VII.

APPENDICES
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 178 

FDIC Actions on Financial Institutions Applications 

2023 2022 2021

Deposit Insurance 5 17 15

Approved1 5 17 15

Denied 0 0 0

New Branches 398 481 493

Approved 398 481 493

Denied 0 0 0

Mergers 116 133 187

Approved 116 133 187

Denied 0 0 0

Requests for Consent to Serve2 61 52 47

Approved 58 50 47

 Section 19 0 6 5

Section 32 58 44 42

Denied 3 2 0

 Section 19 0 0 0

Section 32 3 2 0

Notices of Change in Control 15 23 34

Letters of Intent Not to Disapprove 15 22 34

Disapproved 0 1 0

Brokered Deposit Waivers 11 1 1

Approved 11 0 1

Denied 0 1 0

Savings Association Activities3 0 0 0

Approved 0 0 0

Denied 0 0 0

State Bank Activities/Investments4 13 25 25

Approved 13 25 25

Denied 0 0 0

Conversion of Mutual Institutions 4 4 4

Non-Objection 4 4 4

Objection 0 0 0

1 Includes deposit insurance applications filed on behalf of (1) newly organized institutions, (2) existing uninsured financial 

services companies seeking establishment as an insured institution, and (3) interim institutions established to facilitate merger or 

conversion transactions, and applications to facilitate the establishment of thrift holding companies.

2 Under Section 19 of the Federal Deposit Insurance (FDI) Act, an insured institution must receive FDIC approval before employing 

a person convicted of dishonesty or breach of trust. Under Section 32, the FDIC must approve any change of directors or senior 

executive officers at a state nonmember bank that is not in compliance with capital requirements or is otherwise in troubled 

condition. 

3 Section 28 of the FDI Act, in general, prohibits a federally-insured state savings association from engaging in an activity not 

permissible for a federal savings association and requires notices or applications to be filed with the FDIC.

4 Section 24 of the FDI Act, in general, prohibits a federally-insured state bank from engaging in an activity not permissible for a 

national bank and requires notices or applications to be filed with the FDIC.

A. Key Statistics
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 179 

Combined Risk and Consumer Enforcement Actions 

2023 2022 2021

Total Number of Actions Initiated by the FDIC 117 118 99

Termination of Insurance 12 16 7

Involuntary Termination 0 0 0

 Sec. 8a for Violations, Unsafe/Unsound Practices or Conditions 0 0 0

Voluntary Termination 12 16 7

 Sec. 8a by Order Upon Request 0 0 0

 Sec. 8p No Deposits 11 14 6

 Sec. 8q Deposits Assumed 1 2 1

Sec. 8b Consent and Cease-and-Desist Actions 28 19 10

 Notices of Charges Issued 4 0 1

 Orders to Pay Restitution 0 0 0

 Consent and Cease and Desist Orders 22 17 8

 Personal Cease and Desist Orders 2 2 1

Sec. 8e Removal/Prohibition of Director or Officer 43 28 25

 Notices of Intention to Remove/Prohibit 4 3 4

 Consent Orders 39 25 21

Sec. 8g Suspension/Removal When Charged With Crime 0 0 0

Civil Money Penalty Actions 28 27 30

 Sec. 7a Call Report Penalty Orders 0 0 0

 Sec. 8i Flood Act Civil Money Penalty Orders 24 24 26

 Sec. 8i Civil Money Penalty Notices of Assessment 4 3 4

Sec. 10c Orders of Investigation 4 8 2

Sec. 19 Waiver Orders 1 20 24

 Approved Section 19 Waiver Orders 1 20 24

 Denied Section 19 Waiver Orders 0 0 0

Sec. 32 Notices Disapproving Officer/Director’s Request for Review 0 0 0

Truth-in-Lending Act Reimbursement Actions 31 41 44

 Denials of Requests for Relief 0 0 0

 Grants of Relief 0 0 0

 Banks Making Reimbursement1 31 41 44

Suspicious Activity Reports (Open and closed institutions)1 407,304 421,118 360,121

Other Actions Not Listed2 1 0 1

1 These actions do not constitute the initiation of a formal enforcement action and, therefore, are not included in the total 

number of actions initiated.

2 The Other Actions Not Listed were, in 2023: 1 Order Dismissing Notice of Assessment of Civil Money Penalty and Order to Pay; in 

2022: 0; in 2021: 1 Supervisory Prompt Corrective Action Directive.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 180 

FDIC Insured Institutions Closed During 2023

Dollars in Thousands

Codes for Bank Class:

NM = State-chartered Bank that is 

 not a member of the Federal

 Reserve System

N = National Bank

SB = Savings Bank

SI = Stock and Mutual 

 Savings Bank

SM = State-chartered Bank that is a member 

 of the Federal Reserve System

SA = Savings Association

Name and Location

Bank 

Class

Number

of 

Deposit 

Accounts

Total 

Assets1

Total 

Deposits1

Estimated 

Loss to 

the DIF2

Date of 

Closing or 

Acquisition

Receiver/

Assuming Bank 

and Location

Purchase and Assumption - All Deposits

Silicon Valley Bank

Santa Clara, CA

SM 165,226 $209,026,000 $175,378,000 $2,618,2393 3/10/2023 First–Citizens Bank & 

Trust Company

Raleigh, North Carolina.

Signature Bank

New York, NY

NM 175,044 $110,363,650 $88,612,911 $602,2753 3/12/2023 Flagstar Bank, 

National Association, 

Hicksville, New York 

Citizens Bank

Sac City, IA

NM 1,965 $60,448 $52,311 $14,804 11/3/2023 Iowa Trust & 

Savings Bank

Emmetsburg, Iowa

Whole Bank Purchase and Assumption - All Deposits

First Republic Bank

San Francisco, CA

NM 1,095,457 $212,638,872 $176,436,706 $16,657,086 5/1/2023 JPMorgan Chase Bank, 

National Association, 

Columbus, Ohio 

Heartland 

Tri-State Bank

Elkhart, KS

SM 5,404 $139,446 $130,110 $54,167 7/28/2023 Dream First Bank, 

National Association

Syracuse, Kansas

1 Total Assets and Total Deposits data are based upon the last Call Report filed by the institution prior to failure. 

2 Estimated losses are as of December 31, 2023. Estimated losses are routinely adjusted with updated information from new appraisals and asset sales, 

which ultimately affect the asset values and projected recoveries. Represents the estimated loss to the DIF from deposit insurance obligations. 

3 The estimated losses for Silicon Valley Bank and Signature Bank exclude $20.4 billion of estimated losses for uninsured deposits pursuant to a systemic 

risk exception.
Estimated Insured Deposits and the Deposit Insurance Fund, 

December 31, 1934, through September 30, 20231

Dollars in Millions (except Insurance Coverage)

Deposits in Insured 

Institutions2

Insurance Fund as

a Percentage of

Year

Insurance

Coverage2

Total

Domestic 

Deposits

Est. Insured

Deposits

Percentage

of Domestic 

Deposits

Deposit

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

2023 $250,000 $17,213,780 $10,592,562 61.5 $119,339.0 0.69 1.13

2022 250,000 17,778,221 10,265,997 57.7 128,218.0 0.72 1.25

2021 250,000 18,237,236 9,923,221 54.4 123,141.0 0.68 1.24

2020 250,000 16,339,026 9,103,253 55.7 117,896.8 0.72 1.30

2019 250,000 13,262,843 7,828,163 59.0 110,346.9 0.83 1.41

2018 250,000 12,659,406 7,525,204 59.4 102,608.9 0.81 1.36 

2017 250,000 12,129,503 7,154,379 59.0 92,747.5 0.76 1.30 

2016 250,000 11,693,371 6,915,663 59.1 83,161.5 0.71 1.20

2015 250,000 10,952,922 6,518,675 59.5 72,600.2 0.66 1.11

2014 250,000 10,410,687 6,195,554 59.5 62,780.2 0.60 1.01

2013 250,000 9,825,479 5,998,238 61.0 47,190.8 0.48 0.79

2012 250,000 9,474,720 7,402,053 78.1 32,957.8 0.35 0.45

2011 250,000 8,782,291 6,973,483 79.4 11,826.5 0.13 0.17

2010 250,000 7,887,858 6,301,542 79.9 (7,352.2) (0.09) (0.12)

2009 250,000 7,705,354 5,407,773 70.2 (20,861.8) (0.27) (0.39)

2008 100,000 7,505,408 4,750,783 63.3 17,276.3 0.23 0.36

2007 100,000 6,921,678 4,292,211 62.0 52,413.0 0.76 1.22 

2006 100,000 6,640,097 4,153,808 62.6 50,165.3 0.76 1.21

2005 100,000 6,229,753 3,890,930 62.5 48,596.6 0.78 1.25 

2004 100,000 5,724,621 3,622,059 63.3 47,506.8 0.83 1.31

2003 100,000 5,223,922 3,452,497 66.1 46,022.3 0.88 1.33 

2002 100,000 4,916,078 3,383,598 68.8 43,797.0 0.89 1.29 

2001 100,000 4,564,064 3,215,581 70.5 41,373.8 0.91 1.29 

2000 100,000 4,211,895 3,055,108 72.5 41,733.8 0.99 1.37

1999 100,000 3,885,826 2,869,208 73.8 39,694.9 1.02 1.38 

1998 100,000 3,817,150 2,850,452 74.7 39,452.1 1.03 1.38 

1997 100,000 3,602,189 2,746,477 76.2 37,660.8 1.05 1.37

1996 100,000 3,454,556 2,690,439 77.9 35,742.8 1.03 1.33 

1995 100,000 3,318,595 2,663,873 80.3 28,811.5 0.87 1.08

1994 100,000 3,184,410 2,588,619 81.3 23,784.5 0.75 0.92

1993 100,000 3,220,302 2,602,781 80.8 14,277.3 0.44 0.55

1992 100,000 3,275,530 2,677,709 81.7 178.4 0.01 0.01

1991 100,000 3,331,312 2,733,387 82.1 (6,934.0) (0.21) (0.25)

1990 100,000 3,415,464 2,784,838 81.5 4,062.7 0.12 0.15

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 181 
Estimated Insured Deposits and the Deposit Insurance Fund, 

December 31, 1934, through September 30, 20231 (continued)

Dollars in Millions (except Insurance Coverage) 

Deposits in Insured 

Institutions2

Insurance Fund as

a Percentage of

Year

Insurance

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage

of Domestic 

Deposits

Deposit

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

1989 100,000 3,412,503 2,755,471 80.7 13,209.5 0.39 0.48

1988 100,000 2,337,080 1,756,771 75.2 14,061.1 0.60 0.80

1987 100,000 2,198,648 1,657,291 75.4 18,301.8 0.83 1.10

1986 100,000 2,162,687 1,636,915 75.7 18,253.3 0.84 1.12

1985 100,000 1,975,030 1,510,496 76.5 17,956.9 0.91 1.19

1984 100,000 1,805,334 1,393,421 77.2 16,529.4 0.92 1.19

1983 100,000 1,690,576 1,268,332 75.0 15,429.1 0.91 1.22 

1982 100,000 1,544,697 1,134,221 73.4 13,770.9 0.89 1.21

1981 100,000 1,409,322 988,898 70.2 12,246.1 0.87 1.24

1980 100,000 1,324,463 948,717 71.6 11,019.5 0.83 1.16

1979 40,000 1,226,943 808,555 65.9 9,792.7 0.80 1.21

1978 40,000 1,145,835 760,706 66.4 8,796.0 0.77 1.16

1977 40,000 1,050,435 692,533 65.9 7,992.8 0.76 1.15

1976 40,000 941,923 628,263 66.7 7,268.8 0.77 1.16

1975 40,000 875,985 569,101 65.0 6,716.0 0.77 1.18

1974 40,000 833,277 520,309 62.4 6,124.2 0.73 1.18

1973 20,000 766,509 465,600 60.7 5,615.3 0.73 1.21

1972 20,000 697,480 419,756 60.2 5,158.7 0.74 1.23 

1971 20,000 610,685 374,568 61.3 4,739.9 0.78 1.27

1970 20,000 545,198 349,581 64.1 4,379.6 0.80 1.25 

1969 20,000 495,858 313,085 63.1 4,051.1 0.82 1.29 

1968 15,000 491,513 296,701 60.4 3,749.2 0.76 1.26

1967 15,000 448,709 261,149 58.2 3,485.5 0.78 1.33 

1966 15,000 401,096 234,150 58.4 3,252.0 0.81 1.39

1965 10,000 377,400 209,690 55.6 3,036.3 0.80 1.45

1964 10,000 348,981 191,787 55.0 2,844.7 0.82 1.48

1963 10,000 313,304 177,381 56.6 2,667.9 0.85 1.50 

1962 10,000 297,548 170,210 57.2 2,502.0 0.84 1.47

1961 10,000 281,304 160,309 57.0 2,353.8 0.84 1.47

1960 10,000 260,495 149,684 57.5 2,222.2 0.85 1.48

1959 10,000 247,589 142,131 57.4 2,089.8 0.84 1.47

1958 10,000 242,445 137,698 56.8 1,965.4 0.81 1.43

1957 10,000 225,507 127,055 56.3 1,850.5 0.82 1.46

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 182 
Estimated Insured Deposits and the Deposit Insurance Fund, 

December 31, 1934, through September 30, 20231

 (continued)

Dollars in Millions (except Insurance Coverage) 

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

1956 10,000 219,393 121,008 55.2 1,742.1 0.79 1.44 

1955 10,000 212,226 116,380 54.8 1,639.6 0.77 1.41 

1954 10,000 203,195 110,973 54.6 1,542.7 0.76 1.39 

1953 10,000 193,466 105,610 54.6 1,450.7 0.75 1.37 

1952 10,000 188,142 101,841 54.1 1,363.5 0.72 1.34 

1951 10,000 178,540 96,713 54.2 1,282.2 0.72 1.33 

1950 10,000 167,818 91,359 54.4 1,243.9 0.74 1.36 

1949 5,000 156,786 76,589 48.8 1,203.9 0.77 1.57 

1948 5,000 153,454 75,320 49.1 1,065.9 0.69 1.42 

1947 5,000 154,096 76,254 49.5 1,006.1 0.65 1.32 

1946 5,000 148,458 73,759 49.7 1,058.5 0.71 1.44 

1945 5,000 157,174 67,021 42.6 929.2 0.59 1.39 

1944 5,000 134,662 56,398 41.9 804.3 0.60 1.43 

1943 5,000 111,650 48,440 43.4 703.1 0.63 1.45 

1942 5,000 89,869 32,837 36.5 616.9 0.69 1.88 

1941 5,000 71,209 28,249 39.7 553.5 0.78 1.96 

1940 5,000 65,288 26,638 40.8 496.0 0.76 1.86 

1939 5,000 57,485 24,650 42.9 452.7 0.79 1.84 

1938 5,000 50,791 23,121 45.5 420.5 0.83 1.82 

1937 5,000 48,228 22,557 46.8 383.1 0.79 1.70 

1936 5,000 50,281 22,330 44.4 343.4 0.68 1.54 

1935 5,000 45,125 20,158 44.7 306.0 0.68 1.52 

1934 5,000 40,060 18,075 45.1 291.7 0.73 1.61 

1 For 2023, figures are as of September 30; all other prior years are as of December 31. Prior to 1989, figures are for the Bank Insurance Fund (BIF) only 

and exclude insured branches of foreign banks. For 1989 to 2005, figures represent the sum of the BIF and Savings Association Insurance Fund (SAIF) 

amounts; for 2006 to 2023, figures are for DIF. Amounts for 1989-2023 include insured branches of foreign banks. Prior to year-end 1991, insured 

deposits were estimated using percentages determined from June Call and Thrift Financial Reports.

2 The year-end 2008 coverage limit and estimated insured deposits do not reflect the temporary increase to $250,000 then in effect under the Emergency 

Economic Stabilization Act of 2008. The Dodd-Frank Wall Street Reform and Consumer Protection (Dodd-Frank) Act made this coverage limit permanent. 

The year-end 2009 coverage limit and estimated insured deposits reflect the $250,000 coverage limit. The Dodd-Frank Act also temporarily provided 

unlimited coverage for non-interest bearing transaction accounts for two years beginning December 31, 2010. Coverage for certain retirement accounts 

increased to $250,000 in 2006. Initial coverage limit was $2,500 from January 1 to June 30, 1934.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 183 
Income and Expenses, Deposit Insurance Fund, from Beginning of Operations, 

September 11, 1933, through December 31, 2023 

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment

Income

Assessment

Credits

Investment

and Other

Effective

Assessment

Rate1 Total

Provision

for 

Ins. Losses

Admin.

and 

Operating

Expenses2

Interest

& Other Ins. 

Expenses

Funding

Transfer

from the 

FSLIC 

Resolution

Fund

Net Income/

(Loss)

TOTAL $323,111.6 $246,497.3 $12,157.2 $88,771.5 $201,599.9 $147,010.0 $42,807.4 $11,782.6 $139.5 $121,651.2

2023 35,995.8 33,188.03 0.0 2,807.8 0.0614% 45,374.7 40,950.83 2,126.0 2,297.9 0.0 (9,378.9)

2022 9,606.7 8,310.8 0.0 $1,295.9 0.0396% 1,803.5 (82.9) 1,882.9 3.5 0.0 7,803.2

2021 8,153.4 7,080.2 0.0 1,073.2 0.0356% 1,705.3 (143.7) 1,842.7 6.3 0.0 6,448.1

2020 8,796.5 7,153.9 60.7 $1,703.3 0.0395% 1,691.9 (157.3) 1,846.5 2.7 0.0 7,104.6

2019 7,095.3 5,642.7 703.6 2,156.2 0.0312% 513.2 (1,285.5) 1,795.6 3.1 0.0 6,582.1

2018 11,170.8 9,526.7 0.0 1,644.1 0.0626% 1,205.2 (562.6) 1,764.7 3.1 0.0 9,965.6

2017 11,663.7 10,594.8 0.0 1,068.9 0.0716% 1,558.2 (183.1) 1,739.4 2.0 0.0 10,105.5

2016 10,674.1 9,986.6 0.0 687.5 0.0699% 150.6 (1,567.9) 1,715.0 3.5 0.0 10,523.5

2015 9,303.5 8,846.8 0.0 456.7 0.0647% (553.2) (2,251.3) 1,687.2 10.9 0.0 9,856.7

2014 8,965.1 8,656.1 0.0 309.0 0.0663% (6,634.7) (8,305.5) 1,664.3 6.5 0.0 15,599.8

2013 10,458.9 9,734.2 0.0 724.7 0.0775% (4,045.9) (5,659.4) 1,608.7 4.8 0.0 14,504.8

2012 18,522.3 12,397.2 0.2 6,125.3 0.1012% (2,599.0) (4,222.6) 1,777.5 (153.9) 0.0 21,121.3

2011 16,342.0 13,499.5 0.9 2,843.4 0.1115% (2,915.4) (4,413.6) 1,625.4 (127.2) 0.0 19,257.4

2010 13,379.9 13,611.2 0.8 (230.5) 0.1772% 75.0 (847.8) 1,592.6 (669.8) 0.0 13,304.9 

2009 24,706.4 17,865.4 148.0 6,989.0 0.2330% 60,709.0 57,711.8 1,271.1 1,726.1 0.0 (36,002.6)

2008 7,306.3 4,410.4 1,445.9 4,341.8 0.0418% 44,339.5 41,838.8 1,033.5 1,467.2 0.0 (37,033.2)

2007 3,196.2 3,730.9 3,088.0 2,553.3 0.0093% 1,090.9 95.0 992.6 3.3 0.0 2,105.3

2006 2,643.5 31.9 0.0 2,611.6 0.0005% 904.3 (52.1) 950.6 5.8 0.0 1,739.2

2005 2,420.5 60.9 0.0 2,359.6 0.0010% 809.3 (160.2) 965.7 3.8 0.0 1,611.2

2004 2,240.3 104.2 0.0 2,136.1 0.0019% 607.6 (353.4) 941.3 19.7 0.0 1,632.7

2003 2,173.6 94.8 0.0 2,078.8 0.0019% (67.7) (1,010.5) 935.5 7.3 0.0 2,241.3

2002 2,384.7 107.8 0.0 2,276.9 0.0023% 719.6 (243.0) 945.1 17.5 0.0 1,665.1 

2001 2,730.1 83.2 0.0 2,646.9 0.0019% 3,123.4 2,199.3 887.9 36.2 0.0 (393.3)

2000 2,570.1 64.3 0.0 2,505.8 0.0016% 945.2 28.0 883.9 33.3 0.0 1,624.9

1999 2,416.7 48.4 0.0 2,368.3 0.0013% 2,047.0 1,199.7 823.4 23.9 0.0 369.7

1998 2,584.6 37.0 0.0 2,547.6 0.0010% 817.5 (5.7) 782.6 40.6 0.0 1,767.1

1997 2,165.5 38.6 0.0 2,126.9 0.0011% 247.3 (505.7) 677.2 75.8 0.0 1,918.2

1996 7,156.8 5,294.2 0.0 1,862.6 0.1622% 353.6 (417.2) 568.3 202.5 0.0 6,803.2 

1995 5,229.2 3,877.0 0.0 1,352.2 0.1238% 202.2 (354.2) 510.6 45.8 0.0 5,027.0 

1994 7,682.1 6,722.7 0.0 959.4 0.2192% (1,825.1) (2,459.4) 443.2 191.1 0.0 9,507.2

1993 7,354.5 6,682.0 0.0 672.5 0.2157% (6,744.4) (7,660.4) 418.5 497.5 0.0 14,098.9

1992 6,479.3 5,758.6 0.0 720.7 0.1815% (596.8) (2,274.7) 614.84 1,063.1 35.4 7,111.5

1991 5,886.5 5,254.0 0.0 632.5 0.1613% 16,925.3 15,496.2 326.1 1,103.0 42.4 (10,996.4)

1990 3,855.3 2,872.3 0.0 983.0 0.0868% 13,059.3 12,133.1 275.6 650.6 56.1 (9,147.9)

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 184 
Income and Expenses, Deposit Insurance Fund, from Beginning of Operations, 

September 11, 1933, through December 31, 2023 (continued)

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment

Income

Assessment

Credits

Investment

and Other

Effective

Assessment

Rate1 Total

Provision

for 

Ins. Losses

Admin.

and 

Operating

Expenses2

Interest

& Other Ins. 

