October 2026 Financial Reporting, Governance, and Risk Management
Message from Mandi Simpson, Partner, Advisory, Crowe Advisory LLC
Dear FIEB readers,
We hope the start of fall is treating you well. Recent earnings reports from some of the nation’s largest banks point to continued strength in consumer spending, lending activity, and overall credit quality, even as industry leaders acknowledge uncertainty around inflation, interest rates, and the impact of AI. With the next Federal Open Market Committee meeting just around the corner on Oct. 27-28, these issues remain top of mind for financial institution leaders. In this month’s briefing, we highlight important regulatory developments, including proposed changes to third-party risk management guidance, examination cycles, and the emerging framework for digital assets and other matters that are relevant to the industry.
I want to take this opportunity to recognize Sydney Garmong, who has shared her insights and perspective with FIEB readers for many years. Sydney has made a tremendous impact on Crowe, our profession, and me personally. Her leadership, deep knowledge of the industry, and commitment to our clients and colleagues have made a lasting difference, and I'm grateful for the opportunity to have worked alongside her.
Finally, I’d like to extend an invitation to join us at one of our upcoming Crowe Financial Services Year-End Conferences, taking place in six locations across the country in November and December. These conferences offer 10 hours of bank-specific CPE, timely accounting and regulatory updates, and an opportunity to connect with peers and Crowe professionals to exchange perspectives on the issues facing financial institutions. Our team looks forward to the opportunity to connect with you. We hope to see you there.
Fed supervision vice chair outlines efforts to modernize bank regulation and supervision
On Oct. 6, 2026, at the 2026 Community Banking Research Conference, Federal Reserve (Fed) Vice Chair for Supervision Michelle Bowman addressed ongoing efforts to modernize the regulatory and supervisory framework, with an emphasis on reducing regulatory burden for community banks and focusing supervision on material financial risks. Bowman highlighted initiatives to update and index outdated asset thresholds; streamline regulatory reporting; revise the capital, asset quality, management, earnings, liquidity, and sensitivity to market risk ratings (CAMELS) rating system; and improve the bank merger review process. She also announced a restructuring of the Fed’s supervisory function into five geographic regions to strengthen accountability, clarify decision-making authority, and improve coordination with state regulators. Bowman emphasized that supervisory examinations should prioritize risks that could materially affect an institution’s financial condition rather than procedural compliance.
Banking agencies and NCUA propose revised third-party risk management guidance
On Sept. 11, 2026, the Fed, Federal Deposit Insurance Corp. (FDIC), National Credit Union Administration (NCUA), and Office of the Comptroller of the Currency (OCC) requested comment on proposed guidance for managing risks associated with third-party relationships. The proposed guidance would emphasize a principles-based approach that allows banks and credit unions to tailor risk management practices based on the magnitude and likelihood of potential harm associated with individual relationships. The banking agencies also issued a statement addressing supervision of certain services offered by core providers to community banking organizations.
The proposal could provide institutions with greater flexibility to allocate third-party risk management resources based on actual risk rather than applying uniform processes across relationships. Banks and credit unions should consider how their current due diligence, monitoring, governance, and documentation practices align with the proposed risk-based approach. Comments are due Nov. 16, 2026.
Banking agencies expand eligibility for 18-month examination cycle
On Sept. 10, 2026, the Fed, FDIC, and OCC issued an interim final rule increasing the asset threshold for certain institutions eligible for an 18-month on-site examination cycle from $3 billion to $6 billion. The change applies to qualifying institutions that meet existing capital, management, and other eligibility requirements and is intended to reduce regulatory burden for community banks.
The change could reduce examination burden and related preparation costs for community banks that become eligible for the longer cycle. Qualifying institutions should consider how the extended examination schedule affects examination planning while continuing to maintain appropriate monitoring and readiness between examinations.
