Regulatory Commentary
2026 Supervisory Reset: What Mid-Sized Banks and Credit Unions Must Act On Before the Next Exam Cycle
May 15, 20264 min read
Between October 2025 and April 2026, the OCC, FDIC, and NCUA independently moved to a governance-driven supervisory model. The institutions that treat the lighter touch as relief, rather than as a sharper standard, will discover the shift the hard way.
Between October 2025 and April 2026, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) independently reshaped supervision for banks and credit unions. Narrower scope, fewer prescribed procedures, more examiner discretion. Most have read this as relief. That reading is incomplete. Regulators replaced a documentation-heavy, checklist-driven model with one that evaluates whether governance functions in practice. For mid-sized institutions in the $5 billion to $50 billion asset range, the exam your team prepared for last year no longer exists.
A parallel shift across three agencies
The OCC and FDIC jointly proposed narrowing what counts as an unsafe or unsound practice, and removed reputational risk as a standalone basis for supervisory criticism. Effective January 1, 2026, the OCC eliminated all policy-based examination activities not required by statute for community banks. The NCUA matched the move for federally insured credit unions: reputational risk removed, document request lists reduced, exam cycles extended to 24 months for well-managed institutions, eleven rounds of deregulation in 2026 alone. Three federal agencies, separate decisions, same philosophy. That convergence is the signal.
The governance consequence most institutions have not named
The old model was forgiving in a specific way. Extensive documentation could carry an institution through an exam cycle even if governance underneath was uneven. A well-organized binder could mask an inconsistently executed control environment. The replacement asks different questions: whether the board receives risk reporting that drives decisions, whether controls are tested against outcomes rather than procedures, whether issues trace to root cause and close with verifiable evidence. Fewer findings does not mean fewer risks. It means less margin for the ones that remain.
Where mid-sized institutions need to focus
Four areas deserve attention. Self-assessment credibility: institutions are now expected to act as their own first-line examiners. Evidence quality over volume: governance artifacts must connect policy to operations, with Federal Financial Institutions Examination Council (FFIEC) expectations now serving as a pass-fail test. Ownership and escalation: risk reporting must reach the board in a form that enables action, not merely awareness. Issue closure discipline: examiners will test the full chain, from identification through root cause to documented evidence of closure.
The window is the comment period, not the final rule
Final rules have not been issued. The Basel III Endgame re-proposal comment period runs through June 18, 2026. By the time a final rule is published, your next exam cycle may already be underway. Treat the comment period itself as the planning window. Conduct a governance self-assessment against the new expectations, not the old checklist. Inventory your evidence. Brief the board: governance maturity, not documentation volume, will determine the tone of the next examination.
Back to all insights