12 CFR Part 363 — Annual Independent Audits and Reporting Requirements

PART 363—ANNUAL INDEPENDENT AUDITS AND REPORTING REQUIREMENTS Authority: 12 U.S.C. 1831m. Source: 74 FR 35745, July 20, 2009, unless otherwise noted. § 363.0 OMB control number. The information collection requirements in this part have been approved by the Office of Management and Budget under OMB control number 3064-0113. § 363.1 Scope and definitions. (a) Applicability. (b) Compliance by subsidiaries of holding companies. (i) For fiscal years ending on or before June 14, 2010, by audited consolidated financial statements of the top-tier or any mid-tier holding company. (ii) For fiscal years ending on or after June 15, 2010, by audited consolidated financial statements of the top-tier or any mid-tier holding company provided that the consolidated total assets of the insured depository institution (or the consolidated total assets of all of the holding company's insured depository institution subsidiaries, regardless of size, if the holding company owns or controls more than one insured depository institution) comprise 75 percent or more of the consolidated total assets of this top-tier or mid-tier holding company as of the beginning of its fiscal year. (2) The other requirements of this part for an insured depository institution that is a subsidiary of a holding company may be satisfied by the top-tier or any mid-tier holding company if the insured depository institution meets the criterion specified in § 363.1(b)(1) and if: (i) The services and functions comparable to those required of the insured depository institution by this part are provided at this top-tier or mid-tier holding company level; and (ii) The insured depository institution has as of the beginning of its fiscal year: (A) Total assets of less than $5 billion; or (B) Total assets of $5 billion or more and a composite CAMELS rating of 1 or 2. (3) The appropriate Federal banking agency may revoke the exception in paragraph (b)(2) of this section for any institution with total assets in excess of $9 billion for any period of time during which the appropriate Federal banking agency determines that the institution's exemption would create a significant risk to the Deposit Insurance Fund. (c) Financial reporting. (d) Definitions. (1) AICPA (2) GAAP (3) PCAOB (4) Public company nonpublic company public company. (5) SEC (6) SOX [74 FR 35745, July 20, 2009, as amended at 85 FR 67433, Oct. 23, 2020; 86 FR 66155, Nov. 22, 2021; 90 FR 55811, Dec. 4, 2025] § 363.2 Annual reporting requirements. (a) Audited financial statements. (b) Management report. (1) A statement of management's responsibilities for preparing the institution's annual financial statements, for establishing and maintaining an adequate internal control structure and procedures for financial reporting, and for complying with laws and regulations relating to safety and soundness that are designated by the FDIC and the appropriate Federal banking agency; (2) An assessment by management of the insured depository institution's compliance with such laws and regulations during such fiscal year. The assessment must state management's conclusion as to whether the insured depository institution has complied with the designated safety and soundness laws and regulations during the fiscal year and disclose any noncompliance with these laws and regulations; and (3) For an insured depository institution with consolidated total assets of $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more as of the beginning of such fiscal year, an assessment by management of the effectiveness of such internal control structure and procedures as of the end of such fiscal year that must include the following: (i) A statement identifying the internal control framework 14 14 Internal Control—Integrated Framework, (ii) A statement that the assessment included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions including identification of such regulatory reporting instructions; and (iii) A statement expressing management's conclusion as to whether the insured depository institution's internal control over financial reporting is effective as of the end of its fiscal year. Management must disclose all material weaknesses in internal control over financial reporting, if any, that it has identified that have not been remediated prior to the insured depository institution's fiscal year-end. Management is precluded from concluding that the institution's internal control over financial reporting is effective if there are one or more material weaknesses. (c) Management report signatures. (1) If the audited financial statements requirement specified in § 363.2(a) is satisfied at the insured depository institution level and the management report requirement specified in § 363.2(b) is satisfied in its entirety at the insured depository institution level, the management report must be signed by the chief executive officer and the chief accounting officer or chief financial officer of the insured depository institution; (2) If the audited financial statements requirement specified in § 363.2(a) is satisfied at the holding company level and the management report requirement specified in § 363.2(b) is satisfied in its entirety at the holding company level, the management report must be signed by the chief executive officer and the chief accounting officer or chief financial officer of the holding company; and (3) If the audited financial statements requirement specified in § 363.2(a) is satisfied at the holding company level and (i) the management report requirement specified in § 363.2(b) is satisfied in its entirety at the insured depository institution level or (ii) one or more of the components of the management report specified in § 363.2(b) is satisfied at the holding company level and the remaining components of the management report are satisfied at the insured depository institution level, the management report must be signed by the chief executive officers and the chief accounting officers or chief financial officers of both the holding company and the insured depository institution and the management report must clearly indicate the level (institution or holding company) at which each of its components is being satisfied. [74 FR 35745, July 20, 2009, as amended at 90 FR 55811, Dec. 4, 2025] § 363.3 Independent public accountant. (a) Annual audit of financial statements. (b) Internal control over financial reporting. (1) A statement identifying the internal control framework used by the independent public accountant, which must be the same as the internal control framework used by management, to evaluate the effectiveness of the insured depository institution's internal control over financial reporting; (2) A statement that the independent public accountant's evaluation included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions including identification of such regulatory reporting instructions; and (3) A statement expressing the independent public accountant's conclusion as to whether the insured depository institution's internal control over financial reporting is effective as of the end of its fiscal year. The report must disclose all material weaknesses in internal control over financial reporting that the independent public accountant has identified that have not been remediated prior to the insured depository institution's fiscal year-end. The independent public accountant is precluded from concluding that the insured depository institution's internal control over financial reporting is effective if there are one or more material weaknesses. (c) Notice by accountant of termination of services. (d) Communications with audit committee. (1) All critical accounting policies and practices to be used by the insured depository institution, (2) All alternative accounting treatments within GAAP for policies and practices related to material items that the independent public accountant has discussed with management, including the ramifications of the use of such alternative disclosures and treatments, and the treatment preferred by the independent public accountant, and (3) Other written communications the independent public accountant has provided to management, such as a management letter or schedule of unadjusted differences. (e) Retention of working papers. (f) Independence. (g) Peer reviews and inspection reports. (2) Within 15 days of receiving notification that a peer review has been accepted or a PCAOB inspection report has been issued, or before commencing any audit under this part, whichever is earlier, the independent public accountant