Expenses

Funding

Transfer

from the

 FSLIC 

Resolution

Fund

Net Income/

(Loss)

1989 3,494.8 1,885.0 0.0 1,609.8 0.0816% 4,352.2 3,811.3 219.9 321.0 5.6 (851.8)

1988 3,347.7 1,773.0 0.0 1,574.7 0.0825% 7,588.4 6,298.3 223.9 1,066.2 0.0 (4,240.7)

1987 3,319.4 1,696.0 0.0 1,623.4 0.0833% 3,270.9 2,996.9 204.9 69.1 0.0 48.5 

1986 3,260.1 1,516.9 0.0 1,743.2 0.0787% 2,963.7 2,827.7 180.3 (44.3) 0.0 296.4 

1985 3,385.5 1,433.5 0.0 1,952.0 0.0815% 1,957.9 1,569.0 179.2 209.7 0.0 1,427.6 

1984 3,099.5 1,321.5 0.0 1,778.0 0.0800% 1,999.2 1,633.4 151.2 214.6 0.0 1,100.3

1983 2,628.1 1,214.9 164.0 1,577.2 0.0714% 969.9 675.1 135.7 159.1 0.0 1,658.2 

1982 2,524.6 1,108.9 96.2 1,511.9 0.0769% 999.8 126.4 129.9 743.5 0.0 1,524.8

1981 2,074.7 1,039.0 117.1 1,152.8 0.0714% 848.1 320.4 127.2 400.5 0.0 1,226.6 

1980 1,310.4 951.9 521.1 879.6 0.0370% 83.6 (38.1) 118.2 3.5 0.0 1,226.8 

1979 1,090.4 881.0 524.6 734.0 0.0333% 93.7 (17.2) 106.8 4.1 0.0 996.7

1978 952.1 810.1 443.1 585.1 0.0385% 148.9 36.5 103.3 9.1 0.0 803.2 

1977 837.8 731.3 411.9 518.4 0.0370% 113.6 20.8 89.3 3.5 0.0 724.2

1976 764.9 676.1 379.6 468.4 0.0370% 212.3 28.0 180.45 3.9 0.0 552.6 

1975 689.3 641.3 362.4 410.4 0.0357% 97.5 27.6 67.7 2.2 0.0 591.8

1974 668.1 587.4 285.4 366.1 0.0435% 159.2 97.9 59.2 2.1 0.0 508.9

1973 561.0 529.4 283.4 315.0 0.0385% 108.2 52.5 54.4 1.3 0.0 452.8 

1972 467.0 468.8 280.3 278.5 0.0333% 65.7 10.1 49.6 6.06 0.0 401.3

1971 415.3 417.2 241.4 239.5 0.0345% 60.3 13.4 46.9 0.0 0.0 355.0 

1970 382.7 369.3 210.0 223.4 0.0357% 46.0 3.8 42.2 0.0 0.0 336.7

1969 335.8 364.2 220.2 191.8 0.0333% 34.5 1.0 33.5 0.0 0.0 301.3

1968 295.0 334.5 202.1 162.6 0.0333% 29.1 0.1 29.0 0.0 0.0 265.9 

1967 263.0 303.1 182.4 142.3 0.0333% 27.3 2.9 24.4 0.0 0.0 235.7

1966 241.0 284.3 172.6 129.3 0.0323% 19.9 0.1 19.8 0.0 0.0 221.1 

1965 214.6 260.5 158.3 112.4 0.0323% 22.9 5.2 17.7 0.0 0.0 191.7

1964 197.1 238.2 145.2 104.1 0.0323% 18.4 2.9 15.5 0.0 0.0 178.7

1963 181.9 220.6 136.4 97.7 0.0313% 15.1 0.7 14.4 0.0 0.0 166.8

1962 161.1 203.4 126.9 84.6 0.0313% 13.8 0.1 13.7 0.0 0.0 147.3

1961 147.3 188.9 115.5 73.9 0.0323% 14.8 1.6 13.2 0.0 0.0 132.5 

1960 144.6 180.4 100.8 65.0 0.0370% 12.5 0.1 12.4 0.0 0.0 132.1 

1959 136.5 178.2 99.6 57.9 0.0370% 12.1 0.2 11.9 0.0 0.0 124.4

1958 126.8 166.8 93.0 53.0 0.0370% 11.6 0.0 11.6 0.0 0.0 115.2 

1957 117.3 159.3 90.2 48.2 0.0357% 9.7 0.1 9.6 0.0 0.0 107.6

1956 111.9 155.5 87.3 43.7 0.0370% 9.4 0.3 9.1 0.0 0.0 102.5

1955 105.8 151.5 85.4 39.7 0.0370% 9.0 0.3 8.7 0.0 0.0 96.8 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 185 
Income and Expenses, Deposit Insurance Fund, from Beginning of Operations, 

September 11, 1933, through December 31, 2023 (continued)

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment

Income

Assessment

Credits

Investment

and Other

Effective

Assessment

Rate1 Total

Provision

for 

Ins. Losses

Admin.

and 

Operating

Expenses2

Interest

& Other Ins. 

Expenses

Funding

Transfer

from the

 FSLIC 

Resolution

Fund

Net Income/

(Loss)

1954 99.7 144.2 81.8 37.3 0.0357% 7.8 0.1 7.7 0.0 0.0 91.9

1953 94.2 138.7 78.5 34.0 0.0357% 7.3 0.1 7.2 0.0 0.0 86.9 

1952 88.6 131.0 73.7 31.3 0.0370% 7.8 0.8 7.0 0.0 0.0 80.8 

1951 83.5 124.3 70.0 29.2 0.0370% 6.6 0.0 6.6 0.0 0.0 76.9

1950 84.8 122.9 68.7 30.6 0.0370% 7.8 1.4 6.4 0.0 0.0 77.0

1949 151.1 122.7 0.0 28.4 0.0833% 6.4 0.3 6.1 0.0 0.0 144.7

1948 145.6 119.3 0.0 26.3 0.0833% 7.0 0.7 6.37 0.0 0.0 138.6 

1947 157.5 114.4 0.0 43.1 0.0833% 9.9 0.1 9.8 0.0 0.0 147.6

1946 130.7 107.0 0.0 23.7 0.0833% 10.0 0.1 9.9 0.0 0.0 120.7

1945 121.0 93.7 0.0 27.3 0.0833% 9.4 0.1 9.3 0.0 0.0 111.6

1944 99.3 80.9 0.0 18.4 0.0833% 9.3 0.1 9.2 0.0 0.0 90.0 

1943 86.6 70.0 0.0 16.6 0.0833% 9.8 0.2 9.6 0.0 0.0 76.8

1942 69.1 56.5 0.0 12.6 0.0833% 10.1 0.5 9.6 0.0 0.0 59.0

1941 62.0 51.4 0.0 10.6 0.0833% 10.1 0.6 9.5 0.0 0.0 51.9

1940 55.9 46.2 0.0 9.7 0.0833% 12.9 3.5 9.4 0.0 0.0 43.0 

1939 51.2 40.7 0.0 10.5 0.0833% 16.4 7.2 9.2 0.0 0.0 34.8 

1938 47.7 38.3 0.0 9.4 0.0833% 11.3 2.5 8.8 0.0 0.0 36.4 

1937 48.2 38.8 0.0 9.4 0.0833% 12.2 3.7 8.5 0.0 0.0 36.0 

1936 43.8 35.6 0.0 8.2 0.0833% 10.9 2.6 8.3 0.0 0.0 32.9 

1935 20.8 11.5 0.0 9.3 0.0833% 11.3 2.8 8.5 0.0 0.0 9.5

1933-

34 7.0 0.0 0.0 7.0 N/A 10.0 0.2 9.8 0.0 0.0 (3.0)

1

 The effective assessment rate is calculated from annual assessment income (net of assessment credits), excluding transfers to the Financing Corporation (FICO), 

Resolution Funding Corporation (REFCORP) and FSLIC Resolution Fund, divided by the average assessment base. Figures represent only BIF-insured institutions prior 

to 1990, and BIF- and SAIF-insured institutions from 1990 through 2005. After 1995, all thrift closings became the responsibility of the FDIC and amounts are reflected in 

the SAIF. Beginning in 2006, figures are for the DIF.

The annualized assessment rate for 2023 is based on full year assessment income divided by a four quarter average of 2023 quarterly assessment base amounts. The 

assessment base for fourth quarter 2023 was estimated using the third quarter 2023 assessment base and an assumed quarterly growth rate of one percent.

Historical Assessment Rates:

1934 – 1949 The statutory assessment rate was 0.0833 percent.

1950 – 1984 The effective assessment rates varied from the statutory rate of 0.0833 percent due to assessment credits provided in those years.

1985 – 1989 The statutory assessment rate was 0.0833 percent (no credits were given).

1990 The statutory rate increased to 0.12 percent.

1991 – 1992 The statutory rate increased to a minimum of 0.15 percent. The effective rates in 1991 and 1992 varied because the FDIC exercised new authority to 

increase assessments above the statutory minimum rate when needed.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 186 
1993 – 2006 Beginning in 1993, the effective rate was based on a risk-related premium system under which institutions paid assessments in the range of 0.23 percent 

to 0.31 percent. In May 1995, the BIF reached the mandatory recapitalization level of 1.25 percent. As a result, BIF assessment rates were reduced to 

a range of 0.04 percent to 0.31 percent of assessable deposits, effective June 1995, and assessments totaling $1.5 billion were refunded in September 

1995. Assessment rates for the BIF were lowered again to a range of 0 to 0.27 percent of assessable deposits, effective the start of 1996. In 1996, the 

SAIF collected a one-time special assessment of $4.5 billion. Subsequently, assessment rates for the SAIF were lowered to the same range as the BIF, 

effective October 1996. This range of rates remained unchanged for both funds through 2006.

2007 – 2008 As part of the implementation of the Federal Deposit Insurance Reform Act of 2005, assessment rates were increased to a range of 0.05 percent to 0.43 

percent of assessable deposits effective at the start of 2007, but many institutions received a one-time assessment credit ($4.7 billion in total) to offset 

the new assessments.

2009 – 2011 For the first quarter of 2009, assessment rates were increased to a range of 0.12 percent to 0.50 percent of assessable deposits. On June 30, 2009, a 

special assessment was imposed on all insured banks and thrifts, which amounted in aggregate to approximately $5.4 billion. For 8,106 institutions, 

with $9.3 trillion in assets, the special assessment was 5 basis points of each insured institution’s assets minus tier one capital; 89 other institutions, 

with assets of $4.0 trillion, had their special assessment capped at 10 basis points of their second quarter assessment base. From the second quarter of 

2009 through the first quarter of 2011, initial assessment rates ranged between 0.12 percent and 0.45 percent of assessable deposits. Initial rates were 

subject to further adjustments.

2011 – 2016 Beginning in the second quarter of 2011, the assessment base changed to average total consolidated assets less average tangible equity (with certain 

adjustments for banker’s banks and custodial banks), as required by the Dodd-Frank Act. The FDIC implemented a new assessment rate schedule at the 

same time to conform to the larger assessment base. Initial assessment rates were lowered to a range of 0.05 percent to 0.35 percent of the new base. 

The annualized assessment rates averaged approximately 17.6 cents per $100 of assessable deposits for the first quarter of 2011 and 11.1 cents per $100 

of the new base for the last three quarters of 2011 (which is shown in the table).

2016 Beginning July 1, 2016, initial assessment rates were lowered from a range of 5 basis points to 35 basis points to a range of 3 basis points to 30 basis 

points, and an additional surcharge was imposed on large banks (generally institutions with $10 billion or more in assets) of 4.5 basis points of their 

assessment base (after making adjustments).

2018 The 4.5 basis point surcharge imposed on large banks ended effective October 1, 2018. The annualized assessment rates averaged approximately 7.2 

cents per $100 of the assessable base for the first three quarters of 2018 and 3.5 cents per $100 of the assessment base for the last quarter of 2018. The 

full year annualized assessment rate averaged 6.3 cents per $100 (which is shown in the table).

2019 Assessment income for 2019 was reduced by small bank credits of $703.6 million.

2020 Assessment income for 2020 was reduced by small bank credits of $60.7 million.

2 These expenses, which are presented as operating expenses in the Statement of Income and Fund Balance, pertain to the FDIC in its corporate capacity only and do 

not include costs that are charged to the failed bank receiverships that are managed by the FDIC. The receivership expenses are presented as part of the “Receivables 

from Resolutions, net” line on the Balance Sheet. The narrative and graph presented on page 128 of this report shows the aggregate (corporate and receivership) 

expenditures of the FDIC.

3 Assessment Income and Provision for Ins. Losses include revenue and estimated losses of $20.4 billion for coverage of uninsured deposits pursuant to systemic 

risk exceptions.

4 Includes $210 million for the cumulative effect of an accounting change for certain postretirement benefits (1992).

5 Includes a $106 million net loss on government securities (1976).

6 This amount represents interest and other insurance expenses from 1933 to 1972.

7 Includes the aggregate amount of $81 million of interest paid on capital stock between 1933 and 1948.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 187 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 188 

Assets and Deposits of Failed or Assisted Insured Institutions and 

Losses to the Deposit Insurance Fund, 1934 - 2023

Dollars in Thousands

Bank and Thrift Failures1

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3

Losses to 

the Fund4

2,636 $1,479,535,581 $1,154,472,610 $124,416,688

2023 5 $532,228,416 $440,610,038 $19,946,5535

2022 0 0 0 0 

2021 0 0 0 0 

2020 4 454,986 437,138 91,011 

2019 4 208,767 $190,547 25,260

2018 0 0 0 0 

2017 8 5,081,737 4,683,360 1,078,967

2016 5 277,182 268,516 42,474 

2015 8 6,706,038 4,870,464 857,273

2014 18 2,913,503 2,691,485 378,362

2013 24 6,044,051 5,132,246 1,202,763 

2012 51 11,617,348 11,009,630 2,377,369

2011 92 34,922,997 31,071,862 6,389,947

20106 157 92,084,988 78,290,185 15,781,132

20096 140 169,709,160 137,835,208 25,863,181

20086 25 371,945,480 234,321,715 17,754,594 

2007 3 2,614,928 2,424,187 157,440

2006 0 0 0 0

2005 0 0 0 0

2004 4 170,099 156,733 3,917 

2003 3 947,317 901,978 62,647 

2002 11 2,872,720 2,512,834 413,989 

2001 4 1,821,760 1,661,214 292,465 

2000 7 410,160 342,584 32,138 

1999 8 1,592,189 1,320,573 586,027 

1998 3 290,238 260,675 221,606 

1997 1 27,923 27,511 5,026 

1996 6 232,634 230,390 60,615 

1995 6 802,124 776,387 84,472 

1994 13 1,463,874 1,397,018 179,051 

1993 41 3,828,939 3,509,341 632,646 

1992 120 45,357,237 39,921,310 3,674,149 

1991 124 64,556,512 52,972,034 6,001,595 

1990 168 16,923,462 15,124,454 2,771,489 

1989 206 28,930,572 24,152,468 6,195,286 

1988 200 38,402,475 26,524,014 5,377,497 

1987 184 6,928,889 6,599,180 1,862,492 

1986 138 7,356,544 6,638,903 1,682,538 

1985 116 3,090,897 2,889,801 648,179 

1934 - 1984 729 16,719,435 12,716,627 1,682,538
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 189 

Assistance Transactions

Assets and Deposits of Failed or Assisted Insured Institutions and 

Losses to the Deposit Insurance Fund, 1934 - 2023 (continued)

Dollars in Thousands

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3

Losses to 

the Fund4

154 $3,317,099,253 $1,442,173,417 $5,430,481

2010 - 2023 0 0 0 0

20097 8 1,917,482,183 1,090,318,282 0 

20087 5 1,306,041,994 280,806,966 0 

1993 - 2007 0 0 0 0 

1992 2 33,831 33,117 250 

1991 3 78,524 75,720 3,024 

1990 1 14,206 14,628 2,338 

1989 1 4,438 6,396 2,296 

1988 80 15,493,939 11,793,702 1,540,642 

1987 19 2,478,124 2,275,642 160,164 

1986 7 712,558 585,248 93,179 

1985 4 5,886,381 5,580,359 359,056 

1984 2 40,470,332 29,088,247 1,116,275 

1983 4 3,611,549 3,011,406 337,683 

1982 10 10,509,286 9,118,382 1,042,784 

1981 3 4,838,612 3,914,268 772,790 

1980 1 7,953,042 5,001,755 0 

1934 - 1979 4 1,490,254 549,299 0

1 Institutions for which the FDIC is appointed receiver, including deposit payoff, insured deposit transfer, and deposit assumption 

cases.

2 For 1990 through 2005, amounts represent the sum of BIF and SAIF failures (excluding those handled by the RTC); prior to 1990, 

figures are only for the BIF. After 1995, all thrift closings became the responsibility of the FDIC and amounts are reflected in the 

SAIF. For 2006 to 2023, figures are for the DIF.

3 Assets and deposit data are based on the last Call Report or TFR filed before failure.

4 Losses to the fund include final and estimated losses. Final losses represent actual losses for unreimbursed subrogated claims 

of inactivated receiverships. Estimated losses generally represent the difference between the amount paid by the DIF to cover 

obligations to insured depositors and the estimated recoveries from the liquidation of receivership assets. 

5 Excludes estimated losses of $20.4 billion for uninsured deposits pursuant to a systemic risk exception.

6 Includes amounts related to transaction account coverage under the Transaction Account Guarantee Program (TAG). The 

estimated losses as of December 31, 2023, for TAG accounts in 2010, 2009, and 2008 are $362 million, $1.1 billion, and $12 

million, respectively.

7

 Includes institutions where assistance was provided under a systemic risk determination.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 190 

Martin J. Gruenberg 

Martin J. Gruenberg was sworn in as Chairman of the FDIC Board 

of Directors on January 5, 2023. He has been a member of the FDIC 

Board since August 2005 and previously served as Vice Chairman 

from August 2005 to July 2011 and as Chairman from November 

2012 to mid-2018. Mr. Gruenberg has also served as Acting 

Chairman on a number of occasions.

Mr. Gruenberg joined the FDIC Board after broad congressional 

experience in the financial services and regulatory areas. He 

served as Senior Counsel to Senator Paul S. Sarbanes (D-MD) 

on the staff of the Senate Committee on Banking, Housing, and 

Urban Affairs from 1993 to 2005. He also served as Staff Director of the Banking Committee’s 

Subcommittee on International Finance and Monetary Policy from 1987 to 1992.

Mr. Gruenberg served as Chairman of the Executive Council and President of the International 

Association of Deposit Insurers (IADI) from November 2007 to November 2012. In addition, Mr. 

