FDIC Policy Statements

Key dates

2026-07-31

Policy becomes effective for authorized financial services provided to persons or entities located in Venezuela

2027-01-29 Deadline

End of the stated commitment period for the agencies’ enforcement-policy non-action position

Suggested considerations

• Compliance teams may wish to confirm whether any Venezuela-related activity is specifically authorized under applicable OFAC sanctions licenses or other authorizations before relying on the policy.
• Institutions may wish to verify that their BSA/AML compliance program is currently in place and that they continue to make reasonable efforts to meet applicable BSA Requirements during the relief period.
• Firms may wish to review whether they have had a final BSA-related enforcement action by FinCEN or their primary federal regulator within the prior 24 months, as that would disqualify reliance on the commitment.
• Operational teams may wish to document the basis for treating transactions as covered authorized financial services in Venezuela and retain evidence supporting reliance on the enforcement-policy statement.

What changed

The agencies announced a temporary enforcement-policy commitment covering authorized financial services provided to persons or entities located in Venezuela from 2026-07-31 through 2027-01-29. During that period, the agencies state they will not take supervisory action, including citing a violation of law, or pursue an enforcement action against a supervised financial institution for BSA Requirement issues arising from such authorized services. The commitment applies only if the institution is currently compliant with an applicable BSA compliance program requirement and continues to make...

Key dates

2026-07-16

FDIC, Federal Reserve Board, and OCC issued the joint statement on handling highly sensitive information during examinations

2026-07-16 Deadline

Affected banks must be notified of any potential or confirmed material data breach involving confidential supervisory information no later than 72 hours after discovery, unless legal restrictions apply

Suggested considerations

• Compliance teams may wish to review examination response procedures for materials that could be treated as highly sensitive, including technology diagrams, penetration test results, detailed control-weakness reports, and similar data.
• Banks may wish to establish an internal process for flagging sensitive examination materials to examiners and documenting the basis for the sensitivity designation.
• Firms may wish to confirm that exam-response playbooks address on-site review, direct-from-system access, redaction, and summarization options for especially sensitive documents.
• Compliance and information security teams may wish to ensure escalation paths are ready if examiners disagree about whether information should receive enhanced handling.
• Firms may wish to verify incident-response and supervisory-notification procedures can support rapid engagement if a material supervisory-information breach is suspected.

What changed

The agencies said they will use a coordinated approach to identify highly sensitive data and documents during examinations and will apply enhanced handling procedures to reduce cybersecurity risk while preserving examiner access. The statement says review may occur on-site rather than by transferring materials onto agency systems, and the agencies may use other protective methods such as direct digital review from the bank's own systems or review of redacted or summarized materials where appropriate.