The statement’s reasoning is short and new: “Inflation remains elevated. Today’s policy action will support a timelier return to the Committee’s 2 percent goal. The Committee will deliver price stability.” Its read of the real economy is confident. It says “Economic activity is expanding at a solid pace,” and “Job gains have kept pace with the workforce, and the unemployment rate has changed little.” At the press conference, Chair Kevin Warsh put it plainly: “The plain fact is that inflation is too high and has been for too long.”
| Median | June | September |
|---|---|---|
| Fed funds · end-2026 | 3.8% | 4.1% |
| Fed funds · end-2027 | 3.6% | 4.1% |
| Fed funds · end-2028 | 3.4% | 3.9% |
| Unemployment · Q4 2026 | 4.3% | 4.1% |
| Core PCE inflation · 2026 | 3.3% | 3.4% |
The projections do more work than the statement. The median path now ends 2026 at 4.1%, which implies one more quarter-point increase at the October or December meeting. It stays there through 2027 before easing to 3.9% in 2028. In June the same committee saw the rate falling to 3.6% by the end of 2027. That is roughly half a point of higher-for-longer added to the medium-term path in a single quarter.
The question for 2026 is no longer when the first cut arrives. It is whether your deposit book reprices faster than your loan book on the way up again.
The mechanics started the next day. The Board raised the interest rate on reserve balances to 3.90% and the primary credit rate to 4.0%, both effective September 17. The discount window and the overnight yield on excess cash moved with the target range. Deposit competition moves more slowly and less evenly, and it is where a hiking cycle hurts institutions that fund with rate-sensitive balances.
The macro backdrop the committee cited is consistent with the month’s data. August payrolls rebounded to 162,000 with upward revisions to June and July, and headline CPI held at 3.4% on an energy-driven headline. The committee did not wait for the core, which has fallen to 2.4%, the lowest since March 2021. The hike is a bet that energy-led inflation stays in the headline long enough to matter for expectations.
What this means for your bank
From Zovos AI
Zovos re-baselines your rate and deposit scenarios against the FOMC’s published projections on the day they are released. Your ALCO pack then reflects the September path instead of the June one.
Sources
]]>The agencies are unusually direct about why. Their proposal says the 2023 guidance “frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring,” and that it “unintentionally incentivized overly-process-driven approaches that fail to prioritize higher-risk relationships.” The replacement makes risk identification and assessment the foundation. Oversight would scale to the magnitude and likelihood of harm that a specific relationship poses, instead of to the category of activity it touches.
Alongside the proposal, the Fed, FDIC, and OCC issued a joint statement on community banks’ engagement with core service providers. It calls core providers community banks’ “most material, complex, and highest-risk third-party relationships,” and acknowledges that “a significant percentage of the core provider market is represented by just a few large providers, which limits CBOs’ negotiating power.”
The statement then turns that into supervisory leverage. When the agencies decide how much examination attention to give a core provider, they will weigh its transparency. That covers its willingness to hand over timely due-diligence information, its use of measurable service levels, its disclosure of operational and security incidents, and its billing practices. They will also weigh contract terms that obstruct a bank’s exit or its use of supplemental providers. The Fed also proposed a separate third-party guide for the community banks it supervises.
For the first time, a core provider’s refusal to hand you a SOC report is framed as the provider’s supervisory problem as well as yours.
In August we pointed to the 2023 guidance as one of the two anchors that still govern generative-AI vendors after the model-risk rewrite carved GenAI out of scope. That anchor is now in motion. Tailoring cuts both ways. A lighter touch for low-risk vendors is only defensible if your risk assessment says why. An AI feature embedded in a core or compliance platform is exactly the kind of relationship whose risk rating needs to be written down instead of assumed.
What this means for your bank
From Zovos AI
Zovos keeps a risk rating and a written rationale on every vendor in your inventory, including the AI features inside them. A risk-tailored program then has its evidence attached from day one.
Sources
]]>The same materiality bar now governs MRAs. Examiners may issue one for a practice that is contrary to prudent operation and “could reasonably be expected to, under current or reasonably foreseeable conditions,” cause that material harm. They may also issue one for an actual violation of a banking or banking-related law or regulation. Weaknesses below that line become “supervisory observations,” which do not by themselves require corrective action.
| Finding | Standard after Nov 2 |
|---|---|
| Unsafe or unsound practice | Likely material harm to financial condition or DIF |
| MRA | Could reasonably be expected to cause material harm, or an actual violation |
| Supervisory observation | Weakness below the MRA bar, with no required action |
| FDIC MRBA / supervisory recommendation | Discontinued, then redesignated as MRAs or closed |
At the FDIC the change is structural. Its implementation statement (FIL-53-2026) discontinues Matters Requiring Board Attention and supervisory recommendations. Outstanding items “will either be redesignated as MRAs where appropriate or otherwise closed out,” and exam reports will carry more concise comments. On September 17 the FDIC Board rescinded its 2016 statement on supervisory recommendations as superseded (FIL-61-2026).
A higher bar for MRAs does not lower the bar for prudence. It moves the argument to whether harm is “likely” and “material,” and that argument is won with numbers.
