FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Supervision and Policy Updates 
FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Asset Liability Management 
, 

, 

I 

I 

I 

I 

, 

, 

FDIC 

Asset Liability Management 

During a Challenging Interest Rate Environment 

Change in Effective Federal Funds Rate 

-

0.5

 1.0

 1.5

 2.0

 2.5

 3.0

 3.5

 4.0

 4.5

 5.0

- 5 10 15 20 25 30 35 40 

(%) 

’99-’00 

’15-’18 

’94-’95 

’04-’06 

’88-’89 

’22-’23 

Months Since Cycle Started → 

Source: Board of Governors of the Federal Reserve System (H.15 Selected Interest Rates, downloaded using the Federal Reserve Bank of Saint Louis’s FRED Tools). 

Change is calculated as the monthly average level. 

3 
- - ----------------- --

- - --· 

FDIC 

 

 

($ in Billions) 

Asset Liability Management 

During a Challenging Interest Rate Environment 

-16% 

-14% 

-12% 

-10% 

-8% 

-6% 

-4% 

-2% 

0% 

2% 

4% 

6%

 (80)

 (70)

 (60)

 (50)

 (40)

 (30)

 (20)

 (10)

 -

10

 20

 30 

Higher Rates Caused Long-Term Bond Values to Decline, 

Potentially Impacting Capital and Liquidity 

1Q15 2Q15 3Q15 4Q15 1Q16 2Q16 3Q16 4Q16 1Q17 2Q17 3Q17 4Q17 1Q18 2Q18 3Q18 4Q18 1Q19 2Q19 3Q19 4Q19 1Q20 2Q20 3Q20 4Q20 1Q21 2Q21 3Q21 4Q21 1Q22 2Q22 3Q22 4Q22 1Q23 

Unrealized G/L AFS Securities (L) Unrealized G/L HTM Securities (L) 10 Year Treasury CMT (R) 

Source: Call Report data for community banks as defined in the FDIC’s 2020 Community Banking Study and https://fred.stlouisfed.org/series/DGS10#0 

4 
FDIC 

 

 

 

 

 

Interagency Policy Statement on 

Funding and Liquidity Risk Management (2010) 

Effective corporate governance by 

Board and management 

A diverse mix of existing and potential 

future funding sources 

Appropriate strategies, policies, 

procedures, and limits 

Adequate levels of highly liquid 

marketable securities 

Comprehensive liquidity risk 

measurement and monitoring systems 

Comprehensive contingency funding 

plans (CFP) 

Active management of intraday 

collateral 

Internal controls and internal audit 

processes 

5 
FDIC 

 

 

 

 

 

Bank Term Funding Program (BTFP) Facility 

New temporary Federal Reserve 

borrowing facility 

Institutions eligible for primary 

credit under the Discount Window 

are eligible to borrow under BTFP 

Eligible collateral: collateral that 

was owned as of March 12, 2023 and 

is eligible for purchase by the 

Federal Reserve in open market 

conditions (12 CFR 201.108(b)) 

Advances can be requested until at 

least March 11, 2024 

Institutions are encouraged to 

obtain and confirm access to the 

Discount Window and the BTFP 

Testing the Discount Window, 

BTFP, and other back-up funding is 

prudent and supports operational 

readiness under the institution’s 

contingency funding plan 

Collateral value based on securities’ par value 

6 
FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Asset Liability Management 
FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Cybersecurity 
FDIC 

 

 

 

Ransomware Horizontal Review 

Background 

• Searched FDIC and other agency databases for ransomware attacks

over a two-year period (June 2019-May 2021)

• Searched for only attacks at FDIC-supervised institutions

Identified 36 ransomware attacks of interest 

• The FDIC reviewed forensic reports from, and conducted interviews

with, attacked financial institutions

7
FDIC 

 

What controls make a difference in defense? 

