FDIC final rule: Updated Part 363 regulatory thresholds effective Jan. 1, 2026 – Key changes and impact to financial institutions  

What is FDIC’s final rule on regulatory thresholds?

On Nov. 25, 2025, the Federal Deposit Insurance Corporation (FDIC) issued the final ruling for “Adjusting and Indexing Certain Regulatory Thresholds”, with an effective date of Jan. 1, 2026. The final ruling can be viewed at: Federal Register Notice - Adjusting and Indexing Thresholds.

The ruling adjusts asset thresholds to reflect current economic conditions, empowering affected institutions to make more informed, strategic growth decisions. It is also expected to reduce regulatory burdens and deliver cost savings that can be reinvested in innovation, advanced technologies, community development and elevating the customer experience. While there are a number of changes, the changes to 12 CFR Part 363 – Annual Independent Audits and Reporting Requirements (Part 363), including the effective date, are expected to have the most significant and immediate impact on financial institutions and its management.

When does the FDIC final rule take effect?

The effective date is Jan. 1, 2026; however, insured depository institutions (IDIs) do not need to comply with Part 363 requirements in effect as of Dec. 31, 2025, if they will not be subject to those requirements under the updated thresholds as of Jan. 1, 2026.

What are the key changes to 12 CFR Part 363?

• Annual independent audit threshold: Increased from $500 million to $1 billion in assets.

Institutions are required to submit to the FDIC and other appropriate federal and state supervisory agencies an annual report (Part 363 Annual Report) comprised of audited financial statements, the independent public accountant’s report on the audited financial statements and a management report containing a statement of management’s responsibilities and an assessment by management of compliance with applicable laws and regulations.

• Internal control over financial reporting (ICFR) threshold: Increased from $1 billion to $5 billion.

Institutions and their management are required to provide an attestation on ICFR, and auditors are to provide an opinion on the operating effectiveness of ICFR.

• Audit committee independence thresholds: Increased from $500 million to $1 billion and from $3 billion to $5 billion.

Institutions are either required to have their audit committee comprised of mainly independent members (historically for institutions with assets between $500 million and $1 billion) or all independent members (historically for institutions with assets above $1 billion). Institutions with assets greater than $3 billion historically were required to have all independent members and members with banking or related financial management expertise. Further, they were required to have access to its own outside council and not to include any large customers of the institution.

• Director compensation threshold: Increased from $100,000 to $120,000.

How do the new ICFR requirements impact financial institutions?

Institutions with assets of $5 billion or more must provide an attestation on ICFR, and auditors must issue an opinion on the operating effectiveness of ICFR. This change reduces the number of institutions subject to ICFR audits but does not eliminate the need for strong internal controls.

• What other FDIC regulations are affected by this rule?
• 12 CFR Part 303 – Filing Procedures
• 12 CFR Part 335 – Securities of Nonmember Banks and State Savings Associations
• 12 CFR Part 340 – Restrictions on Sale of Assets of a Failed Institution
• 12 CFR Part 347 – International Banking
• 12 CFR Part 380 – Orderly Liquidation Authority

Will these changes reduce audit requirements completely?

No. While thresholds have increased, audits may still be required due to debt covenants, other regulatory obligations or governance best practices. Institutions should maintain strong internal controls to prevent errors, fraud, and unauthorized activities.

How will future FDIC threshold adjustments work?

Starting Oct. 1, 2027, thresholds under Part 363 will be indexed every two years based on the cumulative percent change in the non-seasonally adjusted CPI-W.

What does my institution need to do now?

Financial institutions in the affected group should evaluate the immediate impact of this final ruling.

It’s important to recognize that financial statement audits and/or internal control audits may still be required for reasons beyond these rule changes. Financial institutions should evaluate all relevant factors when assessing the immediate impact. While the increased regulatory thresholds reduce certain requirements, they do not lessen the need for strong financial reporting practices and internal controls.

Effective internal controls remain critical to preventing, detecting and correcting errors, unauthorized activities, and fraud; all risks that will persist regardless of threshold changes. Testing these controls provides assurance that they are functioning as intended and offers those charged with governance clear visibility into control effectiveness and financial reporting integrity.

The banking industry is constantly evolving through expanded product offerings, mergers and acquisitions, the use of artificial intelligence and integrating third-party services, resulting in more complex operations and ultimately financial reporting risks. Institutions that have already invested in their internal control framework should consider how to maintain their strong control environment to help reduce risk to their institutions.