Wed, 12 Aug 2026 11:58:28 -0400WeeblyWed, 12 Aug 2026 13:57:40 GMThttps://www.shpco.net/blog/changes-to-corporate-transparency-act-reporting-do-not-end-bank-beneficial-ownership-requirementsAuthor: Jeremy Clifton, CRCM, CAMS

The U.S. Treasury Department and Financial Crimes Enforcement Network (FinCEN) have made significant changes to the federal beneficial ownership framework. For banks and other financial institutions, however, one important point can easily get lost in the headlines:

The elimination of beneficial ownership reporting requirements for most U.S. companies under the Corporate Transparency Act does not eliminate a bank or credit unions Customer Due Diligence (CDD) beneficial ownership obligations.

On August 11, 2026, Treasury announced that FinCEN had finalized a rule permanently removing the requirement for U.S. companies and U.S. persons to report beneficial ownership information to FinCEN under the Corporate Transparency Act (CTA). The rule also provides for the deletion of certain previously reported information concerning U.S. persons from the FinCEN beneficial ownership information database. Foreign entities that remain subject to the CTA reporting requirements will continue to have reporting obligations relative to foreign individuals.

Banks and credit unions remain subject to the separate beneficial ownership requirements under the Bank Secrecy Act's CDD Rule. FinCEN's CDD framework requires covered financial institutions to identify and verify beneficial owners of applicable legal entity customers.

The most important takeaway for banks is that CTA beneficial ownership reporting and CDD beneficial ownership collection are separate regulatory regimes. The CTA primarily addresses what certain companies must report to FinCEN. The CDD Rule addresses what a covered financial institution must obtain and maintain about its customers as part of its BSA/AML program.

Consequently, a business owner would generally be incorrect telling a bank:
"I don't have to file a BOI report with FinCEN anymore, so I don't have to provide beneficial ownership information to the bank"

The bank's obligation arises from the BSA/AML CDD requirements not from whether the customer's business has a CTA filing obligation.

FinCEN’s Press Release

]]>Tue, 07 Jul 2026 12:38:11 GMThttps://www.shpco.net/blog/georgia-passes-hb-945-to-fight-elder-financial-exploitationAuthors: Nicholas P. Milcarek, CFE, CAMS & Jeremy T. Clifton, CRCM, CAMS

On April 6, 2026, the Georgia General Assembly passed House Bill 945, which Governor Brian Kemp has since signed into law with an effective date of July 1, 2026. The law allows financial institutions in Georgia to place a temporary hold on a transaction when there is reasonable cause to believe it may involve the financial exploitation of an "eligible adult" — meaning any person 65 or older or a disabled adult over 18 years of age. A transaction hold may be applied to the eligible adult's own account, any account on which they are a beneficiary, or an account belonging to a suspected exploiter. The transaction hold can be placed on incoming and outgoing transactions and multiple holds can be placed on one account if necessary. Upon placing a transaction hold, the institution must issue written notice (can be provided electronically complying with E-SIGN) within three business days to all authorized account parties and any designated trusted contact, unless those individuals are suspected of involvement. An initial hold lasts 15 business days and may be extended by an additional 15 days if the institution's review continues to support a reasonable belief of exploitation. During the extended 15-day period, the institution may choose to obtain a court order to further extend the hold if EFE persists. The law provides civil, criminal, and administrative immunity to institutions and employees who act in good faith and exercise reasonable care.

The law requires that financial institutions have policies and procedures in place related to financial exploitation and transaction holds as well as train employees on these policies and procedures. Institutions should start by updating existing policies & procedures (e.g., BSA, EFE, and/or fraud policies) or developing a new program that will include in part, who can initiate a transaction hold, what must be documented, how the notice requirement will be met, and the process of establishing a trusted contact. The institution must conduct training and retain records of such training. Training could include training for frontline staff on the eligible adult definition, red flags that establish reasonable cause, and the escalation path to your BSA Officer or other responsible parties.