must file two copies of the most recent peer review report and the public portion of the most recent PCAOB inspection report, if any, accompanied by any letters of comments, response, and acceptance, with the FDIC, Accounting and Securities Disclosure Section, 550 17th Street, NW., Washington, DC 20429, if the report has not already been filed. The peer review reports and the public portions of the PCAOB inspection reports will be made available for public inspection by the FDIC. (3) Within 15 days of the PCAOB making public a previously nonpublic portion of an inspection report, the independent public accountant must file two copies of the previously nonpublic portion of the inspection report with the FDIC, Accounting and Securities Disclosure Section, 550 17th Street, NW., Washington, DC 20429. Such previously nonpublic portion of the PCAOB inspection report will be made available for public inspection by the FDIC. [74 FR 35745, July 20, 2009, as amended at 90 FR 55811, Dec. 4, 2025] § 363.4 Filing and notice requirements. (a) Part 363 Annual Report. (2) Subject to the criteria specified in § 363.1(b), each insured depository institution with consolidated total assets of less than $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, as of the beginning of its fiscal year that is required to file, or whose parent holding company is required to file, management's assessment of the effectiveness of internal control over financial reporting with the SEC or the appropriate Federal banking agency in accordance with section 404 of SOX must submit a copy of such assessment to the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor with its Part 363 Annual Report as additional information. This assessment will not be considered part of the institution's Part 363 Annual Report. (3)(i) Each insured depository institution that is neither a public company nor a subsidiary of a public company that meets the criterion specified in § 363.1(b)(1) shall file its Part 363 Annual Report within 120 days after the end of its fiscal year. (ii) Each insured depository institution that is a public company or a subsidiary of public company that meets the criterion specified in § 363.1(b)(1) shall file its Part 363 Annual Report within 90 days after the end of its fiscal year. (b) Public availability. (c) Independent public accountant's letters and reports. (1) Any written communication regarding matters that are required to be communicated to the audit committee (for example, critical accounting policies, alternative accounting treatments discussed with management, and any schedule of unadjusted differences), (2) Any written communication of significant deficiencies and material weaknesses in internal control required by the AICPA's or the PCAOB's auditing standards; (3) For institutions with total assets of less than $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, as of the beginning of their fiscal year that are public companies or subsidiaries of public companies that meet the criterion specified in § 363.1(b)(1), any independent public accountant's report on the audit of internal control over financial reporting required by section 404 of SOX and the PCAOB's auditing standards; and (4) For all institutions that are public companies or subsidiaries of public companies that meet the criterion specified in § 363.1(b)(1), any independent public accountant's written communication of all deficiencies in internal control over financial reporting that are of a lesser magnitude than significant deficiencies required by the PCAOB's auditing standards. (d) Notice of engagement or change of accountants. (e) Notification of late filing. (f) Place for filing. (1) FDIC: i.e., (2) Office of the Comptroller of the Currency (OCC): (3) Federal Reserve: (4) Office of Thrift Supervision (OTS): (5) State bank supervisor: [74 FR 35745, July 20, 2009, as amended at 90 FR 55811, Dec. 4, 2025] § 363.5 Audit committees. (a) Composition and duties. (1) Each insured depository institution with total assets of $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more as of the beginning of its fiscal year shall establish an independent audit committee of its board of directors, the members of which shall be outside directors who are independent of management of the institution. (2) Each insured depository institution with total assets of $1 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more but less than $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, as of the beginning of its fiscal year shall establish an audit committee of its board of directors, the members of which shall be outside directors, the majority of whom shall be independent of management of the institution. The appropriate Federal banking agency may, by order or regulation, permit the audit committee of such an insured depository institution to be made up of less than a majority of outside directors who are independent of management, if the agency determines that the institution has encountered hardships in retaining and recruiting a sufficient number of competent outside directors to serve on the audit committee of the institution. (3) An outside director is a director who is not, and within the preceding fiscal year has not been, an officer or employee of the institution or any affiliate of the institution. (b) Committees of large institutions. (c) Independent public accountant engagement letters. (i) Indemnify the independent public accountant against claims made by third parties; (ii) Hold harmless or release the independent public accountant from liability for claims or potential claims that might be asserted by the client insured depository institution, other than claims for punitive damages; or (iii) Limit the remedies available to the client insured depository institution. (2) Alternative dispute resolution agreements and jury trial waiver provisions are not precluded from engagement letters provided that they do not incorporate any limitation of liability provisions set forth in paragraph (c)(1) of this section. [74 FR 35745, July 20, 2009, as amended at 90 FR 55811, Dec. 4, 2025] § 363.6 Discretion to exempt certain insured depository institutions from this part. If an insured depository institution likely will no longer be subject to a requirement of this part as a result of the application of a threshold adjusted in accordance with § 314.1 of this chapter that is scheduled to occur during the insured depository institution's current fiscal year, the appropriate Federal banking agency with respect to the insured depository institution may exercise discretion to not require compliance from the insured depository institution with respect to such requirement as of the beginning of the insured depository institution's current fiscal year. If the insured depository institution's total assets exceed such a threshold subsequent to the threshold adjustment occurring, the insured depository institution would be required to comply with the relevant requirement notwithstanding this section, unless the appropriate Federal banking agency again drew the same conclusion with respect to a future threshold adjustment. [90 FR 55811, Dec. 4, 2025] Appendix A to Part 363—Guidelines and Interpretations Table of Contents Introduction Scope of Rule and Definitions (§ 363.1) 1. Measuring Total Assets 2. Insured Branches of Foreign Banks 3. Compliance by Holding Company Subsidiaries 4. Comparable Services and Functions 4A. Financial Reporting Annual Reporting Requirements (§ 363.2) 5. Annual Financial Statements 5A. Institutions Merged out of Existence 6. Holding Company Statements 7. Insured Branches of Foreign Banks 7A. Compliance with Designated Laws and Regulations 8. Management Report 8A. Management's Reports on Internal Control over Financial Reporting under Part 363 and Section 404 of SOX 8B. Internal Control Reports and Part 363 Annual Reports for Acquired Businesses 8C. Management's Disclosure of Noncompliance with the Designated Laws and Regulations 9. Safeguarding of Assets 10. Standards for Internal Control 11. Service Organizations 12. Reserved Role of Independent Public Accountant (§ 363.3) 13. General Qualifications 14. Reserved 15. Peer Review Guidelines 16. Reserved 17. Information to be Provided to the Independent Public Accountant 18. Attestation Report and Management Letters 18A. Internal Control Attestation Standards for Independent Auditors 19. Reviews with Audit Committee and Management 20. Notice of Termination 21. Reliance on Internal Auditors Filing and Notice Requirements (§ 363.4) 22. Reserved 23. Notification of Late Filing 24. Public Availability 