CSBS releases artificial intelligence supervisory framework
On Sept. 16, 2026, the Conference of State Bank Supervisors (CSBS) released an Artificial Intelligence Supervisory Framework to help state financial regulators identify and assess risks associated with AI use at financial institutions. The framework provides a risk-based approach that considers an institution’s size, complexity, risk profile, and AI activities. It includes examination guidance addressing AI governance and oversight, AI inventories and use cases, generative AI, third-party and vendor risk, model risk, and consumer protection. The framework draws on existing resources, including the National Institute of Standards and Technology’s AI Risk Management Framework, and is intended to support supervisory assessments rather than establish new regulatory requirements. Individual state regulators will determine whether and how to incorporate the framework into their supervisory programs.
FinCEN and federal financial institution regulators clarify use of digital credentials for customer identification
On Sept. 8, 2026, the Financial Crimes Enforcement Network (FinCEN), Fed, FDIC, NCUA, and OCC issued FAQs addressing the use of state-issued mobile driver’s licenses and other government-issued verifiable digital credentials under the Customer Identification Program rule. The FAQs clarify how institutions may use digital credentials as a documentary method of identity verification and update prior guidance addressing electronic credentials.
The guidance could support institutions considering mobile driver’s licenses and other digital identity technologies as part of customer onboarding. Banks and credit unions adopting these credentials should consider how their verification processes, policies, and controls continue to provide a reasonable belief that they know the true identity of each customer.
FDIC announces conclusion of independent monitorship
On Sept. 30, 2026, the FDIC announced the conclusion of an independent monitorship established to oversee the agency’s implementation of workplace culture reforms. The FDIC reported substantial changes to its leadership, employee misconduct investigation and accountability processes, and workplace culture practices. The agency also indicated that it had fully implemented all recommendations from the FDIC Office of Inspector General’s 2024 workplace culture audits, with those recommendations formally closed.
FDIC proposes reforms to bank merger review process
On Sept. 22, 2026, the FDIC published a proposed rule to modernize its framework for reviewing and approving merger transactions under the Bank Merger Act. The proposal would establish streamlined filing requirements and expedited processing timelines based on transaction size and risk, including a simplified filing process with deemed approval for qualifying de minimis transactions. It also would revise competitive effects analyses to account for credit union shares and centrally booked deposits, clarify the treatment of mergers in substance and significant asset transfers, and codify the FDIC’s approach to evaluating statutory merger factors. The proposed changes are intended to reduce regulatory burden, improve transparency, and provide greater certainty in the merger approval process.
The proposal could facilitate bank consolidation by reducing application complexity, shortening regulatory review timelines, and increasing predictability for institutions pursuing mergers and acquisitions. Banks considering strategic transactions should evaluate how the proposed changes could affect merger planning, competitive analyses, regulatory filings, and transaction timelines. Comments are due Nov. 23, 2026.
OCC releases report on large banks’ debanking activities
On Oct. 14, 2026, the OCC released a report detailing findings from its supervisory review of debanking activities at the nine largest national banks it supervises. The OCC found that all nine banks maintained policies between 2020 and September 2025 that could restrict access to financial services based on customers’ political or religious beliefs or lawful business activities. The review identified broad reputation risk policies lacking objective, risk-based criteria as well as restrictions affecting certain industries, including energy, firearms, tobacco, and digital assets. The OCC indicated that it is considering additional regulatory and supervisory changes to address improper debanking practices.
OCC updates guidance on concentrations of credit
On Sept. 30, 2026, the OCC issued an updated “Concentrations of Credit” booklet of the Comptroller’s Handbook. The revised booklet provides additional discussion of risks associated with credit concentrations, clarifies the relationship between correlations and concentrations, adds information about securitizations, and provides greater clarity regarding risk management practices for institutions with different sizes, complexities, and risk profiles.
The update is relevant to banks with significant exposure to particular borrowers, industries, geographic areas, or other correlated risks. Banks should consider the revised booklet when evaluating concentration limits, aggregate risk, monitoring practices, and examination readiness.
OCC updates cybersecurity supervision work program
On Sept. 21, 2026, the OCC updated its Cybersecurity Supervision Work Program, which examiners use to assess cybersecurity risk at national banks and federal savings associations. The revised program updates its structure and references to align with the National Institute of Standards and Technology Cybersecurity Framework and other existing supervisory guidance. The OCC did not add or change examination procedures.