Institutions may request that customers establish a trusted contact during the account opening process. Trusted contacts do not have to be joint owners, Power of Attorney (POAs), or even certify themselves as trusted contracts. However, the institution would be expected to obtain enough information to generally be able to get in contact with and reasonably identify the trusted contact before discussing financial matters. Institutions may proactively contact customers to establish trusted contacts for vulnerable adults with active or previously identified higher risk activity.

Previous requirements for mandatory reporters of elder financial exploitation in Georgia are still in effect, such as filing APS reports on exploited adults and contacting law enforcement. It is expected that if transaction holds are placed the situation will be reviewed for possible SAR filing as required. Federal BSA obligations are still in place and FinCEN's 2022 Advisory (FIN-2022-A002) continues to require that SARs reference Field 38(d) and the key term "EFE FIN-2022-A002" in both Field 2 and the narrative. Institutions should remain vigilant of social-engineering scams, money mule schemes, pig butchering, and familial/caretaker abuse and file SARs if applicable.
​
Resources
Georgia HB 945:
https://legiscan.com/GA/bill/HB945/2025

Guidance for Identifying and Reporting Vulnerable Adult Exploitation:
Elder Abuse | Office of the Attorney General

Georgia Department of Banking & Finance- Transaction Hold Guidance:
https://dbf.georgia.gov/document/document/georgia-transaction-hold-guidance/download]]>Thu, 11 Jun 2026 16:18:58 GMThttps://www.shpco.net/blog/save-the-date-steve-h-powell-and-company-2nd-quarter-client-webinarSteve H. Powell and Company will host its 2nd Quarter Client Only Compliance Webinar on June 23, 2026, at 9:30 am. The webinar will focus on the CFPB’s revised Section 1071 Small Business Lending Rule and will provide an overview of the major changes included in the 2026 Final Rule, including revised coverage standards, narrowed reporting requirements, and key compliance and operational considerations for community banks.

This session will offer institutions a valuable opportunity to better understand whether the revised rule applies to their bank and to begin evaluating the next practical steps for implementation and compliance planning ahead of the January 1, 2028, compliance date.
​
Additional registration details will be distributed soon.
]]>Thu, 11 Jun 2026 16:14:25 GMThttps://www.shpco.net/blog/cfpb-significantly-scales-back-section-1071-small-business-lending-ruleAuthor: W. Brad Washburn, CRCM, CAMS

On May 1, 2026, the Consumer Financial Protection Bureau (CFPB) issued a revised Small Business Lending Data Collection Rule under Section 1071 of the Dodd-Frank Act (the “2026 Final Rule”), significantly scaling back portions of the original 2023 rule. The revisions reflect the Bureau’s response to industry concerns regarding compliance costs, operational burdens, and ongoing legal challenges that followed the initial rulemaking.

Key Changes in the 2026 Final Rule
The CFPB described the revised framework as an “incremental approach” to implementing Section 1071, similar to the phased expansion of reporting requirements under the Home Mortgage Disclosure Act (HMDA). The most significant changes include:

Narrower Coverage of Financial Institutions and Credit Products
The 2026 Final Rule substantially reduces the number of institutions subject to Section 1071 reporting requirements. Most notably, the CFPB increased the coverage threshold from 100 to 1,000 covered small-business loan originations annually. As a result, many community banks and other smaller lenders that would have been covered under the 2023 rule are expected to fall outside the scope of the revised rule.

The CFPB also narrowed coverage for certain credit products and transactions that were previously reportable, further reducing the number of loans subject to data collection and reporting requirements.

Updated Definition of “Small Business”
The CFPB revised the definition of a “small business” by lowering the gross annual revenue threshold from $5 million to $1 million. This change significantly reduces the number of businesses whose credit applications will be subject to Section 1071 reporting requirements.

For covered institutions, the revised definition is expected to decrease the volume of reportable applications and originated loans. Combined with the higher institutional coverage threshold, the change substantially narrows the overall scope of the rule compared to the 2023 version.

Reduced Data Collection Requirements
The Bureau also reduced the number of required data points, focusing primarily on information expressly required by the Section 1071 statute. Numerous discretionary data fields included in the 2023 rule have been eliminated, easing compliance burdens and reducing the operational complexity associated with data collection, monitoring, and reporting.

