Compliance Counsel for Texas Community Banks

Regulation O is a Federal Reserve rule that limits how banks lend to their insiders: executive officers, directors, principal shareholders, and companies they control. In general, insider loans must be made on substantially the same terms, including interest rates and collateral, as comparable loans to outsiders, and must not involve more than normal risk. Larger insider loans need prior approval by the board, with the interested person not voting. There are also limits on total lending to each insider and to all insiders together, and tighter limits on loans to executive officers. Banks must keep records of insiders and their related interests. Mistakes can lead to examination criticism or penalties, so banks should review insider lending policies and lists regularly.

Most community banks review key policies at least once a year, and many regulators expect board approval of certain policies on an annual basis. Lending, BSA and anti-money-laundering, information security, vendor management and insider lending policies are common examples. Policies should also be updated whenever a law or regulation changes, the bank adds a new product or delivery channel, an exam raises findings, or the bank's size or risk profile shifts. An outdated policy that staff do not follow can be worse than none, because examiners compare written policy to actual practice. A practical approach is a yearly calendar that spreads reviews across the year and records board approval in the minutes. Kennedy Sutherland LLP reviews and updates bank policies.

Start by reading the findings carefully and sorting them by seriousness, from matters requiring attention to recommendations. The board should be briefed promptly, because regulators expect directors to oversee the response. A written response usually acknowledges each finding, describes the corrective action, names who is responsible, and gives realistic deadlines. Commitments should be specific and achievable, since examiners will check them at the next exam. If the bank disagrees with a finding, it can respond factually and, in some cases, use the agency's informal or formal appeal process. Serious findings or a proposed enforcement action call for legal counsel right away. Counsel can help draft the response, revise policies, and keep the record clean.

In June 2023, the Federal Reserve, FDIC and OCC issued joint final guidance on managing risks from third-party relationships, including fintech partners. It expects banks to plan before entering a relationship, perform due diligence on the partner, negotiate contracts that protect the bank, monitor the partner over time, and plan for an orderly exit. The level of oversight should match the risk and importance of the activity. Key contract points include compliance responsibilities, data security, complaint handling, audit and examination rights, and termination. The bank remains responsible for compliance with consumer protection and anti-money-laundering laws even when a partner performs the work. In September 2026 the agencies proposed replacement guidance (comments due December 16, 2026) and issued a statement on community banks' work with core service providers; the 2023 guidance stays in effect until the new guidance is final. Kennedy Sutherland LLP helps banks review and structure fintech partnerships.

Sources: Proposed third-party risk management guidance (FDIC, Sept. 11, 2026); Comment period extended to Dec. 16, 2026 (OCC, Nov. 13, 2026). Reviewed November 15, 2026.