Two limits matter. The rule binds the OCC and FDIC only. The Federal Reserve and NCUA are not parties, so state member banks and credit unions keep their current frameworks. And the agencies declined to set numerical thresholds for “likely” or “material,” so the line will be drawn exam by exam.
What this means for your bank
From Zovos AI
Zovos tracks every exam finding by type (MRA, observation or violation) with its remediation evidence. Redesignating legacy findings becomes a report you run instead of a hunt through files.
Sources
]]>Eligibility is not automatic by size. A qualifying institution must be well capitalized and well managed, carry an “outstanding” or “good” composite rating, not be subject to a formal enforcement proceeding or order, and not have undergone a change in control in the prior 12 months. Offsite monitoring continues between exams.
Newly eligible banks and savings associations · by primary regulator
The agencies estimate about 188 more banks and savings associations become eligible, bringing the total that may qualify for an 18-month cycle to 4,016. The rule does not reach credit unions, whose exam schedule is set by NCUA.
Eighteen months between exams means six more months of evidence that the next examiner reads cold. Keep the file ready for an examiner at any time, instead of only in exam season.
What this means for your bank
From Zovos AI
Zovos keeps exam-ready evidence current continuously, so a longer cycle means less disruption. It should not mean a bigger scramble when the entry letter arrives.
Sources
]]>Underneath, the picture is the reverse. Prices excluding food and energy rose 0.3% on the month but just 2.4% over the year. That is the lowest core rate since March 2021. Shelter rose 0.3% after two softer months, and food rose 0.1%.
CPI · 12-month change by component, August 2026
A 2.4% core and a rate hike in the same week is the committee telling you which number it thinks your customers feel.
What this means for your bank
From Zovos AI
Zovos maps the macro series behind each of your credit and deposit assumptions, so a CPI release updates the right model inputs automatically.
Sources
]]>The unemployment rate held at 4.1%, and labor-force participation rose to 61.6%. Average hourly earnings rose 10 cents, or 0.3%, to $37.75, and are up 3.1% over the year. That is still below August’s 3.4% CPI, so real wages are falling.
| Month | First reported | Now |
|---|---|---|
| June | +57K | +31K |
| July | −23K | +21K |
| August | +162K | Preliminary |
Two months ago the revisions took jobs away. This month they gave them back. Build credit assumptions on the three-month average, never on a single print.
What this means for your bank
From Zovos AI
Zovos re-runs your credit and deposit baselines when a revision moves the macro record in either direction.
Sources
]]>On September 22 Anthropic released Claude Opus 5.5, which it says “performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5,” at $4 and $20 per million tokens. Because the model “has extremely strong cyber capabilities,” Anthropic applied safeguards under which routine bug-fixing still works, “but most cybersecurity tasks will be re-routed to Opus 4.8.” Vetted defenders get a separate path through an expanded Cyber Verification Program.
The first risk is on the threat side. Autonomous discovery and exploitation of unknown flaws is now a commercial capability, with the labs’ safeguards as the main brake on misuse. For a community bank, the exposed surface is mostly someone else’s code, such as the core, the online-banking platform and the payment processor. That makes a provider’s patch cadence and incident transparency a first-order control.
The second is on the vendor side. Safeguard routing means the model a vendor contracts for is not always the model that answers. By design, some requests go to a different, older model. Enterprise access is also a configuration decision, because ChatGPT Enterprise administrators must switch Astra on for their organizations. A vendor attestation that names one model and one version no longer describes what actually runs.
When the model can find the zero-day, the question for your vendors is no longer whether they use AI. The question is how fast they patch, and how fast they tell you.
What this means for your bank
From Zovos AI
Zovos records the model, version, and routing disclosures behind every AI feature in your vendor stack, and opens a review when a provider’s release changes them.
Sources
]]>The unemployment rate fell to 4.1%, and that is not good news either. The decline came largely from people leaving the labor force. Participation dropped to 61.4%, a level not seen in over five years. Wage growth confirms the loosening. Average hourly earnings rose 3.2% over the year, the slowest since May 2021.
| Month | First reported | Now |
|---|---|---|
| May | +172K | +63K |
| June | +57K | +20K |
| July | −23K | Preliminary |
Revisions of this size mean the economy your June assumptions were built on did not exist. Recalibrate to the revised record instead of the remembered one.
This report lands on a committee that split 9–3 in July with all three dissents preferring a hike. A negative payroll print and decelerating wages are the strongest counterargument the doves have had all year. With inflation at 3.5% and falling, September 15–16 is now a genuinely open meeting. The July CPI, due August 12, becomes the swing data point.
For community banks the credit signal outranks the rate signal. Consumer delinquency cycles begin when a labor market sheds jobs, however mildly. The payroll-deposit inflows that anchor community funding soften first.
What this means for your bank
From Zovos AI
Zovos re-runs your credit and deposit scenario baselines automatically when a data revision moves the macro record. Your assumptions follow the data instead of the headline.
Sources
]]>The design answers the standing critique of the SARC, which was that appeals were decided inside the same reporting lines that made the original call. The new office “is independent of the Divisions that make supervisory determinations” and will decide appeals “without deferring to the judgments of either party.” Panels draw on reviewing officials with varied backgrounds. Each panel includes at least one official with bank-supervisory experience and at least one with industry experience.
