VII.

APPENDICES
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 169 

FDIC Actions on Financial Institutions Applications 

2022 2021 2020

Deposit Insurance 17 15 18

Approved1 17 15 18

Denied 0 0 0

New Branches 481 493 430

Approved 481 493 430

Denied 0 0 0

Mergers 133 187 159

Approved 133 187 159

Denied 0 0 0

Requests for Consent to Serve2 52 47 79

Approved 50 47 78

Section 19 6 5 11

Section 32 44 42 67

Denied 2 0 1

Section 19 0 0 0

Section 32 2 0 1

Notices of Change in Control 23 34 17

Letters of Intent Not to Disapprove 22 34 17

Disapproved 1 0 0

Brokered Deposit Waivers 1 1 4

Approved 0 1 4

Denied 1 0 0

Savings Association Activities3 0 0 0

Approved 0 0 0

Denied 0 0 0

State Bank Activities/Investments4 25 25 31

Approved 25 25 31

Denied 0 0 0

Conversion of Mutual Institutions 4 4 2

Non-Objection 4 4 2

Objection 0 0 0

1 Includes deposit insurance applications filed on behalf of (1) newly organized institutions, (2) existing uninsured financial 

services companies seeking establishment as an insured institution, and (3) interim institutions established to facilitate merger or 

conversion transactions, and applications to facilitate the establishment of thrift holding companies.

2 Under Section 19 of the Federal Deposit Insurance (FDI) Act, an insured institution must receive FDIC approval before employing 

a person convicted of dishonesty or breach of trust. Under Section 32, the FDIC must approve any change of directors or senior 

executive officers at a state nonmember bank that is not in compliance with capital requirements or is otherwise in troubled 

condition. 

3 Section 28 of the FDI Act, in general, prohibits a federally-insured state savings association from engaging in an activity not 

permissible for a federal savings association and requires notices or applications to be filed with the FDIC.

4 Section 24 of the FDI Act, in general, prohibits a federally-insured state bank from engaging in an activity not permissible for a 

national bank and requires notices or applications to be filed with the FDIC.

A. KEY STATISTICS
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 170 

Combined Risk and Consumer Enforcement Actions 

2022 2021 2020

Total Number of Actions Initiated by the FDIC 118 99 169

Termination of Insurance 16 7 10

Involuntary Termination 0 0 0

Sec. 8a for Violations, Unsafe/Unsound Practices or Conditions 0 0 0

Voluntary Termination 16 7 10

Sec. 8a by Order Upon Request 0 0 0

Sec. 8p No Deposits 14 6 8

Sec. 8q Deposits Assumed 2 1 2

Sec. 8b Consent and Cease-and-Desist Actions 19 10 23

Notices of Charges Issued 0 1 1

Orders to Pay Restitution 0 0 0

Consent and Cease and Desist Orders 17 8 20

Personal Cease and Desist Orders 2 1 2

Sec. 8e Removal/Prohibition of Director or Officer 28 25 37

Notices of Intention to Remove/Prohibit 3 4 4

Consent Orders 25 21 33

Sec. 8g Suspension/Removal When Charged With Crime 0 0 0

Civil Money Penalty Actions 27 30 21

Sec. 7a Call Report Penalty Orders 0 0 0

Sec. 8i Flood Act Civil Money Penalty Orders 24 26 16

Sec. 8i Civil Money Penalty Notices of Assessment 3 4 5

Sec. 10c Orders of Investigation 8 2 4

Sec. 19 Waiver Orders 20 24 74

Approved Section 19 Waiver Orders 20 24 74

Denied Section 19 Waiver Orders 0 0 0

Sec. 32 Notices Disapproving Officer/Director’s Request for Review 0 0 0

Truth-in-Lending Act Reimbursement Actions 41 44 41

Denials of Requests for Relief 0 0 0

Grants of Relief 0 0 0

Banks Making Reimbursement1 41 44 41

Suspicious Activity Reports (Open and closed institutions)1 421,118 360,121 299,887

Other Actions Not Listed2 0 1 0

1 These actions do not constitute the initiation of a formal enforcement action and, therefore, are not included in the total 

number of actions initiated.

2 The Other Actions Not Listed were, in 2022: 0; in 2021: 1 Supervisory Prompt Corrective Action Directive; in 2020: 0.
Estimated Insured Deposits and the Deposit Insurance Fund, 

December 31, 1934, through September 30, 20221

Dollars in Millions (except Insurance Coverage)

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total 

Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total 

Domestic 

Deposits

Est. Insured

Deposits

2022 $250,000 $17,941,143 $9,926,325 55.3 $125,457.0 0.70 1.26

2021 250,000 18,237,196 9,746,183 53.4 123,141.0 0.68 1.26 

2020 250,000 16,339,026 9,129,574 55.9 117,896.8 0.72 1.29

2019 250,000 13,262,843 7,828,163 59.0 110,346.9 0.83 1.41 

2018 250,000 12,659,406 7,525,204 59.4 102,608.9 0.81 1.36 

2017 250,000 12,129,503 7,154,379 59.0 92,747.5 0.76 1.30 

2016 250,000 11,693,371 6,915,663 59.1 83,161.5 0.71 1.20 

2015 250,000 10,952,922 6,518,675 59.5 72,600.2 0.66 1.11

2014 250,000 10,410,687 6,195,554 59.5 62,780.2 0.60 1.01 

2013 250,000 9,825,479 5,998,238 61.0 47,190.8 0.48 0.79 

2012 250,000 9,474,720 7,402,053 78.1 32,957.8 0.35 0.45 

2011 250,000 8,782,291 6,973,483 79.4 11,826.5 0.13 0.17 

2010 250,000 7,887,858 6,301,542 79.9 (7,352.2) (0.09) (0.12)

2009 250,000 7,705,354 5,407,773 70.2 (20,861.8) (0.27) (0.39)

2008 100,000 7,505,408 4,750,783 63.3 17,276.3 0.23 0.36 

2007 100,000 6,921,678 4,292,211 62.0 52,413.0 0.76 1.22 

2006 100,000 6,640,097 4,153,808 62.6 50,165.3 0.76 1.21 

2005 100,000 6,229,753 3,890,930 62.5 48,596.6 0.78 1.25 

2004 100,000 5,724,621 3,622,059 63.3 47,506.8 0.83 1.31 

2003 100,000 5,223,922 3,452,497 66.1 46,022.3 0.88 1.33 

2002 100,000 4,916,078 3,383,598 68.8 43,797.0 0.89 1.29 

2001 100,000 4,564,064 3,215,581 70.5 41,373.8 0.91 1.29 

2000 100,000 4,211,895 3,055,108 72.5 41,733.8 0.99 1.37 

1999 100,000 3,885,826 2,869,208 73.8 39,694.9 1.02 1.38 

1998 100,000 3,817,150 2,850,452 74.7 39,452.1 1.03 1.38 

1997 100,000 3,602,189 2,746,477 76.2 37,660.8 1.05 1.37 

1996 100,000 3,454,556 2,690,439 77.9 35,742.8 1.03 1.33 

1995 100,000 3,318,595 2,663,873 80.3 28,811.5 0.87 1.08 

1994 100,000 3,184,410 2,588,619 81.3 23,784.5 0.75 0.92 

1993 100,000 3,220,302 2,602,781 80.8 14,277.3 0.44 0.55 

1992 100,000 3,275,530 2,677,709 81.7 178.4 0.01 0.01 

1991 100,000 3,331,312 2,733,387 82.1 (6,934.0) (0.21) (0.25)

1990 100,000 3,415,464 2,784,838 81.5 4,062.7 0.12 0.15 

1989 100,000 3,412,503 2,755,471 80.7 13,209.5 0.39 0.48 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 171 
Estimated Insured Deposits and the Deposit Insurance Fund, 

December 31, 1934, through September 30, 20221 (continued)

Dollars in Millions (except Insurance Coverage) 

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

1988 100,000 2,337,080 1,756,771 75.2 14,061.1 0.60 0.80 

1987 100,000 2,198,648 1,657,291 75.4 18,301.8 0.83 1.10 

1986 100,000 2,162,687 1,636,915 75.7 18,253.3 0.84 1.12 

1985 100,000 1,975,030 1,510,496 76.5 17,956.9 0.91 1.19 

1984 100,000 1,805,334 1,393,421 77.2 16,529.4 0.92 1.19 

1983 100,000 1,690,576 1,268,332 75.0 15,429.1 0.91 1.22 

1982 100,000 1,544,697 1,134,221 73.4 13,770.9 0.89 1.21 

1981 100,000 1,409,322 988,898 70.2 12,246.1 0.87 1.24 

1980 100,000 1,324,463 948,717 71.6 11,019.5 0.83 1.16 

1979 40,000 1,226,943 808,555 65.9 9,792.7 0.80 1.21 

1978 40,000 1,145,835 760,706 66.4 8,796.0 0.77 1.16 

1977 40,000 1,050,435 692,533 65.9 7,992.8 0.76 1.15 

1976 40,000 941,923 628,263 66.7 7,268.8 0.77 1.16 

1975 40,000 875,985 569,101 65.0 6,716.0 0.77 1.18 

1974 40,000 833,277 520,309 62.4 6,124.2 0.73 1.18 

1973 20,000 766,509 465,600 60.7 5,615.3 0.73 1.21 

1972 20,000 697,480 419,756 60.2 5,158.7 0.74 1.23 

1971 20,000 610,685 374,568 61.3 4,739.9 0.78 1.27 

1970 20,000 545,198 349,581 64.1 4,379.6 0.80 1.25 

1969 20,000 495,858 313,085 63.1 4,051.1 0.82 1.29 

1968 15,000 491,513 296,701 60.4 3,749.2 0.76 1.26 

1967 15,000 448,709 261,149 58.2 3,485.5 0.78 1.33 

1966 15,000 401,096 234,150 58.4 3,252.0 0.81 1.39 

1965 10,000 377,400 209,690 55.6 3,036.3 0.80 1.45 

1964 10,000 348,981 191,787 55.0 2,844.7 0.82 1.48 

1963 10,000 313,304 177,381 56.6 2,667.9 0.85 1.50 

1962 10,000 297,548 170,210 57.2 2,502.0 0.84 1.47 

1961 10,000 281,304 160,309 57.0 2,353.8 0.84 1.47 

1960 10,000 260,495 149,684 57.5 2,222.2 0.85 1.48 

1959 10,000 247,589 142,131 57.4 2,089.8 0.84 1.47 

1958 10,000 242,445 137,698 56.8 1,965.4 0.81 1.43 

1957 10,000 225,507 127,055 56.3 1,850.5 0.82 1.46 

1956 10,000 219,393 121,008 55.2 1,742.1 0.79 1.44 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 172 
Estimated Insured Deposits and the Deposit Insurance Fund, 

