2019-20610. Removal of Transferred OTS Regulations Regarding Regulatory Reporting Requirements, Regulatory Reports and Audits of State Savings Associations

AGENCY:

Federal Deposit Insurance Corporation.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

In this notice of proposed rulemaking (proposal or proposed rule), the Federal Deposit Insurance Corporation (FDIC) proposes to rescind and remove from the Code of Federal Regulations 12 CFR part 390, subpart R, entitled Regulatory Reporting Standards (part 390, subpart R).

DATES:

Comments must be received on or before November 1, 2019.

ADDRESSES:

You may submit comments by any of the following methods:

• FDIC website: https://www.fdic.gov/​regulations/​laws/​federal/​. Follow instructions for submitting comments on the agency website.
• Email: [e-mail]. Include RIN 3064-AF13 on the subject line of the message.
• Mail: Robert E. Feldman, Executive Secretary, Attention: Comments, Federal Deposit Insurance Corporation, 550 17th Street NW, Washington, DC 20429.
• Hand Delivery to FDIC: Comments may be hand-delivered to the guard station at the rear of the 550 17th Street building (located on F Street) on business days between 7 a.m. and 5 p.m.
• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.

Please include your name, affiliation, address, email address, and telephone number(s) in your comment. All statements received, including attachments and other supporting materials, are part of the public record and are subject to public disclosure. You should submit only information that you wish to make publicly available.

Please note: All comments received will be posted generally without change to https://www.fdic.gov/​regulations/​laws/​federal/​,, including any personal information provided.

FOR FURTHER INFORMATION CONTACT:

Christine M. Bouvier, Assistant Chief Accountant, [phone], [e-mail], Division of Risk Management Supervision; Karen J. Currie, Senior Examination Specialist, [phone], Division of Risk Management Supervision; David M. Miles, Counsel, Legal Division, [phone].

SUPPLEMENTARY INFORMATION:

I. Policy Objectives

The policy objectives of the proposed rule are twofold. The first is to simplify the FDIC's regulations by removing unnecessary ones and thereby improving ease of reference and public understanding. The second is to promote parity between State savings associations and State nonmember banks by having the regulatory reporting requirements, regulatory reports and audits of both classes of institutions addressed in the same FDIC rules.

II. Background

A. The Dodd-Frank Act

The Dodd-Frank Act, signed into law on July 21, 2010, provided for a substantial reorganization of the regulation of State and Federal savings associations and their holding companies.^[1] Beginning July 21, 2011, the transfer date established by section 311 of the Dodd-Frank Act,^[2] the powers, duties, and functions formerly performed by the OTS were divided among the FDIC, as to State savings associations, the Office of the Comptroller of the Currency (OCC), as to Federal savings associations, and the Board of Governors of the Federal Reserve System (FRB), as to savings and loan holding companies. Section 316(b) of the Dodd-Frank Act ^[3] provides the manner of treatment for all orders, resolutions, determinations, regulations, and other advisory materials that have been issued, made, prescribed, or allowed to become effective by the OTS. The section provides that if such materials were in effect on the day before the transfer date, they continue in effect and are enforceable by or against the appropriate successor agency until they are modified, terminated, set aside, or superseded in accordance with applicable law by such successor agency, by any court of competent jurisdiction, or by operation of law.

Pursuant to section 316(c) of the Dodd-Frank Act,^[4] on June 14, 2011, the FDIC's Board of Directors (Board) approved a “List of OTS Regulations to be Enforced by the OCC and the FDIC Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act.” This list was published by the FDIC and the OCC as a Joint Notice in the Federal Register on July 6, 2011.^[5]

Although section 312(b)(2)(B)(i)(II) of the Dodd-Frank Act ^[6] granted the OCC rulemaking authority relating to both State and Federal savings associations, nothing in the Dodd-Frank Act affected the FDIC's existing authority to issue regulations under the Federal Deposit Insurance Act (FDI Act) ^[7] and other laws as the “appropriate Federal banking agency” or under similar statutory terminology. Section 312(c)(1) of the Dodd-Frank Act ^[8] revised the definition of “appropriate Federal banking agency” contained in section 3(q) of the FDI Act,^[9] to add State savings associations to the list of entities for which the FDIC is designated as the “appropriate Federal banking agency.” As a result, when the FDIC acts as the designated “appropriate Federal banking agency” (or under similar terminology) for State savings associations, as it does here, the FDIC is authorized to issue, modify, and rescind regulations involving such associations, as well as for State nonmember banks and State-licensed insured branches of foreign banks.

