may wish to assess whether existing small-business application and demographic-data processes could support future reporting, because the CFPB’s enforcement posture did not eliminate potential litigation, examination, state-law, fair-lending, or reputational exposure.

What changed

The CFPB stated that it would deprioritize enforcement and supervision of the Small Business Lending Rule against entities not covered by the court-ordered stay, citing limited resources and the perceived unfairness of treating similarly situated institutions differently. The statement did not create a formal exemption, alter Regulation B, remove Section 1071 data-collection and reporting obligations, or expand the Fifth Circuit’s stay, which initially tolled compliance dates only for the plaintiffs and intervenors in Texas Bankers Association v. CFPB.

Key dates

2024-07-08

The final rule was published at 89 Fed. Reg. 56028.

2024-09-16

The final rule became effective.

2025-01-14 Deadline

Initial implementation deadline for larger participant CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(1).

2025-04-11

The CFPB announced its policy of not prioritizing enforcement or supervision actions for failures to meet future registration deadlines under 12 CFR part 1092.

2025-04-14 Deadline

Implementation registration deadline for other CFPB-supervised covered nonbanks under 12 CFR 1092.206(a)(2).

2025-07-14 Deadline

Implementation registration deadline for all other covered nonbanks under 12 CFR 1092.206(a)(3).

Suggested considerations

• Compliance teams may wish to document whether the entity is a covered nonbank and whether any agency or court order meets the covered-order criteria in 12 CFR 1092.201, including the requirement that the order be a final public order identifying the entity and imposing obligations based in whole or in part on specified consumer-law or UDAAP violations.
• Firms should consider preserving an inventory of potentially covered orders, registration data, and supporting legal analyses even if they elect not to file while the CFPB's prioritization policy remains in effect.
• Covered entities may wish to assess whether filing by the applicable date remains preferable for licensing, supervisory, litigation, diligence, or reputational reasons, rather than treating the announcement as a definitive exemption.
• Compliance teams should monitor for a proposed rulemaking, final rule, formal withdrawal, or further CFPB communication that changes the status or scope of 12 CFR part 1092.
• CFPB-supervised registered entities should continue evaluating the separate annual written-statement requirements in 12 CFR 1092.204 and should not assume that the announcement eliminates obligations other than the future registration-deadline enforcement priority described.
• Firms may wish to record the policy statement as an enforcement-risk and resource-allocation development, not as a statutory safe harbor against other CFPB, state, or private-party consequences for underlying consumer-law violations.

What changed

The CFPB stated that it will not prioritize enforcement or supervision actions concerning failures to submit registration information by future deadlines under the Registry of Nonbank Covered Persons Subject to Certain Agency and Court Orders, codified at 12 CFR part 1092. The stated policy covers, among other entities, nonbanks subject to the implementation deadlines in 12 CFR 1092.206(a)(2) and 12 CFR 1092.206(a)(3). The CFPB will instead focus enforcement and supervision resources on pressing threats to consumers.

Key dates

2025-03-28

The CFPB announced that it would not prioritize supervision or enforcement involving penalties or fines under the Payment Withdrawal and Payment Disclosure provisions and said it was considering a rulemaking to narrow the rule's scope.

2025-03-30

The Payment Withdrawal and Payment Disclosure provisions of the Payday, Vehicle Title, and Certain High-Cost Installment Loans Regulation became operative after litigation-related delays.

Suggested considerations

• Firms should continue treating 12 C.F.R. §§ 1041.7 and 1041.9 as operative unless and until a legally effective amendment changes them.
• Compliance teams may wish to preserve controls that prevent additional payment-transfer attempts after two consecutive failed transfers for insufficient funds unless a new authorization satisfying the rule is obtained.
• Firms should review pre-withdrawal, post-failure, and other payment-related notices for compliance with the applicable content, timing, and delivery requirements in 12 C.F.R. § 1041.9.
• Lenders may wish to document the CFPB announcement separately from their formal compliance risk assessment, because the announcement describes enforcement priorities rather than a legal exemption or limitation on private, state, or other applicable enforcement exposure.
• Firms should assess state attorney general and state regulator exposure, including the possibility of enforcement under the Consumer Financial Protection Act and applicable state consumer-protection laws.
• Compliance teams may wish to monitor any CFPB notice of proposed rulemaking, Federal Register publication, litigation, and subsequent effective-date activity before changing production controls.
• Covered lenders should retain evidence of payment-attempt logic, consumer authorizations, notices, exceptions, and records required by the rule so that supervisory or state inquiries can be addressed.

What changed

The CFPB stated that it would deprioritize enforcement and supervision actions concerning penalties or fines associated with the rule's Payment Withdrawal and Payment Disclosure provisions. The operative rule continues to restrict a covered lender from attempting additional payment withdrawals after two consecutive failed attempts caused by insufficient funds unless the consumer provides a new authorization, and it requires specified payment-related notices, including notices before certain withdrawals and after two consecutive failed attempts.