Although the update does not establish new regulatory expectations, it provides banks with additional context regarding how OCC examiners might approach cybersecurity preparedness during risk-based examinations. The OCC noted that banks are not expected to use the work program to assess their own cybersecurity preparedness.
FinCEN withdraws proposed digital asset rules
On Oct. 5, 2026, FinCEN withdrew two proposed rules that would have imposed additional requirements involving certain digital assets. One proposal would have established recordkeeping, verification, and reporting requirements for certain convertible virtual currency transactions involving unhosted wallets, while the other would have imposed a special measure involving convertible virtual currency mixing. FinCEN said it considered comments received on the proposals and withdrew them as part of efforts to ensure digital asset regulations are fit for purpose.
The withdrawals remove two potential sources of additional Bank Secrecy Act (BSA)/anti-money laundering compliance requirements for institutions involved with digital assets. Existing BSA obligations remain applicable, but institutions will not need to prepare for the specific reporting, verification, and special measure requirements contemplated by the proposals.
FinCEN targets sanctions evasion network used by Iran
On Oct. 1, 2026, FinCEN proposed a rule that would prohibit certain transmittals of funds involving sub-agents of the A7 Network, a shadow banking network with ties to Russia that the U.S. Department of the Treasury (Treasury) says has been used by Iran to evade sanctions. FinCEN also issued an alert to help financial institutions detect and report suspicious activity related to the network, while the Office of Foreign Assets Control separately sanctioned the A7 Network as a significant transnational criminal organization.
The action is particularly relevant for institutions with correspondent banking, cross-border payments, or other international exposure. Financial institutions should consider the alert and proposed restrictions when evaluating transaction monitoring, sanctions screening, and potential direct or indirect exposure to the network.
FinCEN highlights healthcare fraud risks
On Sept. 9, 2026, FinCEN issued a Financial Trend Analysis identifying approximately $17.5 billion in suspicious financial activity potentially related to healthcare fraud. The analysis draws on BSA reporting and highlights financial patterns associated with suspected schemes involving healthcare providers and other participants.
The analysis could help institutions identify potentially suspicious transactions involving healthcare fraud and reinforces FinCEN’s continued focus on fraud-related BSA reporting. Institutions with significant healthcare payments or exposure to healthcare providers should consider the analysis when evaluating transaction monitoring and suspicious activity investigations.
Fed supervision vice chair highlights initial effects of eSLR changes
On Oct. 1, 2026, Bowman discussed the initial effects of recent changes to the enhanced supplementary leverage ratio (eSLR). Bowman said supervisory data indicate that the recalibration has increased large bank balance sheet capacity and Treasury positions, with dealer Treasury holdings increasing from approximately $600 billion at the beginning of the modification period to more than $700 billion at the end of April. She said the early results suggest the changes have improved Treasury market functioning and resilience by reducing regulatory balance sheet constraints.
The remarks provide an early indication of how the Fed is evaluating the effects of its recent capital reforms and reinforce its broader emphasis on reviewing regulations for unintended consequences. For large banks, the comments also highlight the relationship between capital requirements, balance sheet capacity, and participation in Treasury and other low-risk markets.
Fed finalizes changes to stress-testing framework
On Sept. 30, 2026, the Fed finalized changes intended to increase transparency in its supervisory stress-testing program and reduce volatility in stress-test-related capital requirements. Beginning in 2028, the Fed will average results from the two most recent annual supervisory stress tests when calculating stress capital buffer requirements for firms tested in both years. The Fed expects the changes to reduce year-over-year volatility in capital requirements by approximately 50% without materially affecting aggregate capital requirements.
For large banking organizations, the changes could make stress capital buffer requirements more predictable while providing greater visibility into the Fed’s stress-testing methodology. Institutions subject to the framework should consider the revised process and timing as part of capital planning and stress-testing activities.