25. Reserved 26. Notices Concerning Accountants Audit Committees (§ 363.5) 27. Composition 28. “Independent of Management” Considerations 29. Reserved 30. Holding Company Audit Committees 31. Duties 32. Banking or Related Financial Management Expertise 33. Large Customers 34. Access to Counsel 35. Transition Period for Forming and Restructuring Audit Committees Other 36. Modifications of Guidelines Introduction Congress added section 36, “Early Identification of Needed Improvements in Financial Management” (section 36), to the Federal Deposit Insurance Act (FDI Act) in 1991. The FDIC Board of Directors adopted 12 CFR part 363 of its rules and regulations (the Rule) to implement those provisions of section 36 that require rulemaking. The FDIC also approved these “Guidelines and Interpretations” (the Guidelines) and directed that they be published with the Rule to facilitate a better understanding of, and full compliance with, the provisions of section 36. Although not contained in the Rule itself, some of the guidance offered restates or refers to statutory requirements of section 36 and is therefore mandatory. If that is the case, the statutory provision is cited. Furthermore, upon adopting the Rule, the FDIC reiterated its belief that every insured depository institution, regardless of its size or charter, should have an annual audit of its financial statements performed by an independent public accountant, and should establish an audit committee comprised entirely of outside directors. The following Guidelines reflect the views of the FDIC concerning the interpretation of section 36. The Guidelines are intended to assist insured depository institutions (institutions), their boards of directors, and their advisors, including their independent public accountants and legal counsel, and to clarify section 36 and the Rule. It is recognized that reliance on the Guidelines may result in compliance with section 36 and the Rule which may vary from institution to institution. Terms which are not explained in the Guidelines have the meanings given them in the Rule, the FDI Act, or professional accounting and auditing literature. Scope of Rule and Definitions (§ 363.1) 1. Measuring Total Assets. 2. Insured Branches of Foreign Banks. 3. Compliance by Holding Company Subsidiaries. i.e., 4. Comparable Services and Functions. (a) Prepares reports used by the subsidiary institution to meet the requirements of this part; (b) Has an audit committee that meets the requirements of this part appropriate to its largest subsidiary institution; and (c) Prepares and submits management's assessment of compliance with the Designated Laws and Regulations defined in guideline 7A and, if applicable, management's assessment of the effectiveness of internal control over financial reporting based on information concerning the relevant activities and operations of those subsidiary institutions within the scope of the Rule. 4A. Financial Statements Prepared for Regulatory Reporting Purposes. (b) Financial statements prepared for regulatory reporting purposes do not include regulatory reports prepared by a non-bank subsidiary of a holding company or an institution. For example, if a bank holding company or an insured depository institution owns an insurance subsidiary, financial statements prepared for regulatory reporting purposes would not include any regulatory reports that the insurance subsidiary is required to submit to its appropriate insurance regulatory agency. Annual Reporting Requirements (§ 363.2) 5. Annual Financial Statements. 5A. Institutions Merged Out of Existence. 6. Holding Company Statements. 7. Insured Branches of Foreign Banks. (a) Audited balance sheets, disclosing information about financial instruments with off-balance-sheet risk; (b) Schedules RAL and L of form FFIEC 002, prepared and audited on the basis of the instructions for its preparation; or (c) With written approval of the appropriate Federal banking agency, consolidated financial statements of the parent bank. 7A. Compliance with Designated Laws and Regulations. 8. Management Report. 8A. Management's Reports on Internal Control over Financial Reporting under Part 363 and Section 404 of SOX. (i) Management can prepare two separate reports on the institution's or the holding company's internal control over financial reporting to satisfy the FDIC's part 363 requirements and the SEC's section 404 requirements; or (ii) Management can prepare a single report on internal control over financial reporting provided that it satisfies all of the FDIC's part 363 requirements and all of the SEC's section 404 requirements. 8B. Internal Control Reports and Part 363 Annual Reports for Acquired Businesses. (a) In such instances, the acquired business's internal control structure and procedures for financial reporting may be excluded from management's assessment report and the accountant's attestation report on internal control over financial reporting. However, the FDIC expects management's assessment report to identify the acquired business, state that the acquired business is excluded, and indicate the significance of this business to the institution's consolidated financial statements. Notwithstanding management's exclusion of the acquired business's internal control from its assessment, management should disclose any material change to the institution's internal control over financial reporting due to the acquisition of this business. Also, management may not omit the assessment of the acquired business's internal control from more than one annual part 363 assessment report on internal control over financial reporting. When the acquired business's internal control over financial reporting is excluded from management's assessment, the independent public accountant may likewise exclude this acquired business's internal control over financial reporting from the accountant's evaluation of internal control over financial reporting. (b) If the acquired business is or has a consolidated subsidiary that is an insured depository institution subject to part 363 and the institution is not merged out of existence before the deadline for filing its Part 363 Annual Report (120 days after the end of its fiscal year for an institution that is neither a public company nor a subsidiary of a public company that meets the criterion specified in § 363.1(b)(1), and 90 days after the end of its fiscal year for an institution that is a public company or a subsidiary of public company that meets the criterion specified in § 363.1(b)(1)), the acquired institution must continue to comply with all of the applicable requirements of part 363, including filing its Part 363 Annual Report. 8C. Management's Disclosure of Noncompliance with the Designated Laws and Regulations. e.g., 9. Safeguarding of Assets. 15 15 10. Standards for Internal Control. • Is free from bias; • Permits reasonably consistent qualitative and quantitative measurements of an institution's internal control over financial reporting; • Is sufficiently complete so that those relevant factors that would alter a conclusion about the effectiveness of an institution's internal control over financial reporting are not omitted; and • Is relevant to an evaluation of internal control over financial reporting. In the United States, Internal Control—Integrated Framework, 11. Service Organizations. 12. [Reserved] Role of Independent Public Accountant (§ 363.3) 13. General Qualifications. 14. [Reserved] 15. Peer Review Guidelines. (a) The external peer review should be conducted by an organization independent of the accountant or firm being reviewed, as frequently as is consistent with professional accounting practices; (b) The peer review (other than a PCAOB inspection) should be generally consistent with AICPA Peer Review Standards; and (c) The review should include, if available, at least one audit on an insured depository institution or consolidated depository institution holding company. 16. [Reserved] 17. Information to be Provided to the Independent Public Accountant. 18. Attestation Report and Management Letters. 