December 31, 1934, through September 30, 20221 (continued)

Dollars in Millions (except Insurance Coverage) 

Deposits in Insured 

Institutions2

Insurance Fund as 

a Percentage of

Year

Insurance 

Coverage2

Total Domestic 

Deposits

Est. Insured

Deposits

Percentage 

of Domestic 

Deposits

Deposit 

Insurance

Fund

Total

Domestic 

Deposits

Est. Insured

Deposits

1955 10,000 212,226 116,380 54.8 1,639.6 0.77 1.41 

1954 10,000 203,195 110,973 54.6 1,542.7 0.76 1.39 

1953 10,000 193,466 105,610 54.6 1,450.7 0.75 1.37 

1952 10,000 188,142 101,841 54.1 1,363.5 0.72 1.34 

1951 10,000 178,540 96,713 54.2 1,282.2 0.72 1.33 

1950 10,000 167,818 91,359 54.4 1,243.9 0.74 1.36 

1949 5,000 156,786 76,589 48.8 1,203.9 0.77 1.57 

1948 5,000 153,454 75,320 49.1 1,065.9 0.69 1.42 

1947 5,000 154,096 76,254 49.5 1,006.1 0.65 1.32 

1946 5,000 148,458 73,759 49.7 1,058.5 0.71 1.44 

1945 5,000 157,174 67,021 42.6 929.2 0.59 1.39 

1944 5,000 134,662 56,398 41.9 804.3 0.60 1.43 

1943 5,000 111,650 48,440 43.4 703.1 0.63 1.45 

1942 5,000 89,869 32,837 36.5 616.9 0.69 1.88 

1941 5,000 71,209 28,249 39.7 553.5 0.78 1.96 

1940 5,000 65,288 26,638 40.8 496.0 0.76 1.86 

1939 5,000 57,485 24,650 42.9 452.7 0.79 1.84 

1938 5,000 50,791 23,121 45.5 420.5 0.83 1.82 

1937 5,000 48,228 22,557 46.8 383.1 0.79 1.70 

1936 5,000 50,281 22,330 44.4 343.4 0.68 1.54 

1935 5,000 45,125 20,158 44.7 306.0 0.68 1.52 

1934 5,000 40,060 18,075 45.1 291.7 0.73 1.61 

1 For 2022, figures are as of September 30; all other prior years are as of December 31. Prior to 1989, figures are for the Bank Insurance Fund (BIF) only 

and exclude insured branches of foreign banks. For 1989 to 2005, figures represent the sum of the BIF and Savings Association Insurance Fund (SAIF) 

amounts; for 2006 to 2022, figures are for DIF. Amounts for 1989-2022 include insured branches of foreign banks. Prior to year-end 1991, insured 

deposits were estimated using percentages determined from June Call and Thrift Financial Reports.

2 The year-end 2008 coverage limit and estimated insured deposits do not reflect the temporary increase to $250,000 then in effect under the Emergency 

Economic Stabilization Act of 2008. The Dodd-Frank Wall Street Reform and Consumer Protection (Dodd-Frank) Act made this coverage limit permanent. 

The year-end 2009 coverage limit and estimated insured deposits reflect the $250,000 coverage limit. The Dodd-Frank Act also temporarily provided 

unlimited coverage for non-interest bearing transaction accounts for two years beginning December 31, 2010. Coverage for certain retirement accounts 

increased to $250,000 in 2006. Initial coverage limit was $2,500 from January 1 to June 30, 1934.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 173 
Income and Expenses, Deposit Insurance Fund, from Beginning of Operations, 

September 11, 1933, through December 31, 2022 

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment 

Income

Assessment 

Credits

Investment 

and Other

Effective

Assessment 

Rate1 Total

Provision 

for 

Ins. Losses

Admin.

and 

Operating 

Expenses2

Interest

& Other Ins. 

Expenses

Funding 

Transfer

from the 

FSLIC 

Resolution 

Fund

Net Income/

(Loss)

TOTAL $287,115.8 $213,309.3 $12,157.2 $85,963.7 $156,225.2 $106,059.2 $40,681.4 $9,484.7 $139.5 $131,030.1

2022 9,606.7 8,310.8 0.0 $1,295.9 0.0397% 1,803.5 (82.9) 1,882.9 3.5 0.0 7,803.2

2021 8,153.4 7,080.2 0.0 1,073.2 0.0356% 1,705.3 (143.7) 1,842.7 6.3 0.0 6,448.1

2020 8,796.5 7,153.9 60.7 $1,703.3 0.0395% 1,691.9 (157.3) 1,846.5 2.7 0.0 7,104.6

2019 7,095.3 5,642.7 703.6 2,156.2 0.0312% 513.2 (1,285.5) 1,795.6 3.1 0.0 6,582.1

2018 11,170.8 9,526.7 0.0 1,644.1 0.0626% 1,205.2 (562.6) 1,764.7 3.1 0.0 9,965.6 

2017 11,663.7 10,594.8 0.0 1,068.9 0.0716% 1,558.2 (183.1) 1,739.4 2.0 0.0 10,105.5 

2016 10,674.1 9,986.6 0.0 687.5 0.0699% 150.6 (1,567.9) 1,715.0 3.5 0.0 10,523.5 

2015 9,303.5 8,846.8 0.0 456.7 0.0647% (553.2) (2,251.3) 1,687.2 10.9 0.0 9,856.7 

2014 8,965.1 8,656.1 0.0 309.0 0.0663% (6,634.7) (8,305.5) 1,664.3 6.5 0.0 15,599.8 

2013 10,458.9 9,734.2 0.0 724.7 0.0775% (4,045.9) (5,659.4) 1,608.7 4.8 0.0 14,504.8 

2012 18,522.3 12,397.2 0.2 6,125.3 0.1012% (2,599.0) (4,222.6) 1,777.5 (153.9) 0.0 21,121.3 

2011 16,342.0 13,499.5 0.9 2,843.4 0.1115% (2,915.4) (4,413.6) 1,625.4 (127.2) 0.0 19,257.4 

2010 13,379.9 13,611.2 0.8 (230.5) 0.1772% 75.0 (847.8) 1,592.6 (669.8) 0.0 13,304.9 

2009 24,706.4 17,865.4 148.0 6,989.0 0.2330% 60,709.0 57,711.8 1,271.1 1,726.1 0.0 (36,002.6)

2008 7,306.3 4,410.4 1,445.9 4,341.8 0.0418% 44,339.5 41,838.8 1,033.5 1,467.2 0.0 (37,033.2)

2007 3,196.2 3,730.9 3,088.0 2,553.3 0.0093% 1,090.9 95.0 992.6 3.3 0.0 2,105.3 

2006 2,643.5 31.9 0.0 2,611.6 0.0005% 904.3 (52.1) 950.6 5.8 0.0 1,739.2 

2005 2,420.5 60.9 0.0 2,359.6 0.0010% 809.3 (160.2) 965.7 3.8 0.0 1,611.2 

2004 2,240.3 104.2 0.0 2,136.1 0.0019% 607.6 (353.4) 941.3 19.7 0.0 1,632.7 

2003 2,173.6 94.8 0.0 2,078.8 0.0019% (67.7) (1,010.5) 935.5 7.3 0.0 2,241.3 

2002 2,384.7 107.8 0.0 2,276.9 0.0023% 719.6 (243.0) 945.1 17.5 0.0 1,665.1 

2001 2,730.1 83.2 0.0 2,646.9 0.0019% 3,123.4 2,199.3 887.9 36.2 0.0 (393.3)

2000 2,570.1 64.3 0.0 2,505.8 0.0016% 945.2 28.0 883.9 33.3 0.0 1,624.9 

1999 2,416.7 48.4 0.0 2,368.3 0.0013% 2,047.0 1,199.7 823.4 23.9 0.0 369.7 

1998 2,584.6 37.0 0.0 2,547.6 0.0010% 817.5 (5.7) 782.6 40.6 0.0 1,767.1 

1997 2,165.5 38.6 0.0 2,126.9 0.0011% 247.3 (505.7) 677.2 75.8 0.0 1,918.2 

1996 7,156.8 5,294.2 0.0 1,862.6 0.1622% 353.6 (417.2) 568.3 202.5 0.0 6,803.2 

1995 5,229.2 3,877.0 0.0 1,352.2 0.1238% 202.2 (354.2) 510.6 45.8 0.0 5,027.0 

1994 7,682.1 6,722.7 0.0 959.4 0.2192% (1,825.1) (2,459.4) 443.2 191.1 0.0 9,507.2 

1993 7,354.5 6,682.0 0.0 672.5 0.2157% (6,744.4) (7,660.4) 418.5 497.5 0.0 14,098.9 

1992 6,479.3 5,758.6 0.0 720.7 0.1815% (596.8) (2,274.7) 614.83 1,063.1 35.4 7,111.5 

1991 5,886.5 5,254.0 0.0 632.5 0.1613% 16,925.3 15,496.2 326.1 1,103.0 42.4 (10,996.4)

1990 3,855.3 2,872.3 0.0 983.0 0.0868% 13,059.3 12,133.1 275.6 650.6 56.1 (9,147.9)

1989 3,494.8 1,885.0 0.0 1,609.8 0.0816% 4,352.2 3,811.3 219.9 321.0 5.6 (851.8)

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 174 
Income and Expenses, Deposit Insurance Fund, from Beginning of Operations, 

September 11, 1933, through December 31, 2022 (continued)

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment 

Income

Assessment 

Credits

Investment 

and Other

Effective

Assessment 

Rate1 Total

Provision 

for 

Ins. Losses

Admin.

and 

Operating 

Expenses2

Interest

& Other Ins. 

