A bank examination is the thing that finds the problem before the problem finds the depositors. How often one happens is set by a rule, and the rule changed on September 14 — four days after it was announced, and on the day it took effect, with no comment period before it.

The day after the announcement, the same regulators proposed throwing out the rules for how banks oversee the outside companies that run their software, their deposits and their payments.

The examination cycle: $3 billion becomes $6 billion

Small, well-rated banks can be examined every 18 months instead of every 12. The asset ceiling for that has moved five times — $250 million in 1997, $500 million in 2007, $1 billion in 2016, $3 billion in 2018, and now $6 billion.

Part of the increase is statutory: section 903 of the 21st Century ROAD to Housing Act, which became law on July 11, 2026, raised it for banks rated "outstanding." The rest is discretionary. The agencies separately chose to extend the same $6 billion ceiling to banks rated "good" — a CAMELS composite of 2 rather than 1 — where the statute permits anything up to that figure. The rule states that this is "consistent with principles of safety and soundness" and offers no analysis distinguishing a 2-rated bank from a 1-rated bank in the $3–6 billion range.

The agencies' own count:

The Agencies estimate that the interim final rule will increase the number of banks and savings associations that may be eligible for an extended 18-month examination cycle by approximately 188 (95 of which are supervised by the FDIC, 50 by the OCC, and 43 by the Board), bringing the total number of institutions that may qualify for an extended 18-month cycle to 4,016.

About 19 of the 188 are U.S. branches and agencies of foreign banks.

Effective before the comments

The rule was issued as an interim final rule: legally in force on September 14, its publication date, with comments accepted until October 14. The agencies state plainly that they are skipping the Administrative Procedure Act's ordinary sequence, and give three reasons. The third is the one worth reading twice:

the Agencies believe that providing a notice and comment period prior to issuance of the interim final rule is unnecessary because the Agencies do not expect public objection to the regulations being promulgated

That is a prediction about comments, made as the justification for not taking comments first.

The risk is named, then set aside

The rule does not pretend the longer cycle is free. It says:

extending the examination cycles creates a longer window during which emerging problems could develop before being detected through an on-site examination

and then:

the Agencies do not expect that extending the examination cycle by six months for these small, well-rated IDIs with relatively simple risk profiles and no outstanding enforcement action or order would appreciably increase their risk of financial deterioration or failure

"Appreciably" is not defined. No probability is given, no historical failure rate for banks on an extended cycle, no sensitivity analysis. The threshold has been raised four times before; the rule cites those four occasions as legal precedent for using an interim final rule, and never as evidence of what happened afterwards. There is no retrospective data on whether the 2016 or 2018 expansions changed failure rates, enforcement actions or examination findings.

The substitute offered is offsite monitoring — the agencies "will continue their off-site monitoring activities designed to identify new or increasing risks, which often include various Call Report-based analyses." Nothing describes what offsite monitoring catches that an on-site examination would, and nothing commits to strengthening it for the newly eligible banks.

A burden reduction with no number on it

The rule is titled and promoted as burden relief. It carries no estimate of the relief. On savings:

These potential beneficial effects will vary from institution to institution depending upon the composition of staff supporting examinations, an institution's business activities, and the decisions of senior management. Therefore, they are difficult to accurately estimate.

On costs, the same shape — "modest one-time implementation costs" that are "expected to be marginal and far outweighed by the ongoing cost savings," with no figure on either side of the comparison. The Paperwork Reduction Act analysis reports no change because the rule "would not introduce any new collection of information." There is no examiner-hour accounting either: the claimed benefit of letting agencies "better focus their supervisory resources" comes with no statement of how many hours are freed or where they go.

The next day: rescinding the 2023 third-party rules

On September 11 the three agencies, plus the National Credit Union Administration, proposed guidance that would replace the 2023 Interagency Guidance on Third-Party Relationships (88 FR 37920) and, with it, four further documents — including the 2024 community-bank third-party guide and the 2024 joint statement on bank-fintech deposit products. The proposal invites comment on rescinding still more. Comments close November 16, 2026.

The stated reason is that the 2023 guidance

frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles

and "unintentionally incentivized overly-process-driven approaches." The evidence offered for that is "feedback from stakeholders and supervisory experience." No survey, comment tally, examination-finding count or cost study is cited anywhere in the notice. Nor is any evidence offered that the replacement framework works better: no pilot, no examiner testing, no benchmark.

The proposal also narrows when supervisors act, moving the trigger toward "material financial risks and violations of laws and regulations rather than ineffective and counter-productive check-the-box exercises," and states that "the use of subcontractors alone does not typically create an independent third-party relationship." It carries a section headed "Non-Enforceable Guidance" saying deviation from it "will not alone be a basis for supervisory action."

The dissent

Governor Michael S. Barr voted against it and said why:

I am concerned that this proposal will reduce safe and sound operations, increase financial and other risk, create undue confusion, and leave gaps in supervisory coverage.

He names the mechanism:

The interagency guidance incorporates a new standard of "material financial risk" for supervisors to take action, making it less likely that banks will correct problems before they become material risks to the firm.

And the hole left by the carve-outs:

The two proposals specifically exclude consumer compliance matters, but in a final rule could end up rescinding existing guidance, leaving a big gap in risk, or banks could end up needing to comply with two sets of guidance, sowing confusion and increasing burden.

He closed: "I dissent."

What is missing from the set

Neither document mentions the other. One lengthens the interval between on-site examinations for about 188 more banks. The other relaxes third-party oversight expectations and would rescind the community-bank guide written for exactly those banks. Nothing in the record assesses the two together.
Nothing replaces the bank-fintech statement. The Board's own community-bank guide excludes "complex bank-fintech partnerships," and the proposal would rescind the 2024 bank-fintech deposit-products statement without naming a successor.
No count in the core-provider statement. The separate September 11 statement asserts that "a significant percentage of the core provider market is represented by just a few large providers, which limits CBOs' negotiating power" — without naming a provider, a market share, or a number of affected banks. It raises the possibility that core providers "qualify as 'institution-affiliated parties'" and so "may be held liable for the practices or violations of a CBO," designates none, and describes no process for doing so.
The core-provider statement carries no enforceability disclaimer at all, unlike the proposed guidance beside it, and it was not published for comment.

What a reader can still do

The examination-cycle rule is already law, and comments on it close October 14, 2026. The third-party guidance is a proposal, and comments close November 16, 2026. This desk keeps a running board of open federal comment periods with each agency's own submission link at /federal.

In two days, federal banking regulators let 188 more banks go eighteen months between examinations and proposed to rescind the third-party risk rules they wrote in 2023 — one effective before anyone could comment, the other resting on what banks told them.