18A. Internal Control Attestation Standards for Independent Auditors. (1) For an insured institution that is neither a public company nor a subsidiary of a public company, its independent public accountant need only follow the AICPA's attestation standards. (2) For an insured institution that is a public company that is required to comply with the auditor attestation requirement of section 404 of SOX, its independent public accountant should follow the PCAOB's auditing standards. (3) For an insured institution that is a public company but is not required to comply with the auditor attestation requirement of section 404 of SOX, its independent public accountant is not required to follow the PCAOB's auditing standards. In this case, the accountant need only follow the AICPA's attestation standards. (4) For an insured institution that is a subsidiary of a public company that is required to comply with the auditor attestation requirement of section 404 of SOX, but is not itself a public company, the institution and its independent public accountant have flexibility in complying with the internal control requirements of part 363. If the conditions specified in § 363.1(b)(2) are met, management and the independent public accountant may choose to report on internal control over financial reporting at the consolidated holding company level. In this situation, the independent public accountant's work would be performed for the public company in accordance with the PCAOB's auditing standards. Alternatively, the institution may choose to comply with the internal control reporting requirements of part 363 at the institution level and its independent public accountant could follow the AICPA's attestation standards. (b) If an independent public accountant need only follow the AICPA's attestation standards, the accountant and the insured institution may instead agree to have the internal control attestation performed under the PCAOB's auditing standards. 19. Reviews with Audit Committee and Management. 20. Notice of Termination. e.g., e.g., e.g., 21. Reliance on Internal Auditors. Filing and Notice Requirements (§ 363.4) 22. [Reserved] 23. Notification of Late Filing. (b) If the late filing notice submitted pursuant to § 363.4(e) relates only to a portion of a Part 363 Annual Report or any other report or notice, the insured depository institution should file the other components of the report or notice within the prescribed filing period together with a cover letter that indicates which components of its Part 363 Annual Report or other report or notice are omitted. An institution may combine the written late filing notice and the cover letter into a single notice that is submitted together with the other components of the report or notice that are being timely filed. 24. Public Availability. 25. [Reserved] 26. Notices Concerning Accountants. e.g., Audit Committees (§ 363.5) 27. Composition. 28. “Independent of Management” Considerations. (a) If an outside director, either directly or indirectly, owns or controls, or has owned or controlled within the preceding fiscal year, 10 percent or more of any outstanding class of voting securities of the institution, the institution's board of directors should determine, and document its basis and rationale for such determination, whether such ownership of voting securities would interfere with the outside director's exercise of independent judgment in carrying out the responsibilities of an audit committee member, including the ability to evaluate objectively the propriety of management's accounting, internal control, and reporting policies and practices. Notwithstanding the criteria set forth in paragraphs (b), (c), and (d) of this guideline, if the board of directors determines that such ownership of voting securities would interfere with the outside director's exercise of independent judgment, the outside director will not be considered “independent of management.” (b) The following list sets forth additional criteria that, at a minimum, a board of directors should consider when determining whether an outside director is “independent of management.” The board of directors may conclude that additional criteria are also relevant to this determination in light of the particular circumstances of its institution. Accordingly, an outside director will not be considered “independent of management” if: (1) The director serves, or has served within the last three years, as a consultant, advisor, promoter, underwriter, legal counsel, or trustee of or to the institution or its affiliates. (2) The director has been, within the last three years, an employee of the institution or any of its affiliates or an immediate family member is, or has been within the last three years, an executive officer of the institution or any of its affiliates. (3) The director has participated in the preparation of the financial statements of the institution or any of its affiliates at any time during the last three years. (4) The director has received, or has an immediate family member who has received, during any twelve-month period within the last three years, more than $120,000 in direct and indirect compensation from the institution, its subsidiaries, and its affiliates for consulting, advisory, or other services other than director and committee fees and pension or other forms of deferred compensation for prior service (provided such compensation is not contingent in any way on continued service). Direct compensation also would not include compensation received by the director for former service as an interim chairman or interim chief executive officer. (5) The director or an immediate family member is a current partner of a firm that performs internal or external auditing services for the institution or any of its affiliates; the director is a current employee of such a firm; the director has an immediate family member who is a current employee of such a firm and who participates in the firm's audit, assurance, or tax compliance practice; or the director or an immediate family member was within the last three years (but no longer is) a partner or employee of such a firm and personally worked on the audit of the insured depository institution or any of its affiliates within that time. (6) The director or an immediate family member is, or has been within the last three years, employed as an executive officer of another entity where any of the present executive officers of the institution or any of its affiliates at the same time serves or served on that entity's compensation committee. (7) The director is a current employee, or an immediate family member is a current executive officer, of an entity that has made payments to, or received payments from, the institution or any of its affiliates for property or services in an amount which, in any of the last three fiscal years, exceeds the greater of $200 thousand, or 5 percent of such entity's consolidated gross revenues. This would include payments made by the institution or any of its affiliates to not-for-profit entities where the director is an executive officer or where an immediate family member of the director is an executive officer. (8) For purposes of paragraph (b) of this guideline: (i) An “immediate family member” includes a person's spouse, parents, children, siblings, mothers- and fathers-in-law, sons- and daughters-in-law, brothers- and sisters-in-law, and anyone (other than domestic employees) who shares such person's home. (ii) The term affiliate of, or a person affiliated with, a specified person, means a person or entity that directly, or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with, the person specified. (iii) The term indirect compensation for consulting, advisory, or other services includes the acceptance of a fee for such services by a director's immediate family member or by an organization in which the director is a partner or principal that provides accounting, consulting, legal, investment banking, or financial advisory services to the institution, any of its subsidiaries, or any of its affiliates. (iv) The terms direct and indirect compensation and payments do not include payments such as dividends arising solely from investments in the institution's equity securities, provided the same per share amounts are paid to all shareholders of that class; interest income from investments in the institution's deposit accounts and debt securities; loans from the institution that conform to all regulatory requirements applicable to such loans except that interest payments or other fees paid in association with such loans would be considered payments; and payments under non-discretionary charitable contribution matching programs. (c) An insured depository institution that is a public company and a listed issuer (as defined in Rule 10A-3 of the Securities Exchange Act of 1934 (Exchange Act)), or is a subsidiary of a public company that meets the criterion specified in § 363.1(b)(1) and is a listed issuer, may choose to use the definition of audit committee member independence set forth in the listing standards applicable to the public institution or its public company parent for purposes of determining whether an outside director is “independent of management.” (d) All other insured depository institutions may choose to use the definition of audit committee member independence set forth in the listing standards of a national securities exchange that is registered with the SEC pursuant to section 6 of the Exchange Act or a national securities association that is registered with the SEC pursuant to section 15A(a) of the Exchange Act for purposes of determining whether an outside director is “independent of management.” 