Board Insights
Winter 2026 EditionKal Onomato’s Board Insights newsletter delivers the regulatory, governance, and financial strategy updates that Florida financial institution board members need most — in the depth and clarity that enables informed oversight. This Winter 2026 edition covers four high-priority topics: the FDICIA threshold amendments effective January 1, 2026; AI and cybersecurity governance obligations for audit committees; OCC community bank regulatory relief; and the compliance–internal audit partnership framework every board should understand. Our financial management advisory team is ready to discuss any of these topics in the context of your specific institution.
Winter 2026 Edition — Featured Articles
FDICIA Requirements Updated: What Florida Small and Mid-Sized Banks Must Know
On November 25, 2025, the FDIC adopted amendments to FDICIA’s 12 CFR Part 363 — raising total asset thresholds for audit committee composition, independent audits, and internal controls reporting. Effective January 1, 2026, these changes remove nearly 800 institutions from the general scope of Part 363 while still covering approximately 95% of all industry assets. For Florida community banks, the amendments create immediate compliance decisions, strategic planning opportunities, and a critical monitoring obligation for institutions near the $1 billion and $5 billion thresholds.
Banks near either threshold must implement ongoing total asset monitoring now. The first inflation-based threshold adjustment is expected October 2027 — capital scenario modeling should begin immediately, not after the final rule is published.
- Tier 1 ($1B–$5B): outside directors required, majority independent; mandatory independent external audit; management attestation on internal controls including IT and fraud prevention
- Tier 2 (Over $5B): full independent audit committee; mandatory ICFR assessment and external auditor attestation; banking expertise, outside counsel access, no large customers on committee
- Under $1B: removed from Part 363 scope — but voluntary independent audits remain strategically valuable for growth, M&A, and credibility
- Director independence compensation threshold raised from $100,000 to $120,000 — broadening the pool of eligible independent directors
AI, Cybersecurity, and Audit Committee Governance for Florida Financial Institutions
Artificial intelligence is already embedded in Florida financial institutions — in financial reporting, fraud detection, enterprise risk management, and customer-facing systems. For audit committee members, the question is no longer whether AI affects operations but whether oversight of AI is as rigorous as oversight of every other material risk. The OBBB also introduces new AI-trackable reporting benefits for agricultural and auto loans that Florida lenders must capture accurately. Cybersecurity frameworks aligned with NIST, ISO, or CISA ICS provide the oversight structure that regulators expect to see.
Audit committees must confirm that management has a complete AI inventory, defined human oversight procedures for every material AI workflow, and a cybersecurity framework explicitly reviewed for the integration points that AI creates outside the institution’s network perimeter.
- Four data governance pillars every audit committee must understand: data governance, data security, transparency, and human oversight
- OBBB agricultural loan deduction: up to 25% of qualifying interest income for loans originated after July 4, 2025 — AI-powered tracking required for accuracy
- OBBB auto loan reporting: lenders receiving $600+ in interest on qualifying auto loans must report vehicle VIN, origination date, outstanding principal, and TIN — IRS proposed regs issued Dec. 31, 2025
- Six questions every audit committee should ask management about AI — from inventory and testing to business continuity and breach response
OCC Regulatory Oversight Shifts: Strategic Opportunities for Florida Community Banks
The Office of the Comptroller of the Currency is delivering the most community bank-friendly regulatory changes in years. New Community Bank Minimum BSA/AML Examination Procedures, effective February 1, 2026, significantly reduce examination burden through expanded examiner discretion. The OCC also discontinued mandatory MLR annual data collection and issued an RFI on third-party service provider challenges. Most strategically, a proposed reduction to the Community Bank Leverage Ratio framework — with a decision expected mid-2026 — creates major capital planning implications for Florida community banks.
CBLR capital scenario modeling must begin now — before the final rule is published. Florida community banks that model the full range of proposed reductions will be positioned to act decisively within days of the decision, not weeks behind their more-prepared competitors.
- BSA/AML examiner discretion: rely on independent testing results, carry forward prior conclusions for one cycle, limit or scale transaction testing — all available to banks with strong documented compliance programs
- MLR annual data collection discontinued as of November 24, 2025 — remove from compliance calendar immediately
- Third-party RFI covering core vendor contracts, billing practices, data access, and system conversion challenges — final report expected mid-2026
- CBLR reduction proposal: comment period closed January 30, 2026; final rule and implementation timeline expected early to mid-2026
Compliance and Internal Audit: A Dynamic Partnership for Strong Governance
Compliance and internal audit are two closely related but distinct governance functions — and for Florida financial institution boards, understanding the difference is foundational to effective oversight. Compliance asks: “Are we following the rules?” Internal audit asks: “Are the rules working?” When these two functions coordinate their efforts — sharing risk intelligence, aligning work plans, and eliminating redundancy — they build a governance framework that is more efficient, more comprehensive, and more resistant to the blind spots that develop when each function operates in isolation. The board plays a critical role in ensuring both functions are properly resourced, independent, and working together.
The silos between compliance and internal audit are where losses hide. Boards must confirm that escalation protocols are clearly defined, that internal audit reports directly to the audit committee, and that open findings are tracked through to verified corrective action completion.
- Compliance monitors day-to-day regulatory adherence and develops policies — it is part of management and not independent
- Internal audit is independent of management, examines control effectiveness on a risk-based basis, and reports to the audit committee
- Coordinated partnership streamlines processes, eliminates redundancy, strengthens fraud detection, and enables proactive risk identification
- Board responsibilities: set and document risk appetite; ensure independent audit committee reporting lines; monitor corrective action completion; define escalation protocols
🤖 Four Issues. One Strategic Conversation with Kal Onomato.
Each of the four topics in this edition connects to the others. FDICIA compliance infrastructure supports internal audit governance. Strong AI governance improves OBBB reporting accuracy. OCC BSA/AML relief is most beneficial to banks with well-documented independent testing programs — the same programs that internal audit relies on. Florida financial institutions that address all four simultaneously — with a coordinated advisory strategy — build governance capabilities that compound in value year over year. Our financial management advisory team, tax and accounting team, and AI advisory team work together to build exactly that for Florida banking clients. Schedule your free consultation today →
Ready to Discuss What This Edition Means for Your Florida Institution?
Book a free 30-minute consultation with Kal. We will review which Winter 2026 Board Insights topics are most immediately relevant to your institution’s size, asset position, and governance priorities — and outline a clear, coordinated action plan across FDICIA compliance, AI governance, OCC regulatory planning, and compliance-audit partnership strategy.