As noted above, on June 14, 2011, operating pursuant to this authority, the Board issued a list of regulations of the former OTS that the FDIC would enforce with respect to State savings associations. On that same date, the Board reissued and redesignated certain regulations transferred from the former OTS. These transferred OTS regulations were published as new FDIC regulations in the Federal Register on August 5, 2011.^[10] When the FDIC republished the transferred OTS regulations as new FDIC regulations, it specifically noted that its staff would evaluate the transferred OTS rules and might later recommend incorporating the transferred OTS regulations into other FDIC regulations, amending them, or rescinding them, as appropriate.^[11]

B. Transferred OTS Regulations (Transferred to the FDIC's Part 390, Subpart R)

A subset of the regulations transferred to the FDIC from the OTS concern regulatory reporting requirements, regulatory reports and audits of State savings associations. The OTS regulations, formerly found at 12 CFR part 562, now comprise 12 CFR part 390, subpart R. The provisions of part 390, subpart R, are discussed in Part III of this Supplementary Information section, below.

The FDIC has conducted a careful review and comparison of part 390, subpart R, and other FDIC regulations that pertain to regulatory reporting requirements (12 CFR part 304, 12 CFR part 363 and its Appendices A and B, and 12 CFR part 364 and its Appendix A), regulatory reports (12 CFR part 304 and 12 CFR part 308), and audits of insured depository institutions (12 CFR part 363 and its Appendices A and B and 12 CFR part 364 and its Appendix A) that already apply to State savings associations. As discussed in Part III of this Supplementary Information section, the FDIC proposes to rescind part 390, subpart R, because the FDIC considers it to be redundant or otherwise unnecessary given the applicability of these other FDIC regulations.

III. Comparison of the Transferred OTS Regulations Proposed for Removal With Other Applicable FDIC Regulations

A. Regulatory Reporting Requirements: State Savings Associations Must Maintain Business Records Supporting and Easily Reconciled to Their Regulatory Reports and GAAP Financial Statements and Must Use the Forms and Follow the Instructions of the FDIC in Preparing Regulatory Reports

1. Transferred OTS Regulation Currently at 12 CFR part 390.320

Section 390.320 imposes two requirements upon State savings associations designed to help maintain the integrity, accuracy, reliability and uniformity of key documents used by the FDIC for supervisory purposes. First, section 390.320(a) requires each State savings association to maintain accurate and complete records of its business transactions that support and are readily reconcilable to the association's regulatory reports and to financial reports prepared in accordance with generally accepted accounting principles (GAAP).^[12] Second, section 390.320(b) instructs each State savings association to prepare its regulatory reports using such forms and following such regulatory reporting requirements as the FDIC may require by regulation or otherwise.^[13]

2. Other FDIC Regulations

State savings associations are already subject to other FDIC regulations that achieve the purposes of section 390.320. For example, as recognized by section 304.3 of the FDIC's regulations, all insured depository institutions, including State savings associations, are required to file quarterly Consolidated Reports of Condition and Income (Call Reports). Under section 304.3(a), all insured depository institutions must prepare the Call Report in accordance with the instructions for the report (Call Report Instructions), which in turn require the institutions to maintain their business records in a manner that supports and reconciles to the contents of the Call Report.^[14] In addition, portions of the Call Report also are required to be prepared in accordance with GAAP.^[15] Furthermore, all insured depository institutions, including State savings associations, with total assets of $500 million or more at the beginning of their respective fiscal year (“covered institutions”) must prepare annual financial statements in accordance with GAAP, which must be submitted to the FDIC, the appropriate Federal banking agency for the institution (if not the FDIC) and the appropriate State bank supervisor if applicable.^[16]

