An FDIC signage audit tests whether a bank meets 12 CFR Part 328 everywhere the rule reaches: teller windows and lobbies, deposit-taking ATMs, the homepage, login and first account-opening page of every website and app, non-deposit pages, advertisements and the fintech partners that offer the bank’s deposits. Its accuracy has two parts that must be measured separately. Coverage is the share of in-scope places the audit actually looked at, on the version customers see. Correctness is the share of those places it judged right against the rule. Most signage reviews report neither: they report the findings from the screenshots someone happened to take. Botminds’ FDIC Signage Compliance is built to make both numbers visible, with every place in an inventory, every capture kept and every check citing its passage.
One sample bank’s FDIC signage audit, in four numbers
1,140
screens in scope across the bank’s channels, ATM builds and 9 partners
1,126
captured, each with size, version, test account and hash
14
screens the agents could not reach, listed for a person
23
findings closed since September 1, each on a passing recapture
How do you audit FDIC signage? Two numbers, measured separately
Start with the denominator. An audit that cannot say how many places the rules reach cannot say what share it checked, and an audit that only counts findings rewards looking in the wrong places. The first number, coverage, is places checked divided by places in scope, by channel. The second, correctness, is the share of checks a second reviewer confirms, measured on a sample of the audit’s own passes and fails. A clean report with low coverage is not evidence of compliance; it is evidence that the unchecked places are unknown.
The FDIC’s own framework separates the two activities that produce these numbers. Monitoring is the bank’s own continuing search for weak procedures and gaps in training before they turn into violations; an audit is an independent check that the controls, operations and compliance risk framework work (the two definitions are quoted and compared incompliance testing vs audit). And the FDIC warns, in the passage below, against treating strong monitoring as a substitute for audit (FDIC manual II-3).
It should not be assumed that if an institution has a strong monitoring function in place, risks are appropriately mitigated.
FDIC, Consumer Compliance Examination Manual, II-3
The measures of an FDIC signage audit, and how to compute them
| Measure | Numerator | Denominator | What a low value means |
|---|---|---|---|
| Coverage | Places checked on the live version, in the right state (logged in, device size) | Places in the inventory that a Part 328 duty reaches | Unknown places, not compliant ones |
| Correctness | Checks a second reviewer agrees with | Checks re-reviewed, passes and fails alike | False passes hide violations; false fails waste fix time |
| Freshness | Places checked since their last change | Places that changed in the period | A release or campaign the audit never saw |
| Closure on evidence | Findings closed on a new passing check | Findings closed | Findings closed on someone’s word |
What is a signage inventory? The denominator of the audit
A signage inventory lists every place a Part 328 duty can attach, with the rule that reaches it. For premises that is each teller window or station where deposits are usually received, each place non-deposit products are sold and each lobby screen used for signs (12 CFR 328.3). For ATMs it is each deposit-taking machine, grouped by screen build, with its in-service date. For digital channels it is each website and app’s homepage, login page and first account-opening page, the pages primarily dedicated to non-deposit products and every logged-in link to a third party’s non-deposit platform (12 CFR 328.5). Add the ad channels under § 328.6 and the partner screens that make statements about insurance under subpart B.
Build it from systems, not memory: the content management system’s publish log, app release notes, the ATM vendor’s build list, the branch roster, the partner portal. An inventory rebuilt from those every cycle catches the campaign landing page nobody added and the app flow that changed in the last release. How the inventory sits inside a bank’s written policy is set out in a sample FDIC signage policy.
How many screens need the FDIC sign?
Fewer than many 2024 projects assumed, in more places than most inventories list. After the 2026 rule, a digital channel needs the official digital sign on three pages: the homepage, the login page and the first account-opening page. The FDIC removed transaction pages and said dashboards after login are not covered (Q&A II.A.8–9). But every channel counts separately: a public website, an online banking site and two mobile apps are four sets of three, and account opening may start on several of them.
The places that do not need the sign still need checking, for other duties. Investment pages need non-deposit signage, outbound links need the one-time notice, ads need or must avoid the advertising statement, and partner screens must not misstate insurance. In the sample bank, 1,140 screens across the bank’s channels, ATM builds and nine partners are in scope for one or more of those checks.
Coverage: the share of places the audit actually saw
Coverage fails quietly. An annual review with screenshots taken by hand often covers what the reviewer could reach that week, logged out, on a desktop browser. Partners send the screenshots they choose. Branch attestations record that a sign exists somewhere. None of these reports what was not seen. A measured audit reports coverage by channel and lists the places it could not reach, so the gap is a finding of its own rather than an assumption of compliance.