The quietly significant change is what can be appealed. Under the revised guidelines, “institutions’ appeal rights are now expanded to permit appeals in certain cases when an enforcement action is proposed or pending.” Under the prior regime, a pending enforcement matter could effectively freeze a bank’s ability to contest the underlying supervisory determination. The new guidelines narrow that blocker.
An appeal channel you never intend to use still changes your exam. The possibility of independent review disciplines what gets written down.
What this means for your bank
From Zovos AI
Zovos keeps your exam workpapers, examiner correspondence, and finding-by-finding responses in one timeline. If you ever appeal, the record already exists.
Sources
]]>The operative status of the 2024 rule deserves precision, because it is genuinely tangled. A federal court in Kentucky enjoined the Bureau from enforcing it. The appeal of that ruling is stayed in the Sixth Circuit at the CFPB’s request while the Bureau rewrites the rule. The looming compliance deadlines are paused along with it. The rule exists on paper. Its obligations, for now, do not bind.
Our May edition described §1033 entering its first compliance tier, with a build clock running for smaller institutions. That was the frame the 2024 rule prescribed, and the injunction and the OIRA submission have formally suspended it. The correction matters. If your 2027–2028 roadmap still cites the old tier dates, it is planning against a schedule that no longer exists.
The deadline is gone, but the direction remains. Open banking keeps arriving. The rewrite is about who pays for the rails and who holds the liability.
Reporting on the revised proposal suggests the contested ground is cost recovery for data-access infrastructure and liability allocation. Whether consumers get API access to their data is not in dispute. Credential-based screen scraping is still the practice every party wants retired. The 2024 rule demanded authenticated APIs, consent and authorization logging, and revocation. The market and the eventual rule are still converging on those capabilities. What changed is the clock and possibly the cost model.
What this means for your bank
From Zovos AI
Zovos tracks the status, litigation posture and live deadlines of each rule your roadmap depends on. It also flags the documents in your governance stack that still cite superseded dates.
Sources
]]>The agencies paired the carve-out with a promise. They said a request for information on model risk and banks’ use of AI, including generative and agentic AI, would come “in the near future.” As this edition went to press on August 8, no such RFI had been published. The result is a genuine vacuum. The fastest-moving model class in your institution is the one class your model-risk guidance now formally declines to cover.
| Model class | Governing framework |
|---|---|
| Traditional statistical & quantitative models | SR 26-2 (revised guidance) |
| Non-generative, non-agentic AI/ML | SR 26-2 (revised guidance) |
| Generative AI · agentic AI | Out of scope. RFI promised but not yet issued |
| AI vendors as third parties | Interagency TPRM guidance (unchanged since June 2023) |
A carve-out is not a safe harbor. The examiner who agrees your chatbot is outside SR 26-2 will still ask what does govern it, and “nothing” is the wrong answer.
Two anchors survive. The first is the third-party risk lens. The interagency guidance on third-party relationships has not changed since June 2023, and it still covers every GenAI vendor relationship. Inventory, diligence, and monitoring obligations stand regardless of the model-risk carve-out. The second is that nothing prevents you from applying SR 26-2’s own principles to GenAI voluntarily. That means an inventory entry, a documented validation approach sized to use-case risk, and defined ownership. Banks that do so now will have both a defensible exam answer and a ready-made RFI comment letter.
What this means for your bank
From Zovos AI
Zovos maintains your AI use-case inventory with each tool’s governance status, covering framework, validation state and owner. Your own documented policy fills the gap the guidance left.
Sources
]]>Real final sales to private domestic purchasers strip out the noise and give the purest read on underlying private demand. That measure accelerated from 1.7% to 3.9%. The economy was not losing momentum in the spring. The private sector was speeding up underneath a soft trade-and-government headline.
The energy shock owned the quarter’s price data. The PCE price index rose at a 5.1% annual rate (from 4.6%), and the gross domestic purchases price index hit 5.7% (from 3.6%). Core PCE prices decelerated sharply to 3.4%, from 4.4% in the first quarter. The monthly CPI has been drawing the same shape, with a loud, energy-driven headline over a genuinely improving core.
Read the quarter twice. Nominal statements will look inflated by the price spike, while real private demand was the strongest it has been all year.
What this means for your bank
From Zovos AI
Zovos annotates your board packs with the macro series that actually drive your assumptions. The committee then debates the right number instead of the headline.
Sources
]]>The turn is in commercial real estate. Banks “generally reported easier standards and basically unchanged demand for commercial real estate (CRE) loans.” Specifically, “moderate and modest net shares of banks reported having eased standards” for nonfarm nonresidential and multifamily loans respectively. After years of one-way tightening, that is the first net easing of the cycle.
An easing cycle in CRE arriving in the same week payrolls turned negative is a combination worth sitting with. Competitive pressure to follow looser terms will build just as the labor data argues for discipline. For community banks, CRE concentration is already the exam topic that never leaves the table. If you can show your standards held while the market eased, that counts in your favor at the exam. Quietly matching the street is how concentration findings start.