Expenses

Funding 

Transfer

from the

 FSLIC 

Resolution 

Fund

Net Income/

(Loss)

1988 3,347.7 1,773.0 0.0 1,574.7 0.0825% 7,588.4 6,298.3 223.9 1,066.2 0.0 (4,240.7)

1987 3,319.4 1,696.0 0.0 1,623.4 0.0833% 3,270.9 2,996.9 204.9 69.1 0.0 48.5 

1986 3,260.1 1,516.9 0.0 1,743.2 0.0787% 2,963.7 2,827.7 180.3 (44.3) 0.0 296.4 

1985 3,385.5 1,433.5 0.0 1,952.0 0.0815% 1,957.9 1,569.0 179.2 209.7 0.0 1,427.6 

1984 3,099.5 1,321.5 0.0 1,778.0 0.0800% 1,999.2 1,633.4 151.2 214.6 0.0 1,100.3 

1983 2,628.1 1,214.9 164.0 1,577.2 0.0714% 969.9 675.1 135.7 159.1 0.0 1,658.2 

1982 2,524.6 1,108.9 96.2 1,511.9 0.0769% 999.8 126.4 129.9 743.5 0.0 1,524.8 

1981 2,074.7 1,039.0 117.1 1,152.8 0.0714% 848.1 320.4 127.2 400.5 0.0 1,226.6 

1980 1,310.4 951.9 521.1 879.6 0.0370% 83.6 (38.1) 118.2 3.5 0.0 1,226.8 

1979 1,090.4 881.0 524.6 734.0 0.0333% 93.7 (17.2) 106.8 4.1 0.0 996.7 

1978 952.1 810.1 443.1 585.1 0.0385% 148.9 36.5 103.3 9.1 0.0 803.2 

1977 837.8 731.3 411.9 518.4 0.0370% 113.6 20.8 89.3 3.5 0.0 724.2 

1976 764.9 676.1 379.6 468.4 0.0370% 212.3 28.0 180.44 3.9 0.0 552.6 

1975 689.3 641.3 362.4 410.4 0.0357% 97.5 27.6 67.7 2.2 0.0 591.8 

1974 668.1 587.4 285.4 366.1 0.0435% 159.2 97.9 59.2 2.1 0.0 508.9 

1973 561.0 529.4 283.4 315.0 0.0385% 108.2 52.5 54.4 1.3 0.0 452.8 

1972 467.0 468.8 280.3 278.5 0.0333% 65.7 10.1 49.6 6.05 0.0 401.3 

1971 415.3 417.2 241.4 239.5 0.0345% 60.3 13.4 46.9 0.0 0.0 355.0 

1970 382.7 369.3 210.0 223.4 0.0357% 46.0 3.8 42.2 0.0 0.0 336.7 

1969 335.8 364.2 220.2 191.8 0.0333% 34.5 1.0 33.5 0.0 0.0 301.3 

1968 295.0 334.5 202.1 162.6 0.0333% 29.1 0.1 29.0 0.0 0.0 265.9 

1967 263.0 303.1 182.4 142.3 0.0333% 27.3 2.9 24.4 0.0 0.0 235.7 

1966 241.0 284.3 172.6 129.3 0.0323% 19.9 0.1 19.8 0.0 0.0 221.1 

1965 214.6 260.5 158.3 112.4 0.0323% 22.9 5.2 17.7 0.0 0.0 191.7 

1964 197.1 238.2 145.2 104.1 0.0323% 18.4 2.9 15.5 0.0 0.0 178.7 

1963 181.9 220.6 136.4 97.7 0.0313% 15.1 0.7 14.4 0.0 0.0 166.8 

1962 161.1 203.4 126.9 84.6 0.0313% 13.8 0.1 13.7 0.0 0.0 147.3 

1961 147.3 188.9 115.5 73.9 0.0323% 14.8 1.6 13.2 0.0 0.0 132.5 

1960 144.6 180.4 100.8 65.0 0.0370% 12.5 0.1 12.4 0.0 0.0 132.1 

1959 136.5 178.2 99.6 57.9 0.0370% 12.1 0.2 11.9 0.0 0.0 124.4 

1958 126.8 166.8 93.0 53.0 0.0370% 11.6 0.0 11.6 0.0 0.0 115.2 

1957 117.3 159.3 90.2 48.2 0.0357% 9.7 0.1 9.6 0.0 0.0 107.6 

1956 111.9 155.5 87.3 43.7 0.0370% 9.4 0.3 9.1 0.0 0.0 102.5 

1955 105.8 151.5 85.4 39.7 0.0370% 9.0 0.3 8.7 0.0 0.0 96.8 

1954 99.7 144.2 81.8 37.3 0.0357% 7.8 0.1 7.7 0.0 0.0 91.9 

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 175 
Income and Expenses, Deposit Insurance Fund, from Beginning of Operations, 

September 11, 1933, through December 31, 2022 (continued)

Dollars in Millions

Income Expenses and Losses

Year Total

Assessment 

Income

Assessment 

Credits

Investment 

and Other

Effective

Assessment 

Rate1 Total

Provision 

for 

Ins. Losses

Admin.

and 

Operating 

Expenses2

Interest

& Other Ins. 

Expenses

Funding 

Transfer

from the

 FSLIC 

Resolution 

Fund

Net Income/

(Loss)

1953 94.2 138.7 78.5 34.0 0.0357% 7.3 0.1 7.2 0.0 0.0 86.9 

1952 88.6 131.0 73.7 31.3 0.0370% 7.8 0.8 7.0 0.0 0.0 80.8 

1951 83.5 124.3 70.0 29.2 0.0370% 6.6 0.0 6.6 0.0 0.0 76.9 

1950 84.8 122.9 68.7 30.6 0.0370% 7.8 1.4 6.4 0.0 0.0 77.0 

1949 151.1 122.7 0.0 28.4 0.0833% 6.4 0.3 6.1 0.0 0.0 144.7 

1948 145.6 119.3 0.0 26.3 0.0833% 7.0 0.7 6.36 0.0 0.0 138.6 

1947 157.5 114.4 0.0 43.1 0.0833% 9.9 0.1 9.8 0.0 0.0 147.6 

1946 130.7 107.0 0.0 23.7 0.0833% 10.0 0.1 9.9 0.0 0.0 120.7 

1945 121.0 93.7 0.0 27.3 0.0833% 9.4 0.1 9.3 0.0 0.0 111.6 

1944 99.3 80.9 0.0 18.4 0.0833% 9.3 0.1 9.2 0.0 0.0 90.0 

1943 86.6 70.0 0.0 16.6 0.0833% 9.8 0.2 9.6 0.0 0.0 76.8 

1942 69.1 56.5 0.0 12.6 0.0833% 10.1 0.5 9.6 0.0 0.0 59.0 

1941 62.0 51.4 0.0 10.6 0.0833% 10.1 0.6 9.5 0.0 0.0 51.9 

1940 55.9 46.2 0.0 9.7 0.0833% 12.9 3.5 9.4 0.0 0.0 43.0 

1939 51.2 40.7 0.0 10.5 0.0833% 16.4 7.2 9.2 0.0 0.0 34.8 

1938 47.7 38.3 0.0 9.4 0.0833% 11.3 2.5 8.8 0.0 0.0 36.4 

1937 48.2 38.8 0.0 9.4 0.0833% 12.2 3.7 8.5 0.0 0.0 36.0 

1936 43.8 35.6 0.0 8.2 0.0833% 10.9 2.6 8.3 0.0 0.0 32.9 

1935 20.8 11.5 0.0 9.3 0.0833% 11.3 2.8 8.5 0.0 0.0 9.5 

1933-

34 7.0 0.0 0.0 7.0 N/A 10.0 0.2 9.8 0.0 0.0 (3.0)

1

 The effective assessment rate is calculated from annual assessment income (net of assessment credits), excluding transfers to the Financing Corporation (FICO), 

Resolution Funding Corporation (REFCORP) and FSLIC Resolution Fund, divided by the average assessment base. Figures represent only BIF-insured institutions prior 

to 1990, and BIF- and SAIF-insured institutions from 1990 through 2005. After 1995, all thrift closings became the responsibility of the FDIC and amounts are reflected in 

the SAIF. Beginning in 2006, figures are for the DIF.

The annualized assessment rate for 2022 is based on full year assessment income divided by a four quarter average of 2022 quarterly assessment base amounts. The 

assessment base for fourth quarter 2022 was estimated using the third quarter 2022 assessment base and an assumed quarterly growth rate of one percent.

Historical Assessment Rates:

1934 – 1949 The statutory assessment rate was 0.0833 percent.

1950 – 1984 The effective assessment rates varied from the statutory rate of 0.0833 percent due to assessment credits provided in those years.

1985 – 1989 The statutory assessment rate was 0.0833 percent (no credits were given).

1990 The statutory rate increased to 0.12 percent.

1991 – 1992 The statutory rate increased to a minimum of 0.15 percent. The effective rates in 1991 and 1992 varied because the FDIC exercised new authority to 

increase assessments above the statutory minimum rate when needed.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 176 
1993 – 2006 Beginning in 1993, the effective rate was based on a risk-related premium system under which institutions paid assessments in the range of 0.23 percent 

to 0.31 percent. In May 1995, the BIF reached the mandatory recapitalization level of 1.25 percent. As a result, BIF assessment rates were reduced to 

a range of 0.04 percent to 0.31 percent of assessable deposits, effective June 1995, and assessments totaling $1.5 billion were refunded in September 

1995. Assessment rates for the BIF were lowered again to a range of 0 to 0.27 percent of assessable deposits, effective the start of 1996. In 1996, the 

SAIF collected a one-time special assessment of $4.5 billion. Subsequently, assessment rates for the SAIF were lowered to the same range as the BIF, 

effective October 1996. This range of rates remained unchanged for both funds through 2006.

2007 – 2008 As part of the implementation of the Federal Deposit Insurance Reform Act of 2005, assessment rates were increased to a range of 0.05 percent to 0.43 

percent of assessable deposits effective at the start of 2007, but many institutions received a one-time assessment credit ($4.7 billion in total) to offset 

the new assessments.

2009 – 2011 For the first quarter of 2009, assessment rates were increased to a range of 0.12 percent to 0.50 percent of assessable deposits. On June 30, 2009, a 

special assessment was imposed on all insured banks and thrifts, which amounted in aggregate to approximately $5.4 billion. For 8,106 institutions, 

with $9.3 trillion in assets, the special assessment was 5 basis points of each insured institution’s assets minus tier one capital; 89 other institutions, 

with assets of $4.0 trillion, had their special assessment capped at 10 basis points of their second quarter assessment base. From the second quarter of 

2009 through the first quarter of 2011, initial assessment rates ranged between 0.12 percent and 0.45 percent of assessable deposits. Initial rates were 

subject to further adjustments.