Extended Compliance Timeline
Although the rule becomes effective on June 30, 2026, mandatory compliance will not begin until January 1, 2028. The extended implementation period provides institutions with additional time to evaluate their reporting obligations, assess system capabilities, and implement any necessary operational changes.

Key Takeaways
The revised coverage criteria represent a significant shift from the original rule and may exempt many community banks that previously expected to be subject to Section 1071 reporting requirements. Institutions should carefully review the revised thresholds and definitions to determine whether they remain covered under the 2026 Final Rule.

For institutions that continue to meet the coverage requirements, the additional implementation time should be used to assess data collection processes, lending systems, reporting capabilities, and fair lending compliance programs to ensure readiness before the January 1, 2028, compliance date.

Institutions should continue to monitor developments related to Section 1071. As of this writing, several federal court challenges to the original 2023 rule remain pending, although those cases are expected to be resolved once the final rule takes effect. Nevertheless, future litigation by trade associations or other opponents of the final rule could further alter compliance obligations or implementation timelines. Similar developments occurred during the prior Trump administration, when a federal court invalidated amendments to HMDA reporting thresholds, resulting in additional regulatory uncertainty and compliance adjustments.

Steve H. Powell & Company will continue to monitor developments related to Section 1071 and provide updates as additional guidance becomes available.

Click the link below to find the final rule:
Federal Register: Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)
]]>Fri, 22 May 2026 17:37:55 GMThttps://www.shpco.net/blog/new-fil-concerning-multiple-re-presentment-nsf-feesAuthor: Andrew Howard

On April 10, 2026, the FDIC issued a new FIL concerning Multiple Re-Presentment NSF fees. This FIL rescinds the prior FDIC communication from June 16, 2023, which had already signaled a possible softer approach from regulators to re-presentment NSF fees as the guidance published in 2023 was a reissuance of an earlier FIL issued in 2022. The guidance issued in 2022 and 2023 coupled with regulatory actions in those timeframes generally viewed multiple NSF fees assessed against single transactions as “junk” fees and if not properly disclosed the assessment of these fees could rise to the level of a violation under Section 5 of the Fair Trade Commission (FTC) Act. Financial Institutions were encouraged to review their practices and disclosures regarding these multiple re-presentment fees and ensure that risk mitigation practices were implemented to reduce consumer harm and potential violations. With the release of the new FIL on April 10th, the FDIC is rescinding its earlier issuances of guidance concerning Multiple Re-presentment NSF Fees. The FDIC, through a review and assessment, has concluded that the previous guidance provided was too broad in nature and caused confusion as to when NSF re-presentment fees could result in potential unfairness concerns under Section 5 of the FTC Act.  
​
Although this guidance has been rescinded, it is recommended that institutions continue to ensure that their practices are clearly disclosed to their customers and the disclosures and/or agreements provided accurately reflect the practices with concerns to Multiple Re-Presentment NSF fees. At this point, we are not aware of any other prudential regulators rescinding related guidance. If your financial institution is considering making any changes with overdraft or NSF practices, please let us know how we can be helpful.   
 
FIL-14-2026
Referenced FIL: FIL-32-2023
Original Guidance: FIL-40-2022]]>Fri, 08 May 2026 12:14:11 GMThttps://www.shpco.net/blog/fincen-releases-fact-sheet-on-the-rapid-response-programAuthor: Nicholas Milcarek, CFE, CAMS

On April 15, 2026, FinCEN released updated statistics on the effectiveness of the Rapid Response Program (RRP). Since the beginning of 2025, the program has halted the transfer of $268 million in stolen funds bringing the total to $1.8 billion in funds retrieved. Stolen funds have largely consisted of investment scams, business email compromise, and phone scams. The RRP is a collaboration of various financial intelligence units and law enforcement agencies with a range over 96 jurisdictions. Once the program is activated, FinCEN will issue hold harmless/stop payment orders to the fraudster’s institution in an attempt to claw back the funds.

