Fall is shaping up to be a busy season for regulators. The OCC, FDIC, Fed, and NCUA joined forces, proposing new TPRM guidance. State examiners are laying down AI inventory expectations, and the IRS wants VIN and original-use data behind every vehicle loan interest return.
Charter-specific news is in the mix too: federal credit unions now share national banks' protection from Illinois' interchange fee law, state-chartered institutions don't, and the FDIC proposed extending parity to state banks without a branch.
Want a deeper dive into the latest headlines? Watch the October Reg Update podcast. For additional resources and regulatory analyses, check out Ncomply, our compliance management software.
The Conference of State Bank Supervisors (CSBS) created an Artificial Intelligence Supervisory Framework to help state examiners identify and understand AI at FIs. It builds on existing AI risk management documents, including NIST's AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework, and the Treasury's AI Lexicon, so FIs that have already aligned with those don’t have to start from scratch.
The package includes a core examiner guide, an examiner work program, nonbank AI supplements, and an AI use-case risk-tiering worksheet, which are designed to adapt to an FI's size and risk profile, and to how it uses AI.
The framework puts a comprehensive AI inventory at the center. FIs need to know where AI (including shadow AI) is used internally and across vendors, how it's used, and what risk level it carries, since undocumented or uncontrolled use invites exam findings. From there, the framework turns to governance, including who owns AI risk, who approves new use cases, and how it's reported.
State examiners aren't required to use the framework, but it likely previews what they will evaluate. A close read and even a mock exam can help FIs see what still needs work.
Six U.S. and foreign banks also released five principles for building trust in AI agents used in commerce: transparency, safe transacting, consent and data, consumer choice, and ecosystem connectivity. These cover the consumer side of AI use, and many states already apply their unfair acts and practices (UDAP) laws to it as AI-specific rules continue to develop.
Mapping these principles to your AI inventory is one way to demonstrate consumer protection. Used together, the framework and principles prepare FIs for scrutiny from both examiners and consumer or state litigation.
Related: AI Risk Management Frameworks for Financial Institutions
FIs now have clearer guidance on what they can say to customers about suspected fraud.
FinCEN, the Federal Reserve, NCUA, FDIC, and OCC issued a joint statement on how SAR confidentiality applies when banks and credit unions talk with customers about potentially fraudulent transactions, other suspicious activity, such as payment or check fraud, and account closures.
The rule hasn't changed, so FIs still can't disclose a SAR or reveal information indicating that one was filed or may be filed. What the statement adds is clarity on what they can discuss. SAR confidentiality doesn't prevent a conversation with a customer about the underlying activity, such as the purpose of a transaction, the source of funds, or the suspicious activity itself. FIs can also communicate account closure decisions tied to suspected fraud or suspicious activity, if they don't reveal that a SAR exists.
The agencies also acknowledge that a reasonable person might look at the facts and conclude a SAR was probably filed. Their position is that this possibility alone doesn't make the communication a prohibited disclosure. The question remains whether the FI is revealing the SAR's existence.
With the line clearer but still in the same place, employee training matters as much as ever.
The OCC, Federal Reserve, FDIC, and NCUA jointly proposed new third-party risk management (TPRM) guidance that would replace the 2023 interagency guidance and its supplemental resources. It's notably the NCUA's first time joining the other agencies on TPRM guidance.
The agencies noted that the 2023 version pushed FIs toward check-the-box compliance rather than genuine risk management, and the proposal's structure reflects that. While the 2023 guidance followed a five-stage lifecycle, the proposal is built around four components: risk identification and assessment, risk oversight, residual risk acceptance, and governance. The old lifecycle activities still sit within risk oversight.
Two shifts stand out:
That second shift reaches into vendor contract management. The proposal says there are no generally applicable expected contract terms, and a missing term isn't enough for an examiner to issue a finding. An FI can proceed with a vendor that won't negotiate everything it wants if it understands the risks and if the residual risk sits within its appetite.
For banks, the Federal Reserve also proposed a guide for traditional community banking organizations under $30 billion in assets, and the Fed, FDIC, and OCC issued a joint statement on core service providers. The statement says provider transparency and contracting practices, along with technology resiliency and market concentration, may influence supervisory and enforcement decisions involving the core providers themselves. The NCUA isn't part of either because it lacks vendor oversight authority.
Credit unions should watch how the proposal fits with the NCUA's existing third-party guidance, since the list of rescinded documents doesn't appear to name the agency’s TPRM letters. Comments are due November 16, and FIs with views on fintech partnerships and core provider leverage may want to weigh in.
Because this is a proposal, start by analyzing its impact on your existing TPRM program. If your vendor tiers hang on a fixed critical activities list, map each relationship to the magnitude and likelihood of harm and document why.
As Michael Carpenter and Michael Berman say in their book The Upside of Third-Party Risk Management, remember to tier the service, not the vendor. Add a step where someone with authority accepts residual risk, with the rationale on paper, and make sure board reporting explains why each level of oversight was chosen. Existing vendor due diligence and monitoring should keep running.
For more information, watch the webinar: Proposed Interagency Guidance on Third-Party Risk Management: What It Means for Your Bank or Credit Union
Lenders that make vehicle loans finally have clarity.
The One Big Beautiful Bill Act created a tax deduction for qualified passenger vehicle loan interest, and the IRS final rule explains how it works, including the new lender reporting obligation.