Fed proposes regulatory framework for payment stablecoin issuers
On Sept. 24, 2026, the Fed requested comment on two proposals implementing its responsibilities under the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act. One proposal would establish reserve assets, capital, risk management, safekeeping, and other requirements for Board-supervised payment stablecoin issuers and clarify permissible stablecoin activities for Board-supervised banks. The second would establish an application process for Board-supervised banks seeking approval to issue payment stablecoins through a subsidiary.
The proposals represent an important step in establishing a regulatory framework for banks seeking to participate in payment stablecoin activities. Institutions considering stablecoin issuance or related services should monitor the proposals as they evaluate governance, risk management, compliance, and other requirements associated with potential digital asset activities. Comments are due Nov. 30, 2026.
NCUA reports continued credit union asset and loan growth
On Sept. 14, 2026, the NCUA released second-quarter 2026 credit union system performance data. Total assets at federally insured credit unions increased 5% from a year earlier to $2.50 trillion, while loans increased 4.9% to $1.76 trillion and insured shares and deposits increased 4.3% to $1.91 trillion. The delinquency rate increased six basis points from a year earlier to 0.96%, while the net charge-off ratio was little changed at 0.78%.
The results reflect continued balance sheet and lending growth across the credit union system while indicating some increase in credit pressure. Credit unions should continue to monitor delinquency trends, portfolio performance, and liquidity as loan and deposit growth evolve.
Guidance on residential mortgage servicing rights recapture
On Sept. 23, 2026, the FASB issued a proposed Accounting Standards Update (ASU), “Transfers and Servicing – Servicing Assets and Liabilities (Subtopic 860-50): Mortgage Servicing Rights – Recapture.” The proposal would require entities to include the effects of recapture when measuring residential mortgage servicing rights (MSRs) by specifying that the measurement should reflect all rights and obligations associated with the servicing contract. Recapture refers to a servicer’s ability to solicit a borrower to refinance an existing mortgage loan and retain the servicing rights on the new loan.
The proposal would apply to all entities that recognize residential MSRs and could affect valuation models, assumptions, controls, and impairment assessments at banks, mortgage companies, and other mortgage servicers. It would not change the existing amortization guidance or apply to servicing assets and liabilities other than residential MSRs. Comments are due Nov. 9, 2026.
FASB adds project on participating interest guidance
At its Sept. 16, 2026, board meeting, the FASB added a project to its technical agenda to address diversity in practice related to applying the participating interest guidance in Topic 860, “Transfers and Servicing.” That guidance is used in determining whether the transfer of a portion of a financial asset can qualify for sale accounting rather than being reported as a secured borrowing.
The project could be particularly relevant to banks and other financial institutions that originate, sell, or purchase participations in loans and other financial assets. The FASB has not yet proposed specific amendments and the addition of the project does not change current generally accepted accounting principles.
FASB addresses portfolio layer method project for financial liabilities
At its Sept. 23, 2026, board meeting, the FASB decided that the scope of its project on extending the portfolio layer method would include financial liabilities. The existing portfolio layer method allows entities to apply fair value hedge accounting to layers of certain closed portfolios of financial assets. The board directed the staff to further analyze the expected costs and benefits of extending the method to financial liabilities.
The project could be particularly relevant to banks that manage interest rate risk on portfolios of financial liabilities because it might eventually provide a hedge accounting approach that better aligns with common asset-liability management practices. The project remains in board deliberations and does not change current hedge accounting requirements.
SEC staff updates retail voting program guidance
On Oct. 8, 2026, the Division of Corporation Finance (CorpFin) added two new Corporation Finance Interpretations focusing retail voting programs toward its guidance on the federal proxy rules. The interpretations address the types of standing voting instructions a company may offer and considerations for programs that allow votes to be cast according to third-party recommendations.
SEC chief economist discusses information in the age of AI
On Sept. 17, 2026, SEC Chief Economist and Division of Economic and Risk Analysis Director Joshua White spoke about the growing use of artificial intelligence to access and analyze financial information. He emphasized that AI increases the importance of structured, consistent, and reliable data, while noting that advances in processing technology do not eliminate the costs of producing and verifying disclosures or lessen the importance of materiality. He also encouraged market participants to provide detailed information through the comment process to support the SEC’s economic analysis of proposed rules.