In addition, all State savings associations and other FDIC-supervised institutions are subject to 12 CFR part 364 (including its Appendix A).^[17] This part requires FDIC-supervised institutions to have internal controls and information systems that are appropriate to their size and the risks posed by their activities and that provide for, among other things: “timely and accurate financial, operational and regulatory reports.” ^[18] Because accurate and complete business records are the very foundation of accurate regulatory and financial reporting, State savings associations must, therefore, maintain accurate and complete records of their business transactions supporting and readily reconcilable to the associations' regulatory and financial reports. In the event an FDIC-supervised institution fails to create and maintain the required internal controls and information systems, the FDIC may require the institution to submit a safety and soundness plan designed to correct the deficiencies and, if necessary, compel compliance by means of order.^[19]

In addition, existing FDIC regulations also require State savings associations and other FDIC-supervised institutions to use the forms and follow the instructions of the FDIC in preparing and submitting their regulatory reports. For example, section 304.3(a) of the FDIC's regulations requires all insured depository institutions, including State savings associations, to follow the Call Report Instructions in preparing their Call Reports.^[20] Moreover, it is difficult to see how an institution could fail to comply with relevant instructions governing regulatory reports and yet still file a timely, accurate and complete report in accordance with the explicit or implicit requirements of the governing statute or regulation.

B. Regulatory Reports: State Savings Associations Must Prepare Regulatory Reports Using GAAP and Safe & Sound Practices

1. Transferred OTS Regulation Currently at 12 CFR Part 390.321

The transferred OTS regulation found at 12 CFR 390.321(b)(1) provides a framework of “regulatory reporting requirements” governing the preparation of regulatory reports by State savings associations. Such requirements must, at a minimum, incorporate GAAP whenever called for; incorporate applicable safe and sound practices specified in the report instructions and other FDIC publications; and incorporate such additional safety and soundness requirements more stringent than GAAP as the FDIC may prescribe.^[21] If the FDIC determines that a State savings association's regulatory reports for previous reporting periods are not in compliance, the association must correct the reports in accordance with the directions of the FDIC.^[22]

2. Other FDIC Regulations

A similar framework is embodied in other applicable FDIC regulations. For example, 12 CFR part 304 requires all insured depository institutions to prepare their Call Reports in accordance with the Call Report Instructions. The Call Report Instructions, published by the Federal Financial Institutions Examination Council (FFIEC), contain uniform reporting requirements that the Federal banking agencies, including the FDIC, have determined to be consistent with GAAP and other regulatory reporting requirements.^[23] In the event of a failure by a State savings association to follow the Call Report Instructions, the FDIC is empowered to take enforcement action to obtain specified civil money penalties for as long as the violation remains uncorrected.^[24] The FDIC also may be able to seek a cease-and-desist order to prevent an impending or ongoing violation and to require corrective action to remedy violations in prior reporting periods.^[25]

C. Audits

1. Transferred OTS Regulation Currently at 12 CFR Part 390.322

The transferred OTS regulation currently found at 12 CFR 390.322 relates to audits of financial statements by qualified independent public accountants. This provision authorizes the FDIC, whenever needed for safety or soundness purposes, to require a State savings association to retain a qualified independent public accountant to conduct an independent audit of the association's financial statements.^[26]

2. Other FDIC Regulations

Other FDIC requirements applicable to all insured depository institutions serve the underlying purposes of section 390.322. For example, as noted previously, all FDIC-supervised institutions, including State savings associations, are required by part 364 Appendix A to maintain internal controls that provide for “timely and accurate financial, operational and regulatory reports” along with an internal audit system that provides for adequate monitoring of the internal controls system.^[27] In the event an FDIC-supervised institution fails to create and maintain the required internal controls and information systems, the FDIC may require the institution to submit a safety and soundness plan designed to correct the deficiencies and, if necessary, compel compliance by means of order.^[28] The FDIC has the ability, pursuant to its examination and safety and soundness authority, to obtain records and reports from State savings associations.^[29] In addition, through the safety and soundness plan, the FDIC may request an independent audit of a State savings association.^[30] If the State savings association does not provide an acceptable plan to the FDIC and implement it, the FDIC may be able to require such audit pursuant to a safety and soundness order if such measures relate to identified safety and soundness deficiencies.