The first bank to ease sets the market price of risk for everyone. Decide deliberately whether to follow, and write the decision down.
What this means for your bank
From Zovos AI
Zovos tracks your loan-level underwriting exceptions against your stated risk appetite, so standards drift shows up in a report before it shows up in an exam.
Sources
]]>Set that tempo against the regulatory calendar. The revised model-risk guidance took fifteen years to replace its predecessor, explicitly excludes generative and agentic AI, and the RFI meant to start closing that gap has not yet been issued. In the time since the guidance published in April, the frontier has shipped at least two major models. The clock speeds are not close, and they are not converging.
Your model-governance cycle is annual. Your vendors’ model supply chain now turns over monthly. The risk is that ratio, more than any single release.
A monthly cadence plus falling prices creates constant swap pressure. Every few weeks, each vendor with an AI feature gets a fresh reason to change the model underneath you. The reason may be cost or capability, or a version may have been deprecated. A governance process that assumes model stability between annual reviews is now assuming something false.
What this means for your bank
From Zovos AI
Zovos watches the release feeds of the model providers under your vendor stack and opens a review task when one ships. Software that runs at release speed handles the tempo problem for you.
Sources
]]>The quieter story is the core. Excluding food and energy, prices rose 2.6% over the year, down from 2.9% in May. Shelter rose just 0.1% on the month, the smallest one-month change for that index since January 2021. The categories the Fed watches for persistence are holding, and they are also improving.
CPI · 12-month change by component, June 2026
A supply shock that unwinds in one month rewards the patient. It also rebukes anyone who repriced their balance sheet at the top.
The July 29 FOMC held at 3.50–3.75% with three dissents for a hike, and those votes were cast with this CPI report in hand. That tension defines the second half. The headline is falling fast and the core is at 2.6%, yet a bloc of the committee reads the energy episode as a warning about inflation expectations rather than a passing distortion. For banks, the practical read is that the bar for a near-term cut is higher than the improving data alone would suggest.
Deposit and lending behavior will normalize on the same lag as pump prices. The transaction-pattern noise that energy stress pushed into AML monitoring this spring should recede over the summer. That is exactly when thresholds tuned to the stressed baseline start over-alerting in the other direction.
What this means for your bank
From Zovos AI
Zovos flags when your monitoring thresholds were last calibrated against a materially different macro baseline. The unwind then gets the same documented re-tuning the shock did.
Sources
]]>The direction of travel is consistent across the proposals. Programs would be judged by effectiveness rather than procedural completeness. Banks would “focus their anti-money laundering resources based on risk, with more attention given to higher-risk customers and activities,” and would “incorporate the Financial Crimes Enforcement Network’s anti-money laundering priorities into their risk assessment processes.” Once a program is established, the Fed says it would concentrate “supervision and enforcement activities on significant failures to implement the program.”
| Today | Proposed |
|---|---|
| Pillar-based program checklist | Risk-based program judged on effectiveness |
| Risk assessment as best practice | Documented risk assessment as an anchor requirement |
| National priorities referenced loosely | FinCEN priorities wired into the risk assessment |
| Findings on any program gap | Supervision focused on significant implementation failures |
The risk assessment stops being the binder nobody opens and becomes the load-bearing wall of the program. Everything else must trace back to it.
For community institutions, the promise of this framework is proportionality. Resources go to your actual risk instead of a uniform checklist. The risk is ambiguity, because “effectiveness” and “significant failure” are standards examiners will interpret in the field. The comment window (through September 8) is the moment to ask for the definitions and examples that will constrain that discretion, and to say concretely what a proportionate program looks like at a $500 million bank.
What this means for your bank
From Zovos AI
Zovos drafts the documented risk assessment the proposed rules anchor on. It builds the assessment from your activity data and maps it line by line to FinCEN’s priorities.
Sources
]]>The mechanics put the first move with the bank. Management identifies the requested materials it believes are highly sensitive, and the agencies then evaluate whether additional protocols should apply. Chief among them are alternative review methods, such as on-site examination or direct digital access through the bank’s own systems. These reduce the need to transfer sensitive data onto agency systems at all.
The statement also formalizes an obligation running in the other direction. If an agency has a reasonable basis to believe a material compromise of confidential supervisory information has occurred, it commits to notify affected banks as soon as practicable and within no more than 72 hours of determining which banks are affected, subject to applicable legal considerations. Exam material sitting on agency infrastructure is a real attack surface. The agencies are now on the clock to tell you if it leaks.
Your pen-test results are a map of your weakest points. The new statement recognizes that the safest place for that map is inside your own walls.
What this means for your bank
From Zovos AI
Zovos tags exam-request items against your sensitivity inventory automatically, so the highly-sensitive flag and the review method you want travel with every document request.
Sources
]]>The structural change is the asset tiers. Banks under $1 billion would be examined as small banks, up from today’s $412 million cutoff. Banks between $1 billion and $10 billion would be intermediate. Only banks above $10 billion would face the full large-bank examination regime, compared with $1.65 billion today. Institutions at or below $10 billion would also face fewer data collection, maintenance, and reporting requirements.
