Recordkeeping for custodial accounts: who pays for the FDIC proposal

Recordkeeping for custodial accounts is the FDIC's 2024 proposal, a new 12 CFR part 375, that would require any insured bank holding pooled custodial deposit accounts with transactional features, such as the FBO accounts sponsor banks keep for fintech partners' customers, to hold each beneficial owner's balance in a prescribed file format, reconcile those records at least daily, have a third party's records validated independently and certify compliance every year. It is still a proposal: the FDIC published it on October 2, 2024, and the current Unified Agenda lists the final rule as "To Be Determined." By the FDIC's own estimate it would reach 600 to 1,100 banks, at roughly $220,000 each in the first year and $110,000 a year after, with smaller banks bearing more relative to their size. Botminds' FBO Reconciliation was built to do that daily work on the systems a sponsor bank already runs, whether or not a final rule arrives.

The figures on this page are the FDIC's, from the proposal's own cost analysis, unless a caption says otherwise. Where the solution appears, it runs on a fictional sample bank, Tessaly Community Bank, with six fintech partners.

What would the FDIC custodial account proposal require?

The FDIC custodial account proposal would require five things of a covered bank, whether it keeps the records itself or relies on a partner. Each one is a cost line, and each one maps to work a sponsor bank's reconciliation desk either already does or would have to start.

First, a record for every beneficial owner, in a pipe-delimited file with one row per owner and 30 fields set out in the proposal's Appendix A, from the bank's account number to the owner's tax ID, current balance and ownership code. Second, a daily reconciliation: balances maintained at the owner level and reconciled against those records at least as of each day's close of business. Third, where a partner keeps the records, direct and continuing access to them even if the partner fails, continuity plans, a contract that sets out who keeps what, and a validation of the partner's records at least once a year by someone independent of the partner. Fourth, written policies and procedures. Fifth, an annual certification signed by the chief executive, chief operating officer or highest-ranking official, and an annual report listing every covered account holder, the total balance and the number of beneficial owners (FDIC, Recordkeeping for Custodial Accounts, 89 FR 80135).

The scope turns on three words in the definition: the account is held for the benefit of others, the owners' money is commingled, and the owners can direct transfers to third parties through the account holder. An FBO account behind a fintech's spending app meets all three. A custodial account that only ever returns money to the account holder or the owner would not, in the FDIC's reading, be "transactional" at all.

Is the FDIC custodial account rule final? No, it is still a proposal

The FDIC custodial account rule is not final. The FDIC's board approved the proposal on September 17, 2024; it was published on October 2, 2024, with comments due December 2, and the comment period was extended to January 16, 2025 (89 FR 91586). No final rule and no withdrawal has appeared in the Federal Register since. The current edition of the Unified Agenda places it among the FDIC's long-term actions, with the next step listed as "Final Rule To Be Determined" and the abstract still saying that "The FDIC plans to issue a final rule that would strengthen FDIC-insured depository institutions’ recordkeeping for custodial deposit accounts" (Unified Agenda, RIN 3064-AG07).

A long-term listing is not a withdrawal, and the work the proposal describes does not wait for it. Examiners can already ask how a sponsor bank knows what each end user is owed, and the Federal Reserve's 2024 order against Evolve Bank & Trust and the CFPB's 2025 judgment against Synapse both turned on records of who is owed what. The practical question for a chief financial officer is not whether to comply with a rule that does not exist, but how much of the proposal's work the bank should be doing anyway, and at what cost.

How much would the FDIC custodial account rule cost? The FDIC's own numbers

The FDIC custodial account rule would cost each covered bank about $220,000 in the first year and $110,000 in each year after, on the agency's assumptions. Those figures come from an assumed 2,200 hours to set up the records and daily reconciliation and 1,100 hours a year to run them, counted together for the bank and its non-bank partners, at $100 an hour. Across up to 1,100 banks the FDIC put the first-year cost "upwards of approximately $250 million" and about $120 million a year after. How the same estimate reads as one of the costs of a whole banking-as-a-service program is set out in the guide to BaaS risk and oversight costs.

The agency was careful about what it did not know. It had no data on how many banks hold covered accounts, no data on what the work costs, and it said so. Its starting point was that many banks already do some of it: "The FDIC believes it is likely that many IDIs currently engage in some form of reconciliation and maintain certain amounts of records in order to maintain custodial accounts. However, the FDIC believes it is unlikely that IDIs currently have all the records necessary to meet all the proposed rule's requirements."

That makes the average a poor guide to any one bank. The proposal names who would pay more: "IDIs which do not currently retain beneficial ownership information nor reconcile their accounts or those with greater complexity in their business lines, accounts and operations would be expected to incur above-average compliance costs." A sponsor bank with six partners, each with its own file format, cut-off time and card processor, is the second kind, whatever its size. The seats on the desk that would carry those hours are set out separately.

Why smaller banks pay more per dollar of assets

Smaller banks pay more per dollar of assets because much of the cost is fixed: a file format, a daily process, a contract, a validation and a certification cost roughly the same whether the bank holds $500 million or $50 billion. The FDIC's analysis said so directly: to the extent smaller banks are more likely to hold such accounts, or move more through them relative to their size, "smaller IDIs will bear higher costs as a share of their assets than larger IDIs."