Gruenberg served as Chairman of the Federal Financial Institutions Examination Council from 

April 2017 to June 2018.

Since June 2019, Mr. Gruenberg has served as Chairman of the Board of Directors of the 

Neighborhood Reinvestment Corporation (NeighborWorks America), and he has been a 

member of that Board since April 2018.

Beginning February 15, 2022, Mr. Gruenberg assumed the role of Chairman of the Resolution 

Steering Group (ResG) of the Financial Stability Board.

Mr. Gruenberg holds a J.D. from Case Western Reserve Law School and an A.B. from Princeton 

University, Princeton School of Public and International Affairs.

B. More About the FDIC

FDIC BOARD OF DIRECTORS
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 191 

Travis Hill

Travis Hill was sworn in as the Vice Chairman of the FDIC Board 

of Directors on January 5, 2023. Previously, he worked at the 

FDIC from 2018 to 2022, as Deputy to the Chairman for Policy 

and before that as Senior Advisor to the Chairman. In these 

roles, among other responsibilities, he oversaw and coordinated 

regulatory and policy initiatives at the agency and advised the 

Chairman on regulatory and policy matters.

Prior to joining the FDIC, Mr. Hill served as Senior Counsel at 

the United States Senate Committee on Banking, Housing, and 

Urban Affairs, where he worked from 2013 to 2018. In this role, he 

participated extensively in the drafting and negotiating of numerous bipartisan bills. Before 

working at the Senate, he worked as a policy analyst at Regions Financial Corporation from 

2011 to 2013.

Mr. Hill received a Bachelor of Science from Duke University, where he studied economics and 

political science, and a Juris Doctor from Georgetown University Law Center.

Jonathan McKernan

Jonathan McKernan was sworn in as a member of the FDIC Board 

of Directors on January 5, 2023. Mr. McKernan previously was a 

Counsel to Ranking Member Pat Toomey (R-PA) on the staff of the 

Senate Committee on Banking, Housing, and Urban Affairs from 

2021 to 2022. He also served as a Senior Counsel at the Federal 

Housing Finance Agency from 2019 to 2021, a Senior Policy 

Advisor at the Department of the Treasury from 2018 to 2019, and 

a Senior Financial Policy Advisor to Senator Bob Corker (R-TN) 

from 2017 to 2018.

Prior to his government service, from 2007 to 2017, Mr. McKernan 

was an attorney in private practice focused on matters under the banking and consumer 

financial laws.

Mr. McKernan holds a Bachelor of Arts and Master of Arts in economics from the University of 

Tennessee and a Juris Doctor with High Honors from the Duke University School of Law.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 192 

Michael J. Hsu 

Michael Hsu became Acting Comptroller of the Currency on 

May 10, 2021.

As Acting Comptroller of the Currency, Mr. Hsu is the administrator 

of the federal banking system and chief executive officer of 

the Office of the Comptroller of the Currency (OCC). The OCC 

ensures that the federal banking system operates in a safe 

and sound manner, provides fair access to financial services, 

treats customers fairly, and complies with applicable laws and 

regulations. It supervises nearly 1,100 national banks, federal 

savings associations, and federal branches and agencies of 

foreign banks that serve consumers, businesses, and communities across the United States. 

These banks range from community banks to the nation’s largest, most internationally active 

banks.

The Comptroller also serves as a Director of the Federal Deposit Insurance Corporation and 

a member of the Financial Stability Oversight Council and the Federal Financial Institutions 

Examination Council.

Prior to joining the OCC, Mr. Hsu served as an Associate Director in the Division of Supervision 

and Regulation at the Federal Reserve Board of Governors. In that role, he chaired the 

Large Institution Supervision Coordinating Committee Operating Committee, which has 

responsibility for supervising the global systemically important banking companies operating 

in the United States.

His career also has included serving as a Financial Sector Expert at the International Monetary 

Fund, Financial Economist at the U.S. Department of the Treasury, and Financial Economist at 

the Securities and Exchange Commission.

Mr. Hsu holds of a Bachelor of Arts from Brown University, a Master of Science in finance 

from George Washington University, and Juris Doctor degree from New York University School 

of Law.

Rohit Chopra

Rohit Chopra is Director of the Consumer Financial Protection 

Bureau. The CFPB is a unit of the Federal Reserve System charged 

with protecting families and honest businesses from illegal 

practices by financial institutions, and ensuring that markets for 

consumer financial products and services are fair, transparent, 

and competitive. As Director, Mr. Chopra is also a member of the 

Board of Directors of the Federal Deposit Insurance Corporation 

and the Financial Stability Oversight Council.

In 2018, Mr. Chopra was unanimously confirmed by the U.S. Senate 

as a Commissioner on the Federal Trade Commission, where he 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 193 

served until assuming office as CFPB Director. During his tenure at the FTC, he successfully 

worked to strengthen sanctions against repeat offenders, to reverse the agency’s reliance on 

no-money, no-fault settlements in fraud cases, and to halt abuses of small businesses. He also 

led efforts to revitalize dormant authorities, such as those to protect the Made in USA label 

and to promote competition.

The Director previously served at the CFPB from 2010 to 2015. In 2011, the Secretary of the 

Treasury designated him as the agency’s student loan ombudsman, where he led the Bureau’s 

efforts on student lending issues. Prior to his government service, Mr. Chopra worked at 

McKinsey & Company, the global management consultancy, where he worked in the financial 

services, health care, and consumer technology sectors.

Mr. Chopra holds a BA from Harvard University and an MBA from the Wharton School at the 

University of Pennsylvania.
A

PPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023

194 

FDIC Organizational Chart

Lo

DIVISION OF 

RESOLUTIONS AND 

RECEIVERSHIPS

Maureen Sweeney

DIVISION OF INSURANCE 

AND RESEARCH

Patrick Mitchell

DIVISION OF COMPLEX 

INSTITUTION 

SUPERVISION AND 

RESOLUTION

Arthur Murton

DEPUTY TO THE 

CHAIRMAN FOR 

FINANCIAL STABILITY

Arthur Murton

Director 

Director 

Director

Donna M. Saulnier

Director

Dr. Felita Boldin

Director and Chief 

Learning Officer

CORPORATE 

UNIVERSITY

DEPUTY TO THE 

CHAIRMAN FOR 

EXTERNAL AFFAIRS

DEPUTY TO THE 

CHAIRMAN AND 

CHIEF FINANCIAL OFFICER

DEPUTY TO THE 

CHAIRMAN AND CHIEF 

OPERATING OFFICER 

Dan Bendler

DIVISION OF 

INFORMATION 

TECHNOLOGY

Zachary Brown

CISO and 

Director of OCISO

OFFICE OF 

CHIEF INFORMATION 

SECURITY OFFICER

CHIEF INFORMATION 

OFFICER AND 

CHIEF PRIVACY OFFICER

Sylvia Burns Bret D. Edwards

OFFICE OF INSPECTOR GENERAL

Jennifer Fain*

INTERNAL OMBUDSMAN

Robert Harris

OFFICE OF FINANCIAL 

INSTITUTION ADJUDICATION

LEGAL DIVISION

*Sworn in on January 11, 2024

DIVISION OF DEPOSITOR 

AND CONSUMER 

PROTECTION

Mark E. Pearce Nikita Pearson

GENERAL COUNSEL

Harrel M. PettwayHarrel M. Pettway

OFFICE OF 

THE OMBUDSMAN

Jill Lennox

Ombudsman (Acting)

OFFICE OF RISK 

MANAGEMENT AND 

INTERNAL CONTROLS

Marshall Gentry

Director 

(1) Vacant

(2) Jennifer Whang

CHIEF OF STAFF

Kymberly Copa

BOARD OF DIRECTORS

Martin J. Gruenberg

FDIC

Chairman

Jonathan McKernan

FDIC

Board Member

Travis Hill

FDIC

Vice Chairman

Michael J. Hsu

Comptroller of 

the Currency (Acting)

Board Member

Rohit Chopra

CFPB Director

Board Member

DIVISION OF 

RISK MANAGEMENT 

SUPERVISION

Doreen Eberley

OFFICE OF MINORITY AND 

WOMEN INCLUSION 

Nikita Pearson

Director 

Andy Jimenez

Director 

OFFICE OF LEGISLATIVE AFFAIRS

DIVISION OF FINANCE OFFICE OF COMMUNICATIONS

Amy Thompson

Director General Counsel

OFFICE OF MINORITY 

AND COMMUNITY 

DEVELOPMENT BANKING

Betty Rudolph

Director

Administrative Law Judges

Dan Bendler

Director 

Sylvia Burns

Director 

DIVISION OF 

ADMINISTRATION
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 195 

CORPORATE STAFFING TRENDS

Note: 2014-2023 staffing totals reflect year-end full time equivalent staff. 

2014 2015 2016 2017 2018 2019 2020 2021 2022 2023

9,000

6,000

3,000

0

6,631 6,385 6,096 5,880 5,693 5,593 5,776 5,670 5,612 5,952

FDIC Year–End Staffing
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 196 

Number of Employees by Division/Office (Year-End)1

Total Washington Regional/Field

Division or Office: 2023 2022 2023 2022 2023 2022

Division of Risk Management Supervision 2,485 2,376 157 151 2,328 2,225

Division of Depositor and Consumer Protection 863 785 132 117 731 668

Legal Division 465 429 307 288 158 141

Division of Administration 412 395 301 289 111 106

Division of Resolutions and Receiverships 386 332 53 54 334 278

Division of Information Technology 304 292 177 165 127 127

Division of Complex Institution Supervision and Resolution 285 286 110 117 175 169

Division of Insurance and Research 196 190 168 153 28 37

Division of Finance 143 134 141 131 2 3

Executive Support Offices 2 88 88 77 76 11 12

Corporate University 75 65 59 53 16 12

Office of the Chief Information Security Officer 57 54 54 53 3 1

Office of Risk Management and Internal Controls 25 23 24 23 1 0

Executive Offices3 24 20 24 20 0 0

Office of Inspector General 144 143 92 92 52 51

Total 5,952 5,612 1,875 1,781 4,077 3,830

1 The FDIC reports staffing totals using a full-time equivalent methodology, which is based on an employee’s scheduled work hours. Division/Office 

staffing has been rounded to the nearest whole FTE. Totals may not foot due to rounding.

2 Includes the Offices of the Legislative Affairs, Communications, Ombudsman, Financial Institution Adjudication, and Minority and Women 

Inclusion. 

3 Includes the Offices of the Chairman, Vice Chairman, Director (Appointive), Chief Operating Officer, Chief Financial Officer, Chief Information 

Officer, Consumer Protection and Innovation, External Affairs, Policy, and Financial Stability. 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 197 

Sources of Information

FDIC WEBSITE

www.fdic.gov

A wide range of banking, consumer, and financial information is available on the FDIC’s publicfacing website. This includes the FDIC’s Electronic Deposit Insurance Estimator (EDIE), which 

estimates an individual’s deposit insurance coverage; the Institution Directory, which contains 

financial profiles of FDIC-insured institutions; Community Reinvestment Act evaluations 

and ratings for institutions supervised by the FDIC; Call Reports, which are bank reports of 

condition and income; and Money Smart, a training program to help individuals outside the 

financial mainstream enhance their money management skills and create positive banking 

relationships. Readers also can access a variety of consumer pamphlets, FDIC press releases, 

speeches, and other updates on the agency’s activities, as well as corporate databases and 

customized reports of FDIC and banking industry information.

FDIC CALL CENTER

Phone: 877-275-3342 (877-ASK-FDIC) 

703-562-2222

Hearing Impaired: 800-877-8339 

703-562-2289

The FDIC Call Center in Washington, D.C., is the primary telephone point of contact for general 

questions from the banking community, the public, and FDIC employees. The Call Center 

directly, or with other FDIC subject-matter experts, responds to questions about deposit 

insurance and other consumer issues and concerns, as well as questions about FDIC programs 

and activities. The Call Center also refers callers to other federal and state agencies as needed. 

Hours of operation are 8:00 a.m. to 6:00 p.m., Eastern Time, Monday – Friday, 8:00 a.m. to 1:00 

p.m., Saturday, and closed Sunday. Recorded information about deposit insurance and other 

topics is available 24 hours a day at the same telephone number. As a customer service, the 

FDIC Call Center has many bilingual Spanish agents on staff and has access to a translation 

service, which is able to assist callers with over 40 different languages.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 198 

PUBLIC INFORMATION CENTER 

3501 Fairfax Drive

Room E-1021

Arlington, VA 22226

Phone: 877-275-3342 (877-ASK-FDIC), 

703-562-2200

Fax: 703-562-2296

FDIC Online Catalog: https://catalog.fdic.gov

E-mail: publicinfo@fdic.gov

Publications such as FDIC Quarterly and Consumer News and a variety of deposit insurance and 

consumer pamphlets are available at www.fdic.gov or may be ordered in hard copy through 

the FDIC online catalog. Other information, press releases, speeches and congressional 

testimony, directives to financial institutions, policy manuals, and FDIC documents are 

available on request through the Public Information Center. Hours of operation are 9:00 a.m. 

to 4:00 p.m., Eastern Time, Monday – Friday; walk-in service is available at the mailing address 

location. On-site visits are by appointment only.

OFFICE OF THE OMBUDSMAN

3501 Fairfax Drive

Suite VASQ E-2048

Arlington, VA 22226-3500

Phone: 1-877-275-3342 

E-mail: ombudsman@fdic.gov

Online Comment form: https://ask.fdic.gov/fdicinformationandsupportcenter/s/

Website: www.fdic.gov/ombudsman

A Resource for the Banking Industry 

The Office of the Ombudsman (OO) is an independent, neutral, and confidential resource 

and liaison for the banking industry and the general public. The OO responds to inquiries 

about the FDIC in a fair, impartial, and timely manner. OO representatives participate in all 

bank closings to provide accurate information to bank customers, bank employees, and the 

general public. 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 199 

Regional Offices

ATLANTA REGIONAL OFFICE CHICAGO REGIONAL OFFICE

Timothy D. Rich, Regional Director Gregory Bottone, Regional Director 

10 Tenth Street, NE 300 South Riverside Plaza

Suite 900 Suite 1700

Atlanta, Georgia 30309 Chicago, Illinois 60606

(678) 916-2200 (312) 382-6000

States represented: States represented:

Alabama Illinois

Florida Indiana

Georgia Kentucky

North Carolina Michigan

South Carolina Ohio

Virginia Wisconsin

West Virginia
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 200 

DALLAS REGIONAL OFFICE KANSAS CITY REGIONAL OFFICE

Kristie K. Elmquist, Regional Director James D. LaPierre, Regional Director

600 North Pearl Street 1100 Walnut Street

Suite 700 Suite 2100

Dallas, Texas 75201 Kansas City, Missouri 64106

(214) 754-0098 (816) 234-8000

States represented: States represented:

Arkansas Iowa

Colorado Kansas

Louisiana Minnesota

Mississippi Missouri

New Mexico Nebraska

Oklahoma North Dakota

Tennessee South Dakota

Texas

NEW YORK REGIONAL OFFICE SAN FRANCISCO REGIONAL OFFICE

John Vogel, Regional Director Paul P. Worthing, Regional Director

350 Fifth Avenue 25 Jessie Street at Ecker Square

Suite 1200 Suite 2300

New York, New York 10118 San Francisco, California 94105

(917) 320-2500 (415) 546-0160

States and territories represented: States and territories represented:

Connecticut Alaska

Delaware American Samoa

District of Columbia Arizona

Maine California

Maryland Federated States of Micronesia

Massachusetts Guam

New Hampshire Hawaii

New Jersey Idaho

New York Montana

Pennsylvania Nevada

Puerto Rico Oregon

Rhode Island Utah

Vermont Washington

Virgin Islands Wyoming
Top Management and Performance Challenges

Facing the Federal Deposit Insurance Corporation

February 2024



Federal Deposit Insurance Corporation

Office of Inspector General

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 201


NOTICE 

Pursuant to Pub. L. 117-263, section 5274, non-governmental organizations and business

entities identified in this OIG Top Management and Performance Challenges Report have the

opportunity to submit a written response for the purpose of clarifying or providing additional

context to any specific reference. Comments must be submitted to comments@fdicoig.gov

within 30 days of the report publication date as reflected on our public website. Any

comments will be appended to this report and posted on our public website. We request that

submissions be Section 508 compliant and free from any proprietary or otherwise sensitive 

information.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 202
Date: February 22, 2024

Memorandum To: Board of Directors

 /Signed/

From: Jennifer L. Fain

Inspector General

Subject Top Management and Performance Challenges Facing the Federal

Deposit Insurance Corporation

The Office of Inspector General (OIG) presents its annual assessment of the Top Management

and Performance Challenges facing the Federal Deposit Insurance Corporation (FDIC). This

document summarizes the most serious challenges facing the FDIC and briefly assesses the 

Agency’s progress to address them.

This Challenges document is based on the OIG’s experience and observations from our

oversight work, reports by other oversight bodies, review of academic and relevant literature,

perspectives from Government agencies and officials, and information from private-sector

entities. In several instances, we discuss topic areas where the OIG had previously conducted 

work to evaluate, audit, and review the FDIC’s progress in these Challenge areas.

We identified nine Top Challenges facing the FDIC. The Challenges identify risks to FDIC

mission-critical activities and to FDIC internal programs and processes that support mission

execution. These Challenges include all aspects of the Challenges that we reported last year,

with important updates. Among these updates are the need for the FDIC to address increasing 

staff attrition--especially for examiners--and to focus on improving the FDIC’s workplace

environment. We also note that the failures of Signature Bank of New York and First Republic

Bank demonstrated the need for the FDIC to escalate supervisory actions when risks are 

identified, consistent with the FDIC’s forward-looking supervision initiative. Further, the FDIC

should consider emerging risks in its failure estimation process and ensure that the FDIC can

execute its orderly liquidation resolution authority.

The FDIC’s Top Challenges include:

1. Strategic Human Capital Management at the FDIC

2. Identifying and Addressing Emerging Financial Sector Risk

3. Ensuring Readiness to Execute Resolutions and Receiverships

4. Identifying Cybersecurity Risks in the Financial Sector

5. Assessing Crypto-Asset Risk

6. Protecting Consumer Interests and Promoting Economic Inclusion

7. Fortifying IT Security at the FDIC

8. Strengthening FDIC Contract and Supply Chain Management

9. Fortifying Governance of FDIC Programs and Data

We commend the FDIC for taking steps in some areas to address certain Challenges and we

note many of these actions in the attached document. This researched and deliberative analysis

guides our work and we believe it is beneficial and constructive for policy makers, including the 

FDIC and Congressional oversight bodies. We further hope that it is informative for the

American people regarding the programs and operations at the FDIC and the Challenges it

faces.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION

Federal Deposit Insurance Corporation

Office of Inspector General

ANNUAL REPORT 2023 203
 Strategic Human Capital Management at the FDIC 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are:

• Addressing FDIC Staff Attrition

• Managing a Wave of Prospective

Retirements at the FDIC

• Sustaining a Work Environment Free

from Discrimination, Harassment, and

Retaliation

The FDIC relies on the talents and skills of 

its workforce of over 5,700 employees to 

accomplish its mission to maintain stability 

and public confidence in the Nation’s 

financial system. The FDIC’s strategic 

management of its human capital is 

important to ensure that the FDIC does not 

experience mission-critical skill and 

leadership gaps. Strategic human 

capital management involves a dynamic 

set of factors across multiple activities—

workforce planning, recruitment, hiring, 

orientation, compensation, engagement, 

succession planning, and retirement 

programs. These activities should occur 

within a workplace that proactively 

prevents and addresses discrimination, 

harassment, and retaliation, and that 

ensures workforce diversity, equity, 

inclusion, and accessibility. Further, 

strategic human capital management 

involves consideration of the trade-offs of 

hiring permanent, temporary, or 

contracted staff to perform the FDIC’s 

work. 

The Government Accountability Office

(GAO) continues to recognize strategic 

human capital management as a 

Government-wide high-risk area, and we 

have included human capital risk as an 

FDIC Top Management and Performance 

Challenge since 2018. The FDIC has also 

included human capital management as a 

risk in the FDIC’s Enterprise Risk 

Management (ERM) Risk Portfolio and in 

2023 elevated the issue to the highest 

Enterprise Risk at the FDIC.

Addressing FDIC Staff Attrition 

Attrition—through resignations and 

retirements—can create opportunities for 

employees and allow organizations to 

restructure, but if turnover is not 

strategically monitored and managed, gaps 

can develop in an organization’s institutional 

knowledge and leadership. 