Proposed CRA examination tiers · by total assets
Substantively, the proposal refocuses evaluation on the lending test, tightens community-development grant criteria toward the communities they are meant to benefit, and narrows the retail services considered for CRA credit by excluding deposit services. It is a deliberate turn back toward lending as the core of CRA performance.
Two agencies rewriting CRA without the third is itself the story. A bank’s CRA obligations may soon depend on who its regulator is.
Comments are due 60 days after the proposal publishes in the Federal Register. Publication was still pending as this issue went to press, so watch for the date. For most community banks the proposal is relief. The open questions worth commenting on are the transition mechanics, the treatment of in-flight evaluations, and how examiners will weigh lending distribution when the deposit-services lens goes away.
What this means for your bank
From Zovos AI
Zovos tracks each of your open comment windows against the Federal Register and drafts the letter skeleton the day the clock starts.
Sources
]]>The composition tells the same late-cycle story as May, but softer. Professional and business services added 36,000, social assistance 25,000, and healthcare 22,000. Leisure and hospitality shed 61,000 on weak seasonal hiring. Hiring is narrowing to the least cyclical corners of the economy.
Payroll change by sector · thousands, June 2026
An unemployment rate that falls because workers leave is a sign of a shrinking labor market. Deposit bases follow workers.
A cooling labor market softens the outlook for consumer credit quality and deposit inflows at the same time, and it lands on a committee already split over inflation. Watch your local employers in leisure, hospitality, and retail. The national seasonal-hiring weakness shows up first as payroll-deposit shrinkage in community footprints.
What this means for your bank
From Zovos AI
Zovos maps national sector shifts onto your own commercial exposure and payroll-deposit flows, so the macro release reads as news about your portfolio instead of a headline.
Sources
]]>The statement itself barely moved. It still described activity as “expanding at a solid pace” and inflation as “elevated relative to the Committee’s 2 percent goal, in part reflecting supply shocks.” What changed is the arithmetic behind it. The dissenters looked at 3.5% headline inflation and a cooling labor market and still concluded that inflation expectations, more than growth, were the risk worth voting against.
| Meeting | Decision | Vote |
|---|---|---|
| April 28–29 | Hold 3.50–3.75% | Four-way dissent |
| June 16–17 | Hold 3.50–3.75% | 12–0 |
| July 28–29 | Hold 3.50–3.75% | 9–3 · all dissents for +25bp |
When every dissent points the same way, it stops being noise and becomes a signal about where the committee’s pain threshold sits.
September 15–16 brings the next decision and a fresh set of projections. A hawkish bloc of three does not make a hike likely. It does make near-term cuts hard, and it widens the tail in both directions. For deposit pricing, that argues for holding the line. For ALCO, it argues for keeping a genuine hike scenario alive even as the headline data improves.
What this means for your bank
From Zovos AI
Zovos drafts the rate-environment section of your ALCO pack from the primary record each meeting cycle, including votes, dissents, and statement diffs.
Sources
]]>For a community bank, the signal is the category more than this particular vendor. Venture capital at unicorn scale is now flowing into software that sits inside the compliance function itself, reading your policies, watching your communications, and increasingly supervising your other AI. The tools you buy to manage AI risk are AI vendors, with the same concentration, continuity, and model-change questions as any other.
When your compliance tooling is itself frontier AI, the question “who validates the validator?” stops being philosophy and becomes a vendor-file entry.
A funded category also churns. Capital at this scale brings rapid feature releases, aggressive model upgrades, and eventual consolidation. Every one of those is a change-management event for a program that depends on the tool’s behavior staying validated. The discipline that applies to your core processor applies here, along with the model-version questions that are unique to AI.
What this means for your bank
From Zovos AI
We hold ourselves to the same standard. Zovos publishes its model providers, version history, and change log to every customer console, so your diligence file is already filled in.
Sources
]]>The statement read differently too. It was sharply shorter than the committee’s recent releases, and the customary forward-guidance paragraph was gone. In its place was this: “Inflation remains elevated relative to the Committee’s 2 percent goal, in part reflecting supply shocks that have driven price increases in certain sectors, including energy. The Committee will deliver price stability.”
| April 28–29 | June 16–17 | |
|---|---|---|
| Decision | Hold at 3.50–3.75% | Hold at 3.50–3.75% |
| Vote | Four-way dissent | 12–0, no dissents |
| Chair | Jerome Powell · final meeting | Kevin Warsh · first meeting |
| Statement | Customary length | Sharply pared back |
Five words, “The Committee will deliver price stability,” replaced the paragraph of forward guidance markets usually parse line by line.
The committee decided with May’s 4.2% CPI print on the table and the Strait of Hormuz still effectively closed. On June 18, one day after the decision, a U.S.–Iran memorandum of understanding reopened the strait. Brent crude averaged $85 per barrel in June, down $22 from May and $32 from the April peak, per the EIA. The supply shock the statement cites began reversing almost immediately after the vote.
For bank balance sheets, the message is symmetrical patience. The statement acknowledged that “economic activity is expanding at a solid pace despite elevated uncertainty that owes, in part, to the conflict in the Middle East.” A unanimous hold in front of a reversing energy shock shows a committee content to let the data settle before the July 28–29 meeting.