To activate the program, victims or institutions must file a complaint with law enforcement such as an FBI IC3 or report the activity to the nearest U.S. Secret Service field office.  report on behalf of the victim with information pertaining to the victim, identity of the fraudster (if available, including email addresses, phone numbers, I.P. addresses, etc.), and the nature of the incident. Filings within 72 hours of the fraudulent activity is deemed to be the most effective for funds retrieval. SAR confidentiality still applies within an IC3 report. In terms of SAR filings, banks should follow regular procedures for filing on funds transfer fraud with the addition of referencing reporting to law enforcement in applicable sections and including mention of the RRP in the narrative. Institutions should have adequate policies and procedures for when to file an IC3 report to activate the RRP, the timeliness of filing an IC3 report, and guidelines for adding the information into applicable SARs. See FIN-2022-FCT1 (linked below) for more details on SAR form completion when SARs are filed on cases where the Rapid Response Program was initiated. 

Additional information from the RRP fact sheet and the news release can be found below:
RRPFactSheet.pdf

FinCEN’s Rapid Response Program Interdicts Nearly $2 Billion on Behalf of U.S. Cyber-Enabled Fraud Victims | FinCEN.gov
​
FIN-2022-FCT1]]>Fri, 08 May 2026 12:11:30 GMThttps://www.shpco.net/blog/fincen-issues-health-care-fraud-advisoryAuthor: Hunter J. Brown, CAMS

On March 30, 2026, FinCEN issued Advisory FIN-2026-A001 in coordination with the FBI and the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG), urging financial institutions to sharpen their focus on health care fraud schemes targeting Medicare, Medicaid, and other federal and state health care benefit programs. The advisory is not a new regulatory requirement, but it carries real exam weight and the red flags it outlines have direct implications for how institutions should monitor their health care provider and supplier customer base.

The numbers behind this advisory are hard to ignore. FinCEN observed a 330% increase in health care fraud BSA reporting between 2020 and 2025, peaking at over 3,800 initial SARs in 2025 alone. The Treasury's 2026 National Money Laundering Risk Assessment (which we discussed in our Q1 2026 clients-only BSA/AML/CFT webinar) identifies health care fraud as one of the largest sources of illicit proceeds in the United States, and fraud remains a named AML/CFT National Priority. FinCEN acknowledges that even those record-filing numbers likely represent only a fraction of actual activity.

The schemes described in the advisory generally follow a predictable pattern. Illicit actors (increasingly transnational criminal organizations) use straw owners, stolen physician identities, and shell companies to register as health care providers or suppliers with Medicare and Medicaid programs. They open bank accounts under the appearance of legitimate medical businesses, begin submitting fraudulent claims, and then immediately launder the reimbursements once payment hits the account. Common laundering methods include outgoing wires to shell companies, transfers to virtual asset service providers (VASPs) and online betting platforms, cash withdrawals, and international wire transfers. The billing fraud itself takes several forms: phantom billing for services never rendered, double billing, upcoding, unbundling, and billing for medically unnecessary services.

Most community financial institutions are not banking large DME suppliers or home hospice networks, but the red flags in this advisory are broader than they might initially appear. Any institution banking medical practices, pharmacies, laboratories, adult day care centers, telemedicine companies, or medical supply businesses should take a close look at how those accounts are being monitored.
​
Action Steps for Financial Institutions:

• Review your health care provider and supplier customer base and assess whether those accounts have been appropriately risk-rated given the typologies described in this advisory.
• Incorporate health care fraud indicators into transaction monitoring scenarios, paying particular attention to newly opened or recently purchased health care entities receiving large reimbursements quickly; reimbursements immediately forwarded to related shell companies; high reimbursement volume with little to no corresponding business expenses; spiked billing patterns; and cash withdrawals correlated with billing increases.
• Familiarize your compliance team with the Medicare Administrative Contractors (MACs) that serve your geographic footprint — MAC payment descriptors may appear in ACH transaction data and can be a useful monitoring trigger.
• When filing applicable SARs, include the key term "HCF-2026-A001" in both SAR Field 2 (Filing Institution Note to FinCEN) and the narrative, and select SAR Field 34(g) — Healthcare/Public or Private Health Insurance — along with Fields 36 and 38 as applicable.
• Where straw owner activity is suspected, FinCEN specifically encourages institutions to include surveillance footage as supporting documentation for the SAR filings. This would be provided if law enforcement requested it and should be noted in the narrative.
• Ensure your CDD and EDD program adequately addresses health care providers and suppliers as a customer segment, including expected transaction activity and triggers for enhanced review.
• Consider whether your institution's 314(b) information sharing participation could support investigations involving health care fraud, particularly where multiple institutions may be seeing related activity.