2011 – 2016 Beginning in the second quarter of 2011, the assessment base changed to average total consolidated assets less average tangible equity (with certain 

adjustments for banker’s banks and custodial banks), as required by the Dodd-Frank Act. The FDIC implemented a new assessment rate schedule at the 

same time to conform to the larger assessment base. Initial assessment rates were lowered to a range of 0.05 percent to 0.35 percent of the new base. 

The annualized assessment rates averaged approximately 17.6 cents per $100 of assessable deposits for the first quarter of 2011 and 11.1 cents per $100 

of the new base for the last three quarters of 2011 (which is shown in the table).

2016 Beginning July 1, 2016, initial assessment rates were lowered from a range of 5 basis points to 35 basis points to a range of 3 basis points to 30 basis 

points, and an additional surcharge was imposed on large banks (generally institutions with $10 billion or more in assets) of 4.5 basis points of their 

assessment base (after making adjustments).

2018 The 4.5 basis point surcharge imposed on large banks ended effective October 1, 2018. The annualized assessment rates averaged approximately 7.2 

cents per $100 of the assessable base for the first three quarters of 2018 and 3.5 cents per $100 of the assessment base for the last quarter of 2018. The 

full year annualized assessment rate averaged 6.3 cents per $100 (which is shown in the table).

2019 Assessment income for 2019 was reduced by small bank credits of $703.6 million.

2020 Assessment income for 2020 was reduced by small bank credits of $60.7 million.

2 These expenses, which are presented as operating expenses in the Statement of Income and Fund Balance, pertain to the FDIC in its corporate capacity only and do 

not include costs that are charged to the failed bank receiverships that are managed by the FDIC. The receivership expenses are presented as part of the “Receivables 

from Resolutions, net” line on the Balance Sheet. The narrative and graph presented on page 117 of this report shows the aggregate (corporate and receivership) 

expenditures of the FDIC.

3 Includes $210 million for the cumulative effect of an accounting change for certain postretirement benefits (1992).

4 Includes a $106 million net loss on government securities (1976).

5 This amount represents interest and other insurance expenses from 1933 to 1972.

6 Includes the aggregate amount of $81 million of interest paid on capital stock between 1933 and 1948.

APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 177 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 178 

Assets and Deposits of Failed or Assisted Insured Institutions and 

Losses to the Deposit Insurance Fund, 1934 - 2022

Dollars in Thousands

Bank and Thrift Failures1

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3

Losses to 

the Fund4

2,631 $947,307,165 $713,862,572 $104,582,869

2022 0 0 0 0 

2021 0 0 0 0 

2020 4 454,986 437,138 93,370 

2019 4 208,767 $190,547 26,234 

2018 0 0 0 0 

2017 8 5,081,737 4,683,360 1,082,256 

2016 5 277,182 268,516 42,474 

2015 8 6,706,038 4,870,464 858,079 

2014 18 2,913,503 2,691,485 378,385 

2013 24 6,044,051 5,132,246 1,204,125 

2012 51 11,617,348 11,009,630 2,381,860 

2011 92 34,922,997 31,071,862 6,394,904 

20105 157 92,084,988 78,290,185 15,789,632 

20095 140 169,709,160 137,835,208 25,912,803 

20085 25 371,945,480 234,321,715 17,790,944 

2007 3 2,614,928 2,424,187 157,440

2006 0 0 0 0

2005 0 0 0 0

2004 4 170,099 156,733 3,917 

2003 3 947,317 901,978 62,647 

2002 11 2,872,720 2,512,834 413,989 

2001 4 1,821,760 1,661,214 292,465 

2000 7 410,160 342,584 32,138 

1999 8 1,592,189 1,320,573 586,027 

1998 3 290,238 260,675 221,606 

1997 1 27,923 27,511 5,026 

1996 6 232,634 230,390 60,615 

1995 6 802,124 776,387 84,472 

1994 13 1,463,874 1,397,018 179,051 

1993 41 3,828,939 3,509,341 632,646 

1992 120 45,357,237 39,921,310 3,674,149 

1991 124 64,556,512 52,972,034 6,001,595 

1990 168 16,923,462 15,124,454 2,771,489 

1989 206 28,930,572 24,152,468 6,195,286 

1988 200 38,402,475 26,524,014 5,377,497 

1987 184 6,928,889 6,599,180 1,862,492 

1986 138 7,356,544 6,638,903 1,682,538 

1985 116 3,090,897 2,889,801 648,179 

1934 - 1984 729 16,719,435 12,716,627 1,682,538
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 179 

Assets and Deposits of Failed or Assisted Insured Institutions and 

Losses to the Deposit Insurance Fund, 1934 - 2022 (continued)

Dollars in Thousands

Assistance Transactions

Year2

Number 

of Banks/

Thrifts

Total 

Assets3

Total 

Deposits3

Losses to 

the Fund4

154 $3,317,099,253 $1,442,173,417 $5,430,481

2010 - 2022 0 0 0 0

20096 8 1,917,482,183 1,090,318,282 0 

20086 5 1,306,041,994 280,806,966 0 

1993 - 2007 0 0 0 0 

1992 2 33,831 33,117 250 

1991 3 78,524 75,720 3,024 

1990 1 14,206 14,628 2,338 

1989 1 4,438 6,396 2,296 

1988 80 15,493,939 11,793,702 1,540,642 

1987 19 2,478,124 2,275,642 160,164 

1986 7 712,558 585,248 93,179 

1985 4 5,886,381 5,580,359 359,056 

1984 2 40,470,332 29,088,247 1,116,275 

1983 4 3,611,549 3,011,406 337,683 

1982 10 10,509,286 9,118,382 1,042,784 

1981 3 4,838,612 3,914,268 772,790 

1980 1 7,953,042 5,001,755 0 

1934 - 1979 4 1,490,254 549,299 0

1 Institutions for which the FDIC is appointed receiver, including deposit payoff, insured deposit transfer, and deposit assumption 

cases.

2 For 1990 through 2005, amounts represent the sum of BIF and SAIF failures (excluding those handled by the RTC); prior to 1990, 

figures are only for the BIF. After 1995, all thrift closings became the responsibility of the FDIC and amounts are reflected in the 

SAIF. For 2006 to 2022, figures are for the DIF.

3 Assets and deposit data are based on the last Call Report or TFR filed before failure.

4 Losses to the fund include final and estimated losses. Final losses represent actual losses for unreimbursed subrogated claims 

of inactivated receiverships. Estimated losses generally represent the difference between the amount paid by the DIF to cover 

obligations to insured depositors and the estimated recoveries from the liquidation of receivership assets. 

5

 Includes amounts related to transaction account coverage under the Transaction Account Guarantee Program (TAG). The 

estimated losses as of December 31, 2022, for TAG accounts in 2010, 2009, and 2008 are $362 million, $1.1 billion, and $12 

million, respectively.

6

 Includes institutions where assistance was provided under a systemic risk determination.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 180 

Martin J. Gruenberg 

Martin J. Gruenberg was sworn in as Chairman of the FDIC Board 

of Directors on January 5, 2023. He has been a member of the 

FDIC Board since August 2005 and previously served as Vice 

Chairman from August 2005 to July 2011 and as Chairman from 

November 2012 to mid-2018. Mr. Gruenberg has also served as 

Acting Chairman on a number of occasions.

Mr. Gruenberg joined the FDIC Board after broad congressional 

experience in the financial services and regulatory areas. He 

served as Senior Counsel to Senator Paul S. Sarbanes (D-MD) 

on the staff of the Senate Committee on Banking, Housing, and 

Urban Affairs from 1993 to 2005. He also served as Staff Director 

of the Banking Committee’s Subcommittee on International Finance and Monetary Policy from 

1987 to 1992.

Mr. Gruenberg served as Chairman of the Executive Council and President of the International 

Association of Deposit Insurers (IADI) from November 2007 to November 2012. In addition, 

Mr. Gruenberg served as Chairman of the Federal Financial Institutions Examination Council 

from April 2017 to June 2018.

Since June 2019, Mr. Gruenberg has served as Chairman of the Board of Directors of the 

Neighborhood Reinvestment Corporation (NeighborWorks America), and he has been a 

member of the Board since April 2018.

Beginning February 15, 2022, Mr. Gruenberg assumed the role of Chairman of the Resolution 

Steering Group (ReSG) of the Financial Stability Board.

Mr. Gruenberg holds a J.D. from Case Western Reserve Law School and an A.B. from Princeton 

University, Princeton School of Public and International Affairs.

B. MORE ABOUT THE FDIC

FDIC BOARD OF DIRECTORS
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 181 

Travis Hill

Travis Hill was sworn in as Vice Chairman of the FDIC Board of 

Directors on January 5, 2023. Previously, he worked at the FDIC 

from 2018 to 2022, as Deputy to the Chairman for Policy and 

before that as Senior Advisor to the Chairman. In these roles, 

among other responsibilities, he oversaw and coordinated 

regulatory and policy initiatives at the agency and advised the 

Chairman on regulatory and policy matters.

Prior to joining the FDIC, Mr. Hill served as Senior Counsel at 

the United States Senate Committee on Banking, Housing, and 

Urban Affairs, where he worked from 2013 to 2018. In this role, 

he participated extensively in the drafting and negotiating of 

numerous bipartisan bills. Before working at the Senate, he worked as a policy analyst at 

Regions Financial Corporation from 2011 to 2013.

Mr. Hill received a Bachelor of Science from Duke University, where he studied economics and 

political science, and a Juris Doctor from Georgetown University Law Center.

Jonathan McKernan

Jonathan McKernan was sworn in as a member of the Board 

of Directors of the Federal Deposit Insurance Corporation on 

January 5, 2023. Mr. McKernan previously was a Counsel to 

Ranking Member Pat Toomey (R-PA) on the staff of the Senate 

Committee on Banking, Housing, and Urban Affairs from 2021 

to 2022. He also has served as a Senior Counsel at the Federal 

Housing Finance Agency from 2019 to 2021, a Senior Policy 

Advisor at the Department of the Treasury from 2018 to 2019, and 

a Senior Financial Policy Advisor to Senator Bob Corker (R-TN) 

from 2017 to 2018.

