Sample FDIC signage policy: who waits on whom to put a sign up

A sample FDIC signage policy should do more than repeat 12 CFR Part 328. Since May 1, 2025, § 328.8 has required every insured bank to “establish and maintain written policies and procedures to achieve compliance with this part”, sized to its risk and covering, as appropriate, the people who offer its deposits to others. A working policy names an owner for every place a sign can appear (branch lobbies, ATMs, websites, apps, ads, fintech partners) and sets out who must wait on whom before a sign goes up or a claim comes down. That is hard because no single team controls those places: web teams wait on releases, ATM owners on vendors, partners on their own roadmaps, and branches on someone noticing. Botminds’ FDIC Signage Compliance is built to run the checking and evidence side of such a policy, every month, across all of them.

What should an FDIC signage policy include?

It should include what § 328.8 names and what the rest of Part 328 implies. The regulation asks for policies “commensurate with the nature, size, complexity, scope, and potential risk of the deposit-taking activities” that include, as appropriate, “provisions related to monitoring and evaluating activities of persons that provide deposit-related services to the insured depository institution or offer the insured depository institution’s deposit-related products or services to other parties.” (12 CFR 328.8(a)). The FDIC’s preamble added examples: measures for when the bank “changes its advertising strategy or engages with, or expands into, new physical or digital deposit-taking channels”, and procedures to make sure websites and apps can carry the signs.

It also expects training. The FDIC said banks “will implement, or enhance, current policies and procedures related to training staff to review any marketing and advertising materials about the IDI’s deposit products and services and to monitor and evaluate compliance with part 328.” (89 FR 3504). The sections below are a sample outline that covers both; they are a starting point to adapt, not a filing template.

Does Part 328 require written policies?

Yes: “An insured depository institution must establish and maintain written policies and procedures to achieve compliance with this part.” The requirement came with the December 2023 rule and has applied since May 1, 2025; the FDIC’s 2025 delays reached only the digital and ATM sections, not § 328.8 (90 FR 11659).

There is one carve-out in time. The FDIC said the policies “will not need to address the requirements in 12 CFR 328.4 or 328.5” until the compliance date for those sections (90 FR 54544), which the January 2026 rule set at April 1, 2027. A policy written in 2025 that covers branches, ads and partners therefore needs a revision now, before April 2027, to add ATMs and digital channels under the amended text.

Who is responsible for FDIC signage?

The bank, and inside it whoever the policy names. Part 328 places every duty on the insured institution, but no single team can meet them: the official sign at a teller window is a branch task, the welcome screen of an ATM is a vendor build, the login page is a release, and a partner’s app is the partner’s code. A policy that simply makes Compliance responsible for signage assigns the accountability without the means.

The workable split is by channel. Each channel has an owner who makes changes, a reviewer who checks them before and after release, and an approver for findings and closures. The roles below are the five the solution’s fictional sample bank uses; the before and after columns show what changes when the capturing and checking is done by agents rather than people with screenshots.

Who waits on whom: the handoffs where signs go missing

Findings cluster at handoffs, not inside teams. Five recur. A campaign launches a new deposit landing page that was never on the inventory. A template change for one product silently drops the sign from an account-opening page. An app version passes store review with a redesigned login screen. An ATM vendor ships a build that moves the sign to the idle loop. A partner releases a feature with a new insurance claim. In each case the owner did their job and the check came too late, or not at all.

A policy closes those gaps with two rules: every change that touches a covered place triggers a check of the place as customers see it, and a finding closes only when a new check passes. Neither depends on anyone remembering. Who signs off on website signage is then simple to write down: the digital owner releases, the reviewer checks the live page, and the Compliance Officer approves the finding or its closure.

Two people stand between a draft and the partner

How do you track signage across channels? An inventory, not a checklist

You track it with an inventory of places, not a list of rules. A checklist says the login page needs a sign; an inventory says which login pages exist, on which channels, owned by whom, last checked when, on which version. The list of pages that take deposits goes out of date whenever a campaign launches, which is why the inventory has to be rebuilt from the systems that create pages, not from memory.