SEC staff publishes crypto asset FAQs
On Sept. 25, 2026, the Division of Corporation Finance published frequently asked questions addressing the classification of crypto assets and related transactions. The FAQs also discuss circumstances in which a crypto asset may be subject to an investment contract and factors that may affect that analysis.
SEC publishes updated capital markets statistics
On Sept. 23, 2026, the Division of Economic and Risk Analysis published updated capital markets statistics. During the first half of 2026, 208 initial public offerings raised more than $137 billion, compared with 180 offerings raising more than $27 billion during the same period in 2025. In addition, 557 follow-on registered offerings raised more than $111 billion, compared with 505 offerings raising nearly $84 billion in the first half of 2025.
SEC proposes two amendments to expand retail access to private markets
On Sept. 30, 2026, the SEC proposed two sets of amendments intended to expand retail access to private market investment strategies through regulated funds. The first proposal would broaden the circumstances in which registered investment advisers may receive performance-based compensation from certain clients, including regulated funds, and require related disclosures on fund registration and reporting forms. The second proposal would modernize the interval fund framework, including by allowing repurchase schedules that better align with a fund’s portfolio liquidity. It also would replace existing exemptive orders with a rules-based framework permitting regulated closed-end funds to offer multiple share classes.
The SEC also requested comments on additional pathways for individuals to qualify as accredited investors. Comments are due Dec. 4, 2026, for the Interval Fund Modernization proposal and Dec. 7, 2026, for the Investment Adviser Performance-Based Compensation Modernization proposal.
SEC proposes crypto asset custody framework
On Oct. 1, 2026, the SEC proposed new rules and amendments establishing a tailored framework for registered investment advisers and regulated funds to custody crypto assets. The proposal would permit self-custody under specified circumstances, allow qualifying state-chartered trust companies to serve as custodians, and update certain audit and broker-dealer custody requirements. Commissioner Mark Uyeda described the proposal as providing a workable compliance path while retaining safeguards such as asset segregation, cybersecurity protections, annual reviews, internal reporting, account statements, and client disclosures.
Comments on the proposal are due Dec. 7, 2026.
SEC proposes expanded cross trading by registered funds
On Oct. 9, 2026, the SEC proposed amendments to Rule 17a-7, the Investment Company Act cross-trading rule, which permits certain securities transactions between registered funds and their affiliates. The amendments would allow most fixed-income securities to be cross traded again, update pricing and oversight requirements, and add aggregate reporting for funds that engage in cross trading.
Comments on the proposal are due Dec. 14, 2026.
SEC chair discusses preparations for 24-hour trading
On Sept. 17, 2026, SEC Chair Paul Atkins addressed a roundtable on preparations for expanding 24-hour trading in U.S. equity markets. Atkins discussed possible benefits, including broader global access, improved liquidity, and the ability of investors to respond more quickly to market developments, while emphasizing the need for resilient infrastructure and investor protections during overnight hours. He also requested feedback on the potential effects on public-company corporate actions, dissemination of material information, and SEC filings during current EDGAR operating hours.
SEC issues temporary exemption for tokenized stock trading
On Sept. 17, 2026, the SEC issued temporary, conditional exemptive relief allowing qualifying Tokenized Securities Venues (TSV) to facilitate trading in tokenized National Market System stocks through permissioned automated market makers and liquidity pools. The relief includes conditions addressing trading limits, equivalent shareholder rights, issuer notice, smart contract transparency, trading halts, and public disclosures.
The exemptions are set to expire five years after publication, and the SEC requested comment on possible modifications and next steps.
SEC publishes examination handbook
On Oct. 1, 2026, the Division of Examinations published “The SEC Exam Handbook: A Practical Guide on Process and Engagement,” replacing and expanding upon its prior examination brochure. The handbook describes the examination process from initial risk assessment through the disposition letter and provides practical information on preparing for an examination, communicating with staff, and submitting feedback.