In addition, insured depository institutions are required by law to file Call Reports that are free from false or misleading information and the FDIC is empowered to take enforcement action in the event that an institution fails to do so. In the event a State savings association's financial statements do not accurately reflect the association's financial condition or results of operations, the inaccuracy is likely to flow from the financial statements into the Call Report, in contravention of the Call Report Instructions. If a State savings association's Call Report contains such a material inaccuracy, the FDIC can require the savings association to amend its Call Report to correct that material inaccuracy and, depending on the facts and circumstances, the correction may necessitate the revision of the savings association's financial statements. If a savings association refuses to make a required amendment to its Call Report, the FDIC may be able to seek a cease-and-desist order to require corrective action to remedy violations in prior reporting periods.^[31] In addition, the FDIC is empowered to obtain specified civil money penalties for as long as the problems remain uncorrected.^[32]

In addition, the FDIC's regulations independently impose audit requirements for many institutions, including several State savings associations. For example, 12 CFR part 363 requires covered institutions (those with $500 million or more in assets) each year to submit annual financial statements that have been prepared in accordance with GAAP and have been audited by an independent public accountant.^[33]

IV. Proposed Amendments to Part 390, Subpart R

As discussed in Part III of this Supplementary Information, the FDIC's part 390 subpart R addresses regulatory reporting requirements, regulatory reports and audits. After reviewing the requirements in part 390, subpart R, the FDIC, as the appropriate Federal banking agency for State savings associations, proposes to rescind part 390, subpart R in its entirety. Rescinding part 390, subpart R will serve to streamline the FDIC's rules and eliminate redundant, duplicate or otherwise unnecessary regulations in light of other FDIC regulations that specifically govern these matters and apply to insured depository institutions, including State savings associations

V. Expected Effects

As explained in detail in Part III of this Supplementary Information section, certain OTS regulations transferred to the FDIC by the Dodd-Frank Act relating to regulatory reporting requirements, regulatory reports, and audits of State savings associations are redundant or unnecessary in light of applicable statutes and other FDIC regulations. This proposal would eliminate those transferred OTS regulations.

As of June 30, 2019, the FDIC supervises 3,424 depository institutions, of which 38 (1.1%) are State savings associations.^[34] The proposed rule would affect regulations that govern State savings associations.

As explained previously, the proposed rule would remove sections 390.320, 390.321 and 390.332 of part 390, subpart R because these sections are redundant of, or otherwise unnecessary in light of, applicable statutes and other FDIC regulations regarding audits, reporting, and safety and soundness. As a result, rescinding and removing these regulations will not have any substantive effects on State savings associations or FDIC-supervised institutions.

The FDIC invites comments on all aspects of this analysis. In particular, would the proposed rule have any costs or benefits to covered entities that the FDIC has not identified?

VI. Alternatives

The FDIC has considered alternatives to the proposed rule but believes that the proposed amendments represent the most appropriate option for covered entities. As discussed previously, the Dodd-Frank Act transferred certain powers, duties, and functions formerly performed by the OTS to the FDIC. The FDIC's Board reissued and redesignated certain transferred regulations from the OTS, but noted that it would evaluate them and might later incorporate them into other FDIC regulations, amend them, or rescind them, as appropriate. The FDIC has evaluated the existing regulations relating to regulatory reporting standards and audits of insured depository institutions, including 12 CFR part 304; 12 CFR part 308; 12 CFR part 363 and its Appendices A and B; 12 CFR part 364 and its Appendix A; and 12 CFR part 390, subpart R. The FDIC considered the status quo alternative of retaining the current regulations but did not choose to do so because the underlying purposes of those regulations are already accomplished through substantively similar regulations regarding regulatory reports, regulatory reporting requirements, and audits. Therefore, the FDIC is proposing to amend and streamline the FDIC's regulations.

VII. Request for Comments

The FDIC invites comments on all aspects of this proposed rulemaking. In particular, the FDIC requests comments on the following questions:

1. Are the statutes and FDIC rules and regulations discussed in this Supplementary Information section sufficient to provide consistent and effective requirements relating to regulatory reporting requirements, regulatory reports and audits of State savings associations for which the FDIC is the appropriate Federal banking agency? Please provide examples, data, or otherwise substantiate your answer.

2. What negative impacts, if any, can you foresee in the FDIC's proposal to rescind part 390, subpart R?

3. Please provide any other comments you have on the proposal.

Written comments must be received by the FDIC no later than November 1, 2019.