Prior to his government service, from 2007 to 2017, Mr. McKernan 

was an attorney in private practice focused on matters under the banking and consumer 

financial laws.

Mr. McKernan holds a Bachelor of Arts and Master of Arts in economics from the University of 

Tennessee and a Juris Doctor with High Honors from the Duke University School of Law.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 182 

Michael J. Hsu 

Michael J. Hsu became Acting Comptroller of the Currency on 

May 10, 2021, upon his designation as First Deputy Comptroller by 

Secretary of the Treasury Janet Yellen pursuant to her authority 

under 12 U.S.C. 4.

As Acting Comptroller of the Currency, Mr. Hsu is the administrator 

of the federal banking system and chief executive officer of 

the Office of the Comptroller of the Currency (OCC). The OCC 

ensures that the federal banking system operates in a safe 

and sound manner, provides fair access to financial services, 

treats customers fairly, and complies with applicable laws 

and regulations. It supervises nearly 1,200 national banks, 

federal savings associations, and federal branches and agencies of foreign banks that 

serve consumers, businesses, and communities across the United States and conducts 

approximately 70 percent of banking activity in the country. These banks range from 

community banks serving local neighborhood needs to the nation’s largest, most 

internationally active banks.

The Comptroller also serves as a Director of the Federal Deposit Insurance Corporation and 

a member of the Financial Stability Oversight Council and the Federal Financial Institutions 

Examination Council.

Prior to joining the OCC, Mr. Hsu served as an Associate Director in the Division of Supervision 

and Regulation at the Federal Reserve Board of Governors. In that role, he chaired the 

Large Institution Supervision Coordinating Committee Operating Committee, which has 

responsibility for supervising the global systemically important banking companies operating 

in the United States. He co-chaired the Federal Reserve’s Systemic Risk Integration Forum, 

served as a member of the Basel Committee Risk and Vulnerabilities Group, and co-sponsored 

forums promoting interagency coordination with foreign and domestic financial regulatory 

agencies.

His career has included serving as a Financial Sector Expert at the International Monetary 

Fund, Financial Economist at the U.S. Department of the Treasury helping to establish the 

Troubled Asset Relief Program, and Financial Economist at the Securities and Exchange 

Commission overseeing the largest securities firms.

Mr. Hsu began his career in 2002 as a staff attorney in the Federal Reserve Board’s Legal 

Division. He holds of a bachelor of arts from Brown University, a master of science in finance 

from George Washington University, and juris doctor degree from New York University School 

of Law.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 183 

Rohit Chopra

Rohit Chopra was confirmed as Director of the Consumer Financial 

Protection Bureau (CFPB) on October 12, 2021. The CFPB is a 

unit of the Federal Reserve System charged with protecting 

families and honest businesses from illegal practices by financial 

institutions, and ensuring that markets for consumer financial 

products and services are fair, transparent, and competitive. 

In 2018, Mr. Chopra was unanimously confirmed by the U.S. 

Senate as a Commissioner on the Federal Trade Commission, 

where he served until assuming office as CFPB Director. During his 

tenure at the FTC, he successfully worked to strengthen sanctions 

against repeat offenders, to reverse the agency’s reliance on nomoney, no-fault settlements in fraud cases, and to halt abuses of small businesses. He also led 

efforts to revitalize dormant authorities, such as those to protect the Made in USA label and to 

promote competition. 

Mr. Chopra previously served at the CFPB from 2010 to 2015. In 2011, the Secretary of the 

Treasury designated him as the agency’s student loan ombudsman, where he led the Bureau’s 

efforts on student lending issues. Prior to his government service, Mr. Chopra worked at 

McKinsey & Company, the global management consultancy, where he consulted in the 

financial services, health care, and consumer technology sectors. 

Mr. Chopra holds a BA from Harvard University and an MBA from the Wharton School at the 

University of Pennsylvania.

Jelena McWilliams 

Jelena McWilliams was sworn in as the 21st Chairman of the FDIC 

on June 5, 2018, and served in that capacity until her resignation 

of February 4, 2022. 

Ms. McWilliams was Executive Vice President, Chief Legal Officer, 

and Corporate Secretary for Fifth Third Bank in Cincinnati, Ohio. 

At Fifth Third Bank she served as a member of the executive 

management team and numerous bank committees including: 

Management Compliance, Enterprise Risk, Risk and Compliance, 

Operational Risk, Enterprise Marketing, and Regulatory Change.

Prior to joining Fifth Third Bank, Ms. McWilliams worked in the U.S. 

Senate for six years, most recently as Chief Counsel and Deputy Staff Director with the Senate 

Committee on Banking, Housing and Urban Affairs, and previously as Assistant Chief Counsel 

with the Senate Small Business and Entrepreneurship Committee. 

From 2007 to 2010, Ms. McWilliams served as an attorney at the Federal Reserve Board of 

Governors, where she drafted consumer protection regulations, reviewed and analyzed 

comment letters on regulatory proposals, and responded to consumer complaints. 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 184 

Before entering public service, she practiced corporate and securities law at Morrison & 

Foerster LLP in Palo Alto, California, and Hogan & Hartson LLP (now Hogan Lovells LLP) 

in Washington, D.C. In legal practice, Ms. McWilliams advised management and boards of 

directors on corporate governance, compliance, and reporting requirements under the 

Securities Act of 1933 and the Securities Exchange Act of 1934. She also represented publiclyand privately-held companies in mergers and acquisitions, securities offerings, strategic 

business ventures, venture capital investments, and general corporate matters.

Ms. McWilliams graduated with highest honors from the University of California at Berkeley 

with a B.S. in political science, and earned her law degree from U.C. Berkeley School of Law.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 185 

FDIC ORGANIZATIONAL CHART

DIVISION OF 

RESOLUTIONS AND 

RECEIVERSHIPS

Maureen Sweeney

DIVISION OF INSURANCE 

AND RESEARCH

Patrick Mitchell

DIVISION OF COMPLEX 

INSTITUTION 

SUPERVISION AND 

RESOLUTION

DEPUTY TO THE 

CHAIRMAN FOR 

John Conneely

FINANCIAL STABILITY

Arthur Murton

Director

Director 

Director 

Donna M. Saulnier

Director

Steve Cooper

Director and Chief 

Learning Oicer (Acting)

CORPORATE 

UNIVERSITY

DEPUTY TO THE 

CHAIRMAN FOR 

EXTERNAL AFFAIRS

DEPUTY TO THE 

CHAIRMAN AND 

CHIEF FINANCIAL OFFICER

DEPUTY TO THE 

CHAIRMAN AND CHIEF 

OPERATING OFFICER 

Dan Bendler

DIVISION OF 

INFORMATION 

TECHNOLOGY

Zachary Brown

CISO and 

Director of OCISO

OFFICE OF 

CHIEF INFORMATION 

SECURITY OFFICER

CHIEF INFORMATION 

OFFICER AND 

CHIEF PRIVACY OFFICER

Sylvia Burns Bret D. Edwards

OFFICE OF INSPECTOR GENERAL

Jay N. Lerner

INTERNAL OMBUDSMAN

Robert Harris

OFFICE OF FINANCIAL 

INSTITUTION ADJUDICATION

LEGAL DIVISION

As of January 5, 2023

DIVISION OF DEPOSITOR 

AND CONSUMER 

PROTECTION

Mark E. Pearce Nikita Pearson

GENERAL COUNSEL

Harrel PettwayHarrel Pettway

OFFICE OF 

THE OMBUDSMAN

M. Anthony Lowe

Ombudsman

OFFICE OF RISK 

MANAGEMENT AND 

INTERNAL CONTROLS

Marshall Gentry

Director 

Christopher B. McNeil

Jennifer Whang

CHIEF OF STAFF

Kymberly Copa

BOARD OF DIRECTORS

Martin J. Gruenberg

FDIC

Chairman

Jonathan McKernan

FDIC

Board Member

Travis Hill

FDIC

Vice Chairman

Michael J. Hsu

Comptroller of 

the Currency (Acting)

Board Member

Rohit Chopra

CFPB Director

Board Member

DIVISION OF 

RISK MANAGEMENT 

SUPERVISION

Doreen Eberley

OFFICE OF MINORITY AND 

WOMEN INCLUSION 

Nikita Pearson

Director 

Andy Jimenez

Director 

OFFICE OF LEGISLATIVE AFFAIRS

DIVISION OF FINANCE OFFICE OF COMMUNICATIONS

Amy Thompson

Director General Counsel

OFFICE OF MINORITY 

AND COMMUNITY 

DEVELOPMENT BANKING

Betty Rudolph

Director

Administrative Law Judges

Dan Bendler

Director 

Sylvia Burns

Director 

DIVISION OF 

ADMINISTRATION

FDiTECH

Brian Whittaker

Deputy Director
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 186 

CORPORATE STAFFING TRENDS

Note: 2013-2022 staffing totals reflect year-end full time equivalent staff. 

2013 2014 2015 2016 2017 2018 2019 2020 2021 2022

9,000

6,000

3,000

0

7,254 6,631 6,385 6,096 5,880 5,693 5,593 5,776 5,670 5,612

FDIC Year–End Staing
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 187 

Number of Employees by Division/Office (Year-End)1

Total Washington Regional/Field

Division or Office: 2022 2021 2022 2021 2022 2021

Division of Risk Management Supervision 2,376 2,484 151 159 2,225 2,325

Division of Depositor and Consumer Protection 785 787 117 115 668 672

Legal Division 429 440 288 295 141 145

Division of Administration 395 375 289 269 106 106

Division of Resolutions and Receiverships 332 317 54 90 278 228

Division of Information Technology 2 292 284 165 225 127 59

Division of Complex Institution Supervision and Resolution 286 280 117 130 169 150

Division of Insurance and Research 190 199 153 163 37 36

Division of Finance 134 134 131 131 3 3

Executive Support Offices 2 88 103 76 92 12 11

Corporate University 65 65 53 57 12 8

Office of the Chief Information Security Officer 54 49 53 49 1 0

Office of Risk Management and Internal Controls 2 23 0 23 0 0 0

Executive Offices3 20 21 20 21 0 0

Office of Inspector General 143 132 92 84 51 48

Total 5,612 5,670 1,781 1,879 3,830 3,792

1 The FDIC reports staffing totals using a full-time equivalent methodology, which is based on an employee’s scheduled work hours. Division/Office 

staffing has been rounded to the nearest whole FTE. Totals may not foot due to rounding.