 
For more detailed information, please view the FinCEN press release here: Treasury Targets Fraud Schemes Exploiting Government Health Care Benefits | U.S. Department of the Treasury

Advisory: FinCEN-Advisory-Health-Care-Fraud.pdf]]>Tue, 24 Mar 2026 22:00:08 GMThttps://www.shpco.net/blog/executive-order-14393-promoting-access-to-mortgage-creditAuthor: W. Brad Washburn, CRCM, CAMS

On March 13, 2026, the Trump Administration issued Executive Order 14393 (“the order”, titled “Promoting Access to Mortgage Credit,”). The order is a sweeping directive aimed at reducing regulatory burdens in the mortgage market and expanding access to home financing, particularly through community and smaller banks, which are often considered most impacted by the regulatory burden. Per the order, smaller banks are considered those with less than $100 billion assets and community banks are considered those with less than $30 billion assets.

This order signals a material shift in regulatory posture, with a clear emphasis on streamlining compliance requirements, modernizing mortgage processes, and increasing lender participation in residential mortgage lending.
The stated objective is to:

• Reduce compliance costs associated with mortgage origination and servicing.
• Reinvigorate community bank participation in mortgage lending.
• Improve access to credit for creditworthy borrowers, particularly in rural and low-to-moderate income segments.

At its core, the order reflects a policy shift away from highly prescriptive, process-driven compliance toward a more risk-based, outcomes-focused regulatory framework.

Key Regulatory Areas Potentially Affected
The order directs federal financial regulators, including the CFPB, Federal Reserve, FDIC, OCC, and others to review and potentially revise a wide range of mortgage-related regulations.

The following summary highlights key areas and objectives regulators are directed under the order to review and potentially revise regulations, supervisory guidance, or regulatory approach.

Ability-to-Repay (ATR) / Qualified Mortgage (QM) Reform

• Regulators are directed to revisit and possibly revise ATR/QM rules to:  
  • Tailor requirements for smaller banks and expand safe harbors for portfolio lending.
  • Provide potential relief from points-and-fees caps for small-balance loans.
  • Move toward less rigid underwriting compliance expectations, by reducing unnecessarily burdensome elements and greater reliance on prudent lender judgment.

TRID and Disclosure Modernization

• Regulators are directed to revisit and possibly revise TRID rules to:
  • Replace strict TRID disclosure timing requirements with a materiality-based disclosure framework, to reduce closing delays.
  • Tailor TILA/RESPA disclosure obligations for smaller institutions and potentially streamline requirements relative to rate-and-term refinancings.

Modernization of Rescission Processes

• Regulators are directed to revisit and possibly revise Right of Rescission rules to:
  • Modernize the right to rescission for mortgage lending, for example by enabling increased secure electronic and digital forms and processes.
  • Exempt rate-and-term refinances (including cash-out refinances) from rescission rights.

HMDA Reporting Relief

• Regulators are directed to revisit and possibly revise HMDA rules to:
  • Raise the asset threshold to make more institutions exempt from HMDA reporting.
  • Place emphasis on privacy protections in reporting and reducing the costs associated with HMDA compliance.

Capital, Liquidity, and Secondary Market Reforms

• Regulators are directed to revisit and possibly revise capital regulations to:
  • Tailor capital requirements to better reflect actual credit risk of mortgage assets.
  • Modernize and expand Federal Home Loan Bank (FHLB) liquidity programs.
  • Enhance access to longer-term funding tied to mortgage lending.

