The Regulatory Compliance Digest’s Q3 2026 issue summarizes the latest updates from FFIEC, FinCEN, CFPB, FDIC and federal bank regulatory agencies, in addition to other hot topics in the regulatory environment. Cherry Bekaert’s Regulatory Compliance Digest is intended to keep you informed of regulatory changes in advance of their effective date so your institution can remain compliant by the time of enactment.
Status Update on Marijuana Rescheduling
In May 2024, the U.S. Department of Justice (DOJ) proposed moving marijuana from Schedule I to Schedule III under the Controlled Substances Act. If finalized, the change would represent a significant shift in federal cannabis policy, but it would not eliminate the compliance considerations financial institutions face when banking cannabis-related businesses. Schedule I currently classifies marijuana as having no accepted medical use and a high potential for abuse; Schedule III would recognize accepted medical use while keeping marijuana subject to federal controls.
Rescheduling would not legalize marijuana nationwide. State medical and adult-use cannabis markets would still operate in tension with federal law, and cannabis-related businesses (CRB) would remain subject to many federal restrictions. However, it could bring major tax relief by removing the harsh impact of IRS rule 280E, which limits deductions for businesses dealing in Schedule I or II substances.
Impacts of Marijuana Rescheduling on Financial Institutions
Rescheduling marijuana from Schedule I to Schedule III could make some CRBs stronger and more stable banking customers by improving cash flow and financial reporting. This may help financial institutions evaluate CRBs for loans, deposit relationships and treasury services, but it would not eliminate cannabis banking risk.
The main impacts of rescheduling include:
- Lower Legal/Tax Pressure on Cannabis-related Businesses: Schedule III could reduce the impact of IRS 280E, improving cash flow and making clients more bankable.
- Remains Federally Controlled: Marijuana would remain illegal outside Food and Drug Administration (FDA)/Drug Enforcement Administration (DEA)-compliant channels, so financial institutions would still face BSA/AML/CFT* risks including those associated with suspicious activity reports (SAR) filing, ongoing enhanced due diligence and monitoring of CRB customers, and regulatory examination.
- No Automatic Safe Harbor: Rescheduling is not the same as federal legalization or SAFE banking-style protections. Many financial institutions may still avoid cannabis clients until Congress or regulators give clearer protection.
Ultimately, rescheduling marijuana would likely make CRBs financially stronger and somewhat less risky, but financial institutions would still need enhanced compliance programs in place to properly serve them.
Current Status of Marijuana Rescheduling
Federal policy has shifted to Schedule III for certain medical/FDA-approved marijuana products, but full marijuana rescheduling has not yet been finalized. Broader rescheduling remains under active DEA administrative review. Results of the June 29, 2026, hearing included:
- The DOJ and DEA issued an April 2026 final order moving certain marijuana-related products to Schedule III, specifically FDA-approved marijuana products and marijuana products subject to a qualifying state medical marijuana license.
- Adult-use/recreational marijuana and other marijuana not covered by the April 2026 order remained Schedule I pending completion of the broader rulemaking process.
- The formal June 29 DEA hearing on proposed marijuana rescheduling to consider whether broader marijuana categories should move from Schedule I to Schedule III is scheduled to run through July 15, 2026.
The outcome remains uncertain because the administrative law judge could recommend Schedule III, Schedule II or no change. The Justice Department and DEA will still need to take final action after the hearing process.
Action Plan for Financial Institutions Serving Cannabis‑related Businesses
As a result of the DEA hearing, financial institutions should not make immediate changes to their BSA/AML/CFT programs related to their CRB controls. Financial institutions should continue applying existing BSA/AML/CFT risk management expectations, enhanced due diligence, transaction monitoring, and SAR processes while monitoring for final DEA/DOJ action and any forthcoming related regulatory guidance.
Cherry Bekaert’s Financial Institutions and Risk Advisory professionals leverage specialized knowledge to help your institution navigate the heightened regulatory expectations of CRB banking, from risk assessment and policy development to ongoing transaction and monitoring programs. Connect with an advisor today to learn more about our services.
Agencies Release List of Distressed or Underserved Nonmetropolitan Middle-income Geographies
On June 29, 2026, Federal bank regulatory agencies released the 2026 list of certain geographies where certain bank activities are eligible for Community Reinvestment Act (CRA) credit.