2 Includes the Offices of the Legislative Affairs, Communications, Ombudsman, Financial Institution Adjudication, and Minority and Women 

Inclusion. In 2022, the Office of Risk Management and Internal Controls was separated from Executive Support Offices, and FDITECH was removed 

from Executive Support Offices and merged with DIT. 

3 Includes the Offices of the Chairman, Vice Chairman, Director (Appointive), Chief Operating Officer, Chief Financial Officer, Chief Information 

Officer, Consumer Protection and Innovation, External Affairs, Policy, and Financial Stability. 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 188 

SOURCES OF INFORMATION

FDIC WEBSITE

www.fdic.gov

A wide range of banking, consumer, and financial information is available on the FDIC’s 

website. This includes the FDIC’s Electronic Deposit Insurance Estimator (EDIE), which 

estimates an individual’s deposit insurance coverage; the Institution Directory, which contains 

financial profiles of FDIC-insured institutions; Community Reinvestment Act evaluations 

and ratings for institutions supervised by the FDIC; Call Reports, which are bank reports of 

condition and income; and Money Smart, a training program to help individuals outside the 

financial mainstream enhance their money management skills and create positive banking 

relationships. Readers also can access a variety of consumer pamphlets, FDIC press releases, 

speeches, and other updates on the agency’s activities, as well as corporate databases and 

customized reports of FDIC and banking industry information. 

FDIC CALL CENTER

Phone: 877-275-3342 (877-ASK-FDIC) 

703-562-2222 

Hearing Impaired: 800-877-8339 

703-562-2289

The FDIC Call Center in Washington, DC, is the primary telephone point of contact for 

general questions from the banking community, the public, and FDIC employees. The Call 

Center directly, or with other FDIC subject-matter experts, responds to questions about 

deposit insurance and other consumer issues and concerns, as well as questions about FDIC 

programs and activities. The Call Center also refers callers to other federal and state agencies 

as needed. Hours of operation are 8:00 a.m. to 6:00 p.m., Eastern Time, Monday – Friday, 

8:00 a.m. to 1:00 p.m., Saturday, and closed Sunday. Recorded information about deposit 

insurance and other topics is available 24 hours a day at the same telephone number.

As a customer service, the FDIC Call Center has many bilingual Spanish agents on staff and has 

access to a translation service, which is able to assist callers with over 40 different languages.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 189 

PUBLIC INFORMATION CENTER 

3501 Fairfax Drive

Room E-1021

Arlington, VA 22226

Phone: 877-275-3342 (877-ASK-FDIC), 

703-562-2200

Fax: 703-562-2296

FDIC Online Catalog: https://catalog.fdic.gov

E-mail: publicinfo@fdic.gov

Publications such as FDIC Quarterly and Consumer News and a variety of deposit insurance and 

consumer pamphlets are available at www.fdic.gov or may be ordered in hard copy through 

the FDIC online catalog. Other information, press releases, speeches and congressional 

testimony, directives to financial institutions, policy manuals, and FDIC documents are 

available on request through the Public Information Center. Hours of operation are 9:00 a.m. 

to 4:00 p.m., Eastern Time, Monday – Friday; walk-in service is available at the mailing address 

location. Onsite visits are by appointment only.

OFFICE OF THE OMBUDSMAN

3501 Fairfax Drive

Room E-2022

Arlington, VA 22226

Phone: 877-275-3342 (877-ASK-FDIC) 

Fax: 703-562-6057

E-mail: ombudsman@fdic.gov

The Office of the Ombudsman (OO) is an independent, neutral, and confidential resource and 

liaison for the banking industry and the general public. The OO responds to inquiries about 

the FDIC in a fair, impartial, and timely manner. It researches questions and fields complaints 

from bankers and bank customers. OO representatives are present at all bank closings to 

provide accurate information to bank customers, the media, bank employees, and the 

general public. The OO also recommends ways to improve FDIC operations, regulations,

and customer service.
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 190 

REGIONAL AND AREA OFFICES

ATLANTA REGIONAL OFFICE CHICAGO REGIONAL OFFICE

John Vogel, Acting Regional Director Gregory Bottone, Regional Director 

10 Tenth Street, NE 300 South Riverside Plaza

Suite 900 Suite 1700

Atlanta, Georgia 30309 Chicago, Illinois 60606

(678) 916-2200 (312) 382-6000

States represented: States represented:

Alabama Illinois

Florida Indiana

Georgia Kentucky

North Carolina Michigan

South Carolina Ohio

Virginia Wisconsin

West Virginia
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 191 

DALLAS REGIONAL OFFICE KANSAS CITY REGIONAL OFFICE

Kristie K. Elmquist, Regional Director James D. LaPierre, Regional Director

600 North Pearl Street 1100 Walnut Street

Suite 700 Suite 2100

Dallas, Texas 75201 Kansas City, Missouri 64106

(214) 754-0098 (816) 234-8000

States represented: States represented:

Arkansas Iowa

Colorado Kansas

Louisiana Minnesota

Mississippi Missouri

New Mexico Nebraska

Oklahoma North Dakota

Tennessee South Dakota

Texas

NEW YORK REGIONAL OFFICE SAN FRANCISCO REGIONAL OFFICE

Frank R. Hughes, Regional Director Kathy L. Moe, Regional Director

350 Fifth Avenue 25 Jessie Street at Ecker Square

Suite 1200 Suite 2300

New York, New York 10118 San Francisco, California 94105

(917) 320-2500 (415) 546-0160

States and territories represented: States and territories represented:

Connecticut Alaska

Delaware American Samoa

District of Columbia Arizona

Maine California

Maryland Federated States of Micronesia

Massachusetts Guam

New Hampshire Hawaii

New Jersey Idaho

New York Montana

Pennsylvania Nevada

Puerto Rico Oregon

Rhode Island Utah

Vermont Washington

Virgin Islands Wyoming

Top Management and Performance Challenges

Facing the Federal Deposit Insurance Corporation

February 2023



Federal Deposit Insurance Corporation

Office of Inspector General

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 193
Federal Deposit Insurance Corporation

Office of Inspector General

Date: February 16, 2023

Memorandum To: Board of Directors

From: Tyler Smith

Acting Inspector General

Subject Top Management and Performance Challenges Facing the Federal

Deposit Insurance Corporation

The Office of Inspector General (OIG) presents its annual assessment of the Top Management 

and Performance Challenges facing the Federal Deposit Insurance Corporation (FDIC). This 

document summarizes the most serious challenges facing the FDIC and briefly assesses the 

Agency’s progress to address them. 

This Challenges document is based on the OIG’s experience and observations from our 

oversight work, reports by other oversight bodies, review of academic and relevant literature, 

perspectives from Government agencies and officials, and information from private-sector 

entities. In several instances, we discuss topic areas where the OIG has previously conducted 

work to evaluate, audit, and review the FDIC’s progress in these Challenge areas. 

We identified nine Top Challenges facing the FDIC. These Challenges include all aspects of the 

Challenges that we reported last year, with important updates. Among these updates are the 

need for supervisory attention and crises planning to include executing its resolution processes, 

examining banks’ compliance with U.S.-imposed sanctions, and assessing digital asset risk. 

The Challenges identify risks to FDIC mission-critical activities and to FDIC internal programs 

and processes that support mission execution. 

The FDIC’s Top Challenges include:

1.

2.

3.

4.

5.

6.

7.

8.

9.

Preparing for Crises in the Banking Sector

Mitigating Cybersecurity Risks at Banks and Third Parties

Supervising Risks Posed by Digital Assets

Fostering Financial Inclusion for Underserved Communities

Fortifying IT Security at the FDIC

Managing Changes in the FDIC Workforce

Improving the FDIC’s Collection, Analysis, and Use of Data

Strengthening FDIC Contracting and Supply Chain Management

Implementing Effective Governance at the FDIC

We commend the FDIC for taking steps in some areas to address certain Challenges, and we

note many of these actions in the attached document. This researched and deliberative analysis 

guides our work, and we believe it is beneficial and constructive for policy makers, including the 

FDIC and Congressional oversight bodies. We further hope that it is informative for the 

American people regarding the programs and operations at the FDIC and the Challenges it 

faces. 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 194
Executive Summary

The FDIC plays a unique role in support of the U.S. financial system. The FDIC insures nearly 

$10 trillion in deposits at more than 4,700 banks, supervises over 3,200 banks, and oversees 

the $125 billion Deposit Insurance Fund (DIF) that protects bank depositor accounts and

resolves failing banks. The readiness of the FDIC to execute all facets of its mission promotes 

confidence and stability in the Nation’s financial system. 

Currently, banks are facing a rising interest rate environment while the U.S. economy faces 

inflationary pressure and continued uncertainties remain resulting from Russia’s invasion of 

Ukraine. Banks have also adopted new technologies and third-party partnerships to engage 

customers at a time of increasing cyber security breaches. Banks are also entering into 

markets for digital assets, which may increase money laundering and terrorist financing risks. 

The FDIC’s operating environment is also changing. The FDIC moved to a hybrid working 

environment and faces increased retirements and resignations among FDIC personnel. 

In light of these circumstances, this document summarizes the most serious challenges facing 

the FDIC and briefly assesses the Agency’s progress to address them, pursuant to the Reports 

Consolidation Act of 2000 and Office of Management and Budget Circular A-136 (revised 

August 27, 2020). This document is based on the OIG’s experience and observations from our 

oversight work, reports by other oversight bodies, review of academic and relevant literature, 

perspectives from Government agencies and officials, and information from private-sector 

entities. To compile this document, we received input and considered comments from the 

FDIC, and while exercising our independent judgment, we incorporated suggestions where 

appropriate and fair. 

We identified nine Top Challenges facing the FDIC that could impact its capabilities to promote 

public confidence and financial stability: 

Preparing for Crises in the Banking Sector. The FDIC has a unique mission to administer 

the DIF and insure Americans’ bank deposits against losses during crises. The FDIC’s effective 

maintenance of the DIF, supervision of banks, and resolution of failed banks provides financial 

stability to the United States. The FDIC faces crises readiness challenges to fully develop its 

plans to respond to an unfolding crisis, including exercising the orderly liquidation of 

systemically important entities. Further, FDIC readiness and supervisory activities should take 

into account climate-related risks. FDIC supervisory processes should also be agile to respond 

to evolving risks such as fraud in crises-related Government-guaranteed loan programs and the 

evasion of US-imposed economic and trade sanctions. 