Do fintech partners follow FDIC signage rules?

Their own rules, yes; the bank’s signs, no. A partner is bound directly by subpart B, which applies to “any person”, and the bank must monitor it under § 328.8. The FDIC’s preamble gave the test: a web host that only publishes the bank’s own content may not need provisions at all, but “if the IDI offers a deposit account through or by a non-bank third party on a consumer-facing website with the branding and marketing of a non-bank third party”, then “This would warrant that the IDI include provisions in its policies and procedures to monitor and evaluate compliance with part 328 by the third party.” (89 FR 3504). Partners must not display the official digital sign, which the FDIC said would misrepresent them as insured.

The depth of monitoring is risk-based and can change: relationships “could experience significant changes, including in personnel, risk management philosophy, or new types of products offered, that may warrant more extensive policies and procedures.” The FDIC’s examiners have cited banks where oversight failed, including banks that left compliance controls largely to their third-party providers (FDIC, March 2024). The interagency third-party guidance of 2023 sets the general frame, discussed in the interagency guidance on third-party relationships; on September 11, 2026 the agencies proposed replacing it, while keeping the principle that third parties do not reduce a bank’s responsibility (FIL-58-2026). What partners must say is in the not FDIC insured disclosure.

If a non-bank misrepresents deposit insurance, the FDIC would still expect to devote attention to taking action against the non-bank, formally or informally, under part 328 subpart B, regardless of the presence of a bank partner.

FDIC, final rule of January 18, 2024 (89 FR 3504)

Partner monitoring the policy promises, partner by partner

How often should FDIC signage be reviewed?

On every change that touches a covered place, and on a schedule in between. Part 328 sets no frequency; § 328.8 asks for policies commensurate with risk, and the FDIC’s cost analysis assumes recurring work to maintain, review and update signage. An annual review proves compliance on one day a year. A monthly recapture of every screen, plus a check after every reported fix, proves it on most days.

Branch lobbies change less often than screens, so a quarterly photo per branch is a reasonable middle ground; ATMs need a check per screen build and a photo where the physical sign is relied on. How to measure whether a review found the right places and judged them right is set out in the FDIC signage audit.

A quarterly lobby photo instead of a tick

Where FDIC Signage Compliance fits in the policy, and where it does not

A policy promises things a bank must then do every month: keep the inventory, check every place after every change, track partners, close findings on evidence. Botminds’ FDIC Signage Compliance does that work with agents that capture every page and screen at the device’s own size, logged in with test accounts, check each against the passage it cites, group failures by the template that causes them and draft corrections; people check, approve and send.

It does not write the policy, decide the bank’s risk appetite, or replace counsel on an ambiguous page. It does not publish a fix or contact a partner. And it does not see what it cannot reach: screens behind an expired test account or a bot check are listed for a person rather than guessed at, which a policy should treat as unknown, not as passing.

Questions people ask

Is there an official FDIC sample signage policy?

No. The FDIC requires written policies under § 328.8 but has not published a template; it described what policies should cover in the preamble to its 2023 rule. Any sample policy, including the outline here, has to be adapted to the bank’s channels, partners and risk.

Who signs off on website signage?

Whoever the bank’s policy names. A common split is that the digital channels owner releases the change, a compliance reviewer checks the live page, and the Compliance Officer approves findings and their closure. Part 328 assigns the duty to the bank, not to a role.

What is a signage inventory?

A list of every place a Part 328 duty can attach (teller windows, ATMs and their screen builds, website and app pages, ad channels and partner flows) with an owner, the rule that reaches it and the date and result of its last check. It is the denominator of any review: places not on it are never checked.

Must the signage policy cover ATMs and websites now?

From April 1, 2027 it must. The FDIC said policies required since May 1, 2025 need not address §§ 328.4 and 328.5 until those sections’ compliance date, which the January 2026 rule set at April 1, 2027.

Should the policy cover partners that only host our website?

Usually lightly or not at all. The FDIC said a web host that simply publishes content the bank develops and directs may not warrant Part 328 provisions, while a partner offering the bank’s deposits under its own brand does.