29. [Reserved] 30. Holding Company Audit Committees. (b) When an insured depository institution subsidiary with total assets of $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more as of the beginning of its fiscal year does not meet the requirements for the holding company exception specified in §§ 363.1(b)(1) and (2) or maintains its own separate audit committee to satisfy the requirements of this part, the members of the audit committee of the top-tier or any mid-tier holding company may serve on the audit committee of the subsidiary institution if they are otherwise independent of management of the subsidiary institution, and, if applicable, meet any other requirements for a large subsidiary institution covered by this part. (c) When an insured depository institution with total assets of $1 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more but less than $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, as of the beginning of its fiscal year does not meet the requirements for the holding company exception specified in §§ 363.1(b)(1) and (2) or maintains its own separate audit committee to satisfy the requirements of this part, the members of the audit committee of the top-tier or any mid-tier holding company may serve on the audit committee of the subsidiary institution provided a majority of the institution's audit committee members are independent of management of the subsidiary institution. (d) Officers and employees of a top-tier or any mid-tier holding company may not serve on the audit committee of a subsidiary institution subject to part 363. 31. Duties. (a) Reviewing with management and the independent public accountant the scope of services required by the audit, significant accounting policies, and audit conclusions regarding significant accounting estimates; (b) Reviewing with management and the accountant their assessments of the effectiveness of internal control over financial reporting, and the resolution of identified material weaknesses and significant deficiencies in internal control over financial reporting, including the prevention or detection of management override or compromise of the internal control system; (c) Reviewing with management the institution's compliance with the Designated Laws and Regulations identified in guideline 7A; (d) Discussing with management and the independent public accountant any significant disagreements between management and the independent public accountant; and (e) Overseeing the internal audit function. 32. Banking or Related Financial Management Expertise. 33. Large Customers. 34. Access to Counsel. 35. Transition Period for Forming and Restructuring Audit Committees. (a) When an insured depository institution's total assets as of the beginning of its fiscal year are $1 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more for the first time and it thereby becomes subject to part 363, no regulatory action will be taken if the institution (1) develops and approves a set of written criteria for determining whether a director who is to serve on the audit committee is an outside director and is independent of management and (2) forms or restructures its audit committee to comply with § 363.5(a)(2) by the end of that fiscal year. (b) When an insured depository institution's total assets as of the beginning of its fiscal year are $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more for the first time, no regulatory action will be taken if the institution forms or restructures its audit committee to comply with § 363.5(a)(1) by the end of that fiscal year, provided that the composition of its audit committee meets the requirements specified in § 363.5(a)(2) at the beginning of that fiscal year, if such requirements were applicable. (c) When an insured depository institution's total assets as of the beginning of its fiscal year are $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more for the first time, no regulatory action will be taken if the institution forms or restructures its audit committee to comply with § 363.5(b) by the end of that fiscal year, provided that the composition of its audit committee meets the requirements specified in § 363.5(a)(1) at the beginning of that fiscal year, if such requirements were applicable. Other 36. Modifications of Guidelines. Federal Register Table 1 to Appendix A—Designated Federal Laws and Regulations Applicable to: National banks State member banks State Savings Insider Loans—Parts and/or Sections of Title 12 of the United States Code 375a Loans to Executive Officers of Banks √ √ (A) (A) 375b Extensions of Credit to Executive Officers, Directors, and Principal Shareholders of Banks √ √ (A) (A) 1468(b) Extensions of Credit to Executive Officers, Directors, and Principal Shareholders √ 1828(j)(2) Extensions of Credit to Officers, Directors, and Principal Shareholders √ 1828(j)(3)(B) Extensions of Credit to Officers, Directors, and Principal Shareholders (B) (C) Parts and/or Sections of Title 12 of the Code of Federal Regulations 31 Extensions of Credit to Insiders √ 32 Lending Limits √ 215 Loans to Executive Officers, Directors, and Principal Shareholders of Member Banks √ √ (D) (E) 337.3 Limits on Extensions of Credit to Executive Officers, Directors, and Principal Shareholders of Insured Nonmember Banks √ 390.338 (state savings associations) Loans by Savings Associations to Their Executive Officers, Directors, and Principal Shareholders √ Dividend Restrictions—Parts and/or Sections of Title 12 of the United States Code 56 Prohibition on Withdrawal of Capital and Unearned Dividends √ √ 60 Dividends and Surplus Fund √ √ 1467a(f) Declaration of Dividend √ 1831o(d)(1) Prompt Corrective Action—Capital Distributions Restricted √ √ √ √ Parts and/or Sections of Title 12 of the Code of Federal Regulations 5 Subpart E Payment of Dividends √ 6.6 Prompt Corrective Action—Restrictions on Undercapitalized Institutions √ 208.5 Dividends and Other Distributions √ 208.45 Prompt Corrective Action—Restrictions on Undercapitalized Institutions √ 324.405 Prompt Corrective Action—Restrictions on Undercapitalized Institutions √ 390.342-.348 (state savings associations) Capital Distributions √ 390.455 (state savings associations) Prompt Corrective Action—Restrictions on Undercapitalized Institutions √ (A) Subsections (g) and (h) of section 22 of the Federal Reserve Act [12 U.S.C. 375a, 375b] (B) Applies only to insured Federal branches of foreign banks. (C) Applies only to insured State branches of foreign banks. (D) See 12 CFR 337.3. (E) See 12 CFR 390.338 (state savings associations). [74 FR 35745, July 20, 2009, as amended at 78 FR 55596, Sept. 10, 2013; 83 FR 17742, Apr. 24, 2018; 90 FR 55811, Dec. 4, 2025] Appendix B to Part 363—Illustrative Management Reports Table of Contents 1. General 2. Reporting Scenarios for Institutions that are Holding Company Subsidiaries 3. Illustrative Statements of Management's Responsibilities 4. Illustrative Reports on Management's Assessment of Compliance with Designated Laws and Regulations 5. Illustrative Reports on Management's Assessment of Internal Control Over Financial Reporting 6. Illustrative Management Report—Combined Statement of Management's Responsibilities, Report on Management's Assessment of Compliance With Designated Laws and Regulations, and Report on Management's Assessment of Internal Control Over Financial Reporting 7. Illustrative Cover Letter—Compliance by Holding Company Subsidiaries 1. General. Compliance by Holding Company Subsidiaries, 2. Reporting Scenarios for Institutions that are Holding Company Subsidiaries. (i) An institution that is a subsidiary of a holding company may satisfy the requirements for audited financial statements; management's statement of responsibilities; management's assessment of the institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions; management's assessment of the effectiveness of internal control over financial reporting, if applicable; and the independent public accountant's attestation on management's assertion as to the effectiveness of