What the FDICIA's Part 363 Threshold Updates Mean for Banks

1/2/2026 - By Jason Keith & Jay Newsome

The FDIC adopted a final rule to update and index certain dollar-based regulatory thresholds in several areas of regulation. The most impactful and helpful change to banks is the approved threshold increase 12 CFR Part 363, referred to as FDICIA. Per the ruling, “An insured depository institution (IDI) need not comply with the applicable part 363 requirements in effect as of December 31, 2025, if the IDI will not be subject to such part 363 requirements under the updated thresholds in effect as of January 1, 2026, as specified in this final rule.”

Many thresholds had remained static for years, some decades, meaning inflation had eroded their real value. Thus, over time, more institutions were being swept into requirements merely because of nominal dollar drift, not because they actually grew in size, complexity, or risk.

The change is also aimed at providing regulatory relief to smaller and mid-sized community banks by reducing the number of institutions forced into burdensome compliance solely because of inflation-driven dollar creep.

Threshold Changes, at a Glance

The above thresholds set forth in the rule will achieve meaningful burden reduction for the smallest institutions (below $1 billion), which would be removed from the scope of applicability for reporting requirements and internal control assessments. Future thresholds will update every two years based on inflation (CPI-W), starting October 1, 2027. Note increased director pay threshold is not indexed to inflation and will not change.

Part 363 also required banks over $500 million to establish an audit committee of its board of directors, the members of which were outside directors, and the majority of whom shall be independent of management of the institution. As stated in the ruling, smaller community institutions, particularly those in rural areas, have had difficulty complying with the audit committee composition requirements; therefore, these have been lifted to $1 billion as well. Furthermore, the thresholds to establish an audit committee independent of management, including members with banking or related financial management expertise, have access to its own outside counsel, and do not include any large customers of the institution, have increased to $5 billion.

These changes are expected to remove 797 institutions from the scope of Part 363, while essentially covering 95% of industry assets.

What Does This Mean for Your Bank?

  • Audited financial statements may still be needed/required.
  • Irrespective of the changes to part 363 thresholds, IDIs may still be required to have an audit and/or assess internal controls over financial reporting by their respective States or other regulatory frameworks.
  • Internal controls still matter, and cutting too far may cost you more than it saves. Striking a balance that saves money but doesn’t throw out the proverbial “baby with the bathwater” is important.

 

The Bottom Line

  • Say “yes” to scaling back the testing and say “no” to abandoning any strong internal controls your institution has in place because regulators and Boards still expect sound governance.
  • You can finally run a right-sized internal control program. If you have started down the path of implementing FDICIA controls, take advantage of the work you have done. Reduce the cost by focusing on those controls that are integral to your operations and risk management process. Discard redundant and overly complex controls.

How Saltmarsh Can Help

Saltmarsh helps financial institutions implement and test internal control systems in line with FDICIA 363 requirements. Whether you're preparing for your first audit of the effectiveness of the institution's internal control over financial reporting or fine-tuning an established program, our team brings the technical expertise and hands-on experience to guide you through every stage.

If you’re asking, “What can we safely stop doing, and what should we absolutely keep?”, that’s exactly the conversation we should have. Learn more about our services and how we can support every stage of your FDICIA compliance journey.

About the Authors

Jason Keith, CIA, CISA

Jason is a senior manager with experience across technology risk consulting and information systems. He began his career in the technology field over 20 years ago, focusing on risk management and compliance. His primary areas of experience include providing technology risk consulting services to highly regulated industries, including financial institutions, healthcare, and the defense industrial base.

Jay Newsome, CPA

Jay is a senior manager of the team who provides audit and assurance services. He has over 20 years of experience providing audit and accounting services to financial institutions. Jay specializes in financial statement audits, internal audits, loan reviews, and consulting for the firm’s financial institution clients.

Related Posts

Since 1944 Achieving Success by Contributing to the Success of Others