Coverage by channel at a sample bank: what was captured, and what was not
Correctness: was each check right?
Correctness is measured by re-checking a sample of the audit’s own conclusions, passes as well as fails. Two errors matter and they cost differently. A false pass leaves a violation in front of customers and examiners. A false fail sends a team to fix a page that was fine and erodes trust in the next finding. A reviewer re-checking a random sample of each, by channel and by rule, gives a rate for each, and a seeded test (a few screens known to fail, slipped into the cycle) shows whether the audit finds what it should.
Part 328 makes correctness harder than it looks, because several of its tests are judgments. The FDIC’s 2026 rule makes clear, continuous and conspicuous a judgment about how the sign looks against everything else on the same page or screen (FDIC digital signage requirements quotes the test). Whether a page is “primarily dedicated” to non-deposit products is a judgment too. An audit that cannot show who made each judgment, against which passage, cannot be re-checked. In FDIC Signage Compliance every check names its passage and confidence; below the bank’s threshold the agent proposes nothing and a person decides, and a reviewer checks every finding before the Compliance Officer approves it.
Recording correctness: the four outcomes of a re-checked sample
| Reviewer says it passes | Reviewer says it fails | |
|---|---|---|
| Audit said pass | Confirmed pass | False pass: a missed violation |
| Audit said fail | False fail: wasted fix, lost trust | Confirmed finding |
What evidence proves FDIC signage compliance?
Evidence is the place as the customer sees it, captured with the conditions that make it reproducible. For a screen that means the version or build, the device size, whether the user was logged in and as which test account, the time, and a hash so it cannot be quietly replaced. For a lobby it means a dated photo with every window visible. For a finding it means the passage of the rule it rests on and the person who decided it. For a closure it means a new capture of the same place, same size, same account, on the fixed version, that passes.
Evidence an examiner can re-check, place by place
- The capture, not a description
The screen or photo itself, at its real size, on the version customers saw.
- Conditions of the capture
Device size, logged in or out, test account, app version or ATM build, time.
- Integrity
A hash or equivalent, so the capture cannot be swapped after the fact.
- The passage behind each check
Section and paragraph of Part 328, or the program agreement clause, with the rule version in force that day.
- Who decided
Reviewer, approver, reason codes for overrides; never only “checked”.
- Closure on a recapture
Same place, same conditions, fixed version, passing; both captures kept side by side.
- What was not seen
Places in scope that could not be reached, and who is following them up.
- Partner correspondence
The request as sent, the reply, the due date and the escalation step.
An examiner pack with every capture hashed and every citation checked
Why the FDIC’s exam procedures will not tell you what to test
The FDIC’s published procedures for Part 328 predate the current rule. The chapter still shows “Chapter Last Updated: May 2023”, cites the section numbers in force before the December 2023 rule, and tells examiners “NOTE: Display of the official sign at automated teller machines (ATMs) is not required.” (FDIC manual X-1). It has no procedure for websites, apps, the one-time notice or partner oversight under § 328.8, all of which the current rule contains.
Build the audit program from the rule and the FDIC’s Q&A instead, and treat the manual chapter as a floor for premises and advertising. The current sources are the eCFR text of Part 328, the January 2026 final rule’s preamble for the digital and ATM sections, the 2024 preamble for subpart B and § 328.8, and the Q&A updated on May 13, 2026 (12 CFR Part 328; FDIC Q&A).
Which FDIC signage errors are common?
The errors that recur are the ones the FDIC itself anticipated in its rules, Q&A and letters. Some are new with the 2026 rule; some date from the FDIC’s published demand letters. The table lists the ones an audit should test for first, with where each comes from.
Common FDIC signage errors, and the source that names each
| Error | Where it shows up | Source |
|---|---|---|
| Sign only on the ATM idle loop | ATM screen builds | § 328.4(b): an idle-screen ad is not the initial screen |
| No sign on the first account-opening page | Websites and apps built to the 2023 text | FDIC would not grandfather 2023 compliance (91 FR 3801) |
| Disclosure at page bottom in tiny text | Investment and annuity pages | 91 FR 3801: not conspicuous if at the bottom “in very small text size” |
| Official digital sign on a partner’s screen | Fintech apps | 89 FR 3504: a misrepresentation under subpart B |
| Insured claim with no bank named | Partner and non-bank marketing | § 328.102(b)(5)(i); FDIC letters of 2023 and 2024 |
| Uninsured products beside deposits, no disclaimer | Mixed screens and social posts | § 328.102(b)(5)(iii); 89 FR 3504 on mixed ads |
| “Member FDIC” on a non-deposit ad | Investment and annuity banners | § 328.6(e)(1) |
| Varied lobby sign smaller than 7 × 3 inches | Branches after remodels | § 328.3(b)(4) |
| Non-deposit sign next to the official sign | Small branches and shared desks | § 328.3(c)(2) |
How do you sample websites for FDIC signage?