Internet (HTTP) Address 

Filtering Logging Operating System Hardening 

Multifactor 

Authentication 

Preventing Unauthorized 

Executables and Macros 

(including PowerShell) 

Least Privilege 

Implementation 

Backup Isolation and 

Viability Network Segmentation 

Intrusion Detection 

System / Intrusion 

Prevention System 

Implementation 

8
Information Technology 

Risk 

t:xamination 

Technical Examination Aid 

Pratt 10/3/2022 -Preliminary draft for internal rwlew only. This lll'/Slon WRJJ!,d.lJ9112i JIW)n 

examinalions of lioondal institutions 

Ransomware - Data Backup 

This TEA support$ an examiner's evaluation of partio.,lar <;0ntrols that may mitigate ran:;omware risk. 

It aoss-<eferences each control to tfle relevant examination proced1.-e and includes c01Tespondin11 

control t= to aid in evaluating the control's effectiveness. 

Examiners may coosid«these controls wtien evaluating a financial institution's inloonalioo security 

prowam. Alinandal lnstituUoo Is not 

r!!Qulre!d und« this TEA to implement any of the llste!d cootrols. 

Rath...-, th!>se controls b.iuie b.1.eu~d as potentially effective In mitigalingransomware ris.k. 

The Appendix 10 this TEA Includes citations and excl!l'pts lrom industry and govemmmt sources 

re~rdin~ similar controls effective •~inst ransomware lhr<>ats. These resources can be US<>ful for 

backgrOlDJ education or understanding thecontext of a particular control. 

For more information, se<>the 2022FDIC RMS Risk Advisc,yon li'ansoon.-arewflich may be found on the 

fT and Opro,tions Examiner Resources SharePoint site under Examination Guidance. 

TEAs are for internal FDIC use only Examin...-s should not cite TEAsin examination reyrtsor 

othl!fWise provide them to finaricial institution staff. 

Selected Data Backup Controls to Nltlcate Ransomware Risk 

• Risk-based policy defines data to back up, frequency, and protective mea=es (e.g., 

encryptloo). !JJIBU. cmss-refe

reiice: Support & Dellwt}I Module, Core Anatysls 

Procedure 

7. /+If( IT Booklet aoss-refermce: Business Continuity Mana9ement 

E.romiootion Procedums, Objective 6, ~ Jb. 

o Cootrol Test, Evaluate procroures for selecting nd protecting backup data 

and ensLiing management approves any exduded data. 

• Immutable, offline backups protect data from network attacks. !!!Jllli&.cross

­

referenr.e: Support & Delwe,y Madu/<>, Core Analysis Procedure 7. l+IEC rr Sook/et crossreference: 8usiness Conlinuily Maoogemrot Examiootion Procedures, Objective 6, ~ Jf. 

o Cootrol Test, Ass~ the reasonableness of bac:kup Isolation by reviewing 

network diaSJilmS or topologies. 

• ' Gold images• 

of ctitlca op«ating systems, applications, and configuration mes. 

support ransom ware attad< recovery procedures. ~ cross-refureoce: Support & 

Information Technology 

Risk 

mmabon 

Technical Examination Aid 

Draft 10/3/2022-Prelfmlnarydroft for IntMIOI rov/r;wonly. This vers/on~09l}),f,Jl2iifl)n 

exominalions of lioonciol instituoons 

Ransomware - Authentication 

This TEA supports an examiner's evaluation of particular controls that may miti gilte ransomware risk. 

ltc:ro55-references each control to the relevant examination procootxeand includes c01Tespondin11 

control tests to aid In ev luatlng thecontrol'seffectlveness. I 

Examiners may consld«these controls wlM!n evaluallng a financl I Institution's Information security 

pro warn. A fi

nancial institutl on is not required under this TEA to implament any of th<! listed controls. 

Rather, these controls b.;uie b.1,eQ jllfflii~d as potentially effective in mitigotingronsomware risk. 

The Appendix to this TEA includes citations and excerpts from industry and gov...-nment sources 

rev.ardinR similar controls effective av.ainst ransomware threats- These resources can be useful for 

backgrO\.IKI education or understanding the context of a partirularcontrot 

For more information, see the 1022 FDIC RMS Risk A.Jvisory on li'ansomwam which may be found on the 

IT and Op«atioos Examioor Resources SharePolnt site under Examlnatton Guidance. 