The FDIC has faced increasing staff attrition 

rates, and the FDIC has been unable to 

close the attrition gap through hiring. As 

shown in Figure 1, the 2022 FDIC staff 

attrition rate remained higher than the 

pre-pandemic rates of 6.3 percent in 2018 

and 7 percent in 2019. In part, the attrition 

increased in 2021 and 2022 because of the 

FDIC’s Voluntary Early Retirement and 

Separation Incentive Program, which began 

in early March 2020, was suspended in midMarch 2020 as a result of the pandemic, 

and reintroduced in February 2021 for 

certain positions.

Further, the FDIC attrition rate has generally 

been lower than that of the Federal 

Source: FDIC Retention Management: Baseline Organizational 

Assessment 

Figure 1: Workforce Attrition Rates for FDIC and Federal 

Government-wide 2018-2022

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 204
Government, but in 2022 the FDIC attrition 

rate was beginning to close that gap. 

According to the FDIC’s analysis of surveys 

from employees departing the FDIC, more 

than 41 percent of those departing were 

retiring, and about 25.5 percent were 

resigning to take positions at banks or within 

the private sector. Nearly 16 percent of 

employees transferred to other Federal 

agencies, and 17.5 percent did not provide 

a reason for departure. 

FDIC staff hiring has not kept pace with 

FDIC attrition in all FDIC Divisions. We 

computed the FDIC’s 

net gain or loss for 

staff hiring and 

attrition for the 5-year 

period between 

January 1, 2018, and 

January 1, 2023. As 

shown in Figure 2, 

despite hiring, 

important FDIC 

Divisions had 

cumulative net 

employee losses over 

that 5-year period. In 

other words, the FDIC 

lost more employees 

during that period 

than it was able to 

hire. 

The FDIC’s largest component, the Division 

of Risk Management Supervision (RMS), 

responsible for safety and soundness 

examinations and bank supervision, had a 

net loss of nearly 200 staff (about 9 percent 

of RMS employees). The FDIC’s second 

largest component, the Division of Depositor 

and Consumer Protection (DCP), which 

conducts bank consumer compliance 

examinations, had a net loss of more than 

100 personnel (or about 14 percent of DCP 

employees); the Division of Resolutions and 

Receiverships (DRR), responsible for

marketing and resolving failed banks, 

paying deposit insurance, and managing 

bank receiverships, had net employee 

losses of over 50 staff (or about 20 percent

of employees). The Legal Division, which 

provides legal support for all FDIC

Divisions, experienced a net loss of over 50 

staff (about 16 percent of employees). The

Division of Insurance and Research (DIR),

which analyzes emerging risks to the

Deposit Insurance Fund (DIF), had net staff

losses of over 20 personnel (about 14 

percent of employees). The Division of

Complex Institution Supervision and 

Resolution (CISR), responsible for the

supervision and resolution of the largest

banks, had net staff losses of more than 10 

staff (about 5 percent of employees).

Three of the six Divisions noted above also 

had increases in budgeted authorized 

staffing levels in 2021 and 2022. In effect,

at the same time that the FDIC was unable 

to hire to replace staff losses, the FDIC

determined that additional staff was needed

to accomplish its mission, thereby further

increasing the number of required new

hires. 

Figure 2: Cumulative Net Employee Losses (hiring less attrition) for the Period of 

January 1, 2018 to January 1, 2023

-250 -200 -150 -100 -50 0

CISR

DIR

Legal

DRR

DCP

RMS

Source: OIG Analysis of FDIC Data 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 205
As shown in Figure 3, CISR had a budget 

authorized staffing increase of 16 percent in 

2021 and 7 percent in 2022. RMS had a 

budget authorized staffing increase of 1 

percent in 2021 and 7 percent in 2022. 

DCP had a budget authorized staffing 

increase of 4 percent in 2022. Although the 

Legal Division, DIR, and DRR had small 

percentage budget authorized staffing 

decreases, their respective cumulative net 

staff losses exceeded budget authorized 

staffing reductions. 

In addition, the FDIC experienced 

increasing attrition for mission-critical FDIC 

examination staff. Examiners work in four 

Divisions at the FDIC: RMS, DCP, CISR, 

and the FDIC’s Corporate University (CU). 

RMS examiners conduct safety and 

soundness examinations. According to the 

FDIC’s Risk Management Manual of 

Examination Policies, bank safety and 

soundness examinations allow the FDIC to 

“identify the cause and severity of problems 

at individual banks and emerging risks in 

the financial services industry. The accurate 

identification of existing and emerging risks 

helps the FDIC develop effective corrective 

measures for individual institutions and 

broader supervisory strategies for the 

industry.” DCP examiners conduct 

consumer compliance examinations that the 

FDIC Consumer Compliance Examination 

Manual states “are the primary means the

FDIC uses to determine whether a financial

institution is meeting its responsibility to 

comply with the requirements and 

proscriptions of Federal consumer 

protection laws and regulations.” 

CISR specialists, many of whom 

qualify as examiners, perform 

back-up supervision, risk 

monitoring and analysis, and 

resolution planning activities for

large complex financial

institutions, and examiners in CU

teach examination skills to other

examiner staff.

As shown in Figure 4, overall 

attrition among all FDIC 

examiners increased in 2021 and 

2022 after the pandemic but 

began to contract in 2023. 

Although overall attrition rates 

trended lower in 2023, examiner 

resignations continued to 

increase. For 2020, examiner attrition 

equaled about 4 percent of all FDIC 

examination staff with 38 examiners 

resigning. In 2021, examiner attrition rose 

to about 6 percent with 83 examiners 

resigning. In 2022, about 7 percent of 

examiners left the FDIC with 85 examiners 

0

20

40

60

80

100

120

140

160

180

200

2020 2021 2022 2023

Resign Retire

Figure 4: All FDIC Examiner Resignations and 

Retirements 2020-2023

Figure 3: Budget Authorized Staffing Percentage 

Increase/Decrease for Selected Divisions from 2021-2022

-5%

0%

5%

10%

15%

20%

CISR RMS DCP Legal DIR DRR Percentage Change in

Authorized Staff

2021 2022

Source: OIG Analysis of FDIC Budget Data

Source: OIG Analysis of FDIC Data 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 206
resigning. The examiner attrition rate in 

2023 was 6 percent with 100 examiners 

resigning. 

Further, turnover rates for new examiners 

are higher than those for new employees 

throughout the FDIC. The FDIC’s March 

2023 Baseline Organizational Assessment 

found that early career examiners with 2 

years of training had a 15.4 percent 

turnover rate, but the turnover rate for nonexaminer FDIC employees with 2 years of 

service was 4.3 percent. 

Examiner departures are costly to the FDIC 

in terms of both funding and time. The 

FDIC invests approximately 4 years of 

training for new examiners from the time 

they are hired until they earn an 

examination commission. Such 

commissioning requires that employees 

meet benchmarks, training, and other 

technical requirements, including passing a 

Technical Examination. 

Importantly, examiner departures have 

impacted the FDIC’s mission. Both the 

FDIC report and our report on the failure of 

Signature Bank of New York found that the 

FDIC lacked examination resources to 

conduct timely, quality safety and 

soundness examinations. 

In the FDIC Chief Risk Officer’s report, 

FDIC’s Supervision of Signature Bank, the 

FDIC found that it “experienced resource 

challenges with examination staff that 

affected the timeliness and quality of 

[Signature Bank] examinations.” The report 

found that since 2020, 40 percent of the 

FDIC’s New York Regional Office large 

bank safety and soundness examination 

staff positions had been either vacant or 

filled with temporary staff. Further, the 

FDIC noted challenges regarding the quality 

of examiner skillsets that required additional 

supervisory review of data analysis and 

reports. As a result, the report concluded 

that “the vacancies and adequacy of the 

skillsets of the Dedicated Team slowed 

earlier identification and reporting of

[Signature Bank] weaknesses.” 

In our Material Loss Review of Signature 

Bank of New York, we found that the FDIC

did not timely perform supervisory activities

and was repeatedly delayed in issuing 

supervisory products because of staffing 

limitations in terms of the number of 

available personnel and their respective 

skillsets. We noted frequent turnover in the 

FDIC’s New York Regional Office 

examination staff and that temporary 

personnel added prior to 2022 to the 

Signature Bank examination team often 

lacked requisite experience with large 

banks. 

We recommended that the FDIC reevaluate 

its strategy to attract, retain, and allocate 

staff. Further, as discussed in greater detail 

in the Identifying Cybersecurity Risks in the 

Financial Sector section of this Report, we 

also found that FDIC examiner staffing 

impacted the ability of the FDIC to conduct 

timely examinations of bank third-party 

service providers. 

Managing a Wave of Prospective 

Retirements at the FDIC 

The FDIC also faces significant prospective 

retirement-eligibility risk for current staff. 

Retirement eligibility is the date that an 

employee is eligible to choose to retire, but 

employees may work beyond their eligibility 

date. 

The FDIC makes annual retirement date 

projections beyond eligibility dates based on 

a combination of factors, including age and 

retirement eligibility. Historically, the FDIC 

has found that many employees have 

chosen to work beyond their retirementeligibility dates. 

The FDIC faces staffing risks based on its 

employee retirement-eligibility rates, which 

are higher than Government-wide averages. 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 207
As shown in Table 1, 23 percent of the 

FDIC workforce was eligible to retire in 

2023, with that figure rising to 36 percent in 

2027. According to Analytic Perspectives in 

the President’s Fiscal Year 2023 budget, 15 

percent of the Federal workforce was 

eligible to retire in Fiscal Year 2023 with 30 

percent eligible in the next 5 years. Further, 

every FDIC Division except DCP had higher 

staff retirement-eligibility rates than the 

current Government-wide average 

retirement eligibility rate of 15 percent. 

Retirement-eligibility rates are high for FDIC 

Executives and Managers across FDIC 

Regional Offices and for mission-critical 

examination staff. 

As noted in Table 2, about 41 percent of all 

Executives and nearly 30 percent of all 

FDIC Managers were eligible to retire in 

2023. These rates climb to 57 percent for 

FDIC Executives and nearly 47 percent for 

Managers by 2027. Some FDIC Regional 

Offices have significantly higher retirement 

rates for their Executives and Managers. 

Division 2023 2024 2025 2026 2027

Division of Finance (DOF) 38% 43% 46% 46% 47%

Division of Resolutions and Receiverships (DRR) 37% 42% 45% 47% 49%

Legal Division (Legal) 33% 38% 38% 48% 48%

Division of Administration (DOA) 29% 32% 36% 39% 41%

Division of Risk Management Supervision (RMS) 21% 25% 28% 32% 34%

Division of Information Technology (DIT) 18% 21% 23% 27% 31%

Division of Complex Institution Supervision and Resolution (CISR) 16% 20% 25% 27% 31%

Division of Insurance Research (DIR) 16% 21% 24% 25% 28%

Division of Depositor and Consumer Protection (DCP) 15% 19% 23% 27% 29%

Overall for FDIC 23% 27% 30% 33% 36%

Table 1: FDIC Staff Retirement-Eligibility Rates by Division

Source: OIG Analysis of FDIC Data

Regional Office 2023 2024 2025 2026 2027

Executives Atlanta 100% 100% 100% 100% 100%

 Chicago 100% 100% 100% 100% 100%

 Dallas 75% 75% 100% 100% 100%

 Kansas City 100% 100% 100% 100% 100%

 New York 25% 25% 25% 50% 50%

 San Francisco 33% 67% 67% 67% 67%

 Washington 37% 42% 48% 51% 53%

All Executives 41% 46% 52% 56% 57%

Managers

 Atlanta 21% 31% 37% 40% 45%

 Chicago 22% 36% 47% 52% 56%

 Dallas 49% 53% 58% 61% 63%

 Kansas City 38% 47% 53% 58% 58%

 New York 25% 32% 39% 46% 50%

 San Francisco 24% 30% 33% 42% 48%

 Washington 28% 31% 36% 38% 40%

All Managers 29% 35% 41% 44% 47%

 Table 2: FDIC Executive and Manager Retirement Eligibility

 Source: OIG Analysis of FDIC Data

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 208
For example, 100 percent of Atlanta, 

Chicago, and Kansas City Regional Office 

Executives and 75 percent of the 

Executives from the Dallas Regional Office 

were eligible to retire in 2023. These 

retirements may result in gaps in leadership 

positions. Leadership gaps can cause 

delayed decision-making, reduced program 

oversight, and failure to achieve Agency 

goals.

In addition, a significant percentage of 

examiners across the FDIC are eligible for 

retirement. As shown in Table 3, in 2023, 

30 percent of supervisory examiners were 

eligible to retire – a figure that climbs to 53 

percent in 2027. In 2023, 15 percent of

non-supervisory examiners were eligible to 

retire, and by 2027, 29 percent of this group 

is eligible to retire. 

Further, some of the examiners noted in 

Table 3 are considered to be subject-matter 

experts (SME) because they have additional 

training and experience in certain bankrelated disciplines. As shown in Table 4,

the FDIC faces significant retirement risks 

for SMEs. Notably, the FDIC has the 

highest SME retirement-eligibility rates for 

Advanced Information Technology (IT) and 

Trust Account experts followed by 

Intermediate IT, Bank Secrecy Act/AntiMoney Laundering (BSA/AML), Capital

Markets, Accounting, and Consumer

Protection experts. The FDIC’s vulnerability

to SME retirements is occurring at a time 

when banks are facing rising risks from the

increased use of Advanced IT, partnerships

with third-party service providers,

involvement with crypto assets and cryptoasset sector participants, and potential fraud

and money laundering risks.

Collectively, FDIC current attrition and

retirement-eligibility rates have the potential

to result in future organizational knowledge,

skill, and leadership gaps that may impede

the FDIC from achieving results. 

The FDIC has recognized the significance 

of its human capital risk and has taken a 

number of steps to mitigate risks. 

For example, in March 2023, the FDIC

completed a Baseline Organizational

Assessment to support the work of an 

FDIC-wide Retention Management Working

Group. The FDIC also established a 

Human Capital Strategic Planning Analysis

Unit within the Division of Administration to

design an Agency-wide approach to 

address talent pipeline challenges. In

September 2021, the FDIC also began its

Leadership Excellence Acceleration 

2023 2024 2025 2026 2027

Supervisory examiners 30% 39% 45% 50% 53%

Non-supervisory examiners 15% 19% 23% 26% 29%

Table 3: Supervisory and Non-Supervisory Retirement-Eligibility Rates for All Examiners

Source: OIG Analysis of FDIC Data

2023 2024 2025 2026 2027

Advanced IT 31% 62% 62% 69% 69%

Trusts 29% 35% 39% 45% 53%

Intermediate IT 22% 24% 27% 29% 31%

BSA/AML 16% 22% 28% 33% 40%

Capital Markets 15% 21% 28% 30% 32%

Accounting 14% 24% 30% 33% 36%

Consumer Protection 7% 7% 7% 13% 20%

Table 4: Examiner Retirement-Eligibility Rates for SMEs

Source: OIG Analysis of FDIC Data

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 209
Program offering non-supervisory

employees one year of specialized 

leadership training to provide the 

knowledge, skills, and experience to take on

leadership roles. Further, FDIC Divisions

have been assessing their human capital

needs, including one Division that is

engaging a contractor in its efforts. 

Sustaining a Work Environment 

Free From Discrimination, 

Harassment, and Retaliation 

Discrimination, harassment, and retaliation 

within an organization can have profound

effects and serious consequences for the

individual, fellow colleagues, and the

agency as a whole. In certain instances, a

harassed individual may risk losing a job or

the chance for a promotion, and it may lead 

the employee to suffer emotional and

physical consequences. It is critical for

organizations to have leadership that

promotes a workplace and culture that

safeguards against discrimination,

harassment, and retaliation.

Organizations should have policies,

procedures, and training to guard against

and effectively address discrimination,

harassment, and retaliation. Further,

organizations should have mechanisms for

individuals to report incidents of

discrimination, harassment, and retaliation,

and processes to promptly assess reported

incidents and take appropriate actions

against those who engage in such

misconduct.

In our July 2020 OIG evaluation, Preventing

and Addressing Sexual Harassment, we

assessed the FDIC’s sexual harassmentrelated policies, procedures, training, and

practices for the period January 2015 

through April 2019. We found that the FDIC

had not established an adequate sexual

harassment prevention program and should 

improve its policies, procedures, and 

training to facilitate the reporting of sexual

harassment allegations and address

reported allegations in a prompt and

effective manner. Specifically, we found that

the FDIC had not developed a sexual

harassment prevention program that fully

aligned with the five core principles

promoted by the Equal Employment

Opportunity Commission: (1) committed and

engaged leadership; (2) strong and 

comprehensive harassment policies; (3)

trusted and accessible complaint

procedures; (4) regular, interactive training 

tailored to the audience and the

organization; and (5) consistent and 

demonstrated accountability.

As part of our evaluation, we conducted a

voluntary survey of FDIC employees. The

survey responses provided insight into

employee understanding of what constitutes

sexual harassment, instances of sexual

harassment experienced or observed at the 

FDIC, impediments to reporting, and the 

adequacy of training. Our survey found that

approximately 8 percent of FDIC

respondents (191 of 2,376) said that they

had experienced sexual harassment at the

FDIC during the period January 2015 

through April 2019.

Although 191 FDIC respondents to the OIG

survey reportedly experienced sexual

harassment, the FDIC only received 12 

reported sexual harassment allegations,

including both formal complaints and

misconduct allegations from January 2015 

through April 2019. This response suggests

that there may have been an underreporting

of sexual harassment allegations. We

made 15 recommendations to the FDIC to

strengthen its anti-sexual harassment

program. The FDIC made changes to its

anti-sexual harassment policies and 

procedures based on our recommendations.

On November 13, 2023, the Wall Street

Journal published the first of several articles

outlining a toxic work environment at the 

FDIC over at least a decade that alleged 

sexual harassment, a heavy drinking

culture, improper behavior by FDIC senior

leaders, and an unwillingness of employees

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 210
to file sexual harassment complaints

because of the fear of retaliation. On 

November 21, 2023, the FDIC Board

announced that the Board had established a 

Special Committee co-chaired by FDIC

Director Jonathan McKernan and FDIC

Director and Acting Comptroller of the 

Currency Michael Hsu to oversee a “thirdparty review of the agency’s workplace 

culture.” In addition, we have work ongoing 

to follow up on our assessment of the 

FDIC’s sexual harassment prevention 

program and a Special Inquiry to report on

the leadership climate at the FDIC with 

regard to all forms of harassment and

inappropriate behavior.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 211
Identifying and Addressing Emerging 

Financial Sector Risk 

Key Areas of Concern 

In addition to the examiner staffing 

challenges described in the Strategic

Human Capital Management at the FDIC

section of this Report, the primary areas of

concern for this Challenge area are:

• Escalating Supervisory Actions to

Address Identified Risks

• Assessing Emerging Risks Through

Data Gathering and Analysis

• Considering Emerging Risks in the

FDIC’s Bank Failure Estimation

Process

• Sharing Threat and Vulnerability

Information with Financial

Institutions

According to the FDIC’s Quarterly Banking 

Profile, the FDIC insures over 4,600

financial institutions with total assets

exceeding $23 trillion. The FDIC supervises

over 2,900 of these banks with combined 

total assets of about $4.2 trillion. A key 

aspect of the FDIC’s bank supervision is a 

forward-looking supervisory approach to 

identify and assess bank and banking 

sector risks before they impact the financial

condition of a bank or the broader financial

sector.

Escalating Supervisory Actions to 

Address Identified Risks 

When FDIC examinations identify

weaknesses in bank risk management, the 

FDIC should ensure that bank board

members and senior management take 

timely and appropriate actions to address

such risks. FDIC examinations may include 

recommendations requiring that bank board

members address weaknesses, or in the

case of severe deficiencies, the FDIC may

put in place informal or formal enforcement

actions to require program improvements

and hold banks accountable for

implementing and maintaining required 

changes.

1

Prior to the financial crisis of 2008-2011,

examiners identified weak risk management

practices at financial institutions, but they

often delayed taking supervisory action until

the institution’s financial performance

declined. In some cases, financial decline 

led to bank failures and losses to the DIF.

To avoid that result, in 2011 the FDIC

implemented a forward-looking supervisory

initiative as part of its risk-focused 

supervision program. The goal of this

supervisory approach was to identify and 

assess risk before it impacts a bank’s

financial condition and to ensure early risk

mitigation.