Appraisal and Valuation Modernization

• Regulators are directed to revisit and possibly revise and modernize appraisal regulations to:
  • Increase use of automated valuation models (AVMs), AI tools, and hybrid appraisals.
  • Reduce appraisal requirements for low-risk transactions, including low-LTV refinancing transactions, and low balance loans, as well as setting clear appraisal timelines.

Servicing, Construction Lending, and Licensing Relief
Prudential regulators are also directed to review and potentially revise regulations and/or update supervisory guidance as necessary to promote:

• Simplification of mortgage servicing requirements through aligning supervisory expectations to support portfolio mortgage servicing as a core community banking function; extending cure-first standards to good-faith servicing errors; simplifying loss mitigation requirements; and provide exemptions from complex mortgage services for smaller banks.
• Revising supervisory guidance both to exclude one-to-four-family residential development and construction lending from commercial real estate concentration guidance and providing support for responsible construction lending by community banks.
• Elimination of duplicative or unnecessary licensing requirements for mortgage loan officers at any smaller bank.

Supervisory and Enforcement Philosophy Shift

The order represents a notable shift toward principles-based supervision but also introduces interpretive uncertainty during the transition period.

• Under the order, regulators are encouraged to:
  • Allow institutions a reasonable opportunity for self-identification and remediation of appropriate compliance matters.
  • Consider good corporate conduct, including a bank's correction of good-faith, technical compliance errors.
  • Limit civil monetary penalties to willful, knowing, or reckless violations.

Conclusions and Key Takeaways
Executive Order 14393 represents one of the most significant recent efforts to restructure the mortgage regulatory environment, with the potential to reshape compliance expectations across origination, servicing, and reporting. While the order states the administration’s broad intentions, we will have to wait until proposed rules are released for comment to have a better understanding of the specific impacts to mortgage compliance and reporting requirements going forward. However, as we have seen with previous mortgage deregulation efforts in the prior Trump administration, any proposed changes to regulations and guidance may be subject to successful legal challenges.

While the order is deregulatory in intent, it does not eliminate compliance risk, it redefines it, placing greater emphasis on judgment, governance, and risk management effectiveness. Strong compliance review and internal monitoring processes will continue to be important as regulatory focus will continue to promote a bank’s correction of good faith technical errors and robust processes for self-identification and remediation of appropriate compliance matters.

We are actively tracking regulatory developments, agency rulemaking, and industry responses related to the order. As implementing guidance becomes available, we will provide timely updates and will be here as a resource to help you adapt.
​
If you have questions or if there are any other ways we can assist you, please contact our team.]]>Thu, 26 Feb 2026 13:45:42 GMThttps://www.shpco.net/blog/fincens-exceptive-relief-for-customer-due-diligence-requirementsAuthor: Nicholas P. Milcarek, CFE, CAMS

On February 13, 2026, FinCEN issued an order enabling “exceptive relief” to all covered financial institutions specifically under the 2016 CDD rule. Before the order, covered institutions were required to identify Beneficial Owners “at the time a new account is opened” with “new account” being identified as every account being opened at the institution regardless of longevity of the customer relationship. The order now only requires beneficial ownership information to be obtained/updated, “(1) when a legal entity customer first opens an account with a covered financial institution; (2) any time thereafter when the covered financial institution has knowledge of facts that would reasonably call into question the reliability of beneficial ownership information previously obtained about the legal entity customer; and (3) as needed based on a covered financial institution’s risk-based procedures for conducting ongoing customer due diligence.” Potential triggering events include death of an owner, purchase of the entity by an external party, potentially higher risk customer reviews, etc.

What does this mean for your financial institution? Now beneficial ownership requirements will more closely follow the CIP rules and will allow FIs to obtain Beneficial Ownership certificates and identification at initial account opening while subsequent account openings for the same entity will generally only need an updated Beneficial Ownership certification if triggering events happen (see 2 and 3 above).

Your FI will need to determine based on your risk profile if this exceptive relief should be implemented, as this change is not required and is within the FIs discretion. If changes are made, your Board approved policies and procedures will need to be updated and training for applicable staff will need to take place.  If an FI implements the exceptive relief, it may be a good idea to document discussions with the customer about any possible Beneficial Ownership change when additional accounts are opened for the same entity.