TEAs are for intl!l'nal FDIC use only. Examio«s should not dte TEAs in examination rl!l>OftS or 

oth""'ise provide them to finandal institution staff. 

~IKTM" Authentication Controls to Mltlpto Ransom111uo Risk 

• Identification of systems ensures appropriate authentication measures for users•. 

w.IH!&. cross-referer,ce; Management Mod11le, Core Analysis Procedure J 4. FF/EC fT 

8ook/N cross.mferenm Management Examination Procedures, Objoctiv(} 10_ 

~ 2. 

o Control Test Assess management's procedtxes for maintaining accurate 

systl!i'n inventories to ensure authentication controls ~to all us...-s. 

1 The term •use~ re

fers to any user ac.c.es.sing a financial ins:titution's irlormation sys.term, in duding 

employees, board membaerSa third parties, service accounts•, applications~ and devices.. The term "u~ does 

not incl~e customers t hat orJy access digita l banking services. For moce infOfTllation, see the discussion of 

•u,er,• in thoAutheoticcoon<mdAcW» to 8ank S<-m<e,ond S)'>lem>, AL-55-21121. 

• CIS Critical Sec.wity Controls V~ion 8 defines a se,vice account as a "dedicated account with escalated 

p,ivileges used for ru ooir,g appl

ications and other processes- SeMc,, accounts !WX~I~ b$ ~ just to own 

data and tonfiguration file,. They are no( in!end<d 10 be um by -le, ex<epl lor performing a>dmini>lralive 

operations.. 

FDIC 

Resulting Supervisory Adjustments 

9
FDIC 

 

 

 

 

 

 

Updated FFIEC Cybersecurity Resource 

Guide for Financial Institutions 

 The Federal Financial Institutions Examination Council (FFIEC) issued a

Cybersecurity Resource Guide for Financial Institutions in 2018.

 The Guide provides resources to assist financial institutions in meeting their

security control objectives and in preparing to respond to cyber incidents.

 The Guide includes resources to help:

 Assess cybersecurity readiness

 Perform exercises to test cybersecurity readiness

 Monitor threats and vulnerabilities

 Report incidents

10
FDIC 

 

 

 

 

Updated FFIEC Cybersecurity Resource 

Guide for Financial Institutions 

 On October 3, 2022, the FFIEC published an update to the Cybersecurity Resource

Guide that includes ransomware-specific resources:

 Cybersecurity and Infrastructure Security Agency (CISA) Cyber Security

Evaluation Tool: Ransomware Readiness Assessment

https://www.cisa.gov/downloading-and-installing-cset

 CISA Ransomware Guide

https://www.cisa.gov/sites/default/files/publications/CISA_MSISAC_Ransomware%20Guide_S508C.pdf

 CISA Stop Ransomware Resource Site

https://www.cisa.gov/stopransomware

 Conference of State Bank Supervisors Ransomware Self-Assessment Tool

https://www.csbs.org/ransomware-self-assessment-tool

11
FDIC 

 

 

 

 

 

 

CISA Cyber Hygiene Scanning 

 One listed resource worth highlighting is the cyber hygiene vulnerability

scanning service available from the Cybersecurity and Infrastructure

Security Agency (CISA) and listed under “CISA Cyber Resource Hub” in the

updated Guide.

 Vulnerability scanning evaluates an entity’s external network presence by

scanning public network interfaces for vulnerabilities.

 The CISA service is free and provides weekly vulnerability reports and adhoc alerts.

 Requests should be sent to vulnerability@cisa.dhs.gov, with the subject

line “Requesting Cyber Hygiene Services.”

12
FDIC 

 

 

 

 

Updated FFIEC Cybersecurity Resource 

Guide for Financial Institutions 

 On October 27, 2022, the FDIC shared the FFIEC Resource Guide with

financial institutions through Financial Institution Letter 50-2022.

