FDICIA threshold 2026: $1 billion, $5 billion, and who dropped out

The FDICIA threshold is the asset size at which an insured bank or savings association becomes subject to the annual audit and reporting requirements of 12 CFR Part 363, which implements section 36 of the Federal Deposit Insurance Act added by FDICIA in 1991. From January 1, 2026 there are two main thresholds: $1 billion in total assets for Part 363 as a whole (an audited annual report, a management report, an audit committee of outside directors) and $5 billion for the internal control assessment and the independent accountant's attestation on it. Before 2026 they were $500 million and $1 billion. The FDIC's final rule took 778 institutions out of Part 363 and 727 out of the internal control requirements. The change matters to regulatory reporting because Part 363 is the one rule that makes "financial reporting" include the Call Report; Botminds' Regulatory Reporting Controls is built for the controls behind that report, whichever band a bank sits in.

What is the FDICIA threshold in 2026?

$1 billion and $5 billion, each "as adjusted from time to time in accordance with 12 CFR 314.1." Part 363 "applies to any insured depository institution with respect to any fiscal year in which its consolidated total assets as of the beginning of such fiscal year are $1 billion" or more, and the internal control assessment applies to an institution "with consolidated total assets of $5 billion" or more at the beginning of the fiscal year (12 CFR 363.1(a) and 363.2(b)(3), eCFR current to October 23, 2026). The FDIC's final rule was published on December 4, 2025 and is "effective January 1, 2026" (90 FR 55789).

The two numbers carry most of the rule, but not all of it. The audit committee rules move with them: from $1 billion to $5 billion, an audit committee of outside directors, a majority independent of management; at $5 billion or more, all independent; and above $5 billion, members with banking or financial expertise, access to their own counsel and no large customers. The large-committee threshold was $3 billion before 2026.

When did the FDICIA thresholds change?

Twice before, and now a third time with indexing built in. FDICIA was enacted in December 1991, and the FDIC set the first threshold at $500 million when it implemented Part 363 in 1993. In 2005 it raised the internal control threshold to $1 billion. The 2025 rule raised both, effective January 1, 2026, and added automatic adjustment for inflation from 2027.

The FDIC's own history explains why. In 1993, it wrote, "a $500 million asset threshold captured approximately 1,000 IDIs (out of approximately 14,000) holding 75 percent of U.S. banking assets." By 2005 inflation and consolidation had stretched that to more than 1,150 of 8,900 institutions, and after that year's change "about 600 of the largest IDIs with approximately 86 percent of industry assets continued to be covered by the ICFR requirements of part 363." The 2026 change brings the count back to about a thousand institutions under Part 363: 1,024 on the FDIC's data.

How are FDICIA thresholds measured?

On total assets at the beginning of the fiscal year, read from the Call Report. The FDIC's guidelines say an institution "should use total assets as reported on its most recent Report of Condition (Call Report)... the date of which coincides with the end of its preceding fiscal year" (Part 363, Appendix A, guideline 1). For a calendar-year bank, the December 31, 2026 Call Report decides whether Part 363, and the internal control assessment, apply to fiscal 2027.

That makes the threshold a planning date, not a surprise. A bank at $4.6 billion in September that expects to pass $5 billion by December will be under the internal control assessment for the whole of the next year, with management's assessment as of the next December 31 and the report due 90 or 120 days after that. The audit committee changes get a grace period: the guidelines take no regulatory action if a newly covered institution restructures its committee by the end of that fiscal year.

Who dropped out of Part 363, and do they have to stop?

Institutions between $500 million and $1 billion left Part 363 altogether, and those between $1 billion and $5 billion left the internal control assessment and attestation. The rule let them stop at once: an institution "need not comply with the applicable 12 CFR part 363 requirements in effect as of December 31, 2025, if the IDI will not be subject to such 12 CFR part 363 requirements under the updated thresholds in effect as of January 1, 2026" (90 FR 55789, Dates).

"Need not" is permission, not instruction. Nothing in Part 363 prevents a $3 billion bank from keeping an internal control assessment its board values, and the FDIC's guidelines still say the agency believes "every insured depository institution, regardless of its size or charter, should have an annual audit of its financial statements performed by an independent public accountant, and should establish an audit committee comprised entirely of outside directors." Dropping out of the attestation also does not change a single Call Report signature: the CFO and directors attest every quarter whatever the bank's size.

The FDICIA threshold decides who must prove their controls to an outside accountant once a year. It does not decide whose Call Report has to be right every quarter.