Financial institutions must continue to maintain adequate risk-based processes and procedures for complying with Beneficial Ownership requirements. Obtaining and documenting Beneficial Ownership information during the initial account opening process as well as for triggering events on an established relationship are still key aspects for remaining in compliance.
 
Reference for the FinCEN order and news release can be found below:
Order: https://www.fincen.gov/system/files/2026-02/FinCEN-Order-CCDExceptiveRelief.pdf

News Release: https://www.fincen.gov/news/news-releases/fincen-issues-exceptive-relief-streamline-customer-due-diligence-requirements

]]>Tue, 06 Jan 2026 15:15:59 GMThttps://www.shpco.net/blog/2026-compliance-update-reminders Author: James M. Moore, CRCM
 
As we move into 2026, the calendar may have turned, but compliance obligations rarely reset. For those in compliance, a “new year” is less about starting over and more about building on what is already in motion—regulatory expectations, examiner focus areas, and evolving risks that continue to compound over time. The following reminders and updates are intended to help institutions recalibrate, confirm alignment, and address emerging priorities as they head into the year ahead.
 
Deposit Compliance:

• Regulation CC training should have been provided during 2025 and make plans to provide Reg. CC training during 2026.
• Regulation CC hold thresholds remain at $275 (next day) and $6,725 (exception) as of July 1, 2025. By the second business day, Regulation CC requires $550 in total funds availability, though cash withdrawal availability may be limited absent disclosure of a higher amount.
• Consider providing annual privacy training to all employees and directors.
• Ensure annual privacy disclosures will be mailed during 2026 or verify the institution’s exemption status for 2026.   
• Determine the number of remittance transfers under Regulation E from the previous calendar year to ensure the institution has not exceeded the threshold for “normal course of business” of 500 consumer transfers.
• Ensure the ID Theft Program administrator has reported to the Board annually on the status of the ID Theft Program.
• Regulatory agencies have provided guidance extending the implementation timeline for the new Advertisement of Membership rule, with institutions expected to be prepared to comply by January 1, 2027. 

Loan Compliance:

• The 2025 HMDA LAR for all institutions and CRA LAR for large institutions must be submitted by March 2, 2026.
• Check the historic examples for HELOC and ARM application disclosures to ensure the most recent 15 years are used in the examples.
• The CRA Public File should be updated by April 1, 2026.
• Check the accuracy of the affiliated business disclosures to ensure all affiliated businesses are disclosed along with the current range of fees and the current ownership interest of each affiliated business.
• The 2026 HOEPA points and fees test will use the following:
  • 5% of loan amounts of $27,592 or more
  • For a loan amount less than $27,592, the lesser of 8% or $1,380
• The 2026 QM points and fees test will use the following:
  • For a loan amount greater than or equal to $137,958: 3% of the total loan amount
  • For a loan amount greater than or equal to $82,775 but less than $137,958: $4,139
  • For a loan amount greater than or equal to $27,592 but less than $82,775: 5% of the total loan amount
  • For a loan amount greater than or equal to $17,245 but less than $27,592: $1,380
  • For a loan amount less than $17,245: 8% of the total loan amount
• The 2026 General QM threshold will use the following:
• 2.25 or more percentage points for a first lien covered transaction with a loan amount greater than or equal to $137,958
• 3.5 or more percentage points for a first lien covered transaction with a loan amount greater than or equal to $82,775 but less than $137,958
• 6.5 or more percentage points for a first lien covered transaction with a loan amount less than $82,775
• 6.5 or more percentage points for a first lien covered transaction secured by a manufactured home with a loan amount less than $137,958
• 3.5 or more percentage points for a subordinate-lien covered transaction with a loan amount greater than or equal to $82,775 and
• 6.5 or more percentage points for a subordinate-lien covered transaction with a loan amount less than $82,775.
• The 2026 Truth In Lending threshold is $73,400 for loans not secured by real property, not secured by personal property expected to be used as a primary dwelling, and are not private education loans.
• The 2026 “small creditors that operate predominantly in rural or underserved areas” asset threshold is $2.785 billion.
• The 2026 “insured creditor” asset threshold is $12.485 billion.
• The 2026 “small loan” exemption for HPML appraisal rules is $34,200 as of January 1, 2026.
• Until further notice, the safe harbor credit card penalty fee is $30 for the first and $41 for subsequent late fees garnered within the same or next six billing cycles. 
• If the creditor allows borrowers to shop for any required services for TRID loans, it should update (as necessary) the written list provided with the Loan Estimate to identify at least one available provider for each settlement service for which the consumer is permitted to shop. 
• Ensure that employees and Directors have received fair lending and CRA training for 2025.  Training should be planned for 2026.
• Review the CRA asset size thresholds for 2026:
  • CRA asset size thresholds as of December 31, 2025, are under $1.649 billion for small bank (based on both of the last two calendar years), at least $412 million up to $1.649 billion for intermediate small bank (based on either of the two last calendar years), and $1.649 billion and over for large bank (based on both of the last two calendar years).