Both our Material Loss Review of Signature 

Bank of New York and the FDIC Chief Risk

Officer’s report, FDIC’s Supervision of

Signature Bank, found that the FDIC could 

have escalated supervisory concerns

regarding Signature Bank earlier, consistent

with the FDIC’s forward-looking supervision 

initiative.

These supervisory concerns included 

multiple opportunities to downgrade the

Management component of the FDIC’s

safety and soundness examination rating

known as CAMELS2

—changing the 

Management component from a 2—

meaning satisfactory, to a 3—meaning 

needs improvement. The downgrade may

have lowered the bank’s composite

CAMELS rating and, according to FDIC

policy, supported consideration of an

enforcement action against Signature Bank.

We made three recommendations to the 

FDIC to emphasize to examiners the

importance of timely escalation of

supervisory concerns in line with the FDIC’s

forward-looking supervision initiative. 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 212
In remarks before the Committee on 

Financial Services, United States House of 

Representatives, on November 15, 2023, 

the FDIC Chairman noted that the FDIC 

was looking at options to improve 

supervision, such as “updating examiner 

guidance to be more explicit about analyses 

of uninsured deposit concentrations and 

reemphasiz[ing] to examiners the 

importance of forward–looking indicators of 

risk, such as high growth rates and 

breaches of internal risk limits.” In our 

report, Material Loss Review of First 

Republic Bank, we recommended that the

FDIC also engage with other regulators to

evaluate the need for changes to rules 

under safety and soundness standards, 

including the adoption of noncapital triggers 

that would require early and forceful 

regulatory actions to address unsafe 

banking practices before such practices

impair capital. 

Assessing Emerging Risks Through 

Data Gathering and Analysis 

The FDIC has a number of activities, 

beyond examinations, for the detection of 

emerging risks in the banking sector. The 

FDIC’s Offsite Review Program is designed 

to identify emerging supervisory concerns 

and potential problems that may arise 

between onsite bank examinations so that 

supervisory strategies can be adjusted 

appropriately.3

 Further, the FDIC released 

its Risk Review 2023 report outlining key 

risks to banks. Through our work, we have 

found that the FDIC could do more to 

assess emerging risks by analyzing the data 

it holds and obtaining data from outside the

FDIC. 

Information Technology Risks. According 

to our report, Implementation of the FDIC’s 

Information Technology Risk Examination 

(InTREx) Program, the FDIC is not fully

utilizing available data and analytic tools to 

identify emerging IT risks at financial 

institutions. In 2017, the FDIC developed a 

tool called AlphaREx to conduct analysis of 

unstructured data from IT examinations. 

The FDIC used AlphaREx to identify 

financial institutions at risk from specific 

types of vulnerabilities, but the system has 

not been used to analyze FDIC IT 

examination data to identify emerging 

trends across all FDIC-supervised 

institutions. Such risk trend information 

could be used to promote risk remediation 

efforts, target specific IT reviews, and 

improve IT examination processes. Such 

analysis could be valuable to both 

policymakers and examiners in assessing 

cyber threats, formulating supervisory

strategies, and evaluating the adequacy of

InTREx procedures and examiner training. 

The FDIC is conducting a review to 

determine areas in which to use AlphaREx 

to identify emerging IT risks and trends at 

financial institutions. 

Further, in our memorandum, The FDIC’s 

Regional Service Provider Examination 

Program, we identified an opportunity for

the FDIC to leverage available information 

to develop a comprehensive inventory of 

FDIC-supervised bank service providers. A 

map of bank and third-party 

interconnections may be useful for 

examiners to understand the full scope of 

cybersecurity risks—rather than risks solely 

for a single bank or third party. This 

information may also help FDIC 

policymakers to ensure that FDIC policies 

and examination procedures appropriately 

address and assess interconnected risks. 

Further, in the event of a cybersecurity 

incident, a mapping of bank and third-party 

relationships may allow the FDIC to quickly 

identify the parties at risk and may provide 

relevant threat information and supervisory 

guidance to mitigate such risk as well as

prepare for potential resolutions. 

Threat Information. In our report, Sharing 

of Threat Information to Guide the 

Supervision of Financial Institutions, we 

found that the FDIC receives threat

information relevant to the banking sector, 

but the FDIC had not established effective 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 213
processes to acquire, analyze, disseminate,

and use relevant and actionable threat

information to guide the supervision of

financial institutions. For example, the FDIC

relied solely on the judgment of certain 

individuals to determine the extent to which 

threat information should be analyzed to 

support FDIC business needs and the 

supervision of financial institutions rather

than engaging stakeholders and developing

procedures to guide analysis.

Also in our report, Sharing of Threat and

Vulnerability Information with Financial

Institutions, we found that the FDIC’s threat

intelligence operations may benefit from

using an available natural language 

processing tool or alternative capabilities to 

analyze other FDIC unstructured data sets

for the identification of threat and

vulnerability information.

Government-Guaranteed Loan 

Information. In our report, FDIC

Examinations of Government-Guaranteed

Loans, we found that FDIC examiners did 

not have adequate data to identify, monitor,

and research bank participation in 

Government-Guaranteed loan programs.

The FDIC’s DIR had obtained information 

from publicly-available sources for researchrelated purposes and studies, but that data

was neither requested by nor shared with 

examination staff.

Absent sufficient data, the FDIC may be 

limited in its ability to proactively identify and 

monitor emerging risks associated with a 

bank’s participation in GovernmentGuaranteed loan programs. GovernmentGuaranteed loan programs often have 

complex requirements and documentation 

standards that present compliance 

challenges for financial institutions. For

example, a Federal agency may rescind its

guaranty if a bank makes a loan to an 

ineligible borrower or to a borrower that

lacks creditworthiness or repayment ability.

The FDIC completed 6 recommendations

and is in the process of implementing the

remaining 13 recommendations we made to

improve the FDIC’s supervision of banks

that participate in Government-Guaranteed

loan programs.

Climate Change. As part of the Council of

Inspectors General on Financial Oversight,

we contributed to the Audit of the Financial

Stability Oversight Council’s Efforts to

Address Climate-Related Financial Risk

(FSOC Climate Report) that found that

FSOC’s Report on Climate-Related

Financial Risk was consistent with 

Executive Order 14030, Climate-Related 

Financial Risk. The FSOC Climate Report

identified the need for “actionable climaterelated data to allow better risk

measurement by regulators and in the

private sector.” According to the FDIC’s

Risk Review 2023, the FDIC is at the

beginning stages of assessing climaterelated financial risks. The FDIC is working

with other Federal banking regulators,

FSOC, and international organizations to 

ensure a common understanding of risks

and share information.

On October 30, 2023, Federal banking

regulators issued final Interagency

Guidance on Principles for Climate-Related 

Financial Risk Management for Large

Financial Institutions. The principles

“provide a high-level framework for the safe

and sound management of large bank

exposures to climate-related financial risks.”

The principles focus on governance,

strategic planning, risk management, data,

scenario analysis, and policies and 

procedures. The FDIC is also focusing on

monitoring how the adverse effects of

climate change could include a potentially

disproportionate impact on the financially

vulnerable, including low- and moderateincome and other underserved consumers

and communities.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 214
Considering Emerging Risks in the 

FDIC’s Bank Failure Estimation 

Process 

The FDIC estimates anticipated bank 

failures for its financial statements and for 

budgeting and planning purposes. The 

FDIC’s internal Financial Risk Committee 

determines the FDIC’s DIF Contingency 

Liability for Anticipated Failure of Insured 

Institutions for FDIC financial statements 

using a process that has been in place 

since at least 2015.4 The Committee 

determines which institutions are included in 

the Contingency Liability for Anticipated 

Failure of Insured Institutions primarily 

based on bank examination CAMELS 

ratings, which may have up to an 18-month 

reporting lag. The anticipated failures figure 

also informs the FDIC failure estimate used 

for budgeting and resolution planning, which 

can be more forward-looking than the 

estimate used for the financial statements. 

It is critical that the FDIC have a robust 

failure estimation process for its budgeting 

and resolution planning that monitors 

emerging banking risks. For example, 

failure estimates may need to consider the 

impact of the ease and speed of deposit 

movement through mobile apps and other 

technology as well as banks’ unrealized 

losses on investment securities in assessing 

potential failure scenarios. 

As noted in our reports, 

Material Loss Review of 

Signature Bank of New York

and Material Loss Review of 

First Republic Bank, the 

speed of deposit movement

and unrealized losses played 

a role in these bank failures. 

Further, as shown in Figure 5, 

unrealized losses on 

investment securities for 

insured banks rose again in 

the Third Quarter of 2023 to 

about $675 billion.

Sharing Threat and Vulnerability 

Information with Financial 

Institutions 

A bank’s Board of Directors and senior 

management are ultimately responsible for 

an institution’s risk management. The 

FDIC, as a member of the Federal Financial 

Institutions Examination Council (FFIEC),

has jointly stated that financial institutions 

should have an effective threat intelligence 

program, including methods for gathering, 

monitoring, sharing, and responding to 

threat and vulnerability information in order 

to support the institutions’ safety and 

soundness. Without emerging threat and 

vulnerability information, bank board 

members and senior management may be 

unable to assess threats to their 

organization and take actions to reduce 

risks. 

In our report, Sharing of Threat and 

Vulnerability Information with Financial 

Institutions, we found that the FDIC has

implemented processes for sharing threat

and vulnerability information with financial 

institutions. For example, the FDIC 

established formal procedures to 

communicate cyber threat and vulnerability 

information. However, the FDIC can 

improve the effectiveness of its processes 

to ensure financial institutions receive 

Figure 5: Unrealized Gains (Losses) on Investment Securities

Source: FDIC Quarterly Banking Profile, Third Quarter 2023

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 215
•

actionable and relevant threat and 

vulnerability information. We determined 

that: 

• The FDIC can improve its sharing

of threat and vulnerability

information with financial

institutions and other financial

sector entities.

The FDIC can improve its controls

over the recording of reported

computer-security incidents to

support threat intelligence 

operations and sharing activities. 

• The FDIC can mature its threat

information sharing program by

establishing procedures for sharing

non-cyber-related threat information

and revising the program’s existing

threat sharing policies and

procedures.

We made 10 recommendations to improve 

the FDIC’s processes in order to ensure that 

financial institutions receive actionable and 

relevant threat and vulnerability information.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 216
Ensuring Readiness to Execute 

Resolutions and Receiverships 

Key Areas of Concern

In addition to the staffing challenges

described in the Strategic Human Capital

Management at the FDIC section of this

Report, the primary areas of concern for this

Challenge are:

• Readiness for FDI Act Resolutions

• Preparing for an Orderly Liquidation

The FDIC must stand ready to resolve failed 

financial institutions. The Federal Deposit

Insurance Act (FDI Act) grants authority to

the FDIC to execute bank resolutions and 

become a receiver of failed banks. The FDI

Act, however, does not apply to systemically

important financial companies (SIFC) such

as investment banks, insurance companies,

and broker-dealers. Title II of the DoddFrank Wall Street Reform and Consumer

Protection Act of 2010 (Dodd-Frank Act)

was enacted and designed to address this

gap and granted Orderly Liquidation 

Authority (OLA) to the FDIC to provide the

necessary authority to liquidate failing 

financial companies that pose a significant

risk to the financial stability of the United

States in a manner that mitigates such risk

and minimizes moral hazard.

Readiness for FDI Act Resolutions 

The FDIC generally resolves failed banks

under the FDI Act over a weekend to limit

impacts to bank customers, but preparation

activities for a resolution begin well before 

that period of time. According to the FDIC’s

Resolutions Handbook, the resolution

process begins prior to a bank failure and

includes an analysis of the bank’s financial

and organizational structure, receipt of

failing bank data to assess a valuation, the

set-up of an FDIC virtual data room to

provide potential bidders information on the

failing bank, the receipt of bids on the failing

bank, and the FDIC’s selection of a

resolution strategy.

The rapid outflow of uninsured deposits

during recent failures reduced the FDIC’s

resolution preparation lead time from days

to hours. The reduced timeframe impacted 

the FDIC’s ability to receive and validate 

bank data submissions from the failing

banks for the establishment of an FDIC

virtual data room for potential bidders.

In an August 14, 2023 speech regarding the

failures of Silicon Valley Bank, Signature 

Bank, and First Republic Bank, the FDIC

Chairman highlighted these data issues and 

noted shortcomings in the FDIC’s 2012 rule

requiring that large banks with over $50 

billion in assets submit resolution plans.

Specifically, the Chairman noted that the 

FDIC was hindered in receiving prompt and

reliable information from failed banks; the 

FDIC did not have information on bank key

personnel and retention plans, critical bank

third parties, and bank payment and trading 

activities; and the FDIC did not have 

communications systems and strategies to 

reach internal and external stakeholders.

As noted by the FDIC Chairman, “[w]hile 

Silicon Valley Bank and First Republic had

been required to file resolution plans which 

provided basic information that was useful,

far more robust plans would have been 

helpful in dealing with the failure of these 

institutions. Signature Bank failed before it

would have been required to file its first

resolution plan in June.”

Further, large bank failures also leave the

FDIC with limited resolution options. For

example, the FDIC can sell a failed bank or

portions of its assets to another bank;

however, such a transaction may increase

the asset size and the systemic risk of the

purchasing bank. Alternatively, the FDI

Act’s systemic risk exception may be

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 217
invoked—as was the case for Silicon Valley

Bank and Signature Bank—when there is a 

serious adverse effect on economic

conditions or financial stability. When 

invoked, the systemic risk exception allows

the FDIC to resolve banks using different

methods, including resolutions that may not

be the least costly to the DIF. Use of the

systemic risk exception may require that

certain banks that had no involvement with 

the failed bank pay for the failed bank

management’s missteps.

In a series of rulemakings, the FDIC and

other banking regulators are taking steps to 

address identified large bank resolution 

shortcomings. On September 18, 2023,

banking regulators issued a Notice of

Proposed Rulemaking that would revise 

regulatory capital requirements for banks

with assets of $100 billion or more and for

other banks with significant trading activity.

Among other things, the proposed rule 

would change regulatory capital ratio 

calculations to reflect the banks’ ability to 

absorb losses by, for example, requiring

banks to include net unrealized losses on 

securities held as available for sale in the 

calculation of regulatory capital. The 

proposed rule has a 3-year phase-in

requirement.

On September 19, 2023, banking regulators

issued a second Notice of Proposed 

Rulemaking, requiring insured depository

institutions with more than $100 billion in 

assets to maintain a minimum amount of

long-term debt. The debt is intended to act

as a “buffer” to absorb losses in the event of

a bank failure, thereby providing regulators

with greater flexibility to respond to the 

failure and reduce costs to the DIF.

Currently, only the largest, global

systemically important financial companies

are required to hold long-term debt as part

of their total loss absorbing capacity

requirement.

Also, on September 19, 2023, the FDIC

issued a third Notice of Proposed 

Rulemaking, revising a current rule requiring 

the submission of resolution information for

insured depository institutions with $50 

billion or more in total assets. The

proposed rule requires that insured

institutions with $100 billion or more in 

assets provide a full resolution plan that

includes a strategy for its orderly and 

efficient resolution, including demonstrating 

the capability to provide needed information

such as establishing a virtual data room with 

information for potential bidding parties.

Additionally, on October 11, 2023, the FDIC

issued a fourth Notice of Proposed 

Rulemaking, providing new guidance for

large banks with assets of $10 billion or

more that raises the FDIC’s standards for

corporate governance, risk management,

and controls commensurate with the size,

business model, risk, and complexity of

larger banks.

Further, the FDIC issued a Request for

Information and Comment on Rules,

Regulations, Guidance and Statements of

Policy Regarding Bank Merger Transactions

to receive “comments regarding the 

effectiveness of the existing framework in 

meeting the requirements of section 18(c) of

the Federal Deposit Insurance Act (known 

as the Bank Merger Act)” including, among 

other things, the financial stability risks

resulting from the merger of large banks.

As noted by the OCC Acting Comptroller of

the Currency, there is a resolvability gap for

the very largest regional banks subject to 

the FDI Act. Should such a bank fail, the

FDIC may face limited resolution options

that could result in the FDIC selling the 

bank, or a large portion of its assets, to a

systemically important financial

company, thereby making the SIFC even 

larger and more systemic.

Preparing for an Orderly 

Liquidation 

The FDIC has not been required to execute 

an OLA resolution; however, it is critical that

the FDIC remain ready to do so. In our

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 218
•

•

evaluation report, The FDIC’s Orderly 

Liquidation Authority, we determined that

the FDIC has made progress in

implementing elements of its OLA program, 

including progress in OLA resolution 

planning for global SIFCs based in the U.S. 

However, we found that in the more than 12 

years since the enactment of the DoddFrank Act, the FDIC has not maintained a 

consistent focus on maturing the OLA 

program and has not fully established key 

elements to execute its OLA responsibilities. 

Specifically: 

• OLA Policies and Procedures.

The FDIC has made significant

progress in developing high-level

policies and procedures for the

execution of an OLA resolution of a

systemically important bank holding

company. However, it has not

completed operational-level policies

and procedures, nor identified how it

would need to adjust its policies and

procedures for an OLA resolution of

other types of SIFCs. In addition, the

FDIC has not developed two

regulations required by the DoddFrank Act or completed policies and

procedures for ongoing OLA

resolution planning activities.

5

OLA Roles and Responsibilities.

The FDIC has not fully defined

governance and individual

practitioner-level roles and

responsibilities related to the

execution of an OLA resolution.

OLA Resources, Training, and

Exercises. The FDIC needs to

obtain additional staff resources to 

plan for an OLA resolution, and to

fully identify and document the staff

and contractor resources necessary

to execute an OLA resolution. In

addition, the FDIC needs to enhance 

OLA-related training and exercises

to regularly ensure that personnel

have the skills needed to execute an

OLA resolution.

• Monitoring of OLA Activities. The

FDIC does not have adequate

monitoring mechanisms in place to

ensure it promptly implements the

OLA program and consistently

measures, monitors, and reports on

the OLA program status and results.

• Crisis Readiness-Related

Planning. The FDIC has not

documented a readiness plan for

executing OLA resolution authorities

in a financial crisis scenario involving

concurrent failures of multiple

SIFCs.

Absent a consistent focus and fully 

established key elements for executing the 

OLA, the FDIC may not be able to readily 

meet the OLA requirements for every type 

of SIFC that the FDIC may be required to 

resolve. If the FDIC were unable to resolve 

a SIFC, the banking sector and the stability

of the U.S. and global financial systems 

could be severely affected. The FDIC is

addressing the 17 recommendations we 

made to improve key elements for executing 

the FDIC’s OLA responsibilities.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 219
•

•

•

•

Identifying Cybersecurity Risks in the Financial Sector 

Key Areas of Concern

In addition to the Advanced and 

Intermediate IT examiner staffing 

challenges described in the Strategic 

Human Capital Management at the FDIC 

section of this Report, the primary areas of 

concern for this Challenge are: 

Examining for Bank Third-Party

Service Provider Cybersecurity Risk

Improving Bank IT Examination

Processes

Ensuring FDIC Staff Have Requisite

Financial Technology Skills

Continuing to Assess Risks Posed

by Emerging Technology

In its Risk Review 2023, the FDIC 

recognized that the “banking industry’s 

information technology infrastructure 

remains vulnerable to cyber attacks.” 

Similarly, in its Semiannual Risk 

Perspective Spring 2023, the Office of the 

Comptroller of the Currency (OCC) found 

that risks to banks “continue[s] to be 

elevated as cyberattacks evolve and 

become more sophisticated and damaging 

to the U.S. economy.” Both the FDIC and 

OCC have highlighted increased attacks 

against the banking industry through a 

particular variety of cyber attack known as 

ransomware. According to the OCC, 

ransomware attacks “have the potential to 

affect banks and market operations by 

rendering critical data inaccessible as well 

as by threatening the confidentiality of 

customer data through data leaks.” In the 

2023 Risk Management Association’s

survey of 100 community bank executives, 

85 percent of executives stated that 

cybersecurity was their top risk. 

Cybersecurity risks to banks include threats 

directed towards a bank’s IT infrastructure 

and through attacks on banks’ third-party 

service providers. In its Risk Review 2023, 

the FDIC found that “[c]yber threats to thirdparty providers of software, hardware, and 

computing services remain an important 

source of risk to the financial industry.” For 

example, in August 2023, M&T Bank

customer information—names, addresses,

and account numbers—was compromised

through a cybersecurity incident involving

file transfer software used by one of the

bank’s third-party service providers.6

 

Examining for Bank Third-Party 

Service Provider Cybersecurity

Risk 

Banks routinely rely on third parties for 

numerous activities, including IT services, 

accounting, compliance, human resources, 

loan servicing, and document processing. 