Will the FDICIA thresholds change again?

Yes, automatically. The new 12 CFR 314.1 indexes the thresholds to the Consumer Price Index for Urban Wage Earners and Clerical Workers. The first adjustment is effective October 1, 2027, using CPI-W "through August 30, 2027"; after that, adjustments follow every two years, and annually in any year when cumulative inflation over the preceding 12 months exceeds 8 percent (12 CFR 314.1; 90 FR 55789). Each adjusted threshold is rounded to two significant digits, so $1 billion would next read as, say, $1.1 billion, and a fall in prices never lowers a threshold.

The FDIC also gave the agencies room for institutions caught by a scheduled change. Under a new section 363.6, if an institution "likely will no longer be subject to a requirement" because of an adjustment scheduled during its current fiscal year, its primary regulator "may exercise discretion to not require compliance" from the start of that year (12 CFR 363.6). The practical point for a bank close to a line: watch the CPI-W figure in late summer 2027, not only the balance sheet.

Does a $2 billion bank need an ICFR attestation?

Not under Part 363 since January 1, 2026. A $2 billion institution must still file an audited Part 363 Annual Report with a management report signed by the CEO and CFO, but the assessment of internal control over financial reporting and the accountant's attestation now start at $5 billion. A public holding company can be a different case: section 404(b) of the Sarbanes-Oxley Act requires an auditor's attestation for accelerated and large accelerated filers (15 U.S.C. 7262), and Part 363 asks institutions below $5 billion that are public, or subsidiaries of public companies, to file a copy of any such report with their Part 363 Annual Report.

FDICIA vs SOX: how the two internal control regimes differ

They overlap in method and differ in scope. Both require management to assess internal control over financial reporting against "a suitable, recognized control framework" and, at the larger sizes, an outside accountant to attest. FDICIA's version applies to insured institutions by asset size and explicitly reaches regulatory reports; SOX applies to SEC registrants by filer status and reaches the financial statements in their SEC filings.

The row that matters most for a regulatory reporting team is the fourth. At $5 billion and above, management's statement must say that the assessment "included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions including identification of such regulatory reporting instructions." What that sentence requires in practice is the subject of internal controls over financial reporting include your Call Report.

What a bank between $1 billion and $5 billion should keep doing

Keep the controls and the evidence; decide deliberately about the formal assessment. The sample bank used in this series is a useful case: Tessaly Community Bank, fictional, with $3.4 billion in assets, now inside Part 363 but below the internal control threshold. Its board kept the assessment as policy. Its CFO still signs a Call Report declaration every quarter, behind 23 process owners and 61 key controls.

A $3.4 billion bank's quarterly attestation, unchanged by the threshold

There are good reasons to keep more than the rule asks. A bank growing toward $5 billion will need two quarters of tested controls before its first assessment, and the evidence is cheaper to build while nothing is at stake. And examiners test the Call Report's controls at every size: the OCC's regulatory reporting procedures apply to banks it supervises regardless of whether Part 363 does. Regulatory Reporting Controls runs the same quarterly cycle at any size: evidence captured as controls run, separation of duties checked on every instance, key controls re-performed, and the CFO attesting on a complete tree.

Questions people ask

What are the FDICIA requirements for a bank with $1 billion in assets?

An annual audit of its financial statements by an independent public accountant; a management report signed by the CEO and the CFO or chief accounting officer, stating management's responsibilities and assessing compliance with designated safety and soundness laws; an audit committee of outside directors, a majority independent; and filing within 120 days of year-end, or 90 if public.

When does Part 363 apply to a growing bank?

For the first fiscal year that begins with total assets of $1 billion or more, measured on the Call Report at the end of the preceding fiscal year. The internal control assessment starts the same way at $5 billion.

Can a holding company meet Part 363 for its bank?

Often, yes. The audited statements can be the holding company's if its insured subsidiaries make up 75 percent or more of its assets, and other requirements can be met at holding company level if the bank is under $5 billion, or is $5 billion or more with a composite CAMELS rating of 1 or 2. The regulator can withdraw that option above $9 billion.

Is the FDICIA threshold the same for every agency?

Part 363 is the FDIC's rule, but it applies to all insured depository institutions, whichever agency supervises them, and reports are filed with the FDIC, the primary federal regulator and any state supervisor.

Do the new thresholds change the Call Report signatures?

No. The CFO's declaration and the directors' attestation are set by the Call Report instructions and apply to every filer, whatever its size and whether or not Part 363 applies.