Mitigating Cybersecurity Risks at Banks and Third Parties. Cybersecurity has been 

identified as the most significant threat to the banking sector and the critical infrastructure of the 

United States. The FDIC faces challenges to ensure that examiners have the skillsets and 

knowledge to conduct information technology examinations that adequately identify and mitigate 

cybersecurity risks at banks and their third-party service providers (TSP). Further, the FDIC 

should ensure that it has effective processes for the intake of banks’ cybersecurity incident 

reports and uses these reports to mitigate identified risks, identify trends and patterns of 

nefarious activity, and adjust supervisory processes. Mitigating cybersecurity risk is critical, as a

cyber incident at one bank or TSP has the potential to cause contagion within the financial 

sector. 

Supervising Risks Posed by Digital Assets. About 52 million Americans have invested in 

digital assets and 136 FDIC-insured banks have ongoing or planned digital asset activities. The 

FDIC should work with other regulators to provided clarity regarding the regulation of digital 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 195
assets. The FDIC should also have examiners with appropriate skillsets and examination 

processes to assess the safety and soundness of banks’ digital asset activities and identify 

consumer risks. Further, the FDIC should ensure that its examinations, policies, and 

procedures address consumer risks regarding digital assets, including the relationship of 

deposit insurance and digital assets. 

 

Fostering Financial Inclusion for Underserved Communities. Federal statute mandates that 

the FDIC study the unbanked market in the United States and identify the primary issues that 

prevent unbanked individuals from establishing conventional accounts in financial institutions. 

Converting the information gleaned from the study of unbanked individuals into effective actions 

that banks can take to increase access to the financial system for unbanked individuals is a 

challenging endeavor for the FDIC. Further, the FDIC should also ensure that its examiners

have the skills, capabilities, and procedures to assess the effect of banks’ use of artificial

intelligence (AI) in decision making. AI can be beneficial by increasing the speed and reducing 

the cost of bank operations, but it can also result in biases against individuals when the 

algorithms or data used for these decisions are flawed.

Fortifying IT Security at the FDIC. The FDIC is custodian of about 1.8 petabytes of sensitive 

and Personally Identifiable Information (PII) relating to failed banks and more than 4,700 insured 

banks. The FDIC continues to face challenges to ensure that it has strong information security 

processes to guard against persistent and increasing cyber threats against Federal agencies. 

Security control weaknesses of FDIC systems limit the effectiveness of FDIC controls, which 

places the confidentiality, integrity, and availability of FDIC systems and data at risk. The FDIC 

should have robust personnel security and suitability program and privacy controls to safeguard 

IT access to sensitive information and guard against insider threats. 

 

Managing Changes in the FDIC Workforce. A total of 21 percent of the FDIC workforce was 

eligible to retire in 2022, and that figure climbs to 38 percent within 5 years (2027). These 

retirements may have a significant impact on key Divisions involved in Crises Readiness efforts

and for subject matter experts in areas such as consumer compliance and information 

technology. At the same time, the FDIC is experiencing increased resignations of its 

examiners-in-training. Absent effective human capital management, the FDIC may lose 

valuable knowledge and leadership skill sets upon the departure of experienced examiners, 

managers, and executives. Meeting these challenges is especially important as the FDIC shifts 

its operations to a hybrid environment. 

Improving the FDIC’s Collection, Analysis, and Use of Data. Data and information can 

enhance the FDIC’s and its supervised banks’ capabilities to mitigate threats to the U.S. 

financial system. The FDIC faces challenges in receiving and using reliable information. 

Specifically, the FDIC should establish processes to acquire, analyze, and disseminate threat 

information from Government partners, databases, and repositories. Such information informs 

senior FDIC officials and decision-makers, FDIC examiners and Regional personnel, its 

supervisory program officials, and banks. Further, the FDIC should improve the reliability of its 

internal data to ensure that the FDIC Board and senior management can confidently use the 

data to assess program effectiveness. 

 

Strengthening FDIC Contracting and Supply Chain Management. The FDIC awards nearly 

$600 million in contracts every year. Over a 5-year period, the FDIC awarded more than 2,600 

contracts valued at $2.85 billion. The FDIC faces challenges to establish an effective contract 

management program that ensures the FDIC receives goods and services according to contract 

terms, price, and timeframes. An effective FDIC procurement program is important because the 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 196
FDIC relies on contractor services for day-to-day activities and especially during crises. The 

FDIC should also have programs in place to mitigate security risks associated with the supply 

chains for contracted goods and services. Weaknesses in contractor-provided software to 

Government agencies have exposed examples of these supply chain risks. Further, the FDIC 

should have whistleblower processes and provisions within FDIC contracts to protect contractor 

personnel who report allegations of contractor violations and gross mismanagement. 

Implementing Effective Governance at the FDIC. Effective governance allows FDIC Board 

members and senior FDIC officials to proactively manage risk, formulate regulatory policy, and 

provide clear guidance to banks and FDIC Regional Offices. Through these processes, the 

FDIC can allocate resources, prioritize and improve the flow of risk information to decision 

makers, and work toward achieving the FDIC’s mission. The FDIC should ensure that risks to 

the FDIC are identified and monitored through an effective Enterprise Risk Management

Program. The FDIC should also ensure that OIG-identified program weaknesses are promptly 

resolved and remediated. FDIC program performance should be measured using outcome 

measures to assess whether the FDIC is meeting a program’s strategic objectives. The FDIC 

should also clarify its implementation of Executive Branch best practices, ensure the validity of 

its rulemaking process, and promulgate rules based on rigorous cost benefit analyses. 

The FDIC has taken certain concrete and measurable steps to address some of these 

Challenges, as noted in this Challenges document. We also recognize that there may be other 

ongoing plans, inputs, intentions, or future activities that might still be under development at the 

time of this writing.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 197
 Preparing for Crises in the Banking Sector 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are:

• Executing orderly liquidation 

processes; 

• Enhancing readiness for crises; 

• Addressing climate risks to banks; 

• Mitigating pandemic loan fraud; and

• Ensuring banks’ compliance with 

U.S. sanctions. 

The OIG has identified Preparing for Crises 

as a Top Challenge for the FDIC since 

2018.

The Board of Governors of the Federal 

Reserve (Federal Reserve Board) stated 

that U.S. financial stability may be affected 

by sudden adverse events.1

 These events 

may include cyber attacks, climate change 

risk, and global instability.2

 The U.S. 

financial system also faces risks arising 

internationally from outside the United 

States through “a contagious spread of a 

financial crisis” across regions and 

countries.3

 Financial instability could result 

in failures for banks, broker-dealers, 

financial market utilities, insurance 

companies, and other systemically 

important organizations that could require 

the FDIC to exercise its expansive 

resolution authorities. 

In addition, according to the Financial 

Stability Oversight Council’s Report on 

Climate-Related Financial Risk 2021 (FSOC 

Climate Report) (October 2021), climate 

change continues to grow as an emerging 

threat to the financial stability of the United 

States. The National Oceanic and 

Atmospheric Administration reported 18 

weather and climate-related disaster events 

in 2022 with losses exceeding $1 billion 

across the United States. The Organization 

for Economic Co-operation and 

Development (OECD) also noted that the 

transition to low-carbon economies may 

result in financing risks for stranded or 

obsolete assets and production processes 

that do not support renewable energy.4

 The 

60 largest banks financed $4.6 trillion in 

loans to fossil fuel companies between 2016 

and 2021.5

 

The banking sector also faces risks related 

to the Government’s response to the 

pandemic crisis. In 2020 and 2021, the 

Coronavirus Aid, Relief, and Economic 

Security Act (CARES Act) and the American 

Rescue Plan were enacted, and these laws 

provided funds for the Paycheck Protection 

Program (PPP) in the amount of $814 

billion. The PPP has been administered 

through the Nation’s banks. It is estimated 

that fraud in the PPP could be as high as 

$117.3 billion, and banks may suffer losses 

as a result of fraudulent loans.6

 

In addition, the Department of the 

Treasury’s Office of Foreign Assets Control 

(OFAC) administers economic and trade 

sanctions that prohibit domestic banks from 

conducting transactions with a number of 

entities sanctioned by the United States. 

For example, the U.S. recently imposed 

additional sanctions against Russia in 

response to a crisis presented by the

invasion of Ukraine. If banks do not have 

sufficient compliance programs to adhere to 

the U.S. sanctions, they may face increased 

legal, compliance, operational, and 

reputational risks, and significant 

enforcement actions. 

Executing Orderly Liquidation 

Processes 

The FDIC is the primary Federal agency 

responsible for the resolution of insured 

depository institutions. The FDIC’s authority 

stems from the Federal Deposit Insurance 

Act (FDI Act), which allows the FDIC to pay 

insured deposits and become a receiver of 

failed banks. The FDIC’s resolution 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 198
authority under the FDI Act, however, does 

not apply to certain financial institutions, 

such as investment banks, insurance 

companies, broker-dealers, and other 

systemically important financial institutions.7 

As a result, during the financial crisis of 

2008-2011, several large financial firms—

such as Lehman Brothers, Bear Stearns, 

and AIG—were not eligible for FDIC 

receiverships.8 In response, Title II of the 

Dodd-Frank Wall Street Reform and 

Consumer Protection Act of 2010 (DoddFrank Act) was enacted and designed to 

address this gap, and granted Orderly 

Liquidation Authority (OLA) to the FDIC. 

OLA presents unique challenges for the 

FDIC because this authority has not been 

invoked, and the FDIC has limited 

information and experience with financial 

market utilities, insurance companies, and 

broker-dealers that may require OLA 

resolutions. The FDIC should be ready to 

swiftly execute its OLA in an efficient 

manner. In December 2013, the FDIC 

published a strategy to execute an orderly 

liquidation.9

 The strategy includes a 

number of steps, including: (i) coordination 

among the FDIC, the Department of the 

Treasury, and other banking regulators; (ii) 

hiring qualified executives to run the holding 

company; (iii) communicating with staff, 

shareholders, and the public regarding the 

status of the receivership; and (iv) 

contracting and coordination within FDIC 

Divisions and Offices. 