In its Risk Review 2023, the FDIC identified 

multiple security risks to banks from the 

compromise of a third-party service 

provider, including “disclosure of credentials 

or confidential data, corruption of data, 

installation of malware, and application

outages.” In addition, multiple banks may 

rely on the same third-party service 

providers. FSOC has recognized that 

banks’ “concentrated dependency on a 

limited number of service providers... [is] a 

potential risk to financial stability.” Bank 

third-party risk becomes more complex 

when a bank’s third party relies on other 

vendors, thereby introducing fourth-party 

risk to a bank.7

 In the Interagency 

Guidance on Third-Party Relationships: 

Risk Management, bank regulators noted

that a bank’s “use of third parties does not

diminish or remove banking organizations’ 

responsibilities to ensure that activities are 

performed in a safe and sound manner and 

in compliance with applicable laws and 

regulations.” 

The Bank Service Company Act (BSC Act) 

authorizes the FDIC to directly examine 

third-party service providers that offer 

services to supervised banks. The BSC Act 

also requires that banks notify their primary 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 220
regulator of third-party service provider

relationships. Further, during bank IT

examinations, the FDIC collects information 

regarding bank and third-party relationships.

Regulators have divided third-party service

providers into two tiers based on the risks

the service provider poses to the banking

sector: Significant Service Providers (SSP)

that serve large numbers of banks and pose

a higher degree of systemic risk, and

Regional Service Providers (RSP) that

serve fewer banks and pose less risk. In 

2012, banking regulators jointly developed 

guidance for risk-based examinations of

service providers.

8

In our memorandum, the FDIC’s Regional 

Service Provider Examination Program, our

objective was to assess the effectiveness of

the FDIC’s RSP examination program

related to third-party risks to financial

institutions. Overall, we found that the FDIC

had not established performance goals,

metrics, and indicators to measure overall

program effectiveness and efficiency. As a 

result, we were unable to conclude on the

program’s effectiveness; however, we 

identified opportunities to improve the RSP

examination program. We found that the 

FDIC should (1) monitor RSP examination 

distribution timeliness; (2) comply with

examination frequency guidelines; (3)

provide additional guidance on how to use 

RSP examinations in support of the FDIC’s

InTREx program (discussed in the next

section below); and (4) establish a 

comprehensive inventory of FDICsupervised bank service providers and the 

financial institutions serviced.

Significantly, our audit found that only 25 

percent (18 of 71) of examinations were 

performed consistent with interagency

guidance on examination frequency. 

Further, the FDIC has an opportunity to

leverage available service provider

information obtained through its InTREx and 

service provider examination programs to 

develop a comprehensive inventory of

FDIC-supervised bank service providers.

We made one recommendation to the FDIC

to conduct a formal assessment of the RSP

examination program to establish programlevel goals, metrics, and indicators and

determine whether additional resources and

controls are needed to improve program

effectiveness.

A full picture of the interconnected nature of

IT and cybersecurity risks among banks and 

third parties would be helpful for examiners

to understand the full scope of cybersecurity

risks—rather than risks solely for a single 

bank or third party. This information would 

also help FDIC policymakers to ensure that

FDIC policies and examination procedures

appropriately assess and address

interconnected risks. Further, in the event

of a cybersecurity incident, a mapping of

bank and third-party relationships may allow

the FDIC to quickly identify the parties at

risk and may provide relevant threat

information and supervisory guidance to

mitigate such risk as well as prepare for

potential resolutions.

Improving Bank IT Examination 

Processes 

FDIC IT examinations identify areas in 

which a financial institution is exposed to IT 

and cyber-related risks and evaluate bank

management’s ability to identify these risks

and maintain appropriate compensating

controls. FDIC IT examiners follow an 

examination program that utilizes a riskbased approach to assess IT and cyber

risks at financial institutions.

In our OIG evaluation, Implementation of

the FDIC’s Information Technology Risk 

Examination (InTREx) Program, we found

weaknesses in the FDIC’s InTREx program

that limited FDIC examiners’ ability to 

assess and address IT and cyber risks at

financial institutions. For example, we 

found that examiners did not complete 

InTREx procedures and decision factors

required to support their ratings. Without

effective implementation of the InTREx

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 221
program, significant IT and cyber risks may

not be identified by examiners and 

addressed by financial institutions. Further,

an inaccurate assessment of IT risks could 

affect a bank’s safety and soundness rating,

which may require adjustments to the 

FDIC’s supervisory strategies and

examination planning for the bank and may

also impact the insurance premium paid by

a financial institution. The FDIC has

addressed 10 of 19 recommendations we 

made to improve its InTREx examination 

processes and is working to implement the 

remaining 9 recommendations.

Ensuring FDIC Staff Have 

Requisite Financial Technology 

Skills 

In its September 2023 report, Agencies Can

Better Support Workforce Expertise and

Measure the Performance of Innovation 

Offices, the GAO reviewed banking 

regulators’ financial technology expertise.

Financial technology includes a broad range 

of technology underlying bank products and 

services. The GAO found that the FDIC

and other banking regulators “have not

systematically or comprehensively collected 

data on their policymaking and oversight

staff’s technological skills related to financial

technology or conducted assessments to 

determine the financial technology skills

these staff need. The agencies also have 

not measured the effectiveness of their

financial technology training in addressing

their skill need.”

Incorporating skillset assessments and

measurements can help agencies ensure

that staff have the skills needed to conduct

effective policymaking and oversight of

financial technology. The GAO made one 

recommendation to the FDIC to collect staff

skillset data and determine the critical 

financial technology skills the Agency

needs; develop targeted strategies to 

address financial technology-related skill 

gaps; and measure the effectiveness of its

financial technology-related training in

addressing skill needs.

Continuing to Assess Risks Posed 

by Emerging Technologies 

In its 2023 Report on Cybersecurity and

Resilience, the FDIC identified emerging

financial sector cybersecurity threats from

artificial intelligence (AI) and quantum

computing. Specifically, the FDIC noted

that AI may help bad actors create and 

refine malware that can be used to infect

computer systems. AI may also be used to 

create malicious information, such as emails

and voicemails, where the recipient—such 

as a bank customer—may be unable to

distinguish AI-generated information from a

trusted person or source—such as the

bank. Further, AI may be used by malicious

actors to commit synthetic fraud by creating

a new person using stolen and AI-generated

information.9 It may be difficult for banks

and regulators to identify such fraud.

The FDIC also noted that current data 

encryption methods may be vulnerable to

the speed and power of quantum

computing. For example, in May 2022, the

Administration issued a National Security

Memorandum, noting certain types of

quantum computers could “defeat security

protocols for most Internet-based financial

transactions.” The FDIC should continue to 

monitor risks posed by emerging

technologies and ensure that necessary

adjustments are made to policies,

examinations, and examiner training to

address such risks.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 222
Assessing Crypto-Asset Risk 

Key Areas of Concern

The primary areas of concern for this

Challenge are:

• Assessing the Impact of CryptoAsset Risks to FDIC-Supervised

Banks

• Clarifying Processes for Supervisory

Feedback Regarding Bank CryptoAsset-Related Activities

FSOC describes crypto assets as privatesector digital assets that depend primarily

on the use of cryptography and distributed

ledger or similar technologies. In its Report

on Digital Asset Financial Stability Risks

and Regulation 2022, FSOC noted that

“[c]rypto-asset activities could pose risks to 

the stability of the U.S. financial system if

their interconnections with the traditional

financial system or their overall scale were 

to grow without adherence to or being 

paired with appropriate regulations,

including the enforcement of the existing 

regulatory structure.” In its Annual Report

2023, FSOC noted that “some traditional

financial firms were affected by shocks in 

the crypto-asset market.” As noted by the

Congressional Research Service, the

failures of Silvergate, Silicon Valley, and 

Signature Banks “demonstrate that volatility

in crypto markets may expose banks to

liquidity risks that could ultimately lead to

fatal losses.”

The total market capitalization of crypto

assets fluctuated from about $132 billion in

January 2019 rising to $3 trillion in

November 2021. In September 2023,

crypto-asset market capitalization fell to 

about $1 trillion. Further, on January 10,

2024, the Securities and Exchange 

Commission approved 11 applications for

spot bitcoin exchange traded funds, which 

allow investors to purchase exposure to 

bitcoin without directly holding bitcoin.

According to FDIC data, as of September

2023, a total of 42 FDIC-supervised banks

engaged in crypto-asset-related activities.

Crypto-asset-related activities included, for

example, deposit services, crypto-asset

collateralized lending, and facilitation of

customer purchase and sale of crypto 

assets through a third party.

Assessing the Impact of CryptoAsset Risks to FDIC-Supervised 

Banks 

The March 2, 2022 Executive Order on

Ensuring Responsible Development of

Digital Assets stated, among other things,

that three of the principal policy objectives

of the Administration regarding digital

assets were to protect consumers,

investors, and businesses; protect U.S. and 

global financial stability and mitigate 

systemic risk; and mitigate illicit finance and

national security risks posed by digital asset

misuse. In the January 2023 Joint

Statement on Crypto-Asset Risks to

Banking Organizations and the February

2023 Joint Statement on Liquidity Risks to

Banking Organizations Resulting from

Crypto-Asset Market Vulnerabilities, 

banking regulators highlighted risks to 

banks from involvement with crypto assets

and crypto-asset sector participants. In

general, digital asset risks include:

• Liquidity, Concentration, and

Contagion Risk. Banks face

liquidity risks from crypto-asset

market volatility and the resulting

deposit flows associated with cryptoasset entity customers (such as a

crypto exchange). For example,

bank liquidity may be impacted by

the size and timing of deposit inflows

and outflows made by a crypto

exchange on behalf of its customers.

Further, deposits associated with

crypto-asset reserves related to

stable coins are susceptible to stable

coin run risk, creating potential

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 223
deposit outflows for banks. Liquidity 

risk can be acute when a cryptorelated entity’s business represents 

a significant portion—or 

concentration—of a bank’s capital, 

client, or business base. In addition, 

interconnections among crypto-asset 

participants—such as through 

lending, investing, funding, service, 

and operational arrangements—may 

cause losses for one participant to 

quickly flow to other participants. 

• Fraud, Illicit Finance, and

Cybersecurity Risk. Crypto-asset

sector participants may not have

mature and robust governance

processes to manage risks. Absent

oversight and governance

processes, there is an increased risk

of fraud, illicit activities, and

cybersecurity vulnerabilities within

the crypto-asset sector. Banks

without effective due diligence

processes may not have full insight

into the activities of crypto-asset

sector participants. Without effective

due diligence and risk management,

banks may face fines, reputational

risks, and cybersecurity risks as a

result of the banks’ involvement with

crypto-asset participant activities.

• Consumer Protection Risks.

According to the Comprehensive

Framework for Responsible

Development of Digital Assets, 16

percent of American adults

(approximately 53 million people)

have purchased digital assets.

Crypto-asset companies may make

inaccurate or misleading

representations and disclosures,

including misrepresentations

regarding Federal deposit insurance,

and other practices that may be

unfair, deceptive, or abusive,

contributing to significant harm to

retail and institutional investors,

customers, and counterparties. For

example, the bankruptcy filings from

crypto-asset company Prime Trust 

detailed how the company locked 

itself out of its own cryptocurrency 

wallet and used fiat currencies from 

its client accounts to meet 

withdrawal requests. Banks 

engaged with crypto-asset sector 

participants may have exposure to 

these risks.

In our report, FDIC Strategies Related to 

Crypto-Asset Risks, we found that the FDIC

has identified risks with banks’ involvement

with crypto-related activities; however, the 

FDIC has not assessed the significance and 

potential impact of these risks. Specifically, 

the FDIC has not conducted risk 

assessments to determine the significance 

of crypto-asset activity risks and the 

magnitude of the impact, likelihood of 

occurrence, and nature of the risks. Also, 

the FDIC has not developed mitigation 

strategies, such as issuing guidance to 

financial institutions, to ensure that risks are 

within defined risk tolerances. We 

recommended that the FDIC establish a 

plan with timeframes for assessing risks 

pertaining to crypto-related activities.

Until the FDIC assesses the risks of crypto 

activities and provides supervised 

institutions with effective guidance, the 

FDIC and some FDIC-supervised 

institutions may not take appropriate actions 

to address the most significant risks posed 

by crypto assets. Similarly, examiners may 

not have guidance concerning the safety 

and soundness and consumer protection 

risks of banks’ involvement with crypto 

assets and crypto-asset participants. As a 

result, as banks continue to implement 

crypto-asset strategies, bank management 

and FDIC examiners may not identify and 

mitigate the most significant crypto-asset 

risks, which could lead to unsafe and 

unsound practices, consumer harm, or in 

severe instances, financial instability. 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 224
Clarifying Processes for 

Supervisory Feedback Regarding 

Bank Crypto-Asset-Related 

Activities 

On April 7, 2022, the FDIC issued Financial 

Institution Letter, Notification and 

Supervisory Feedback Procedures for 

FDIC-Supervised Institutions Engaging in 

Crypto-Related Activities, requesting that

FDIC-supervised institutions notify the FDIC 

if they intended to engage in, or were 

currently engaged in, crypto-related 

activities. The Letter stated that the FDIC 

would review the notification, request 

additional information as needed, and 

provide relevant supervisory feedback to the 

FDIC-supervised institution, as appropriate, 

in a timely manner.

In our report, FDIC Strategies Related to 

Crypto-Asset Risks, we found that the

FDIC’s process for providing supervisory

feedback to FDIC-supervised institutions 

about their crypto-related activities is 

unclear. Between March 2022 and May 

2023, the FDIC sent letters (pause letters) 

to certain FDIC-supervised institutions 

asking them to pause from proceeding with 

planned or expanded crypto activities and 

provide additional information. The FDIC 

asked the institutions to pause their 

activities in order to review the institutions’

crypto-related activities before providing

supervisory feedback. 

For this pause letter process, the FDIC did 

not establish a timeframe for reviewing 

submitted information, responding to the 

institutions, and describing what constituted 

the end of the FDIC’s review process. The 

FDIC’s lack of clear procedures and timely 

feedback regarding crypto-asset activities 

causes uncertainty for supervised 

institutions in determining the appropriate 

actions to take. Absent timely feedback 

from the FDIC and clarity regarding the end 

of the FDIC’s review process for paused 

crypto-related activities, the FDIC may be 

viewed as not being supportive of financial 

institutions engaging in crypto-related 

activities. We recommended that the FDIC 

update and clarify review timeframes and 

completion.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 225
•

•

•

•

Protecting Consumer Interests and 

Promoting Economic Inclusion 

Key Areas of Concern 

In addition to the DCP examiner staffing 

challenges described in the Strategic 

Human Capital Management at the FDIC 

section of this Report, the primary areas of 

concern for this Challenge are: 

Assessing Risks in Bank Consumer

Services Models

Improving the FDIC’s Ability to

Increase Economic Inclusion

Preparing to Examine for Changes

to the Community Reinvestment Act

Addressing Misuse of the FDIC

Name and Misrepresentation of

Deposit Insurance

According to the FDIC’s 2021 National 

Survey of Unbanked and Underbanked 

Households, 96 percent of U.S. households

(about 126 million in 2023) had bank

accounts. In serving these households, 

banks must keep depositors’ funds safe and 

treat consumers fairly, especially as banks 

introduce new technologies. For the 4 

percent (about 5 million in 2023) of 

households without a bank account, the 

World Bank notes the importance of helping 

these households because access to a

bank account is “a first step toward broader 

financial inclusion since a transaction 

account allows people to store money, and 

send and receive payments.” 

FDIC consumer programs and examinations 

seek to ensure that consumers with bank 

accounts are treated fairly in accordance 

with consumer laws and regulations. For 

those Americans without bank accounts, 

FDIC programs encourage inclusion of 

these individuals in the banking system to 

provide safe and affordable savings and 

credit solutions to improve household 

financial stability and resilience. 

Assessing Risks in Bank Consumer 

Services Models 

The Congressional Research Service has 

noted that banks are becoming increasingly 

reliant on new technology—especially AI 

and Machine Learning (ML). Such 

technology may benefit banks by allowing 

for “greater speed, accuracy, and 

confidence in loan decisions” but also 

introduce risks to consumers. In testimony

to the U.S. House of Representatives, 

Committee on Financial Services, the OCC 

Deputy Comptroller of the Currency for 

Operational Risk Policy outlined key 

consumer risks for new technology, 

including:

• Explainability. Banks must be able

to understand and explain AI

decision-making processes. Absent

explainability, banks may be unable

to ensure compliance with laws and

regulations, validate model

outcomes, and ensure the absence

of bias in the models’ design.

• Data management. Banks should

also understand data origins, use,

and governance of analytic models

to guard against unintended or

illegal decision outcomes.

• Privacy and security. Banks must

ensure the privacy and security of

sensitive consumer data used by AI

models.

• Third-party risk. Banks are also

expected to have robust due

diligence, effective contract

management, and ongoing oversight

of third parties based on the

criticality of the services being

provided.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 226
On March 31, 2021, banking regulators

issued a Request for Information and 

Comment on Financial Institutions’ Use of

AI, Including Machine Learning (AI RFI) to 

obtain information on banks’ risk

management processes for AI, challenges

to AI adoption or use, and potential benefits

to the banks for its use. Regulators are 

continuing to review information received 

from the AI RFI. Also, on October 30, 2023,

the Administration issued the Executive 

Order on Safe, Secure, and Trustworthy

Artificial Intelligence, which established 

standards for AI safety and security to 

promote innovation while protecting

American consumers’ privacy and civil

rights.

The FDIC should ensure that its consumer

protection examination procedures have 

processes to assess banks’ use of AI and

ML, and issue timely supervisory guidance 

to banks as needed. Further, the FDIC

should ensure that its consumer compliance 

examination staff has sufficient skills to

identify AI and ML model risk. DCP recently

established a branch in the Washington

Office to support DCP in assessing banks’

use of emerging technologies and to

monitor consumer protection risks of

emerging technologies.

Improving the FDIC’s Ability to 

Increase Economic Inclusion 

In June 2019, the FDIC published its

updated Economic Inclusion Strategic Plan

(EISP) to guide its efforts to promote and 

expand economic inclusion. In our report,

FDIC Efforts to Increase Consumer

Participation in the Insured Banking System, 

we assessed whether the FDIC developed 

and implemented an effective EISP to

increase participation in the insured banking 

system. We found that the FDIC’s plan 

aligned with several strategic planning best

practices. However, opportunities existed to

strengthen the effectiveness of future EISPs

by incorporating additional strategic

planning best practices into the strategic

planning process. These additional best

practices included: performing a 

comprehensive assessment of the 

landscape; identifying strategies and 

developing outcome-based performance 

measures to assess progress towards

desired goals; and identifying resources

needed to achieve desired goals and

address risks that could affect achievement

of goals.

We also found that the FDIC can take steps

to improve the implementation of future 

EISPs by aligning internal resources to 

achieve program objectives and measuring 

the outcomes of its economic inclusion 

efforts. Additionally, the FDIC’s Enterprise 

Risk Management risk mitigation strategies

to address economic inclusion efforts could

more clearly address risks related to

implementing strategic objectives, effective 

controls, and responsive programs to 

promote economic inclusion. Collectively,

these actions would help management

make the best use of Agency resources,

ensure accountability, monitor progress,

and make the EISP more effective in 

promoting economic inclusion. We made

14 recommendations to the FDIC to 

improve the development and

implementation of EISPs, including the

FDIC’s new EISP that was under

development at the time of our report.

Preparing to Examine for Changes 

to the Community Reinvestment 

Act 

The FDIC must also ensure that it has

required resources to devote towards

changes to the Community Reinvestment

Act (CRA). The purpose of the CRA is to 

encourage banks to help meet the credit

needs of the communities in which they do 

business, including low- and moderateincome communities, consistent with safe 

and sound operations. On October 24,

2023, banking regulators issued a final rule

that implements a revised regulatory

framework based on a bank’s asset size 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 227
and business model that uses performance 

tests to evaluate a bank’s performance in 

meeting the credit needs of its entire 

community. 

Implementation of new CRA regulations will 

require significant time and effort for the 

FDIC and the other banking agencies to 

revise examination policies and procedures; 

modify IT applications and systems; train 

examiners; and provide guidance and 

conduct bank outreach efforts. Given the 

staffing challenges discussed in the 

Strategic Human Capital Management at 

the FDIC section of this Report, DCP will 

need to ensure that it has sufficient staffing 

to address CRA-related changes. 