What this means for your bank
From Zovos AI
Zovos drafts the rate-environment narrative for your ALCO minutes from the primary record, including statement diffs. Each draft is timestamped, sourced, and ready to review.
Sources
]]>The headline change is to the Management component. The proposal “would remove the sentence directing examiners to give ‘special consideration’ to the Management component in the composite rating,” and rewrites the component’s definition and evaluation factors. As Comptroller Jonathan Gould put it, the Management rating has historically “reflected deficiencies already captured in other components.” The proposal recasts it as a standalone assessment.
Beyond Management, the proposal changes the treatment of specialty-review findings, and revises the composite rating definitions. In the agencies’ words, it would also “emphasize consideration of material financial risks over concerns related to policies, procedures, and documentation.” That last sentence is the philosophical core. Ratings would be anchored to financial condition instead of how the paperwork looks.
UFIRS / CAMELS · the long arc
The proposal also “would remove all references to reputation risk, consistent with the policies of the Board, OCC, FDIC, and NCUA.” It lands inside a larger campaign. An OCC/FDIC final rule prohibiting reputation-risk-based supervisory criticism took effect June 9 (91 FR 18279, responding to Executive Order 14331). On June 2 the FDIC, OCC, and Federal Reserve announced they had scrubbed reputation-risk references from 14 interagency guidance documents (FIL-27-2026).
The philosophical core of the rewrite is ratings anchored to material financial risk instead of paperwork. That is the part worth a comment letter.
What this means for your bank
From Zovos AI
Zovos diffs the proposed CAMELS definitions against your latest exam-prep materials and drafts a comment letter grounded in your own findings. You review it, edit it and file it.
Sources
]]>The rule’s reach narrows in kind as well as count. Farm Credit System lenders are excluded from coverage outright, and merchant cash advances, agricultural lending, and small-dollar transactions drop out of the covered-transaction definition. The discretionary data points are removed from the collection. They were application method, application recipient, denial reasons, pricing information, and number of workers.
Despite the tenfold threshold increase, the Bureau estimates the revised rule still captures 92 to 93 percent of small-business loan volume at depository institutions, versus roughly 94 to 95 percent under the 2023 rule. Coverage concentrates in the highest-volume lenders rather than disappearing.
| 2023 final rule | 2026 revised rule | |
|---|---|---|
| Coverage threshold | 100 covered originations | 1,000 in each of 2 consecutive years |
| Farm Credit System | Covered | Excluded |
| MCAs · ag · small-dollar | In scope | Carved out |
| Discretionary data points | Collected | Removed |
| Depository loan volume covered | ~94–95% | ~92–93% |
The two-consecutive-year lookback means coverage is decided before compliance begins. The 2026 and 2027 origination counts are the test, and 2026 is half over.
A 2028 compliance date reads like runway, but the lookback inverts it. Whether you are a covered financial institution on January 1, 2028 depends on origination counts you are generating right now. A community bank near the 1,000-loan line needs a defensible count of covered transactions for 2026 before it can even decide whether to build. The count has to follow the rule’s definition instead of your core system’s loan codes.
What this means for your bank
From Zovos AI
Zovos runs your loan tape against the revised covered-transaction definition and produces the documented count. The coverage question is then settled by evidence instead of an estimate.
Sources
]]>The findings read like a checklist of fintech-partner risk. Since 2020 the bank “significantly grew its payment processing line, relative to its size,” including cross-border activity with foreign financial institutions, but it “failed to develop and maintain controls and risk management processes commensurate with its risk and growth.” Customer due diligence was found ineffective, independent testing weak, BSA staffing thin, and internal audit missed all of it.
The most instructive finding is about automation. The bank ran an automated alert-triage system, but “several deficiencies in its logic, data, and methodology resulted in the system auto-closing alerts that should have been escalated for further review. As a result, the system auto-closed a very high percentage of all ingested alerts.” A misconfigured automated control became an automated failure at scale.
A triage model that auto-closes what it should escalate has stopped monitoring. It has become a suppression program with good intentions.
| Deadline | Requirement |
|---|---|
| 15 days | Board compliance committee of 3+ members, mostly non-employee directors |
| 90 days | Written action plan to the OCC for non-objection (Articles V–X) |
| Per plan | Independent consultant engaged for a SAR look-back review |
| 60 days after look-back | Consultant’s report on the look-back due |
Two things the order does not do are also worth noting. It imposes no civil money penalty, and it states expressly that its findings are “based on concerns largely unrelated to customers involved in digital assets activities.” This is a story about controls. It is not a story about crypto.
What this means for your bank
From Zovos AI
Zovos benchmarks your alert auto-close rate and escalation outcomes against your transaction growth, and flags the divergence examiners flagged here before your exam finds it.