Under the CRA, the agencies assess a bank’s record of meeting the credit needs of its entire community, including low- and moderate-income neighborhoods, consistent with safe and sound operations. The list released by the agencies includes distressed or underserved nonmetropolitan middle-income geographies where revitalization or stabilization activities are eligible to receive CRA consideration. The designations reflect local economic conditions, including unemployment, poverty and population changes.
Revitalization or stabilization activities in these geographies are eligible to receive CRA consideration under the community development definition for 12 months after publication of the current list. As with past lists, the agencies apply a one-year lag period for geographies that were included in 2025 but are no longer designated as distressed or underserved in the current list.
Impact: Awareness
Department: Compliance, Lending
Action: Review current assessment area or possible impact to CRA performance
FFIEC Publishes 2025 Data on Mortgage Lending
On June 23, 2026, the Federal Financial Institutions Examination Council (FFIEC) published data on 2025 mortgage lending transactions reported under the Home Mortgage Disclosure Act (HMDA) by 4782 U.S. financial institutions. The Snapshot National Loan-Level Dataset released contains the national HMDA datasets as of June 1, 2026.
Impact: Awareness
Department: Compliance, Lending
Minority Depository Institutions: Reissuance of Policy Statement
On June 16, 2026, the Office of the Comptroller (OCC) updated its policy statement on minority depository institutions (MDI) in the Federal Register. This update relates to the agency’s rescission or amending of certain regulations that are unnecessary, based on anything other than the best reading of the underlying statutory authority, or lacking clear statutory authority, consistent with Executive Order (EO) 14219, “Ensuring Lawful Governance and Implementing the President’s ‘Department of Government Efficiency’ Deregulatory Initiative” (EO 14219). The updated statement revises the definition of an MDI to more closely align with the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA). The update also removed information about the agency that has proven vulnerable to obsolescence. The document includes other conforming edits. Highlights are as follows:
- Consistent with EO 14219, the updated MDI policy statement bases the MDI definition more on the statutory definition while describing how the OCC may maintain the designation of current MDIs.
- The updated statement also replaces references to specific OCC structures and resources with general directions that are unlikely to become obsolete.
Impact: Awareness
Department: Compliance
Equal Credit Opportunity (Regulation B): Special Purpose Credit Programs; Recission
On June 17, 2026, the Consumer Financial Protection Bureau (Bureau) rescinded an advisory opinion issued in December 2020 regarding Regulation B, which implements the Equal Credit Opportunity Act (ECOA), as it applies to certain aspects of special purpose credit programs designed and implemented by for-profit organizations to meet special social needs.
Impact: Awareness
Department: Compliance, Lending
Statement on Ability To Repay and Immigration Status
On June 8, 2026, the Consumer Financial Protection Bureau (Bureau or CFPB) issued this statement to remind creditors of their obligations under the Truth in Lending Act (TILA) as implemented by Regulation Z, and consistent with EO 14406, titled “Restoring Integrity to America’s Financial System.”
In making lending decisions, creditors are permitted to take into account a wide range of information in order to make a reasonable assessment of a consumer’s ability to repay. Regulation B, which implements the Equal Credit Opportunity Act (ECOA), expressly states that “[a] creditor may take the applicant’s immigration status into account,” and that a creditor “may consider the applicant’s immigration status or status as a permanent resident of the U.S., and any additional information that may be necessary to ascertain the creditor’s rights and remedies regarding repayment.” Such a consideration may be necessary because an “applicant’s immigration status and ties to the community (such as employment and continued residence in the area) could have a bearing on a creditor’s ability to obtain repayment.”
As the Bureau recently explained, “[a] credit applicant’s immigration or citizenship status may present underwriting risks that typical assessments of financial capacity alone will not fully resolve. As Regulation B acknowledges, this is something creditors may legitimately consider.”
