FDIC’s Rule Changes Reshape Audit Requirements for Community Banks

On November 25, 2025, the Federal Deposit Insurance Corporation (FDIC) finalized a sweeping change to regulatory thresholds under Regulation 12 CFR Part 363 (Part 363) of its rules, which govern audit and reporting requirements for insured depository institutions. This is the most significant structural revision to FDIC audit and governance thresholds in decades, with particularly profound implications for community banks. The updated rules will be effective on January 1, 2026. However, a bank need not comply with the applicable Part 363 requirements in effect as of December 31, 2025, if the bank will not be subject to such Part 363 requirements under the updated thresholds in effect as of January 1, 2026.

Impact on Community Banks

The FDIC’s update centers on raising asset-based thresholds that determine the applicability of financial statement and internal control audit requirements for community banks. Key changes include:

• Annual Independent Audit Requirement: The threshold is now increased from $500 million to $1 billion in total assets.
• Internal Control Over Financial Reporting (ICFR): The threshold for mandatory ICFR assessments and audits increases from $1 billion to $5 billion.
• Audit Committee Composition: Requirements are now relaxed for institutions under $5 billion, easing the burden of recruiting independent directors.

Additionally, the FDIC is indexing these thresholds to inflation, using the non-seasonally adjusted Consumer Price Index for Urban Wage Earners (CPI-W), with reviews every two years.

Here’s what these changes could mean for your institution.

Regulatory Relief and Cost Savings

The most immediate benefit for community banks is a significant reduction in compliance costs. The FDIC estimates that:

• Nearly 800 institutions between $500 million and $1 billion in assets are now exempted from the audit requirement.
• Approximately 700 institutions between $1 billion and $5 billion are now relieved from ICFR obligations.

This relief is especially meaningful for rural and smaller institutions that have struggled to meet audit committee composition requirements and bear the costs of external audits and control testing.

Enhanced Operational Flexibility

By removing smaller banks from the scope of Part 363, the update allows these institutions to reevaluate their internal control frameworks. While robust internal controls remain essential, banks may now tailor their governance and risk management practices to better fit their size and complexity.

This flexibility could also ease recruitment challenges for audit committee members, particularly in markets with limited access to qualified independent directors.

Strategic Planning Opportunities

For banks approaching the new thresholds, the update presents a chance to reassess strategic growth plans. Institutions nearing the $5 billion mark may need to prepare for re-entry into the more stringent regulatory framework, while those below it can consider streamlining operations and governance structures.

Preservation of Safety and Soundness

Despite the rollback in requirements, the FDIC maintains that the revised $1 billion and $5 billion thresholds will still cover institutions holding approximately 95% and 89% of industry assets, respectively, ensuring that the most systemically significant banks remain subject to rigorous oversight.

This balance aims to reduce unnecessary burdens without compromising the integrity of the banking system.

Broader Regulatory Context

The update is part of a broader FDIC initiative to modernize outdated rules and recalibrate regulatory frameworks in light of inflation and industry consolidation. Other changes include:

• Raising the director independence compensation threshold from $100,000 to $120,000.
• Updating thresholds in Regulation Part 303, 335, 340, 347, and 380 to reflect inflation.

These adjustments reflect a policy shift toward proportionality, ensuring that regulatory obligations align with institutional size and risk profile.

Next Steps and Considerations

Audit requirements remain in place for certain financial institutions by the Federal Reserve, U.S. Department of Housing and Urban Development, stock exchanges they participate in, state regulations, debt they have issued, company bylaws, etc. It is important that each financial institution understand their requirements as the thresholds set by other regulators have not yet changed and there is no guarantee that they will change to align with the FDIC’s updated thresholds.

Community banks no longer subject to ICFR assessments are encouraged to conduct a thorough risk assessment and determine which internal controls remain essential. While the proposal offers relief, it also calls for thoughtful governance and strategic foresight. Our advisors are ready to help you navigate what’s next and turn regulatory change into strategic opportunity.