Sources
]]>The consumer detail matters more for deposit-takers. Personal income rose 0.7% ($181.6 billion) and spending rose 0.7% ($156.1 billion). Real spending was flat, though, and the personal saving rate fell to 3.0%, with saving at $704.2 billion. Households are absorbing the energy shock by saving less while they keep spending.
| Measure | May 2026 |
|---|---|
| PCE price index | +0.4% m/m · +4.1% y/y |
| Core PCE (ex food & energy) | +0.3% m/m · +3.4% y/y |
| Personal income | +0.7% m/m |
| Real PCE (spending) | 0.0% m/m |
| Personal saving rate | 3.0% |
A 3.0% saving rate is the deposit story hiding inside the inflation release. Households are paying for gas out of their savings.
A falling saving rate is a leading indicator for deposit growth, because the flows that build consumer balances are the first casualty of an energy squeeze. Paired with flat real spending, it argues for conservative deposit-growth assumptions through the second half. That holds even as the energy unwind takes pressure off the headline.
What this means for your bank
From Zovos AI
Zovos ties macro releases to your deposit-concentration reports automatically, so a national saving-rate turn maps straight onto your own funding profile.
Sources
]]>Pump prices lag crude, so the consumer relief arrives on a delay. The EIA projects retail gasoline averaging $3.80 per gallon in the third quarter, down from $4.21 in the second, with further declines toward year-end.
Brent crude · 2026 reference points ($/b)
The shock arrived through the gas pump and the wire room at the same time. The unwind will leave through both, on different clocks.
For credit, an energy retreat eases the household cash-flow squeeze that was starting to show in transaction patterns. For AML programs, it is the mirror image of the spring. Monitoring thresholds re-baselined for energy-driven volatility will need re-tuning again as volumes normalize, or yesterday’s calibration becomes today’s blind spot. Year-over-year comparisons also stay distorted well into 2027. June’s level is calmer, but it is still far above last summer’s.
What this means for your bank
From Zovos AI
Zovos tracks the calibration history of your monitoring thresholds against the macro record, so the re-tuning trail is documented before an examiner asks for it.
Sources
]]>Near-flagship capability at mid-tier prices changes vendor economics overnight. Every software vendor with an AI feature now has a strong financial incentive to swap the model underneath it. Most vendor contracts let them do exactly that without telling you.
A model swap inside a vendor product changes behavior you may have validated, such as alert-triage thresholds, document summaries and customer-facing language. The May consent order against Community Federal Savings Bank showed what a miscalibrated automated triage system costs. A silent model change is how a calibrated system becomes a miscalibrated one without anyone deciding anything.
Falling frontier prices are a feature for your budget and a bug for your change management. The cheaper the swap, the more often it happens.
What this means for your bank
From Zovos AI
Zovos keeps the model-version log for every AI vendor in your inventory and flags the ones that have gone a quarter without an attestation. The record manages the swap risk, so you are not relying on trust.
Sources
]]>The trigger was geopolitical rather than domestic. A disruption to shipping through the Strait of Hormuz pushed crude sharply higher in late spring, and the pass-through to pump prices was almost immediate. Tariff policy, long expected to be the inflationary wildcard of 2026, turned out to be a sideshow next to a classic oil shock.
The headline figure hides a sharp divergence by category. Energy is doing nearly all the work. Shelter and core services are the components the Fed watches most closely for persistence, and they remain close to target.
CPI component change · year-over-year
A contained core keeps the Fed patient rather than punitive. The headline number is a borrower problem before it is a policy one.
With the FOMC holding at 3.50–3.75% and a four-way dissent on the record, the committee is signalling that a supply-driven spike does not by itself justify renewed tightening. The June 16–17 meeting, the first under incoming Chair Kevin Warsh, is widely read as another hold. For banks, the risk is the volatility between meetings more than a rate move.
For deposit-takers, an energy-led squeeze on household budgets tends to show up first in transaction patterns. Balances thin out, small-dollar activity becomes more frequent, and payment-adjacent fraud ticks up measurably as consumers feel cash-flow strain. That mix inflates AML alert volume without changing the underlying risk picture. It is exactly the kind of noise that drowns a small compliance team.
What this means for your bank
The takeaway is to calibrate without alarm. A 4.2% print is uncomfortable, but a 2.9% core says the underlying economy is not running hot. The institutions that fare best this cycle will be the ones that separate the signal from the shock and adjust their controls to the difference.
From Zovos AI
Our AML monitoring models were re-tuned this month for energy-driven transaction volatility. If you are an existing customer, the update is live in your console.
Sources
]]>At its core, §1033 gives consumers the right to access and share their financial data with third parties of their choosing. It also obligates the institutions that hold that data to make it available through secure, standardized interfaces. The rule deliberately steers the market away from credential-based screen scraping toward authenticated, permissioned APIs.
Compliance phases in by asset size. The largest institutions go first, and smaller depositories get more runway. That runway is not idle time. The build, vendor selection, and authorization plumbing all need to start well ahead of your own deadline.
§1033 compliance tiers · by asset size
The model provider behind your new data-access layer is now a vendor you must risk-rate. Examiners are already treating it that way.
Even institutions still years from their own deadline should treat the tier-one requirements as the reference architecture. The capabilities below are what a compliant data-sharing program looks like in practice.
Readiness checklist
The litigation creates uncertainty about the edges of the rule, but its direction is clear. Treating a delay as a reprieve is the expensive mistake. Inventory the covered data you hold, map it to your core and digital-banking vendors, and put the third-party providers who will touch consumer data into your formal risk-rating process today. That is the work that takes the longest and that examiners will ask about first.