Impact: Awareness
Department: Compliance, Lending
Q&A Related to the FDIC’s Part 328 Final Rule
On May 18, 2026, the Federal Deposit Insurance Corporation (FDIC) updated its Q&As related to its regulation governing FDIC Official Signs, Advertisement of Membership, False Advertising, Misrepresentation of Insured Status, and Misuse of the FDIC Name or Logo, to reflect the FDIC’s 2026 amendments to the rule (part 328). The Q&As provide answers to a collection of questions from stakeholders, including insured depository institutions (IDIs), trade associations, technology companies, vendors, and other entities, and are intended to promote transparency and support implementation efforts. Highlights include:
- The final rule, issued in January 2026, amends part 328’s signage requirements for IDI websites, mobile applications, and automated teller machines and like devices.
- The final rule’s compliance date is April 1, 2027.
- The FDIC published the first set of Q&As on this topic in 2024 and has periodically updated them since that time.
- The FDIC will continue to update the Q&As periodically on the FDIC’s website, as needed.
Impact: Awareness
Department: Compliance
Agencies Issue Host State Loan-to-Deposit Ratios
On May 1, 2026, the Federal bank regulatory agencies jointly issued updated host state loan-to-deposit ratios, as required by law. Each ratio compares the total loans in a state to total deposits in the state for all banks that are legally operating in that state. These ratios replace those issued in May 2025.
By law, a bank is generally prohibited from establishing or acquiring branches outside of its home state primarily for the purpose of acquiring additional deposits. This prohibition seeks to ensure that interstate bank branches will not take deposits from a community without the bank also reasonably helping to meet the credit needs of that community.
Impact: Awareness
Department: Compliance
Small Business Lending Under the Equal Credit Opportunity Act (Regulation B)
On May 1, 2026, the CFPB revised certain provisions of Regulation B, subpart B, which implements changes to the Equal Credit Opportunity Act made by section 1071 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. The Bureau is amending coverage of certain credit transactions and financial institutions; the small business definition; inclusion of certain data points and how others are collected; and the compliance date.
The Bureau believes these changes will streamline the rule, reduce complexity for lenders, improve data quality, and advance the purposes of section 1071. This final rule is effective on June 30, 2026. The compliance date for the rule is January 1, 2028.
Impact: Assess the number of covered transactions for 2026 and 2027. If exceeding 1,000 annually, the institution will be subject to compliance.
Department: Compliance, Lending
Action: Determine reportable transactions and provide training for awareness; update policies and procedures as applicable; contact third-party vendors that support data reporting to ensure compliance.
Equal Credit Opportunity (Regulation B)
On April 22, 2026, the CFPB issued a final rule that amends provisions related to disparate impact, discouragement of applicants or prospective applicants, and special purpose credit programs under Regulation B, the regulation implementing the Equal Credit Opportunity Act (ECOA or Act). The amendments facilitate compliance with ECOA by clarifying the obligations imposed by the statute. This final rule is effective July 21, 2026.
Impact: Awareness
Department: Compliance, Lending
Action: Review policy and procedures for possible update, and provide training to staff
OCC Issues Update Model Risk Management Guidance
On April 17, 2026, the OCC, in coordination with the Board of Governors of the Federal Reserve System (Federal Reserve Board) and the FDIC, issued updated model risk management guidance for OCC-supervised institutions. These actions build upon the OCC’s ongoing efforts to tailor its supervisory framework to reduce unnecessary burden and promote risk-based examination across institutions of all sizes.
Impact: Awareness
Department: Compliance, BSA/AML, Governance
FDIC Rescinds Supervisory Guidance on Multiple Representment NSF Fees
On April 10, 2026, the FDIC announced the rescission of the Financial Institution Letter (FIL-32-2023) titled “FDIC Clarifying Supervisory Approach Regarding Supervisory Guidance on Multiple Re-Presentment NSF Fees”. This guidance described the FDIC’s supervisory approach relating to supervised institutions assessing multiple non-sufficient funds (NSF) fees arising from the re-presentment of the same unpaid transaction. The FDIC is rescinding FIL-32-2023 effective immediately.
Highlights include:
- On June 16, 2023, the FDIC issued FIL-32-2023, which rescinded and replaced FIL-40-2022, entitled “Supervisory Guidance on Multiple Re-Presentment NSF Fees.”
- Based on a review and assessment of the guidance in FIL‑32-2023, the FDIC concludes that the guidance is overly broad in scope and has raised uncertainty regarding when, for instance, disclosures regarding re-presentments may result in “unfairness” concerns under Section 5 of the Federal Trade Commission Act.