VIII. Regulatory Analysis and Procedure

A. The Paperwork Reduction Act

In accordance with the requirements of the Paperwork Reduction Act of 1995 (PRA),^[35] the FDIC may not conduct or sponsor, and the respondent is not required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number.

The proposed rule would rescind and remove from FDIC regulations part 390, subpart R. The proposed rule will not create any new or revise any existing collections of information under the PRA. Therefore, no information collection request will be submitted to the OMB for review.

B. The Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA), requires that, in connection with a notice of proposed rulemaking, an agency prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of the proposed rule on small entities.^[36] However, a regulatory flexibility analysis is not required if the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities, and publishes its certification and a short explanatory statement in the Federal Register together with the rule. The Small Business Administration (SBA) has defined “small entities” to include banking organizations with total assets of less than or equal to $550 million.^[37] Generally, the FDIC considers a significant effect to be a quantified effect in excess of 5 percent of total annual salaries and benefits per institution, or 2.5 percent of total noninterest expenses. The FDIC believes that effects in excess of these thresholds typically represent significant effects for FDIC-supervised institutions. For the reasons provided below, the FDIC certifies that the proposed rule, if adopted in final form, would not have a significant economic impact on a substantial number of small banking organizations. Accordingly, a regulatory flexibility analysis is not required.

As of March 31, 2019,^[38] the FDIC supervised 3,465 insured financial institutions, of which 2,705 are considered small banking organizations for the purposes of RFA. The proposed rule primarily affects regulations that govern State savings associations. There are 35 State savings associations considered to be small banking organizations for the purposes of the RFA.^[39]

As explained previously, the proposed rule would remove sections 390.320, 390.321 and 390.332 of part 390, subpart R because these sections are redundant or otherwise unnecessary in light of applicable statutes and other FDIC regulations. As a result, rescinding the regulations would not have any substantive effects on small FDIC-supervised institutions.

Based on the information above, the FDIC certifies that the proposed rule would not have a significant economic impact on a substantial number of small entities.

4. The FDIC invites comments on all aspects of the supporting information provided in this RFA section. In particular, would this rule have any significant effects on small entities that the FDIC has not identified?

C. Plain Language

Section 722 of the Gramm-Leach-Bliley Act ^[40] requires each Federal banking agency to use plain language in all of its proposed and final rules published after January 1, 2000. As a Federal banking agency subject to the provisions of this section, the FDIC has sought to present the proposed rule to rescind part 390, subpart R in a simple and straightforward manner. The FDIC invites comments on whether the proposal is clearly stated and effectively organized, and how the FDIC might make the proposal easier to understand.

D. Riegle Community Development and Regulatory Improvement Act of 1994

Riegle Community Development and Regulatory Improvement Act of 1994 (“RCDRIA”) requires that each Federal banking agency, in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations. In addition, new regulations and amendments to regulations that impose additional reporting, disclosure, or other new requirements on insured depository institutions generally must take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form. The FDIC invites comments that further will inform its consideration of RCDRIA.

E. The Economic Growth and Regulatory Paperwork Reduction Act

Under section 2222 of the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA), the FDIC is required to review all of its regulations, at least once every 10 years, in order to identify any outdated or otherwise unnecessary regulations imposed on insured institutions.^[41] The FDIC, along with the other Federal banking agencies, submitted a Joint Report to Congress on March 21, 2017, (EGRPRA Report) discussing how the review was conducted, what has been done to date to address regulatory burden, and further measures that will be taken to address issues that were identified. As noted in the EGRPRA Report, the FDIC is continuing to streamline and clarify its regulations through the OTS rule integration process. By removing unnecessary regulations, such as part 390, subpart R, this rule complements other actions the FDIC has taken, separately and with the other Federal banking agencies, to further the EGRPRA mandate.

List of Subjects in 12 CFR Part 390

• Administrative practice and procedure
• Advertising
• Aged
• Civil rights
• Conflict of interests
• Credit
• Crime
• Equal employment opportunity
• Fair housing
• Government employees
• Individuals with disabilities
• Reporting and recordkeeping requirements
• Savings associations

For the reasons stated in the preamble, the Federal Deposit Insurance Corporation proposes to amend 12 CFR 390 as follows:

PART 390—REGULATIONS TRANSFERRED FROM THE OFFICE OF THRIFT SUPERVISION

1. Revise the authority citation for part 390 to read as follows:

Authority: 12 U.S.C. 1819.