SEC amends quorum rule as commissioner departs
On Sept. 30, 2026, shortly before Commissioner Hester Peirce’s departure, the SEC adopted amendments to its quorum rule to help ensure the commission can continue conducting business when there are fewer than three commissioners. Three commissioners generally will continue to constitute a quorum. However, when only one or two commissioners are in office, or when recusals or other disqualifications leave only one or two commissioners able to consider a particular matter, the available commissioners may constitute a quorum. The amendments became effective Oct. 2, 2026.
On Oct. 1, 2026, Atkins and Uyeda issued a statement recognizing Peirce’s departure. Peirce served as an SEC commissioner beginning in 2018, following prior service on the SEC staff from 2000 to 2008, and most recently led the agency’s Crypto Task Force.
PCAOB updates standard-setting, research, and rulemaking agendas
On Sept. 30, 2026, the PCAOB updated its standard-setting, research, and rulemaking agendas following its first public comment period focused specifically on those agendas and processes. The updated standard-setting agenda includes projects involving negative assurance related to comfort letter engagements, auditor independence, fraud, noncompliance with laws and regulations, and going concern. Research projects address data and technology, firm and engagement performance metrics, and communications with audit committees, while the rulemaking agenda includes a permanent broker-dealer inspection program.
The PCAOB also said it plans to develop a conceptual framework for its standard-setting process. Although the updated agendas do not establish new requirements, they identify matters that could shape future auditing standards and affect audit firms, public financial institutions, and their audit committees.
AI use in SOC examinations
On Sept. 11, 2026, the AICPA issued nonauthoritative technical questions and answers addressing how a service organization’s use of artificial intelligence affects System and Organization Controls (SOC) 1 examinations performed under clarified attestation standards (AT-C) Section 320 and SOC 2 examinations performed under AT-C Section 205. The guidance could be relevant as financial institutions evaluate service-provider controls and AI-related third-party risks.
Implementation resource for new group audit standard
On Sept. 11, 2026, the AICPA published an implementation resource intended to help practitioners determine when an engagement constitutes a group audit under Statement on Auditing Standards (SAS) No. 149, “Special Considerations – Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors).” SAS No. 149 is effective for audits of group financial statements for periods ending on or after Dec. 15, 2026. Therefore, audits of calendar-year 2026 group financial statements will be required to apply the standard.
The resource could be relevant to audits of nonissuer financial institutions with subsidiaries, branches, shared-service arrangements, or other components, particularly when component or referred-to auditors participate in the engagement. The publication is an implementation resource and does not establish requirements beyond SAS No. 149.
AICPA issues practice aid on AI considerations for financial statement auditors
On Oct. 11, 2026, the AICPA released a nonauthoritative practice aid, “Artificial Intelligence (AI) Considerations for Financial Statement Auditors.” The resource addresses how an entity’s use of AI may affect financial reporting, the auditor’s risk assessment, and the appropriate audit response. It also provides considerations for auditors incorporating AI tools into audit procedures while continuing to comply with applicable professional standards.
The practice aid could be relevant to audits of financial institutions as AI becomes more integrated into business processes, internal controls, financial reporting, and audit execution, but it does not establish new auditing requirements.
CAQ comments on PCAOB draft strategic plan
On Sept. 4, 2026, the CAQ submitted a comment letter on the PCAOB’s draft goals and objectives for its 2026-2030 strategic plan. The CAQ supported the proposed plan and recommended that the board focus on organizational culture, professional development, and expertise; effective execution, prioritization, and coordination with the SEC; continued modernization of inspections and inspection reporting; and an enhanced role for the PCAOB’s Office of the Chief Auditor in standard-setting, implementation support, and interpretation.
The letter reflects the CAQ’s continued emphasis on a focused and transparent PCAOB oversight framework and on providing audit firms and other stakeholders with clear and timely implementation support.
Portions of AICPA materials reprinted with permission. Copyright 2026 by AICPA.
FASB materials reprinted with permission. Copyright 2026 by Financial Accounting Foundation, Norwalk, Connecticut. Copyright 1974-1980 by American Institute of Certified Public Accountants.
Contact us
Related insights