 Additional information is available at:

FFIEC Cybersecurity Awareness webpage:

https://www.ffiec.gov/cybersecurity.htm

FDIC Cybersecurity Resources webpage:

https://www.fdic.gov/regulations/resources/cybersecurity/index.html

13
FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Cybersecurity 
FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Supervisory Guidance on Charging Overdraft Fees for 

Authorize Positive, Settle Negative Transactions 
FDIC 

 

 

 

Authorize Positive/Settle Negative 

FIL-19-2023: Supervised institutions must be aware of the 

consumer compliance risks associated with charging an 

overdraft fee on a transaction that was authorized against a 

positive balance but settled against a negative balance, a 

practice commonly referred to as “Authorize Positive, Settle 

Negative” (APSN). 

 APSN Background  Risk Mitigation Practices

 Potential Risks  Resources

15
FDIC 

 

 

 

 

 

 

 

 

APSN Background 

Overdraft fees may be charged against These situations may occur when using an 

consumer accounts when the account “available balance” or “ledger balance” in 

balance was sufficient at the time the assessing overdraft fees. Risk exists in 

transaction was initiated, but due to both the available & ledger balance 

transaction clearing & settlement scenarios but may be more pronounced in 

processes, was later posted to the the available balance scenario. customer’s account when their balance 

was negative. 

The FDIC has determined that the practice of assessing fees on transactions 

that authorized positive and settle negative are unfair. 

16
FDIC 

 

 

 

 

 

 

 

 

 

 

 

 

Potential Risks 

Federal Trade Commission Act 

• Violations of Section 5 prohibiting unfair or

deceptive acts or practices (UDAP).

• An unfair act or practice is one that causes or

is likely to cause substantial injury; cannot be

reasonably avoided, and is not outweighed by

countervailing benefits to consumer. Public

policy may also be considered.

Dodd-Frank Wall Street Reform and 

Consumer Protection Act of 2010 

• Violations of Section 1036(a)(1)(B) prohibiting

unfair, deceptive or abusive acts or practices

in connection with a consumer financial

product/service.

Basis of Unfairness 

• Unanticipated & unavoidable overdraft

fees may cause substantial injury to

consumers.

• The injury is not reasonably avoidable

because the consumer does not have

the ability to control payment systems

& overdraft processing systems.

• The methods of charging overdraft

fees are not outweighed by

countervailing benefits to consumers

or competition.

17
FDIC 

 

 

 

Risk Mitigation Practices 

• Review overdraft fee practices pertaining to APSN transactions to ensure customers are not

charged overdraft fees they cannot anticipate or avoid.

• Review third-party arrangements & ensure that third-party systems are compliant with all

applicable laws/regulations. This review should cover third-party system settings for charging

overdraft fees, methods for identifying & tracking transactions authorized on a positive balance

but settled on a negative balance, & maintaining data on such transactions.

Third-Party Arrangements

• Review disclosures/account agreements ensuring that practices for charging any fees on deposit

accounts are clearly, accurately & consistently communicated.

• However, disclosures alone generally do not fully address the risks in this area.

Review Disclosures/Account Agreements 

Review Policies/Procedures 

18
FDIC 

 

 

Resources 

FDIC 

FIL-81-2010 

CFPB Circular 

2022-06 

FDIC 

FIL-19-2023 

FDIC 

FIL-44-2008 

OCC Bulletin 

2023-12 

“Guidance for Managing Third-Party Risk” 

“Unanticipated Overdraft Fee Assessment Practices” 

“Supervisory Guidance on Charging Overdraft Fees for 

Authorize Positive, Settle Negative Transactions” 

“Overdraft Payment Supervisory Guidance” 

“Overdraft Protection Programs: 

Risk Management Practices” 

1927
FDII 

FEDERAL DEPOSIT INSURANCE CORPORATION 

 

FDIC Advisory Committee on 

Community Banking 

June 1, 2023 

Supervisory Guidance on Charging Overdraft Fees for 

Authorize Positive, Settle Negative Transactions