Do not sample the pages the rule names. The homepage, login page and first account-opening page of each channel are few enough to check in full, every cycle, and they are where an examiner will look first. Sampling belongs where the population is large and the duty conditional: content pages that may be primarily about non-deposit products, outbound links, ad creative. There, sample by template rather than by page, because a template defect repeats on every page built from it, and weight the sample to whatever changed since the last cycle.
Partner screens are the exception to sampling. A partner’s home screen, sign-up flow and any screen that mentions insurance should be captured in full after every partner release, because the bank cannot see the partner’s change log. The FDIC’s examiners reported in 2024 that some banks had relied heavily on their third-party providers for compliance controls (FDIC, March 2024).
How often should FDIC signage be audited?
Audit on a cycle the policy sets, and monitor continuously in between. Part 328 sets no frequency; the FDIC expects monitoring and audit scaled to the bank’s size, complexity and risk (FDIC manual II-3). Signage changes with releases, so an annual audit with no monitoring tests one day a year. Monthly recapture of every screen, a recapture after every reported fix, and an independent audit that re-checks a sample of the monitoring’s conclusions is a defensible split.
FDIC signage monitoring and audit do different jobs
Monitoring (first and second line): Find and fix problems as they appear.
Audit (independent): Test whether the controls, monitoring included, work.
Monitoring (first and second line): Every cycle and after every change.
Audit (independent): On the audit plan’s cycle.
Monitoring (first and second line): Every place in the inventory.
Audit (independent): The inventory itself, plus a sample of places and of monitoring results.
Monitoring (first and second line): Reviewer checks each finding before approval.
Audit (independent): Re-checks a random sample of passes and fails.
Monitoring (first and second line): Findings, corrections, closures on recapture.
Audit (independent): A report on coverage, error rates and control gaps.
Buying an FDIC signage audit or a tool: what to ask
Whether you hire a reviewer or buy software, ask for the two numbers. How is the inventory built, and what does the audit report about places it did not reach? How is correctness measured, and what were the false-pass and false-fail rates last cycle? Are screens captured logged in, at each device’s size, on the current version, with the conditions recorded? Does every finding cite its passage? Does a finding close on a new capture or on a reply?
Botminds’ FDIC Signage Compliance answers those from its own records: it keeps the inventory, captures every screen on a schedule and after every reported fix, checks each against Part 328 and the program agreement with the passage cited, reports what it could not reach, and closes nothing without a passing recapture approved by the Compliance Officer. It is monitoring, not an independent audit: internal audit should still re-check a sample of its conclusions, and it leaves the judgment on ambiguous pages to people. For how the agents divide the checking, see FDIC Part 328, checked screen by screen by agents.
Readiness by channel, with the gaps named
Questions people ask
What is an FDIC signage audit?
An independent test of whether a bank meets 12 CFR Part 328 in every place it applies: premises, ATMs, websites and apps, advertising and fintech partners. A good one reports coverage and correctness by channel, keeps the evidence and tests the bank’s monitoring as well as the signs.
How do you check ATM screens for the FDIC sign?
Capture the welcome screen of each ATM screen build, not the idle loop, and record which machines run it. For machines relying on the physical sign, keep a dated photo. Machines that take no deposits are out of scope and should be listed as such.
Is a branch manager’s attestation enough evidence?
Rarely on its own. An attestation records that someone said a sign was there; a dated photo of the teller line shows which windows carry the sign and whether it meets the 7 × 3 inch minimum. Photos also let a reviewer re-check the conclusion later.
Should internal audit rely on automated signage monitoring?
It can rely on it after testing it: re-check a random sample of its passes and fails, seed a few known failures, and confirm the inventory is complete. Automated monitoring improves coverage; the audit’s job is to measure its correctness.
What happens to screens the audit cannot reach?
They should be reported as not checked, with an owner and a date to resolve, never counted as passing. Expired test accounts and bot checks on partner flows are the usual causes, and fixing access is part of the partner agreement.