Subpart F also issued under 5 U.S.C. 552; 559; 12 U.S.C. 2901 et seq.

Subpart G also issued under 12 U.S.C. 2810 et seq., 2901 et seq.; 15 U.S.C. 1691; 42 U.S.C. 1981, 1982, 3601-3619.

Subpart M also issued under 12 U.S.C. 1818.

Subpart O also issued under 12 U.S.C. 1828.

Subpart Q also issued under 12 U.S.C. 1462; 1462a; 1463; 1464.

Subpart S also issued under 12 U.S.C. 1462; 1462a; 1463; 1464; 1468a; 1817; 1820; 1828; 1831e; 1831o; 1831p-1; 1881-1884; 3207; 3339; 15 U.S.C. 78b; 78l; 78m; 78n; 78p; 78q; 78w; 31 U.S.C. 5318; 42 U.S.C. 4106.

Subpart T also issued under 12 U.S.C. 1462a; 1463; 1464; 15 U.S.C. 78c; 78l; 78m; 78n; 78w.

Subpart W also issued under 12 U.S.C. 1462a; 1463; 1464; 15 U.S.C. 78c; 78l; 78m; 78n; 78p; 78w.

Subpart Y also issued under 12 U.S.C. 1831o.

Subpart R—[Removed and Reserved]

2. Remove and reserve part 390, subpart R, consisting of §§ 390.320 through 390.322.

Federal Deposit Insurance Corporation.

By order of the Board of Directors.

Dated at Washington, DC, on September 17, 2019.

Robert E. Feldman,

Executive Secretary.

Footnotes

1.  Pub. L. 111-203, 124 Stat. 1376 (2010).

2.  Codified at 12 U.S.C. 5411.

3.  Codified at 12 U.S.C. 5414(b).

4.  Codified at 12 U.S.C. 5414(c).

5.  76 FR 39246 (July 6, 2011).

6.  Codified at 12 U.S.C. 5412(b)(2)(B)(i)(II).

7.  12 U.S.C. 1811 et seq.

8.  Codified at 12 U.S.C. 5412(c)(1).

9.  12 U.S.C. 1813(q).

10.  76 FR 47652 (Aug. 5, 2011).

11.  See 76 FR 47653.

12.  12 CFR 390.320(b). Subpart R defines the term “regulatory report” to mean “any report that the FDIC prepares, or is submitted to, or used by the FDIC, to determine compliance with its rules and regulations, and to evaluate the safe and sound condition and operations of State savings associations. Regulatory reports are regulatory documents, not accounting documents.” 12 CFR 390.321(a).

13.  12 CFR 390.320(b).

14.  See the section entitled “Preparation of the Reports” contained in the General Instructions portion of Call Report Instructions for the FFIEC 031, 041 and 051 Report Forms and the section entitled “Preparation of Information to be Reported” in the General Instructions portion of the Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks (FFIEC 002 Report Form).

15.  12 U.S.C. 1831(n); See the section entitled “Applicability of U.S. Generally Accepted Accounting Principles to Regulatory Reporting Requirements” contained in the General Instructions portion of Call Report Instructions for the FFIEC 031, 041 and 051 Report Forms and the section entitled “Accounting Basis” in the General Instructions portion of the FFIEC 002 Report Form.

16.  12 U.S.C. 1831(m); 12 CFR part 363.

17.  12 CFR 364.101. Part 364 and its appendices implement section 39(a) of the FDI Act. 12 U.S.C. 1831p-1. Taken together, part 364 and Appendix A reflect the FDIC's longstanding expectations for all prudently managed FDIC-supervised institutions while generally leaving the specific methods of achieving these objectives to each institution.

18.  12 CFR part 364, Appendix A II.

19.  See 12 U.S.C. 1831p-1(e); 12 CFR 308.300, et seq.; 12 CFR part 364, Appendix A.

20.  12 CFR 304.3(a). See 12 U.S.C. 1817(a); 12 U.S.C. 1464(v).