- As a result, the FDIC is rescinding FIL-32-2023 effective immediately.
- Supervised institutions should ensure their disclosures to consumers accurately reflect their practices and are provided in accordance with applicable laws, regulations and other current legal requirements.
Impact: Awareness
Department: Compliance, Deposit Operations
Prohibition on the Use of Reputation Risk by Regulators
On April 10, 2026, the OCC of the Currency and the FDIC adopted a final rule to codify the elimination of reputation risk from their supervisory programs. Among other things, the rule prohibits the agencies from criticizing or taking adverse action against an institution on the basis of reputation risk.
The rule also prohibits the agencies from requiring, instructing, or encouraging an institution to close an account, to refrain from providing an account, product, or service, or to modify or terminate any product or service on the basis of a person or entity’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of politically disfavored but lawful business activities perceived to present reputation risk.
The rule further forbids the agencies from taking any supervisory action or other adverse action against an institution, a group of institutions, or the institution-affiliated parties of any institution that is designed to punish or discourage an individual or group from engaging in any lawful political, social, cultural, or religious activities, constitutionally protected speech, or, for political reasons, lawful business activities that the agencies or its personnel disagree with or disfavor.
The final rule is effective June 9, 2026.
Impact: Awareness
Department: Compliance
BSA/AML OFAC Update
Reminder To File the 2026 Annual Report of Blocked Property
31 C.F.R. § 501.603 of the Reporting, Procedures and Penalties Regulations (RPPR) requires U.S. persons holding blocked property as of June 30 of the current year to file an Annual Report of Blocked Property (ARBP) with the Office of Foreign Assets Control (OFAC) by September 30. Persons that did not hold blocked property as of June 30 do not need to file an ARBP.
Please note that the term blocked property only applies to property that is blocked pursuant to OFAC regulations. Property that was unblocked by an OFAC general or specific license, or that was previously blocked pursuant to a sanctions program that was terminated on or before June 30, 2026, is not considered blocked property, and should not be included in the ARBP.
Similarly, a restricted account of a person ordinarily resident in Iran is not blocked property and should not be reported to OFAC in the ARBP, unless a person whose property and interests in property are blocked pursuant to an applicable sanctions authority has an interest in the account.
Persons filing the 2026 ARBP must use spreadsheet form TD-F 90-22.50 and submit the completed form through the OFAC Reporting System (ORS). Failure to file the ARBP by September 30 constitutes a violation of Treasury’s sanctions rules, Reporting Procedures and Penalties Regulations (RPPR).
Impact: Awareness
Department: Compliance, BSA/AML
Section 314(b) Fact Sheet
On June 12, 2026, the U.S. Department of the Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN) issued a fact sheet in support of Treasury’s efforts to promote greater information sharing between and among financial institutions to identify fraud, money laundering, terrorist financing, narcotics trafficking and related crimes, sanctions evasion, and other criminal activity.
This fact sheet further clarifies:
- The permissibility of real-time information sharing under section 314(b) of the USA PATRIOT Act
- Under what circumstances information, including related to fraud, can be shared
- How information can be shared
This fact sheet expands upon and replaces FinCEN’s December 2020 fact sheet.
Impact: Awareness
Department: Compliance, BSA/AML
Action: Review and amend procedures to address clarifications
Joint Advisory on Non-work Authorized Populations and Their Employers and Risks to the Integrity of the U.S. Financial System
On June 5, 2026, FinCEN, jointly with the Federal Deposit Insurance Corporation, OCC of the Currency, and National Credit Union Administration, (collectively, the Agencies), issued this Advisory in coordination with the Internal Revenue Service (IRS) to advise financial institutions — in particular, banks — to be vigilant against fraud schemes and other suspicious or potentially criminal activities involving the unlawful employment of illegal aliens and the associated risks to the integrity of the U.S. financial system.
Through these schemes, employers can gain an unfair advantage over legitimate U.S. businesses; depress wages; facilitate identity theft of people who are authorized to work in the U.S., including American citizens; and steal millions of dollars in Federal and state payroll tax revenue meant for government benefit programs. Non-work authorized populations and their employers often rely on access to the U.S. financial system.