internal control over financial reporting, if applicable, at the insured depository institution level. (ii) An institution that is a subsidiary of a holding company may satisfy the requirements for audited financial statements; management's statement of responsibilities; management's assessment of the institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions; management's assessment of the effectiveness of internal control over financial reporting, if applicable; and the independent public accountant's attestation on management's assertion as to the effectiveness of internal control over financial reporting, if applicable, at the holding company level. (iii) An institution that is a subsidiary of a holding company may satisfy the requirement for audited financial statements at the holding company level and may satisfy the requirements for management's statement of responsibilities; management's assessment of the institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions; management's assessment of the effectiveness of internal control over financial reporting, if applicable; and the independent public accountant's attestation on management's assertion as to the effectiveness of internal control over financial reporting, if applicable, at the insured depository institution level. (iv) An institution that is a subsidiary of a holding company may satisfy the requirements for audited financial statements; management's statement of responsibilities; and management's assessment of the institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions at the insured depository institution level and may satisfy the requirements for the assessment by management of the effectiveness of internal control over financial reporting, if applicable; and the independent public accountant's attestation on management's assertion as to the effectiveness of internal control over financial reporting, if applicable, at the holding company level. (b) For an institution with total assets of $5 billion, as adjusted from time to time in accordance with 12 CFR 314.1, or more as of the beginning of its fiscal year, the assessment by management of the effectiveness of internal control over financial reporting and the independent public accountant's attestation on management's assertion as to the effectiveness of internal control over financial reporting, if applicable, must both be performed at the same level, i.e., (c) Financial statements prepared for regulatory reporting purposes encompass the schedules equivalent to the basic financial statements in an institution's appropriate regulatory report, e.g., e.g., 3. Illustrative Statements of Management's Responsibilities. (a) Statement Made at Insured Depository Institution Level Statement of Management's Responsibilities The management of ABC Depository Institution (the “Institution”) is responsible for preparing the Institution's annual financial statements in accordance with generally accepted accounting principles; for establishing and maintaining an adequate internal control structure and procedures for financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report]; and for complying with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions. ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (b) Statement Made at Holding Company Level Statement of Management's Responsibilities The management of BCD Holding Company (the “Company”) is responsible for preparing the Company's annual financial statements in accordance with generally accepted accounting principles; for establishing and maintaining an adequate internal control structure and procedures for financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report]; and for complying with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions. The following subsidiary institutions of the Company that are subject to Part 363 are included in this statement of management's responsibilities: [Identify the subsidiary institutions.] BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: 4. Illustrative Reports on Management's Assessment of Compliance with Designated Laws and Regulations. (a) Statement Made at Insured Depository Institution Level—Compliance With Designated Laws and Regulations Pertaining to Insider Loans and Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of ABC Depository Institution (the “Institution”) has assessed the Institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has concluded that the Institution complied with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (b) Statement Made at Insured Depository Institution Level—Noncompliance With Designated Laws and Regulations Pertaining to Both Insider Loans and Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of ABC Depository Institution (the “Institution”) has assessed the Institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has determined that, because of the instance(s) of noncompliance noted below, the Institution did not comply with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. [Identify and describe the instance or instances of noncompliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions, including appropriate qualitative and quantitative information to describe the nature, type, and severity of the noncompliance and the dollar amounts of the insider loan(s) and dividend(s) involved.] ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (c) Statement Made at Insured Depository Institution Level—Compliance With Designated Laws and Regulations Pertaining to Insider Loans and Noncompliance With Designated Laws and Regulations Pertaining to Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of ABC Depository Institution (the “Institution”) has assessed the Institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has concluded that the Institution complied with the Federal laws and regulations pertaining to insider loans during the fiscal year that ended on December 31, 20XX. Also, based upon its assessment, management has determined that, because of the instance(s) of noncompliance noted below, the Institution did not comply with the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. [Identify and describe the instance or instances of noncompliance with the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions, including appropriate qualitative and quantitative information to describe the nature, type, and severity of the noncompliance and the dollar amount(s) of the dividend(s) involved.] ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (d) Statement Made at Insured Depository Institution Level—Noncompliance With Designated Laws and Regulations Pertaining to Insider Loans and Compliance With Designated Laws and Regulations Pertaining to Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of ABC Depository Institution (the “Institution”) has assessed the Institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has determined that, because of the instance(s) of noncompliance noted below, the Institution did not comply with the Federal laws and regulations pertaining to insider loans during the fiscal year that ended on December 31, 20XX. Also, based upon its assessment, management has concluded that the Institution complied with the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. [Identify and describe the instance or instances of noncompliance with the Federal laws and regulations pertaining to insider loans, including appropriate qualitative and quantitative information to describe the nature, type, and severity of the noncompliance and the dollar amount(s) of the insider loan(s) involved.] ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (e) Statement Made at Holding Company Level—Compliance With Designated Laws and Regulations Pertaining to Insider Loans and Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of BCD Holding Company (the “Company”) has assessed the Company's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has concluded that the Company complied with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. The following subsidiary institutions of the Company that are subject to Part 363 are included in this assessment of compliance with these designated laws and regulations: [Identify the subsidiary institutions.] BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (f) Statement Made at Holding Company Level—Noncompliance With Designated Laws and Regulations Pertaining to Both Insider Loans and Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of BCD Holding Company (the “Company”) has assessed the Company's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. The following subsidiary institutions of the Company that are subject to Part 363 are included in this assessment of compliance with these designated laws and regulations: [Identify the subsidiary institutions.] Based upon its assessment, management has determined that, because of the instance(s) of noncompliance noted below, the Company did not comply with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. [Identify and describe the instance or instances of noncompliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions, including appropriate qualitative and quantitative information to identify the subsidiary institutions of the Company that are subject to Part 363 that had instances of noncompliance and describe the nature, type, and severity of the noncompliance and the dollar amount(s) of the insider loan(s) and dividend(s) involved.] BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (g) Statement Made at Holding Company Level—Compliance With Designated Laws and Regulations Pertaining to Insider Loans and Noncompliance With Designated Laws and Regulations Pertaining to Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of BCD Holding Company (the “Company”) has assessed the Company's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. The following subsidiary institutions of the Company that are subject to Part 363 are included in this assessment of compliance with these designated laws and regulations: [Identify the subsidiary institutions.] Based upon its assessment, management has concluded that the Company complied with the Federal laws and regulations pertaining to insider loans during the fiscal year that ended on December 31, 20XX. Also, based upon its assessment, management has determined that, because of the instance(s) of noncompliance noted below, the Company did not comply with the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. [Identify and describe the instance or instances of noncompliance with the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions, including appropriate qualitative and quantitative information to identify the subsidiary institutions of the Company that are subject to Part 363 that had instances of noncompliance and describe the nature, type, and severity of the noncompliance and the dollar amount(s) of the dividend(s) involved.] BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (h) Statement Made at Holding Company Level—Noncompliance With Designated Laws and Regulations Pertaining to Insider Loans and Compliance With Designated Laws and Regulations Pertaining to Dividend Restrictions Management's Assessment of Compliance With Designated Laws and Regulations The management of BCD Holding Company (the “Company”) has assessed the Company's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. The following subsidiary institutions of the Company that are subject to Part 363 are included in this assessment of compliance with these designated laws and regulations: [Identify the subsidiary institutions.] Based upon its assessment, management has determined that, because of the instance(s) of noncompliance noted below, the Company did not comply with the Federal laws and regulations pertaining to insider loans during the fiscal year that ended on December 31, 20XX. Also, based upon its assessment, management has concluded that the Company complied with the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. [Identify and describe the instance or instances of noncompliance with the Federal laws and regulations pertaining to insider loans, including appropriate qualitative and quantitative information to identify the subsidiary institutions of the Company that are subject to Part 363 that had instances of noncompliance and describe the nature, type, and severity of the noncompliance and the dollar amount(s) of the insider loan(s) involved.] BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: 5. Illustrative Reports on Management's Assessment of Internal Control Over Financial Reporting. (a) Statement Made at Insured Depository Institution Level—No Material Weaknesses Management's Assessment of Internal Control Over Financial Reporting ABC Depository Institution's (the “Institution”) internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements in accordance with accounting principles generally accepted in the United States of America and financial statements for regulatory reporting purposes, i.e., Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies and procedures may deteriorate. Management is responsible for establishing and maintaining effective internal control over financial reporting including controls over the preparation of regulatory financial statements. Management assessed the effectiveness of the Institution's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control—Integrated Framework. Internal Control—Integrated Framework. Management's assessment of the effectiveness of internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, has been audited by [name of auditing firm], an independent public accounting firm, as stated in their report dated March XX, 20XY. ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (b) Statement Made at Insured Depository Institution Level—One or More Material Weaknesses Management's Assessment of Internal Control Over Financial Reporting ABC Depository Institution's (the “Institution”) internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements in accordance with accounting principles generally accepted in the United States of America and financial statements for regulatory reporting purposes, i.e. Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies and procedures may deteriorate. Management is responsible for establishing and maintaining effective internal control over financial reporting including controls over the preparation of regulatory financial statements. Management assessed the effectiveness of the Institution's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control—Integrated Framework. [Identify and describe the material weakness or weaknesses.] Management's assessment of the effectiveness of internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, has been audited by [name of auditing firm], an independent public accounting firm, as stated in their report dated March XX, 20XY. ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (c) Statement Made at Holding Company Level—No Material Weaknesses Management's Assessment of Internal Control Over Financial Reporting BCD Holding Company's (the “Company”) internal control over financial reporting is a process designed and effected by those charged with governance, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements in accordance with accounting principles generally accepted in the United States of America and financial statements for regulatory reporting purposes, i.e. Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies and procedures may deteriorate. Management is responsible for establishing and maintaining effective internal control over financial reporting including controls over the preparation of regulatory financial statements. Management assessed the effectiveness of the Company's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control—Integrated Framework. Internal Control—Integrated Framework. Management's assessment of the effectiveness of internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, has been audited by [name of auditing firm], an independent public accounting firm, as stated in their report dated March XX, 20XY. BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (d) Statement Made at Holding Company Level—One or More Material Weaknesses Management's Assessment of Internal Control Over Financial Reporting BCD Holding Company's (the “Company”) internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements in accordance with accounting principles generally accepted in the United States of America and financial statements for regulatory reporting purposes, i.e. Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies and procedures may deteriorate. Management is responsible for establishing and maintaining effective internal control over financial reporting including controls over the preparation of regulatory financial statements. Management assessed the effectiveness of the Company's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control—Integrated Framework. [Identify and describe the material weakness or weaknesses.] Management's assessment of the effectiveness of internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, has been audited by [name of auditing firm], an independent public accounting firm, as stated in their report dated March XX, 20XY. BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: 6. Illustrative Management Report—Combined Statement of Management's Responsibilities, Report on Management's Assessment of Compliance With Designated Laws and Regulations, and Report on Management's Assessment of Internal Control Over Financial Reporting (a) Management Report Made at Insured Depository Institution Level—Compliance With Designated Laws and Regulations Pertaining to Insider Loans and Dividend Restrictions and No Material Weaknesses in Internal Control Over Financial Reporting Management Report Statement of Management's Responsibilities The management of ABC Depository Institution (the “Institution”) is responsible for preparing the Institution's annual financial statements in accordance with generally accepted accounting principles; for establishing and maintaining an adequate internal control structure and procedures for financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report]; and for complying with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions. Management's Assessment of Compliance With Designated Laws and Regulations The management of the Institution has assessed the Institution's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has concluded that the Institution complied with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Management's Assessment of Internal Control Over Financial Reporting The Institution's internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements in accordance with accounting principles generally accepted in the United States of America and financial statements for regulatory reporting purposes, i.e. Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies and procedures may deteriorate. Management assessed the effectiveness of the Institution's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control—Integrated Framework. Based upon its assessment, management has concluded that, as of December 31, 20XX, the Institution's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], is effective based on the criteria established in Internal Control—Integrated Framework. Management's assessment of the effectiveness of internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, has been audited by [name of auditing firm], an independent public accounting firm, as stated in their report dated March XX, 20XY. ABC Depository Institution John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: (b) Management Report Made at Holding Company Level—Compliance With Designated Laws and Regulations Pertaining to Insider Loans and Dividend Restrictions and No Material Weaknesses in Internal Control Over Financial Reporting Management Report [ Instruction In this management report, the following subsidiary institutions of the BCD Holding Company (the “Company”) that are subject to Part 363 are included in the statement of management's responsibilities; the report on management's assessment of compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions; and the report on management's assessment of internal control over financial reporting: [Identify the subsidiary institutions.] [ Instruction In this management report, the following subsidiary institutions of BCD Holding Company (the “Company”) that are subject to Part 363 are included in the statement of management's responsibilities and the report on management's assessment of compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions: [Identify the subsidiary institutions.] In addition, the following subsidiary institutions of the Company that are subject to Part 363 are included in the report on management's assessment of internal control over financial reporting: [Identify the subsidiary institutions.] Statement of Management's Responsibilities The management of the Company is responsible for preparing the Company's annual financial statements in accordance with generally accepted accounting principles; for establishing and maintaining an adequate internal control structure and procedures for financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report]; and for complying with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions. Management's Assessment of Compliance With Designated Laws and Regulations The management of the Company has assessed the Company's compliance with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Based upon its assessment, management has concluded that the Company complied with the Federal laws and regulations pertaining to insider loans and the Federal and, if applicable, State laws and regulations pertaining to dividend restrictions during the fiscal year that ended on December 31, 20XX. Management's Assessment of Internal Control Over Financial Reporting The Company's internal control over financial reporting is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of reliable financial statements in accordance with accounting principles generally accepted in the United States of America and financial statements for regulatory reporting purposes, i.e. Because of its inherent limitations, internal control over financial reporting may not prevent, or detect and correct misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies and procedures may deteriorate. Management assessed the effectiveness of the Company's internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, based on the framework set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control—Integrated Framework. Internal Control—Integrated Framework. Management's assessment of the effectiveness of internal control over financial reporting, including controls over the preparation of regulatory financial statements in accordance with the instructions for the [specify the regulatory report], as of December 31, 20XX, has been audited by [name of auditing firm], an independent public accounting firm, as stated in their report dated March XX, 20XY. BCD Holding Company John Doe, Chief Executive Officer Date: Jane Doe, Chief Financial Officer Date: 7. Illustrative Cover Letter—Compliance by Holding Company Subsidiaries. Compliance by Holding Company Subsidiaries To: (Appropriate State Bank Supervisor(s), if applicable) Dear [Insert addressees]: BCD Holding Company (the “Company”) is filing two copies of the Part 363 Annual Report for the fiscal year ended December 31, 20XX, on behalf of its insured depository institution subsidiaries listed in the chart below that are subject to Part 363. The Part 363 Annual Report contains audited comparative annual financial statements, the independent public accountant's report on the audited financial statements, management's statement of responsibilities, management's assessment of compliance with the Designated Laws and Regulations pertaining to insider loans and dividend restrictions, and [if applicable] management's assessment of and the independent public accountant's attestation report on internal control over financial reporting. The chart below also indicates the level (institution or holding company) at which the requirements of Part 363 are being satisfied for each listed insured depository institution subsidiary. [If applicable] The Company's other insured depository institution subsidiaries that are subject to Part 363, which comply with all of the Part 363 annual reporting requirements at the institution level, have filed [or will file] their Part 363 Annual Reports separately. Institutions subject to Part 363 Audited financial statements Management's Management's assessment of compliance with designated laws and regulations Management's Independent auditor's internal control ABC Depository Institution Holding Company Level Holding Company Level Holding Company Level Holding Company Level Holding Company Level. DEF Depository Institution Holding Company Level Institution Level Institution Level Institution Level Institution Level. If you have any questions regarding the annual report [or reports] of the Company's insured depository institution subsidiaries subject to Part 363 or if you need any further information, you may contact me at 987-654-3210. BCD Holding Company Date: [Insert officer's name and title.] [74 FR 35745, July 20, 2009, as amended at 90 FR 55811, Dec. 4, 2025]

Related documents

• 12 CFR Part 305 — XXX#634995
• 50 CFR Part 600 — Magnuson-Stevens Act Provisions#512148
• 50 CFR Part 622 — Fisheries of the Caribbean, Gulf of America, and South Atlantic#512149
• 50 CFR Part 635 — Atlantic Highly Migratory Species#512150
• 50 CFR Part 648 — Fisheries of the Northeastern United States#512151