21.  12 CFR 390.321(b)(2) has an “exception” making clear that State savings associations are not required to reflect any regulatory reporting requirements not consistent with GAAP in audited financial statements, including financial statements contained in securities filings submitted to the FDIC pursuant to the Securities Exchange Act of 1934 or subpart W and 12 CFR part 192. See 12 CFR 390.321(b).

22.  See 12 CFR 390.321(b).

23.  See the section entitled “Applicability of U.S. Generally Accepted Accounting Principles to Regulatory Reporting Requirements” contained in the General Instructions portion of Call Report Instructions for the FFIEC 031, 041 and 051 Report Forms and the section entitled “Accounting Basis” in the General Instructions portion of the FFIEC 002 Report Form.

24.  12 U.S.C. 1818(i)(2); 12 CFR part 308, subpart H.

25.  12 U.S.C. 1817(a), (c); 1818(b); 1464(v). Because FDIC statutes and regulations do not require FDIC-supervised institutions to deviate from GAAP in the preparation of their annual financial statements, there is no need to include the exception discussed in footnote 21, supra.

26.  Although 12 CFR 390.322 by its terms mandates such an audit for a State savings association with a composite examination rating of 3, 4, or 5, Section 322 allows the FDIC to forego an audit if it would not provide further information on safety and soundness matters relating to the examination rating. See 12 CFR 390.322(c)(2).

27.  12 CFR part 364 Appendix A sections II A and B. For an institution whose size, complexity or scope of operations does not warrant a full scale internal audit function, a system of independent reviews of key internal controls may be used.

28.  See 12 U.S.C. 1831p-1(e); 12 CFR 308.300, et seq. State savings associations may also wish to consult the Interagency Statement of Policy on the Internal Audit Function and Its Outsourcing for additional agency recommendations and sound banking practices.

29.  See 12 U.S.C. 1464(d); 1831p-1(e).

30.  See 12 U.S.C. 1464(d), 1831p-1. See also 82 FR 8082, 8099 (Jan. 23, 2017). State savings associations also may be subject to audit requirements under applicable state law or as required by the appropriate State bank supervisor.

31.  12 U.S.C. 1817(a), (c); 1818(b); 1464(v).

32.  12 U.S.C. 1818(i)(2); 12 CFR part 308, subpart H.

33.  12 CFR 363.4(a). Part 363 also requires covered institutions to prepare a management report each year containing a statement of management's responsibilities for, among other things, preparing the institution's financial statements, establishing and maintaining an adequate internal control structure and procedure for financial reporting, and complying with certain laws and regulations relating to safety and soundness. 12 CFR 363.2(b)(1). The report must also contain management's assessment of the institution's compliance with those laws and regulations during the fiscal year. 12 CFR 363.2(b)(2). For covered institutions with consolidated total assets of $1 billion or more, the management report must also include management's assessment of the effectiveness of the internal control structure and procedures for financial reporting. 12 CFR 363.2(b)(3). Management's internal control assessment must be examined, attested to and reported on by an independent accountant. 12 CFR 363.3(b). State savings associations may also wish to consult the Interagency Policy Statement on External Auditing Programs of Banks and Savings Associations for additional agency recommendations and sound banking practices.

34.  Based on data from the June 30, 2019, Call Report and FFIEC 002 Report Form.

35.  44 U.S.C. 3501-3521.

36.  5 U.S.C. 601, et seq.

37.  The SBA defines a small banking organization as having $600 million or less in assets, where an organization's “assets are determined by averaging the assets reported on its four quarterly financial statements for the preceding year.” See 13 CFR 121.201 (as amended, by 84 FR 34261, effective August 19, 2019). In its determination, “SBA counts the receipts, employees, or other measure of size of the concern whose size is at issue and all of its domestic and foreign affiliates.” See 13 CFR 121.103. Following these regulations, the FDIC uses a covered entity's affiliated and acquired assets, averaged over the preceding four quarters, to determine whether the covered entity is “small” for the purposes of the RFA..

38.  March 31, 2019, is the most recent period for which the FDIC's “small entity” designations for depository institutions are available.

39.  Based on data from the March 31, 2019, Call Report and FFIEC 002 Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Bank.

40.  Pub. L. 106-102, 113 Stat. 1338, 1471 (codified at 12 U.S.C. 4809).

41.  Pub. L. 104-208, 110 Stat. 3009 (1996).