In certain instances, the access to financial services and unlawfully obtained wages can be leveraged to facilitate the financing of transnational criminal organizations (TCOs) — several of which have been designated as Foreign Terrorist Organizations (FTOs) — and their global criminal enterprises, including drug trafficking, human trafficking and other illegal activity in the U.S.
Impact: Awareness
Department: Compliance, BSA/AML, HR
Treasury Begins Sanctions Modernization Effort by Removing Outdated Entries
On May 28, 2026, the Treasury’s Office of Foreign Assets Control (OFAC) is removing sanctions on 76 outdated targets, which are now being taken off its Specially Designated Nationals and Blocked Persons (SDN) List. The removals are part of Treasury’s ongoing sanctions modernization initiative, which Secretary of the Treasury Scott Bessent recently discussed at the No Money for Terror conference in Paris.
For today’s action, OFAC identified 76 outdated SDN List entries for removal, including deceased individuals, scrapped or decommissioned vessels, persons designated as part of illicit financial networks that no longer exist, and individuals designated more than 10 years ago who lack sufficient identifiers for continued screening and do not appear to pose an ongoing threat. OFAC conducted an interagency vetting process for each entry to ensure that removal would not harm U.S. foreign policy or national security interests.
Impact: Awareness
Department: Compliance, BSA/AML
FinCEN Alert on the Use of Front Companies, Financial Facilitators and Digital Asset Infrastructure by Iran’s Islamic Revolutionary Guard Corps
On May 11, 2026, FinCEN issued an alert to assist financial institutions in identifying actors suspected of funding and facilitating procurement networks supporting the Islamic Revolutionary Guard Corps (IRGC) and mitigating those risks through the filing of SARs.
The IRGC was created after the Iranian Revolution as a parallel organization to Iran’s regular armed forces that reports directly to Iran’s Supreme Leader and is charged with defending the Iranian regime. The IRGC includes ground, naval, and air forces, along with the Basij internal security militia and the IRGC Qods Force (IRGC-QF). The IRGC-QF conducts covert operations abroad and supports terrorism by supplying funding, training and weapons to aligned groups.
Since its inception, the IRGC has engaged in terrorist activity with the support of the Iranian government and is a designated FTO.
Impact: Awareness
Department: Compliance, BSA/AML
CDD Rule FAQs
On May 6, 2026, FinCEN re-issued frequently asked questions (FAQs) regarding customer due diligence requirements for covered financial institutions. These FAQs were separately published on July 19, 2016, April 3, 2018, and August 3, 2020, to assist covered financial institutions in understanding the scope of the final rule Customer Due Diligence Requirements for Financial Institutions, published on May 11, 2016, and amended on September 29, 2017 (“CDD Rule” or “the Rule”).
The purpose of re-issuing the FAQs is to consolidate the three sets of FAQs into one document and update certain FAQs to align with the exceptive relief order FinCEN issued on February 13, 2026 (FIN-2026-R001) (“Account Opening Exceptive Relief Order”).
Impact: Awareness
Department: Compliance, BSA/AML
Agencies Ease Federal Restrictions on State-regulated Marijuana Products
On April 23, 2026, the DOJ and DEA announced they have reclassified marijuana and marijuana products regulated by state medical licenses as Schedule III drugs, which will expand their availability for medical purposes.
State-licensed marijuana is reclassified from Schedule I to Schedule III of the Controlled Substances Act by the order, which also initiates a new process to consider rescheduling marijuana more broadly. Officials in 2024 previously proposed reclassifying marijuana so it is no longer a strictly controlled Schedule I drug but instead a Schedule III drug, which has fewer restrictions. Examples of Schedule III drugs are testosterone and Tylenol with codeine. President Trump last year issued an executive order directing the attorney general’s office to expedite the rescheduling of marijuana.
Impact: Awareness
Department: Compliance, BSA/AML
Have Questions?
If you would like to discuss any compliance matters for your institution, please contact Cherry Bekaert’s Financial Institutions or Risk Advisory team today.
DISCLAIMER
External links to other websites outside of www.cbh.com are being provided as a convenience and for informational purposes only. The links do not constitute an endorsement or an approval by Cherry Bekaert of any of the information, products, services, or opinions of the organization or individual. Cherry Bekaert bears no responsibility for the accuracy, legality, or content of the external websites or for that of subsequent links. Contact the external website for answers to questions regarding its content.