Both the vehicle and the loan must qualify, and the deduction applies only to loans incurred after December 31, 2024. The vehicle must be:
An FI that receives $600 or more of interest on a specified passenger vehicle loan from an individual in a calendar year must file an information return with the IRS and furnish a statement to the borrower. The return captures the payor, the interest received, beginning principal, the origination date, and the vehicle's year, make, model, and VIN. The borrower statement carries most of the same items, plus lender contact information and a legend noting that the borrower may not be able to deduct the full amount reported.
The IRS released the statement after the final rule. Ncomply users can find the form attached to the rule under ‘Reg Updates.’
In the final rule, Treasury declined to adopt safe harbors for determining whether a vehicle qualifies and to let lenders report interest on all vehicle loans. It also declined to provide additional transition relief. Lenders will need the data to make these determinations, including for refinanced loans. Other details to flag:
Confirm your systems can capture VIN, original-use status, and personal-use information, and plan your Form 1098-VLI process, since penalties can apply for incorrect or missing returns and statements. Borrower statements are due January 31, and the IRS return is due February 28 on paper or March 31 if filed electronically.
Related: Vehicle Interest Reporting Requirements: What Auto Lenders Need to Know
Smaller banks now have a higher asset ceiling for the extended examination cycle.
The Federal Reserve, OCC, and FDIC jointly issued an interim final rule implementing section 903 of the 21st Century ROAD to Housing Act, which raises the asset threshold for the 18-month on-site examination cycle from $3 billion to $6 billion. The rule also makes conforming changes that extend the same threshold to U.S. branches and agencies of foreign banks.
Only the asset threshold has changed, so not every institution under $6 billion automatically moves to an 18-month cycle. A bank still needs to be well-capitalized and well-managed and to meet the same supervisory criteria that have always applied.
For banks that qualify, the benefit is more breathing room between examination cycles, with more time for risk management, strategic initiatives, and day-to-day operations.
Because this is an interim final rule, it’s in effect. The comment period remains open through October 14, so there's still time to weigh in.
Related: ROAD to Housing Act & CRA: What Changed for PWIs
The FDIC proposed changes to its state bank parity regulation, 12 CFR Part 331, which would allow state-chartered banks to claim the same protection from host-state laws that national banks have, even without a branch in the state.
Parity means treating a state-chartered bank the same as a national bank when it operates across state lines. Today, a state bank's branches in a host state (a state where the bank does business but didn't charter) don't have to comply with state laws preempted for national bank branches. The FDIC has historically read the rule to require a branch in that state, so a bank without one can't use parity.
The proposal drops the branch requirement. State laws on community reinvestment, consumer protection, fair lending, and intrastate branching would apply to an out-of-state state bank only to the same extent they apply to an out-of-state national bank.
With the proposal, the FDIC is moving back to legislative intent. Its position is that Congress wanted parity and that requiring a branch would push state banks to open one just to get the protection national banks get without it. However, the statute explicitly uses the term branch, so the rule may face litigation from states that don't want their laws preempted.
The trigger is Illinois' Interchange Fee Prohibition Act (IFPA). If the rule is finalized as proposed, it would preempt the IFPA for state-chartered banks not chartered in Illinois that operate in the state, though the proposal itself isn't a finding that any state law is preempted. Comments are due November 23.
Map where you operate without a branch and which host state laws you follow because of your charter, then flag the ones a national bank is exempt from. If your footprint includes Illinois, continue monitoring the litigation over its interchange fee law.
Related: How to Keep Up with State Regulations
Federal credit unions now have the same protection from Illinois' interchange fee law as national banks.
In Illinois Bankers Association v. Raoul, the court ruled that the IFPA, which restricts interchange fees on the sales tax and tip portion of transactions, can't be enforced against them. Earlier rulings had already enjoined enforcement against national banks and federal savings associations, as well as out-of-state state banks and payment card networks. Federal credit unions were the one group left out, but the NCUA changed that.
After the earlier rulings, the NCUA issued an interim final rule in June, modeled on the OCC's earlier final rule, that amends its preemption regulation. The new provision says federal credit unions may charge non-interest charges and fees, including interchange fees. The definition of “charge” includes fees received through intermediaries, payment networks, and other third parties.
The court based its decision on that provision and on the Federal Credit Union Act's incidental powers clause. If a credit union's coordination with third parties on fees is necessary to maintain its credit lines, the IFPA's prohibition on those fees obstructs that power.
Confirm how your charter type affects your exposure to the IFPA. Illinois-chartered state banks and state-chartered credit unions aren’t covered by the ruling, so they shouldn't assume the ruling applies to them. With federal agency preemption actions carrying real weight in this litigation, charter type is what determines whether Illinois can enforce its law.
The TPRM proposal and the CSBS framework ask the same thing of FIs: match your oversight to your risk, and keep the records that show how you got there. A documented vendor tier or an AI inventory lets an FI show how it reached its decisions.
Comments on the TPRM proposal are due November 16, and comments on state bank parity are due November 23, so the next few weeks are a good time to test your program against whichever applies to you. Compliance management software helps FIs keep up by breaking each new rule out individually, so you can route it to the right team.
Want a framework for judging whether your program can keep pace? Download our free guide, How to Build a Resilient Compliance Program.