The agency's small-entity numbers show the scale. Of 4,577 insured banks, it counted 3,259, about 71 percent, as small, meaning $850 million in assets or less. Applying that share, it expected 426 to 781 small banks to be covered, and found that a $220,000 increase in labor costs would exceed 5 percent of annual salaries and benefits for about 61 percent of small banks, the threshold the FDIC itself treats as a significant economic impact. That is 261 to 478 banks for which the proposal would be a material line in the budget.

The FDIC also predicted how those banks would respond: "the FDIC expects smaller IDIs would more likely opt for third-party arrangements and pass those costs onto their account holders." In other words, the fintech partners would pay part of the bill through their sponsor bank's fees. The proposal's analysis offered a counterweight too. Smaller banks "would also receive a disproportionately higher share of the benefits," because they have less capital and liquidity to absorb a Synapse-style disruption and the deposit flight that can follow it.

Where the 750,200 hours go: building the records is the smaller half

Most of the FDIC's yearly burden estimate is not building the system; it is keeping it running. The proposal's paperwork table spreads the work across three lines for up to 1,100 banks, and the ongoing recordkeeping line, the daily reconciliation among it, is the largest.

That matters for how a bank buys. A one-off project to produce a file in the proposal's format would cover the implementation line and leave the larger one untouched. The cost that recurs is the daily discipline: files arriving, entries pairing, breaks explained and aged, end users checked, and two people signing. That is where automation changes the economics, and where a project plan built around a data conversion underestimates the work.

Which accounts are exempt from the FDIC custodial rule?

Ten kinds of custodial account are exempt from the proposed recordkeeping, mostly because another law already makes someone keep the owners' records or because the money does not move to third parties. Sponsor banks should note what is not on the list: accounts behind prepaid cards, payment apps, earned wage access and similar fintech programs.

Build, extend or add agents: three ways to carry the cost

A sponsor bank has three realistic ways to carry the work, and they differ less in the first year than in every year after. Building in-house gives control and the highest fixed cost. Extending a core or partner platform is the path the FDIC expected small banks to take, and it leaves the bank relying on the party whose records it is meant to check. Adding agents to the existing systems moves the recurring daily work, which the paperwork estimate says is the larger half, off the desk.

None of the three removes the certification. Whoever keeps the records, the proposal would leave the bank responsible; a contract with a third party could not shift it. That is the strongest argument for having the daily evidence inside the bank, in a form an executive can rely on before signing.

What FBO Reconciliation does toward the proposal today, and what it does not

FBO Reconciliation does the daily part of the proposal's work on the systems a sponsor bank already runs. Every business day it ties each FBO account to the sum of its end users' balances, explains each difference with its records, checks every end user against the proposal's 30 fields and ownership codes, recomputes both totals independently, and keeps the attested snapshot so any past day can be rebuilt and downloaded in the proposed layout.

Any past day in FBO Reconciliation, rebuilt from the attested snapshot in the FDIC's proposed layout

It does not sign the certification, write the bank's policies or perform the annual independent validation; those stay with the bank's executives, compliance and internal audit, though the daily attestations give them something to test. It does not replace the core, the partner's systems or the general ledger. And it cannot produce a per-owner record a partner never sends: a partner that supplies only a total is filed as an exception.

FBO Reconciliation's privacy and retention settings

For a bank deciding what to buy, the useful test is the one the FDIC's cost analysis implies: which of the recurring hours does the option remove, and who is left holding the evidence. Why Part 370 is not the rule to plan around and the pass-through insurance requirements already in force complete the picture. To see the daily work on a sample of your own partners' files, start from FBO Reconciliation.

Questions people ask

What is 12 CFR 375?

It is the part of the FDIC's regulations the 2024 custodial-account proposal would create, titled Requirements for Accurate Custodial Deposit Accounts With Transactional Features and Prompt Payment of Deposit Insurance to Depositors. It does not exist in the Code of Federal Regulations today, because the rule has not been finalized.

Which FDIC recordkeeping requirements already apply to custodial accounts?

The pass-through rules in 12 CFR 330.5 and 330.7 already make each owner's coverage depend on records: the custodial relationship has to appear in the bank's deposit account records and each owner's interest has to be traceable in records kept in good faith, or the money is insured as the custodian's. Banks with two million or more deposit accounts also fall under Part 370. The 2024 proposal would add daily reconciliation, a set file format and annual certification for every covered bank, whatever its size.

Who pays for custodial-account recordkeeping, the bank or the fintech?

Under the proposal the bank is responsible and cannot contract the responsibility away, but the FDIC counted the bank's and its partners' hours together and expected smaller banks to pass costs on to their account holders. In practice the split is a term of each program agreement.

When would the custodial-account rule take effect if it were finalized?

The proposal sets no date. It notes that new rules imposing requirements on banks generally take effect on the first day of a calendar quarter after final publication, and the certification and report would be due within a year of the effective date. The proposal also asked commenters how long they would need.

Does the proposal apply to prepaid card programs?

Prepaid programs are not among the ten exemptions, and the FDIC noted that prepaid cards generally hold consumers' funds in custodial deposit accounts until they are spent. A program whose cardholders can pay third parties would meet the proposal's definition of a custodial deposit account with transactional features.