Addressing Misuse of the FDIC 

Name and Misrepresentation of 

Deposit Insurance 

The FDI Act prohibits any person from 

misusing the FDIC name or logo, or making 

misrepresentations about deposit insurance. 

The FDIC may investigate any claims under 

this section and may issue administrative 

enforcement actions, including cease and 

desist orders, and impose civil money 

penalties against perpetrators. Between 

July 2022 and June 2023, the FDIC issued 

12 letters to non-banks requiring that the 

recipients stop making false and misleading 

statements regarding FDIC deposit 

insurance and take immediate action to 

address these misleading and false 

statements or to provide documentation that 

their claims were true and accurate. 

In June 2022, the FDIC issued a final rule

on its “procedures for identifying,

investigating, and where necessary taking 

formal and informal action to address 

potential violations.” In addition, in 

December 2023, the FDIC adopted a final 

rule to modernize its regulations governing

use of the official FDIC signs and 

advertising statements, and to clarify the 

FDIC’s regulations regarding false 

advertising, misrepresentations of deposit 

insurance coverage, and misuse of the 

FDIC’s name or logo. Also, on January 19, 

2024 the FDIC issued a press release

stating that it demanded that five entities 

cease and desist from making false and 

misleading statements about FDIC 

insurance.

The FDIC obtains information on potential 

deposit insurance misrepresentations 

through various methods, including three 

public portals. Two portals are monitored 

by DCP, and the third portal is monitored by 

the Legal Division. The FDIC also scans 

websites for potential fraudulent use of the 

FDIC logo. We also receive information 

regarding potential deposit insurance 

misrepresentations through our OIG Hotline. 

The FDIC should ensure that identified 

potential misuse and misrepresentations are 

investigated and action is taken to address 

violations.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 228
•

•

•

•

•

•

•

•

•

Fortifying IT Security at the FDIC 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are:

Strengthening the FDIC’s

Information Security Profile

Improving Information Security

Controls

Managing Systems Migration to the

Cloud

Protecting the FDIC’s Wireless

Network

Assessing the FDIC’s Ransomware

Attack Readiness

The GAO continues to recognize 

cybersecurity as a high risk to Federal 

agencies, as it has since 1997. According 

to the Federal Information Security 

Modernization Act of 2014 Annual Report 

Fiscal Year 2022, there were 30,659 

reported Federal Government cybersecurity 

incidents in Fiscal Year 2022, which is a 5.7 

percent increase from Fiscal Year 2021. 

The FDIC relies on information and systems 

to execute its mission. In 2023, the FDIC 

had five multi-year capital IT projects 

collectively totaling nearly $1 billion—the 

largest of which is the Chief Information 

Officer Organization’s (CIOO) $862 million 

contract for data services. These systems 

contain sensitive information, such as 

names, Social Security Numbers, and bank 

account numbers for roughly 5,700 FDIC 

employees, about 4,300 contractors, and 

millions of depositors of failed financial 

institutions; confidential bank examination 

information, including supervisory ratings; 

and sensitive financial data. A 

cybersecurity incident could expose these 

FDIC-held data and impair FDIC mission 

capabilities, particularly during a crisis. 

Strengthening the FDIC’s 

Information Security Profile 

The Federal Information Security 

Modernization Act of 2014 requires Federal 

agencies, including the FDIC, to conduct 

annual independent evaluations of their 

information security programs and 

practices. In our OIG report, The FDIC’s 

Information Security Program – 2023 , we

evaluated the effectiveness of the FDIC’s 

information security program and practices. 

While the FDIC’s overall information 

security program was operating at a Level 4 

of 5, meaning managed and measurable, 

we found security control weaknesses that 

reduced the effectiveness of the FDIC’s 

information security program and practices 

that could be improved:

The FDIC needs to fully implement a

software inventory automation

program to manage security risks for

software that is approaching or has

reached its end-of-life or end-ofservice.

The FDIC’s Supply Chain Risk

Management program lacks

maturity.

The FDIC did not remove accounts

belonging to separated personnel in

a timely manner.

The FDIC did not configure

privileged accounts in accordance

with the principle of “Least Privilege.”

We identified security risks in

several instances where accounts

were configured with elevated

account settings that were not

needed for administrators to perform

their business roles, as well as other

instances where users had elevated

access longer than needed.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 229
• The FDIC needs to enforce

cybersecurity and privacy

awareness training requirements.

The FDIC is working to implement the two 

recommendations we made in our report to

address these control weaknesses.

Improving Information Security 

Controls 

The FDIC should ensure that only

individuals with a business need are 

allowed access to FDIC systems and

information. The FDIC uses Active 

Directory to centrally manage user

identification, authentication, and 

authorization for systems access. Active 

Directory infrastructure is an attractive 

target for attackers because the same 

functionality that grants legitimate users

access to systems and data can be hijacked

by malicious actors for nefarious purposes.

Therefore, it is paramount for the FDIC to 

ensure that it is adequately protecting its

Active Directory infrastructure.

In our OIG report, The FDIC's Security

Controls Over Microsoft Windows Active 

Directory, we found that the FDIC had not

fully established and implemented effective 

controls for securing and managing the

Active Directory to protect the FDIC’s

network, systems, and data in 7 of 12 areas

tested. These seven areas included 

password management, account

configuration, access management,

privileged account management, windows

operating system maintenance, active 

directory policies and procedures, and audit

logging and monitoring. The FDIC’s

ineffective Active Directory security controls

could pose significant risks to FDIC data

and systems. The FDIC has addressed 5 of

the 15 recommendations we made to 

improve Active Directory security controls

and is working to implement the remaining

10 recommendations.

In addition, in a memorandum to the FDIC

during our audit, The FDIC’s Information

Security Program—2022, we noted potential

information security and privacy issues 

concerning the FDIC’s process to review

emails flagged by certain automated tools

used to detect and minimize exfiltration of

information. This process presented 

security and privacy risks that FDIC

employees and/or contractors could be

inadvertently exposed to information that

they would otherwise not be permitted to

review, and safety risks that emails relevant

to urgent law enforcement matters would 

not be received by the OIG in a timely

manner.

In March 2023, the CIOO provided a plan to

update systems and processes to ensure

the confidential and timely receipt of OIG

email from complainants, whistleblowers,

and law enforcement partners. The FDIC

has communicated that it has approved 

funding to further on-going efforts that the 

CIOO intends to take during 2024 to

modernize the FDIC and OIG email

infrastructure. Successful implementation,

to include the resolution of technical

challenges (including mail handling/data

loss protection), is critical to meet the OIG’s

mission and maintain its independence.

Managing Systems Migration to 

the Cloud 

The FDIC has been moving systems into a 

cloud environment and plans to have most

of its mission essential and mission critical

systems operating in the cloud by 2026. In

our OIG report, The FDIC’s Adoption of

Cloud Computing Services, we assessed

whether the FDIC has an effective strategy

and governance processes to manage its

cloud computing services. We found that

overall, the FDIC had an effective strategy

and governance processes to manage its

cloud computing services. However, the 

FDIC did not adhere to several cloudrelated practices recommended by the 

Office of Management and Budget (OMB),

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 230
National Institute of Standards and

Technology (NIST), and FDIC guidance. As

a result, controls over cloud computing

posed increased risks to the FDIC, including 

security and privacy concerns due to the 

lack of visibility into cloud data, an inability

to effectively move from one existing cloud

services provider to another, not identifying

and mitigating performance risks and 

vulnerabilities in cloud contracts, and

increased potential for cyber attacks and

costs from the lack of disposal strategies for

legacy systems.

The FDIC addressed three of nine 

recommendations we made to address

these deficiencies and continues to address

the remaining six recommendations. We

also have work ongoing to assess FDIC

cloud security.

Protecting the FDIC’s Wireless 

Network 

The FDIC provides wireless access (WiFi)

throughout its facilities. Absent effective 

security controls, WiFi access provides an 

avenue into FDIC systems that could 

compromise the confidentiality, availability,

and integrity of FDIC data and systems.

In our OIG report, Security Controls Over

the FDIC’s Wireless Network, we found that

the FDIC did not comply or partially

complied with five practices recommended 

by NIST and guidance from the FDIC and

other Federal agencies. As a result, the 

FDIC faced potential security risks based 

upon its then-current wireless practices and

controls, including unauthorized access to 

the FDIC networks and insecure wireless

devices broadcasting WiFi signals. The

FDIC has addressed three of eight

recommendations to strengthen FDIC

wireless networks and is working to address

the remaining five recommendations.

Assessing the FDIC’s Ransomware 

Attack Readiness 

Government agencies are being targeted by

ransomware attacks involving malicious

software that encrypts files, rendering them

unusable until the victim pays a ransom to 

the perpetrator. For example, according to 

the GAO, in February 2023, the U.S.

Marshals Service suffered a ransomware 

attack with perpetrators gaining access to 

sensitive information, including

investigations and employees’ personal

data. In its 2023 Risk Review, the FDIC

noted in particular that “[r]ansomware 

continues to pose a significant threat to U.S.

critical infrastructure sectors, including

finance and banking, as the number of

attacks continues to increase.”

In addition to information security

safeguards, the FDIC should have effective 

processes to address a potential

ransomware attack. A ransomware attack

on the FDIC could hinder the FDIC’s ability

to resolve failed banks, issue deposit

insurance payments to bank account

holders, examine and supervise financial

institutions, and manage receiverships.

Disruption of any of these FDIC core 

functions could lead to financial system

instability, including a loss of public

confidence in the FDIC’s ability to pay

depositors.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 231
•

•

•

•

Strengthening FDIC Contract and 

Supply Chain Management 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are: 

Improving Contract Management

Addressing Supply Chain Risk

Management

Ensuring Contractors Are

Appropriately Vetted and Are Not

Performing Inherently Governmental

Functions

Ensuring Whistleblower Rights and

Protections for Contractor Personnel

Agencies should effectively manage their 

acquisitions process in order to ensure that 

contract requirements are defined clearly 

and all aspects of contracts are fulfilled. 

Agencies are also required to ensure that 

contractor personnel are vetted and 

performing appropriate tasks. Further, 

agencies should assess the risks of their 

goods and services supply chains. 

According to NIST “adversaries are using 

the supply chain as an attack vector and [as 

an] effective means of penetrating [United 

States’ public and private] systems, 

compromising the integrity of system 

elements, and gaining access to critical 

assets.” For example, in June 2023, it was 

reported that several Federal agencies 

suffered a cyber intrusion where malicious 

actors exploited a vulnerability in a 

contracted software application.10

Improving Contract Management 

In 2023, the FDIC awarded 634 contracts 

for a total of $1.3 billion. GAO reviews of 

FDIC financial statements and our OIG 

reports have demonstrated a need for the 

FDIC to improve its contract management. 

In its 2020, 2021, and 2022 audits of FDIC 

financial statements, the GAO identified 

deficiencies in the FDIC’s internal controls 

over contract documentation and paymentreview processes. These deficiencies 

increased the risk that improper payments 

could occur and FDIC operating expenses

and accounts payable could be misstated. 

Collectively, these weaknesses represented 

a significant deficiency11 in the FDIC’s

internal controls over its financial reporting. 

Notably, the FDIC has been working to 

improve its contracting internal controls and 

there was no contracting significant 

deficiency for the 2023 financial statement 

audit.

In three recent OIG reports, we have found 

shortcomings in the FDIC’s contract 

management process and internal controls:

• Lack of Change Management

Resulted in Abandonment of a

Nearly $10 Million Investment

Towards a New Acquisition

System. In our evaluation The

FDIC’s Purchase and Deployment of

the FDIC Acquisition Management

System (FAMS), we found that the

primary reason for the unsuccessful

systems acquisition procurement

was that the FDIC did not employ an

effective change management

process. The FDIC had initiated a

contract to procure a new acquisition

system, in part, to address

weaknesses in its existing systems

that were identified in our report,

Contract Oversight Management. In

June 2022, the FDIC began

implementation of its new acquisition

system but subsequently abandoned

that system within 5 months. As a

result, the FDIC incurred contract

and labor-hour costs of nearly

$10 million and had to revert to its

legacy acquisition systems and

manual reporting of some acquisition

activities. We made three

recommendations to the FDIC to

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 232
improve change management. We 

also identified $9.9 million of funds 

to be put to better use.

• Internal Control Failures and an

Unaccountable Culture Resulted

in an Unauthorized Contractual

Commitment of $4.2 Million and a

Contract Price $1.5 Million Above

Market Value. In our report, FDIC

Oversight of a Telecommunications

Contract, we found that the FDIC did

not authorize and pay AT&T for

services to upgrade bandwidth in the

FDIC Field Offices in accordance

with its policies and procedures and

existing telecommunications

contract. The FDIC did not adhere

to its acquisition policies and

procedures for a number of reasons.

The FDIC’s former CIO had not

established an accountable

organizational culture nor an

appropriate internal control

environment to ensure compliance

with FDIC acquisition policies and

procedures. The FDIC CIOO and

DOA did not implement proper

internal controls for the AT&T

contract. Additionally, the FDIC did

not include risks related to the FDIC

CIOO’s reliance on contractor

services and the need to maintain an

effective internal control environment

for its contract oversight

management activities in the FDIC

Enterprise Risk Management’s Risk

Inventory. Further, certain FDIC

CIOO personnel did not fulfill their

roles and responsibilities. As a

result, the FDIC was subject to an

unauthorized contractual

commitment that cost the FDIC $4.2

million and a prolonged increase in

operational, monetary, legal, and

reputational risks. Further, we found

that the FDIC incurred costs above

the market price for similar services

in the amount of at least $1.5 million.

The FDIC has addressed 10 of 14

recommendations we made to

improve organizational culture and

establish internal controls. 

• Lack of Contract Management

Plans to Ensure Inherent

Performance Risks and Contract

Vulnerabilities Were Managed

Appropriately. In our report, The

FDIC’s Adoption of Cloud

Computing Services, we found that

the FDIC did not develop Contract

Management Plans (CMP) for any of

our sampled 17 cloud computingrelated contracts with a total value of

over $546 million. We further

assessed 93 active IT-related

contracts and found that 91 of these

93 contracts had CMPs, but those

91 CMPs were not in place by

required timeframes. CMPs are

developed to document a common

understanding of contractor and

FDIC obligations and provide a

strategy for managing key contract

vulnerabilities or performance areas

inherent in the contract, and any

unique contract terms and

conditions. Absent CMPs, the FDIC

may not monitor performance

measures, respond to missed

metrics, and enforce contract

penalties in a consistent manner, all

of which could lead to inefficient use

of resources and disruption to FDIC

operations. The FDIC addressed

three of nine recommendations we

made to address these deficiencies

and continues to work to address the

remaining six recommendations.

The FDIC must also ensure that employees 

involved in contracting do not have conflicts 

of interest. According to the FDIC’s Ethics 

Program Advisory, Conflicts of Interest, 

FDIC employees are trusted to make

decisions and take actions to serve the 

public’s interest and should not act to enrich 

their own personal interests. The Advisory 

also notes that criminal penalties—felony 

conviction, fines, or jail time—could result 

from conflicts of interest. 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 233
Addressing Supply Chain Risk 

Management 

In our report, The FDIC’s Implementation of 

Supply Chain Risk Management, we found

that the FDIC has not implemented several 

objectives outlined in its Supply Chain Risk 

Management Implementation Project 

Charter and is not conducting supply chain 

risk assessments in accordance with best 

practices. In addition, we found that the 

FDIC has not integrated Agency-wide 

supply chain risks into its Enterprise Risk 

Management processes. The FDIC has 

addressed four of nine recommendations 

we made to improve the FDIC’s supply 

chain risk management process and is 

working to address the remaining five 

recommendations.

As part of our later OIG report, The Federal 

Deposit Insurance Corporation’s Information 

Security Program -2023, we found that the 

FDIC’s supply chain risk management 

program lacked maturity because five of 

nine recommendations from our Supply 

Chain Risk Management report remained 

outstanding. Specifically, the FDIC had not 

completed development of policies and 

procedures to address supply chain risk and 

had not conducted supply chain risk 

assessments prior to entering into contracts 

with new suppliers or when substantive 

changes were made to contracts, such as 

renewals, extensions, or exercising option

periods. Further, the FDIC had not 

established required metrics and indicators 

to monitor and evaluate supply chain risk 

and implement supply chain controls 

recommended by NIST.

Ensuring Contractors Are 

Appropriately Vetted and Are Not 

Performing Inherently 

Governmental Functions 

The FDIC budget for 2023 included $458 

million for outside services—which was the 

second highest budget category behind 

employee salary and benefit costs. As 

shown in Figure 6, the FDIC has 

consistently had about 4,000 contractors 

supporting the FDIC permanent staff of 

about 5,700. The FDIC increased 

contractor staffing in 2023 because of bank

failure activity.

Contractors must meet FDIC and 

Government-wide vetting standards before 

they may begin work at the FDIC. As part 

of our work reviewing the FDIC’s IT security 

controls, we found that the FDIC did not 

have adequate controls to ensure that 

certain contractors and employees who 

required privileged access to FDIC 

information systems and data had 

background investigations commensurate 

with appropriate determinations of risk. 

In our memorandum regarding these 

inadequate controls, Background 

Investigations for Privileged Account 

Holders, we alerted the FDIC that one

contractor who met FDIC standards in

February 2021 was granted access to a 

privileged account in April 2021. However, 

the Federal background investigation was 

not adjudicated until November 2021, and 

the adjudication was unfavorable at that 

time. Based on the adjudication, the FDIC 

ceased the privileged access and 

terminated the contractor, consistent with 

FDIC policies and procedures. The 

0

1000

2000

3000

4000

5000

6000

7000

2020 2021 2022 2023

Contractors FDIC Employees

Figure 6: FDIC Employees and Contractors 2020 to 2023

Source: OIG Analysis of FDIC Data

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 234
contractor had access to privileged 

accounts for approximately 7 months while 

the background investigation was being

adjudicated.

Also, certain functions cannot be performed 

by contractors. In OMB Policy letter 11-01,

Performance of Inherently Governmental

and Critical Functions, OMB defined these 

functions as inherently governmental

functions. OMB also required that most

agencies identify critical functions and

ensure sufficient staffing and control over

these functions.

12 OMB defined a Critical

Function as “a function that is necessary to 

the agency being able to effectively perform

and maintain control of its mission and 

operations. Typically, critical functions are

recurring and long-term in duration.”

In our OIG evaluation, Critical Functions in 

FDIC Contracts, we assessed whether an

FDIC contractor performed Critical

Functions and, if so, whether the FDIC

retained sufficient management oversight of

the contractor to maintain control of its

mission and operations in accordance with 

best practices. We found that the FDIC did 

not have policies and procedures for

identifying Critical Functions in its contracts.

Therefore, while we determined that the

contractor performed Critical Functions at

the FDIC, the FDIC did not identify these 

services as Critical Functions during its

procurement planning phase. As a result,

the FDIC also did not implement heightened 

contract monitoring. The FDIC has

addressed 11 of our 13 recommendations to 

strengthen the FDIC’s identification and

monitoring of contracts involving Critical 

Functions, and the FDIC is working to 

address the remaining 2 recommendations. 

Ensuring Whistleblower Rights and 

Protections for Contractor 

Personnel 

In our OIG report, Whistleblower Rights and

Protections for FDIC Contractors, we found

that the FDIC had not aligned its procedures

and processes with laws, regulations, and

policies designed to ensure notice to

contractor and subcontractor employees

about their whistleblower rights and 

protections. The FDIC also did not always

comply with the requirements to notify

contractors of their whistleblower rights and 

protections. The FDIC’s Legal Division did

not adopt any whistleblower rights

notification provisions for contractors or

include any whistleblower clauses in its

contracts. The FDIC also did not verify that

contractors and subcontractors notified

employees of their whistleblower rights and 

protections.

The FDIC has implemented eight of our

nine recommendations, including the Legal

Division’s adoption of whistleblower rights

notifications and inclusion of whistleblower

clauses. The FDIC is working to resolve the 

remaining recommendation to develop and 

implement procedures to ensure that

contractors carry out their obligations to 

verify that all contractor and subcontractor

personnel are notified of their whistleblower

rights and that whistleblower clauses are

included in subcontracts.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 235
•

•

•

Fortifying Governance of FDIC Programs and Data 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are:

Strengthening Performance Goal

Development and Monitoring

Improving Internal Controls by

Addressing Outstanding

Recommendations

Ensuring Data Quality to Assess

Program Performance

Effective governance is critical to ensure 

that the FDIC assesses and addresses 

risks—especially those identified in this 

Report. Governance refers to a 

management framework that 

incorporates operational, financial, 

risk management, and reporting 

processes, so that FDIC Board 

Members and senior officials can 

effectively plan, govern, and meet 

strategic objectives. This includes 

ensuring alignment of goals, 

budget, and risks to achieve the 

FDIC’s mission. A governance 

framework should ensure strategic 

guidance, effective monitoring of 

management, and accountability to 

stakeholders. 