• As of June 2025, the OCC, FDIC, and FED rescinded the 2023 CRA final rule for it to be replaced with the previous 1995 CRA regulations.
• The HMDA asset size threshold for depository institutions for 2026 is $59 million.
• Ensure a review of 2024 and 2025 transaction data is conducted for 2026 reporting requirements.  In addition to meeting the above HMDA asset threshold:
  • An institution must have in each of the two preceding calendar years, originated at least 25 or more covered closed-end dwelling secured loans to report closed-end loans. 
  • Dwelling secured open-end lines of credit must be reported if a covered institution originated 200 or more covered dwelling secured open-end lines of credit in each of the previous two calendar years. 
• Review HMDA small filer exemption for reduced field reporting criteria for 2026:
  • Originated less than 500 closed-end mortgages in each of the two preceding calendar years and received a “Satisfactory” or better CRA rating.
  • Originated less than 500 open-end mortgages in each of the two preceding calendar years and received a “Satisfactory” or better CRA rating.
• Ensure procedures are in place for performing escrow account analyses and that the financial institution has implemented procedures for providing annual escrow account notices.
• Ensure loan officers completed S.A.F.E. Act license renewal procedures.
• Ensure an annual independent S.A.F.E. Act audit has been performed.
• Ensure lenders who receive compensation based on insurance sales (credit life/disability) complete license renewal procedures.
• Ensure the financial institution has documented whether they meet the definition of a small servicer, and that documentation of the determination is retained for record retention.
• Ensure the financial institution has documented whether they meet the definition of a small creditor, and that documentation of the determination is retained for record retention.
• Review the final list or rural or underserved counties for 2026, calculate rural or underserved status by address on the CFPB’s website for covered loans, and ensure the financial institution has documented whether it qualifies for the rural / underserved TILA exemption by originating at least one covered loan in a rural or underserved area and that documentation of the determination is retained for record retention.

 
BSA Compliance:

• Schedule a Board review and approval of current BSA/AML/CFT and OFAC program policies.
• Update the BSA/AML/CFT and OFAC Risk Assessments.
• Ensure annual training was conducted for all employees during 2025 and is scheduled for 2026.  Furthermore, the Board of Directors should also receive annual BSA training, which should be documented in the Board minutes.
• Annual reviews should be conducted of all CTR exempt customers for suspicious activity and continued eligibility.
• Ensure any annual due diligence is completed for MSBs, MRBs, remote deposit capture, private ATM customers, coin operated amusement customers, etc. in accordance with the financial institution’s BSA/AML/CFT program.
• Review 314(a) contact information transmitted with the call report for accuracy.
• For institutions that voluntarily share information, ensure 314(b) registration is completed annually.
• Consider whether roles, responsibilities, and resource allocation for monitoring and updating the BSA program are adequate and appropriately aligned.
• Review the automated AML system, including its parameters, to assess whether it is appropriately configured to ensure complete and accurate inclusion of all required sanctions and restricted entity lists (e.g., SDN, Consolidated lists, 2313(a), Cuba).

]]>