FDIC FIL-13-2026: Final Rule Bars Use of Reputation Risk by Regulators

Reference: FIL-13-2026

Official publication: Read the full FIL-13-2026 on the agency website

On April 7, 2026, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency jointly issued a final rule, announced by the FDIC in FIL-13-2026, that removes “reputation risk” from their supervisory programs and prohibits regulators from using that concept as a basis for supervisory criticism or adverse action. For FDIC-regulated institutions, the FIL states that its contents apply to all FDIC-supervised financial institutions.

Executive Summary

The rule is significant because it does more than revise examination vocabulary. According to the FDIC’s published summary, the agencies have adopted a prohibition: they may not criticize, formally or informally, or take adverse action against a supervised institution or an institution employee on the basis of reputation risk. The rule also prohibits the agencies from requiring, instructing, or encouraging an institution to close customer accounts, or take other action, based on a customer’s or counterparty’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely because the person or entity is engaged in politically disfavored but lawful business activity perceived to present reputation risk.

Equally important, the FDIC states that the rule does not impose requirements or obligations on supervised institutions. That point matters. The rule is directed at the conduct of federal bank regulators, not at creating a new compliance program for banks. Even so, institutions should not treat the development as merely rhetorical. It changes how management, boards, counsel, and examination teams should frame account-risk decisions, escalation memoranda, supervisory responses, and requests for account closures.

The agencies also supplied a definition. The rule defines reputation risk as any risk, regardless of label, that an institution action or activity could negatively affect public perception of the institution for reasons not clearly and directly related to the institution’s financial or operational condition. That definition is broad in one respect and narrow in another: broad because it captures any label used as a substitute for “reputation risk,” and narrow because it excludes concerns clearly and directly tied to financial or operational condition.

What the FDIC Issued

The official FDIC communication identifies a joint final rule issued with the OCC. The published highlights describe four operative points.

• First, the agencies may not criticize an institution, formally or informally, or take adverse action against the institution or its employees on the basis of reputation risk.
• Second, the agencies may not require, instruct, or encourage an institution to close accounts or otherwise act against a person or entity because of political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely because the person or entity engages in lawful but politically disfavored business activity perceived to create reputation risk.
• Third, the final rule does not itself impose affirmative duties on supervised institutions.
• Fourth, the rule becomes effective 60 days after publication in the Federal Register.

The FDIC also reported that it removed references to reputation risk from identified examination and supervisory materials, including the Risk Management Manual of Examination Policies, the Application Procedures Manual, the Trust Examination Manual, Applying for Deposit Insurance: A Handbook for Organizers, and the Consumer Compliance Examination Manual. The agency further stated that it will continue working with other federal banking agencies to remove reputation-risk references from interagency materials.

The source material does not, however, provide the Federal Register publication date. As a result, the precise effective date cannot be calculated from the FDIC page alone. Likewise, the FDIC summary does not reproduce the full regulatory text, preamble discussion, or any interpretive examples that may appear in the attached final rule itself. Those details matter for edge cases and should be checked against the rule text before a bank relies on a paraphrase in a contested supervisory setting.

Why It Matters

This rule matters because “reputation risk” has long been used in examination discourse as a flexible supervisory concept. The agencies have now stated that the concept may not be used as a basis for supervisory criticism or adverse action. That is a meaningful limitation on supervisory framing, especially in matters involving higher-profile customers, controversial industries, speech-related controversies, or public-pressure events that do not bear clearly and directly on the institution’s safety, soundness, or operations.

For institutions, the practical consequence is not that all difficult customer relationships become protected. Banks still must manage credit risk, Bank Secrecy Act and anti-money laundering exposure, sanctions issues, fraud risk, third-party risk, unfair or deceptive acts or practices concerns, operational resiliency, consumer protection obligations, and concentration concerns. The change is that those issues should be identified and documented in their own terms. If an institution exits a customer, restricts a product, or declines a relationship, the support for that decision should rest on concrete legal, financial, compliance, or operational grounds rather than generalized concern about adverse press, political reaction, or social controversy.

The rule also has examination-management implications. If an examiner requests action that appears tied to public controversy rather than measurable risk, management and counsel now have a firmer basis to ask for the specific financial, operational, legal, or compliance rationale. The FDIC’s summary language is unusually direct in prohibiting even informal supervisory criticism and in barring regulators from encouraging account termination on protected-viewpoint grounds or solely due to lawful but politically disfavored activity.

There is also a governance implication. Boards and risk committees should expect management to distinguish between risks that are genuinely tied to the institution’s financial or operational condition and risks that are reputational in the sense the rule rejects. That distinction should improve the quality of internal memoranda, committee minutes, customer-offboarding records, and responses to supervisory inquiries.

Practical Action Checklist

1. Revise account-exit, customer-selection, and relationship-review templates to remove “reputation risk” as a standalone rationale.
2. Require each proposed adverse customer action to cite the specific legal, compliance, operational, credit, fraud, sanctions, BSA/AML, consumer, or safety-and-soundness basis supporting the decision.
3. Review recent examiner requests, matters requiring attention, supervisory letters, and meeting notes for any use of “reputation risk” or equivalent phrasing, and preserve a dated internal log of those references.
4. Update board and committee reporting so any customer-restriction recommendation identifies whether the concern is clearly and directly tied to financial or operational condition.
5. Train first-line business personnel, compliance, and legal staff not to use political controversy, public criticism, or media sensitivity as shorthand for a risk conclusion.
6. Revisit customer offboarding decisions involving lawful but controversial industries and confirm that the record reflects independent, supportable risk grounds if the institution intends to maintain the action.
7. When exam staff press for action against a customer or class of customers, request the supervisory basis in writing and ask that any cited concern be stated without reliance on reputation-risk concepts.
8. Align deposit-account agreements, policy manuals, and escalation procedures with the institution’s actual decision factors so the documentary record is consistent across business, compliance, and legal functions.
9. Preserve copies of the revised FDIC manuals identified in FIL-13-2026 and map internal policy references to those updated sources.
10. For multi-agency institutions, compare FDIC and OCC examination practices with any remaining interagency guidance references, because the FDIC states that interagency cleanup is still ongoing.

Open Questions and Watch Items

Several points remain important. The FDIC page states that the agency will continue working with other federal banking agencies to remove reputation-risk references from interagency materials, which means some older interagency documents may still contain language not yet conformed. Institutions should therefore expect a transition period in which legacy guidance and current supervisory expectations are not perfectly synchronized.

In addition, the source material does not explain how the agencies will distinguish prohibited reliance on reputation risk from permissible reliance on operational or financial consequences arising from the same facts. In practice, that line may be disputed. Public controversy can generate deposit volatility, vendor strain, litigation exposure, cyber risk, staffing issues, or liquidity pressure. The rule suggests those consequences must be analyzed through concrete financial or operational channels rather than through a free-standing reputational label, but the FDIC summary does not specify how much evidence will be required to make that distinction.

A further watch item is examination behavior after the rule becomes effective. The summary says the agencies are prohibited from criticizing institutions formally or informally on the basis of reputation risk. Whether institutions see a change in oral supervisory communications, not just written products, will be a practical test of the rule’s force. Banks should document those interactions carefully.

My Law Tampa publishes this memorandum as part of its banking and financial regulatory analysis.

This memorandum is informational only and does not create an attorney-client relationship.