From Zovos AI
Zovos maps your §1033 covered-data inventory to your vendor stack automatically and flags every data recipient that belongs in your third-party risk program. The longest part of the build can then start on day one.
Sources
]]>For a bank, the change is less about who files with FinCEN and more about what your own customer due-diligence procedures assume. Manuals written to the original scope now over-reach, and manuals written before the CTA under-reach. Either way, the document an examiner opens should match the rule as it stands today.
| Original CTA scope | Interim scope · in force | |
|---|---|---|
| Covered entities | All domestic reporting companies | Foreign-formed entities only |
| U.S. beneficial owners | U.S. beneficial owners reported | U.S. persons exempt from reporting |
| Filer population | ~32M entities in initial estimate | Sharp reduction in covered filers |
A narrower rule is a different obligation, even if it is not a lighter one. Your procedures have to name it.
The beneficial-ownership rule for banks' own customers is distinct from the CTA filing regime, but examiners will expect your program to reflect the current legal landscape coherently. Treat the items below as a documentation pass. They do not call for a system overhaul.
Re-paper checklist
From Zovos AI
Zovos diffs your live CDD manual against the current rule text and drafts the redline. Re-papering becomes a review instead of a rewrite.
Sources
]]>The wrinkle with AI is the supply chain. A single customer-facing feature can ride on a model provider, a cloud host, and a software vendor that stitches them together. Those are three distinct relationships, and each has its own concentration, data-handling, and continuity profile.
| Layer | Suggested tier |
|---|---|
| Model provider: the frontier-AI lab behind the underlying weights and API | Critical |
| Cloud / inference host: where the model runs and your data transits | Critical |
| Application vendor: the product that wraps the model into a workflow | Elevated |
| Fine-tuning / data partner: anyone who sees your data to adapt a model | Elevated |
One AI feature is rarely one vendor. It is a stack, and the guidance expects you to see all of it.
You do not need a new framework. You need to run your existing third-party process across a category most inventories missed. Start with the AI you already use, including the tools that arrived inside other products.
This quarter
From Zovos AI
Zovos auto-discovers the AI and model providers already in your stack, tiers them against your criticality criteria, and keeps the version log current. You build the inventory once and it stays current.
Sources
]]>The disagreement is less about today's data than about how to read an energy-driven inflation spike sitting on top of a still-firm labor market. One camp wants insurance cuts before growth softens. Another worries that easing into a supply shock re-anchors expectations the wrong way.
| Position | Lean | Votes |
|---|---|---|
| Hold | Majority | 7 |
| Cut 25 bp | Dove | 3 |
| Cut 50 bp | Dove | 1 |
| Hike 25 bp | Hawk | 1 |
For banks, the bigger risk is the volatility in the months of disagreement before the next rate decision.
A hold keeps deposit costs where they are for now, but a visibly divided committee widens the range of plausible paths into the back half of the year. The June 16–17 meeting, the first under incoming Chair Kevin Warsh, is read as another hold, yet the market will price every speech in between. That is exactly the environment in which a static ALCO assumption set quietly goes stale.
What this means for your bank
From Zovos AI
Zovos drafts the rate-environment narrative for your ALCO and BSA minutes from the primary record. Each draft is timestamped, sourced, and ready to review.
Sources
]]>The composition matters as much as the headline. Hiring concentrated in healthcare and government, with cyclical sectors flat to soft. That is the pattern of a late-cycle labor market that is durable but no longer broad.
Payroll change by sector · thousands
A firm jobs print is what lets the Fed treat the inflation spike as a shock to wait out rather than a fire to fight.
A resilient labor market underpins consumer credit quality and supports deposit stability, and both are good news for community balance sheets. But the narrowing breadth is the signal to watch. When hiring leans on healthcare and government, a downturn in your local cyclical employers can hit your loan book before the national numbers turn.
What this means for your bank
From Zovos AI
Zovos ties macro releases to your concentration reports automatically, so the sectors driving the national number map straight onto your own exposure.
Sources
]]>For a community bank, none of this is a market-timing question. It is a concentration question. The models that increasingly sit inside your vendors' products are produced by a handful of firms. That handful is exactly where third-party and continuity risk concentrate.
| Provider | Valuation | Note |
|---|---|---|
| Anthropic | 965 | Reported round |
| OpenAI | ~850 | Last private mark |
| Google DeepMind | n/a* | Held inside Alphabet |
| Others (combined) | n/a | Remaining frontier firms |
When the whole frontier fits on one hand, vendor concentration stops being a footnote and becomes the headline risk.
A public Anthropic or OpenAI means more disclosure, more scrutiny, and more stability in the providers your vendors depend on. That is broadly good for diligence. But it also cements a market structure where a small set of firms underpins a growing share of banking technology, and where an outage, price change, or policy shift at one of them ripples across your stack at once.
What this means for your bank
From Zovos AI
Zovos traces every vendor in your inventory down to the model provider underneath, so concentration across the frontier takes one report instead of a research project.
Sources
]]>