Strengthening Performance 

Goal Development and 

Monitoring

The FDIC develops and monitors its 

performance goals as part of the 

FDIC’s annual planning and budget 

process. The FDIC annual planning and 

budget process is key to providing 

resources—funding, staffing, goods, and 

services—for the FDIC to address and 

measure progress towards tackling 

identified challenges. 

As shown in Figure 7, the FDIC’s annual

planning and budget process is continual

and includes ten steps: (1) industry and 

workload analysis, (2) strategic planning, (3)

budget and performance goal development, 

(4) senior management review of the budget

and performance goals, (5) Board approval

of the budget, (6) internal FDIC

performance goal and annual performance

goal review, (7) budget monitoring, (8)

approval of internal FDIC performance

goals, (9) approval of external annual

performance goals and submission of these

goals to Congress, and (10) monitoring and

reporting budget variance and progress in

achieving FDIC internal performance goals.

The FDIC’s annual planning and budget 

process also considers risks identified 

through the FDIC’s ERM process. 

According to the GAO, ERM “is a forwardlooking approach that allows agencies to 

assess threats and opportunities that could 

affect achievement of its goals.” OMB 

Circular A-123, Management’s

Responsibility for Enterprise Risk 

Management and Internal Control, notes

Figure 7: FDIC Annual Planning and Budget Process

Source: FDIC DOF Website

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 236
that ERM should be part of an agency’s 

strategic planning, performance 

management, and performance reporting. 

In a number of our reports, we have found 

limitations in the FDIC’s development and 

monitoring of FDIC performance goals and 

a misalignment between performance goals 

and FDIC strategic plans that impeded the 

FDIC from assessing and measuring 

progress towards goal achievement. For 

example:

• Bank IT Examinations: In our

report, Implementation of the FDIC’s

Information Technology Examination

(InTREx) Program, we found that the

FDIC’s performance goal focusing

on improving its supervision program

did not focus on IT supervision

activities and did not address the

performance of IT examinations or

the effectiveness of the InTREx

Program. Also, in the RMS Division

Strategic Plan 2018-2022, RMS

established the following

performance goal: “RMS

supervision is effective, forwardlooking, and provides value-added

risk management expertise to

banks.” However, this goal does not

directly address the FDIC’s InTREx

program. Without establishing IT

examination performance goals,

objectives, and metrics, the FDIC is

unable to measure the effectiveness

of the InTREx program. Further, the

FDIC is unable to determine whether

its IT examination activities under

the InTREx program are achieving

their desired outcomes or results.

• Regional Service Provider

Examinations: In our

memorandum, The FDIC’s Regional

Service Provider Examination

Program, we found that the FDIC

has not established performance

goals or metrics to measure the

effectiveness of the RSP

examination program. Establishing

performance goals and metrics for

the RSP examination program would 

allow the FDIC to define program 

expectations and measure overall 

program efficiency and 

effectiveness, which would identify 

areas for improvement. 

• Orderly Liquidation Readiness: In

our report, The FDIC’s Orderly

Liquidation Authority, we found

limitations in the FDIC’s monitoring

and reporting of Division and

Agency-level goals and objectives

related to OLA. Specifically, we

found that monitoring and reporting

activities did not ensure OLA

resolution planning activities had

consistently and promptly

progressed since the enactment of

the Dodd-Frank Act nor did they

provide a clear picture of the overall

status of the OLA program. The

FDIC had not developed long-term

metrics and a clear definition of

success that would facilitate

consistent measuring, monitoring,

and reporting on the overall status of

the OLA program over time. Such

metrics could address key readiness

items such as the status of

readiness plans, policies and

procedures, training activities,

processes subjected to exercises,

and outstanding significant action

items from exercises.

Further, we found that in 2015, the

FDIC had established an annual

performance goal to "[e]nsure the

FDIC’s operational readiness to

resolve a large, complex financial

institution using the orderly

liquidation authority in Title II of the

DFA." A key target for reaching this

goal, identified in the FDIC Annual

Report 2015, was to “Update and

refine firm-specific resolutions [sic]

plans and strategies and develop

operational procedures for the

administration of a Title II

ANNUAL REPORT 2023 237
receivership.” The FDIC reported 

this milestone as achieved, in part 

because the FDIC had developed its 

Systemic Resolution Framework. 

However, the 2015 annual report did 

not clearly reflect the overall status 

of the OLA program, which 

continues to lack the process-level 

procedures needed for the Systemic 

Resolution Framework and the 

resolution strategies needed for an 

OLA resolution of a systemically 

important non-bank financial 

company or Financial Market 

Utility. 

• Increasing Consumer

Participation in Banking: In our

report, FDIC Efforts to Increase

Consumer Participation in the

Banking System, we found that the

FDIC could strengthen

connections between FDIC Annual

Performance Goals and DCP’s

Economic Inclusion Strategic Plan

(EISP) by ensuring that the

expressed intent of annual goals

related to DCP’s economic

inclusion efforts matched the goals

and objectives articulated in the

EISP. We also found that the FDIC

could improve the implementation of

future EISPs by aligning internal

resources to achieve program

objectives and measuring the

outcomes of its economic inclusion

efforts. Collectively, these actions

would help management make the

best use of Agency resources,

ensure accountability, monitor

progress, and make its strategic plan

more effective in promoting

economic inclusion.

Improving Internal Controls by 

Addressing Outstanding 

Recommendations 

As shown in Figure 8, as of January 31, 

2024 the FDIC had 122 OIG report

recommendations that were unimplemented 

– meaning the OIG had not received and

reviewed information from the Agency to

indicate that a recommendation should be

closed. A total of 90 percent (110 of 122) of

unimplemented recommendations were for

reports issued during Fiscal Year 2023 and

2024, while 10 percent (12 of 122) related to

reports issued between Fiscal Year 2020

and 2022.

The longest outstanding recommendation is 

for our report, Contract Oversight 

Management. In 2019, we recommended

that the FDIC provide enhanced contract 

portfolio reports to the FDIC Board of 

Directors, executives, and senior managers. 

Further, four recommendations remain 

outstanding from our 2021 report, Critical 

Functions in FDIC Contracts. As noted in 

the Strengthening FDIC Contract and

Supply Chain Management section of this 

Report, contract management remains a 

significant challenge at the FDIC and has 

been identified by the FDIC as high risk in 

the FDIC’s Risk Inventory. The FDIC Board 

and senior officials should ensure that 

program weaknesses are promptly 

resolved. If recommendations are not 

addressed expeditiously, the FDIC faces an 

increased likelihood that the underlying 

vulnerabilities or deficiencies will continue or 

recur until remediated by the FDIC.

80 67 68 37

3

1

2 9 90

20

0

20

40

60

80

100

120

140

2020 2021 2022 2023 2024

Figure 8: Unimplemented Recommendations by Fiscal Year 

Source: FDIC OIG website 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 238
Ensuring Data Quality to Assess 

Program Performance 

Data is one of the most valuable FDIC 

assets. Analytical insights based on reliable 

data can support evidence-based decision 

making and help the FDIC build a 

performance-based culture. Reliable data 

requires effective governance of the data 

lifecycle from the point that data is entered 

into a system through the retirement of data 

records. Inadequate data governance can 

lead to higher costs, incorrect decisions, 

and reputational risks to the FDIC. Further, 

data quality is an important control in 

implementing effective use of artificial 

intelligence. Prior reports13 and three 

recent reports highlight data reliability 

issues: 

• Bank-reported Computer Security

Incidents: In our report, Sharing of

Threat and Vulnerability Information

with Financial Institutions, we

determined that the FDIC’s controls

were not effective to ensure that it

maintained complete and accurate

data in the Virtual Supervisory

Information on the Net system on all

computer-security incidents reported

by banks and service providers.

Inaccurate and incomplete incident

information may limit the FDIC’s

ability to conduct critical research

and trend analyses on threats and

vulnerabilities and impede its ability

to share accurate, complete, and

relevant information internally with

its examination staff and externally

with financial institutions.

• Human Capital Costs Related to

Economic Inclusion Efforts: In

our report, FDIC Efforts to Increase

Consumer Participation in the

Insured Banking System, we

identified data reliability issues with 

reports created out of the 

Community Affairs Reporting and 

Events System used to plan, 

monitor, and track outcomes of 

economic-inclusion related events 

and activities. As a result of data 

reliability issues, the FDIC cannot 

ensure it is allocating resources to 

its economic inclusion-related 

activities efficiently, effectively, or 

with accountability to achieve the 

Agency’s goals.

• RSP Bank Customer List: In our

memorandum, The FDIC’s Regional

Service Provider Examination

Program, we noted that the RSP

Uniform Customer List—the list

showing the banks with whom the

RSP has contractual obligations for

services—was found by the FDIC to

be unreliable. As a result, the FDIC

and other Federal banking

regulators were unable to distribute

their reports of examination for

RSPs to the banks that received the

RSP’s services.

The FDIC should have an Agency-wide 

approach to data quality. Each FDIC 

Division and Office should ensure that the 

data they gather and enter into systems is 

adequate, appropriately controlled, and 

used effectively to improve operations. 

FDIC Divisions and Offices should also 

partner with the FDIC’s Division of 

Information Technology to use technology 

to assess and test for data quality issues. 

The FDIC’s cloud migration effort includes 

data quality reviews to identify unreliable 

data prior to cloud migration, and Divisions 

and Offices should ensure that they have 

resources to address data issues as they 

are identified.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 239
1 Informal actions are voluntary commitments made by a

bank’s Board of Directors that are not legally

enforceable and are not publicly disclosed or published.

Examples of informal enforcement actions are a Bank

Board Resolution or a Memorandum of Understanding. 

Formal actions are legally enforceable and published on 

the FDIC website. Examples of formal enforcement 

actions are Consent Orders or Cease and Desist Orders.

2 According to the FDIC RMS Manual, RMS examination 

staff assess and rate six financial and operational

components - Capital adequacy, Asset quality, 

Management capabilities, Earnings sufficiency, Liquidity

position, and Sensitivity to market risk - commonly

referred to as CAMELS ratings. Examiners assign the

component and composite ratings based on a numerical

scale from 1 to 5, with 1 indicating the strongest

performance and risk management practices. A 5 rating

indicates the highest degree of supervisory concern.

3 See OIG report, Offsite Reviews of 1- and 2-Rated

Institutions (December 2019), for a description of the

Offsite Review Program.

4 The process is based on generally accepted accounting

principles.

5 The FDIC has not yet completed the following OLA

requirements to prescribe correlating rules or

regulations for: (1) 12 U.S.C. § 5390(o)(6) that requires

the FDIC, in consultation with the Secretary, to prescribe 

regulations to implement assessments of U.S. financial

companies, if such assessments are needed, to pay in

full obligations issued by the FDIC to the Treasury, and

(2) 12 U.S.C. § 5393(d) that requires the FDIC and the

FRB, in consultation with FSOC, to jointly prescribe rules

or regulations to administer and carry out a ban on

activities by senior executives and directors of failed

SIFCs if they have violated a law, regulation, or certain

agency orders; or participated in “any unsafe or unsound

practice” in connection with a financial company; or

breached their fiduciary duties. Specifically, the DFA

authorizes the FDIC or FRB, as applicable, to “prohibit

any further participation by such person, in any manner,

in the conduct of the affairs of any financial company for

a period of time determined by the appropriate agency

to be commensurate with such violation, practice, or

breach, provided such period shall be not less than 2

years.”

6 NBC, Some M&T Bank Customer Information Hacked in 

Massive Data Breach (August 30, 2023).

7 American Banker, This is the Sleeping Giant, Banks

Zero in on Fourth-Party Risk (August 4, 2023).

8 See FFIEC, Financial Regulators Release Guidance for

the Supervision of Technology Service Providers (October

31, 2012) and current guidance Supervision of

Technology Service Providers.

9 American Banker, AI Is About To Make Synthetic Fraud

A Much Bigger Problem (July 4, 2023).

10 CNN, Exclusive: US Government Agencies Hit in

Global Cyberattack (June 15, 2023).

11 A significant deficiency is a deficiency, or a

combination of deficiencies, in internal control that is

less severe than a material weakness, yet important 

enough to merit attention by those charged with

governance. A material weakness is a deficiency, or

combination of deficiencies, in internal control over

financial reporting, such that there is a reasonable

possibility that a material misstatement of the entity’s

financial statements will not be prevented, or detected

and corrected, on a timely basis. A deficiency in internal 

control exists when the design or operation of a control

does not allow management or employees, in the normal

course of performing their assigned functions, to

prevent, or detect and correct, misstatements on a

timely basis.

12 The FDIC found that Policy Letter 11-01 was not

binding on the FDIC, but the FDIC has viewed the policy

as instructive.

13 See our reports: The FDIC’s Personnel Security and

Suitability Program, where we found that contractor

position risk levels recorded in FDIC systems were

unreliable. As a result, the FDIC could not determine

whether these contractors received background

investigations commensurate with their positions. 

Termination of Bank Secrecy Act/Anti-Money Laundering

Consent Orders, where we found that the FDIC did not 

consistently track Consent Order termination data in its

system of record. As a result, the FDIC provided nine

incorrect reports to the FDIC Board of Directors

concerning enforcement actions and did not report three

BSA/AML Consent Order terminations in a quarterly

report to FinCEN. Reliability of Data in the FDIC Virtual 

Supervisory Information on the Net System, where we

found that two of the four key data elements we tested

in the FDIC’s ViSION system were not reliable. Errors in 

these data elements increase the risk of inaccurate

reporting of examination performance metrics to FDIC

management.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 240
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 241 

D. Acronyms 

(INCLUDES ACRONYMS IN THE FINANCIAL STATEMENTS) 

AEI Alliances for Economic Inclusion

AFS Available-For-Sale

AHDP Affordable Housing Disposition Program

AML Anti-Money Laundering

AML/CFT Anti-Money Laundering and Countering the Financing of Terrorism

ANPR Advance Notice of Proposed Rulemaking

APBO Accumulated Postretirement Benefit Obligation

ARRC Alternative Reference Rates Committee

ASBA Association of Supervisors of Banks of the Americas

ASC Accounting Standards Codification 

BCBS Basel Committee on Banking Supervision

BDC Backup Data Center

BIF Bank Insurance Fund

BIPOC Black, Indigenous, and People of Color

BoA Bank of America

BOA Basic Ordering Agreement

BPM Business Process Modernization

Call Report Consolidated Reports of Condition and Income

CAMELS Capital adequacy; Asset quality; Management capabilites; Earnings 

sufficiency; Liquidity position; Sensitivity to market risk

CBAC Advisory Committee on Community Banking

CCPs Central Counterparties

CDFI Community Development Financial Institution

CECL Current Expected Credit Losses

CEO Chief Executive Officer

CFO Act Chief Financial Officers Act

CFPB Consumer Financial Protection Bureau
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 242 

CFR Center for Financial Research

CFT Countering the Financing of Terrorism

CFTC Commodity Futures Trading Commission

CIO Chief Information Officer

CIOO Chief Information Officer Organization

CISR Division of Complex Institution Supervision and Resolution

CMG Crisis Management Group

CMP Civil Money Penalty

ComE-IN Advisory Committee on Economic Inclusion

COVID-19 Coronavirus Disease 2019

CRA Community Reinvestment Act

CRC Consumer Response Center

CRE Commercial Real Estate

CSBS Conference of State Bank Supervisors

CSRS Civil Service Retirement System

DCP Division of Depositor and Consumer Protection

DEIA Diversity, Equity, Inclusion, and Accessibility

DIF Deposit Insurance Fund

DIR Division of Insurance and Research

DOA Division of Administration

Dodd-Frank Act Dodd-Frank Wall Street Reform and Consumer Protection 

Act of 2010

DRR Division of Resolutions and Receiverships

EDIE Electronic Deposit Insurance Estimator

ERM Enterprise Risk Management

EU European Union

FASB Financial Accounting Standards Board

FBO Foreign Banking Organization

FCB First Citizens Bank & Trust Company

FDI Act Federal Deposit Insurance Act
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 243 

FDIC Federal Deposit Insurance Corporation

FEHB Federal Employees Health Benefits

FERS Federal Employees Retirement System

FFB Federal Financing Bank

FFIEC Federal Financial Institutions Examination Council

FFMIA Federal Financial Management Improvement Act

FHFA Federal Housing Finance Agency

FID Financial Institution Diversity

FIL Financial Institution Letter

FinCEN Financial Crimes Enforcement Network

Fintech Financial Technology Company

FIRREA Financial Institutions Reform, Recovery and Enforcement Act

FISs Financial Institution Specialists

FISMA Federal Information Security Modernization Act of 2014

FMFIA Federal Managers’ Financial Integrity Act

FOCUS Framework for Oversight of Compliance and CRA Activities 

User Suite

FRB Board of Governors of the Federal Reserve System

FRF FSLIC Resolution Fund

FSB Financial Stability Board

FS-ISAC Financial Services Information Sharing and Analysis Center

FSLIC Federal Savings and Loan Insurance Corporation

FSOC Financial Stability Oversight Council

FTC Federal Trade Commission

FTE Full-Time Equivalent

GAAP Generally Accepted Accounting Principles

GAO U.S. Government Accountability Office

GPRA Government Performance and Results Act

G-SIBs Global Systemically Important Banks

G-SIFIs Global Systemically Important Financial Institutions
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 244 

HBCU Historically Black Colleges and Universities

IADI International Association of Deposit Insurers

IDI Insured Depository Institution

IMF International Monetary Fund

IT Information Technology

LCFI Large Complex Financial Institution

LIBOR London Inter-bank Offered Rate

LIDI Large Insured Depository Institution

LMF Labor Management Forum

LMI Low- and Moderate-Income

LURAs Land Use Restriction Agreements

ME/MC Mission Essential/Mission Critical

MDI Minority Depository Institutions

MOL Maximum Obligation Limitation

MOU Memorandum of Understanding

MRBA Matters Requiring Board Attention

MSSP Managed Security Services Provider

MWOB Minority- and Women-Owned Business

MWOLF Minority-and Women-Owned Law Firms

N.A. National Association

NAMWOLF National Association of Minority-and Women-Owned Law Firms

NCDA National Center for Consumer and Depositor Assistance

NCUA National Credit Union Administration

NIM Net Interest Margin

NPR Notice of Proposed Rulemaking

NSFR Net Stable Funding Ratio

NTEU National Treasury Employees Union

OCC Office of the Comptroller of the Currency

OIG Office of Inspector General
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 245 

OLA Orderly Liquidation Authority

OMB U.S. Office of Management and Budget

OMWI Office of Minority and Women Inclusion

OO Office of the Ombudsman

OPM Office of Personnel Management

ORMIC Office of Risk Management and Internal Controls

OTS Office of Thrift Supervision

PAVE Property Appraisal and Valuation Equity

PMN Purchase Money Note

PPE Primary Purpose Exception

QFC Qualified Financial Contract

REFCORP Resolution Funding Corporation

ResG Financial Stability Board’s Resolution Steering Committee

RFI Request For Information

RMS Division of Risk Management Supervision

ROE Reports of Examination

ROU Right-of-Use

RTC Resolution Trust Corporation

SAIF Savings Association Insurance Fund

SARC Supervision Appeals Review Committee

SEC Securities and Exchange Commission

SIFI Systemically Important Financial Institution

SLA Shared-Loss Agreement

SNC Shared National Credit

SPPS Security and Privacy Professional Services

SRAC Systemic Resolution Advisory Committee

SRR SIFI Risk Report

SSGN Structured Sale Of Guaranteed Note

SVB Silicon Valley Bank
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2023 246 

SVBB Silicon Valley Bridge Bank, N.A.

TAG Transaction Account Guarantee Program

TDR Troubled Debt Restructuring

TSP Federal Thrift Savings Plan

UDAA Unclaimed Deposits Amendments Act of 1993

UFIRS Uniform Financial Institutions Rating System

UK United Kingdom

U.S. United States

USD U.S. Dollar

Treasury U.S. Treasury

VIE Variable Interest Entity