The FDIC should clearly define policies, 

procedures, roles, and responsibilities to 

ensure efficient implementation of its OLA 

authorities. Absent such clarity, the 

resolution may not effectively address an 

entity’s failure, thus impeding mitigation of 

systemic risk throughout the financial 

system. We have work ongoing to 

determine if the FDIC has established key 

elements to execute its OLA, including 

comprehensive policies and processes, 

necessary resources and skill sets, and 

integration with the Agency’s crisis 

readiness and response planning efforts.10

Current areas of focus for resolution 

planning under OLA include domestic bank 

holding companies designated as “global 

systemically important banks” (GSIB),11 

U.S. holding companies of foreign-based 

GSIBs,12 and systemically important 

financial market utilities (FMU) designated 

by FSOC.13 The FDIC, however, does not 

supervise or examine FMUs and, as a 

result, has limited expertise or familiarity 

with their operations. Similarly, the FDIC 

does not have examination or supervisory 

authority over broker-dealers and therefore 

has limited knowledge of their operations. 

Enhancing Readiness for Crises 

In April 2020, we issued an OIG evaluation 

report, The FDIC’s Readiness for Crises,

regarding the FDIC’s execution of FDI Act 

resolutions, which found that the FDIC did 

not have documented Agency policy and 

procedures for crisis readiness planning and 

did not have an Agency-wide all hazards 

readiness plan nor Agency-wide hazardspecific readiness plans. The FDIC needed 

to fully establish seven elements of crisis 

readiness to be prepared to respond to any 

type of crisis that may impact the banking 

system: (1) policies and procedures; (2) 

plans; (3) training; (4) exercises; (5) lessons 

learned; (6) maintenance; and (7) 

assessment and reporting. The FDIC has 

addressed the report recommendations.

Subsequent to our report, the Council of 

Inspectors General on Financial Oversight 

issued its Guidance in Preparing for and 

Managing Crises (June 2022).14 This 

Guidance identified critical activities for precrisis planning and crisis management that 

FSOC and member agencies can use to 

evaluate existing efforts and coordinate and 

plan for future crises. The Guidance 

includes three activity categories: 

• Collaboration and Pre-Crisis 

Planning. A proactive crisis 

readiness effort involves working 

collaboratively to coordinate crisis 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 199
readiness efforts across Federal, 

state, and international agencies by: 

(1) identifying risks and conducting 

scenario analyses; and (2) 

developing plans ahead of time that 

outline how an agency will respond 

to crises.

• Crisis Readiness Plan Elements. 

Crisis readiness plans create an 

overarching framework for crisis 

management to include strategic 

decision-making, communication, 

and coordination.

• Crisis Management. The key 

elements to managing a crisis 

effectively include clear leadership 

response, coordination, 

communication, resource 

assessments, supervisory activities, 

and implementation of response or 

rescue programs.

The FDIC should continuously assess its 

own preparedness efforts and make 

changes to address any gaps in its 

readiness. 

Addressing Climate Risks to Banks 

The FDIC should be prepared to address 

banks’ climate-related risks, including how 

these risks may affect FDIC bank 

examinations and supervision. For 

example, the FDIC may need to increase 

the information it collects from banks, 

reassess bank stress testing, and review 

banks’ concentrations in industry financing 

of fossil fuels. The FDIC also may need to 

revise its supervisory strategies and 

examination procedures to address climate 

risks. 

On May 20, 2021, the President issued 

Executive Order 14030, Climate-Related 

Financial Risk, which required that FSOC, 

including the FDIC: 

• Assess, in a detailed and 

comprehensive manner, the climaterelated financial risk, including both 

physical and transition risks, to the 

financial stability of the Federal 

Government and the stability of the 

U.S. financial system; 

• Facilitate the sharing of climaterelated financial risk data and 

information among FSOC member 

agencies and other executive 

departments and agencies as 

appropriate; and 

• Issue a report to the President within 

180 days of the date of the order on 

any efforts by FSOC member 

agencies to integrate consideration 

of climate-related financial risk in 

their policies and programs.

The FSOC Climate Report issued 30 

recommendations to its members related to 

four topic areas to strengthen the financial 

system and lessen the vulnerabilities to 

climate-related shocks: 

• Building capacity and expanding 

efforts to address climate-related 

financial risks. 

• Filling climate-related data and 

methodology gaps. 

• Enhancing public climate-related 

disclosures. 

• Assessing and mitigating climaterelated risks that could threaten the 

stability of the financial system. 

The FSOC Climate Report also noted that a 

climate event may “disproportionately affect 

financially vulnerable populations potentially 

including lower-income communities, 

communities of color, Native American 

communities, and other disadvantaged or 

underserved communities.” For example, a 

study of weather-related climate issues 

conducted by the FDIC Division of 

Insurance and Research, Severe Weather 

Events and Local Economic and Banking 

Conditions (June 2022), concluded that 

climate change events affect areas 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 200
differently based on the health and 

resiliency of the economy preceding the 

event. 

The FDIC 2022 Annual Performance Plan

noted that to “address the risks to the safety 

and soundness of financial institutions and 

the stability of the financial system, the 

FDIC will establish an interdivisional 

working group to assess the enumerated 

risks and provide advice to staff developing 

interagency guidance. The FDIC will also 

join the international Network of Central 

Banks and Supervisors for Greening the 

Financial System.”

In April 2022, the FDIC issued a Notice of

Proposed Policy Statement on a high-level 

framework for banks’ management of 

climate-related financial risk. As of the

writing of this Top Challenges Report, the 

FDIC continues to review the comments 

received on this high-level framework. 

However, to date, the FDIC has not issued 

guidance regarding climate change to its 

examiners or to the banks.

In November 2022, the FDIC also added 

climate-related financial risk to its Risk 

Inventory as part of the FDIC’s Enterprise 

Risk Management (ERM) program. The 

purpose of ERM is to capture risk areas and 

guide FDIC resources and decision-making 

to address such risks. On November 15, 

2022, the then-Acting Chairman of the FDIC 

stated that the Agency “is still in the 

beginning stages of [its] work on climaterelated financial risks.”15 

In order to address the FSOC Climate 

Report recommendations, the FDIC would 

need a coordinated effort among its 

Divisions and Offices, other regulators, and 

international organizations. In so doing, the 

FDIC would need to continue to gather data 

related to climate change risks to banks and 

establish processes to define, measure, 

monitor, assess, and report on these risks. 

Further, based upon identified risks, the 

FDIC would need to provide guidance to 

banks and examiners for risk mitigation, 

update existing policies and processes, and 

formulate new regulations as needed. 

We will continue to monitor FDIC efforts in 

this area, and we are participating in the 

efforts of the Council of Inspectors General 

on Financial Oversight to assess FSOC’s 

efforts to address the requirements of 

Executive Order 14030.

Mitigating Pandemic Loan Fraud 

In response to the pandemic, the CARES 

Act established the PPP, which was 

intended to provide financial relief to 

workers, small businesses, and individuals 

most in need during the pandemic. PPP 

loans were guaranteed by the Small 

Business Administration (SBA), if lenders 

complied with program requirements. 

More than 2,600 FDIC-supervised financial 

institutions originated over 3 million PPP 

loans, totaling approximately $267 billion. 

Government-guaranteed loans also 

introduce other risks such as Operational, 

Compliance, Liquidity, Reputation, and 

Strategic Risks.16 For example, when 

financial institutions fail to materially comply 

with Government-guaranteed loan program 

requirements in the areas of loan 

underwriting, closing, and servicing, those 

Federal agencies guaranteeing the loans 

can be released from their obligations. The 

originating bank is therefore responsible for 

the entire loan amount.

It is estimated that fraudulent loans in the 

PPP may amount to $117.3 billion. For 

example, the SBA OIG’s Inspection of 

SBA's Implementation of the Paycheck 

Protection Program reported that nearly 

55,000 PPP loans worth about $7 billion 

went to potentially ineligible businesses or 

fraudulent recipients and 1.9 million loans 

were disbursed where the loan participants 

did not submit loan forgiveness 

applications—a key fraud indicator. Further, 

as of October 2022, the Government has 

brought charges against 1,616 defendants 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 201
related to 1,050 criminal cases involving 

more than $1.2 billion in pandemic relief 

program funds.17 We have an evaluation 

ongoing to assess the FDIC’s examination 

of Government-guaranteed loans.

Ensuring Banks’ Compliance with 

U.S. Sanctions 

The U.S. imposes sanctions on countries 

and organizations that threaten the U.S. 

economy, foreign policy, and national 

security. For example, in response to 

Russia’s invasion of Ukraine, the United 

States imposed sanctions on organizations 

and entities related to the Russian 

government.

OFAC regulations require that financial 

institutions block or reject transactions 

subject to sanctions, thereby limiting 

sanctioned parties’ access to funding. In 

addition, banks must notify OFAC of 

blocked or rejected transactions within 10 

days of their occurrence and report all 

blocked property to OFAC annually by 

September 30. In addition, banks are 

required to file Suspicious Activity Reports 

with the Financial Crimes Enforcement 

Network (FinCEN) for potential evasion of 

the sanctions. If a bank’s compliance 

program is inadequate, it faces increased 

legal, compliance, operational, and 

reputational risks and significant 

enforcement action.

In February 2022, the U.S. announced 

sanctions against major Russian banks and 

specific Russian individuals.18 On March 7, 

2022, FinCEN alerted banks to be vigilant 

against attempts to evade sanctions.19 

FinCEN provided a list of red flag indicators 

of evasion of sanctions, such as the use of 

third parties to shield the identity of 

sanctioned persons, the use of shell 

companies for wire transfers, and nonroutine foreign exchange transactions. 

FDIC examinations should ensure that 

banks uphold and comply with the 

requirements of the sanctions. According to 

FDIC examination guidance, banks “should 

establish and maintain effective OFAC 

programs and screening capabilities in 

order to facilitate safe and sound banking 

practices.” The guidance continues that 

“examination procedures should focus on 

evaluating the adequacy of an institution’s 

overall OFAC compliance program and 

procedures, including the systems and 

controls in place to reasonably assure 

accounts and transactions are blocked and 

rejected.” We have work planned to assess 

the effectiveness of the FDIC’s examination 

of banks’ sanctions compliance programs.

The FDIC should be prepared to address 

any sort of crisis affecting the U.S. banking 

sector— whether it is a financial crisis or 

one due to climate change, a pandemic, or 

foreign war. To ensure effective execution 

of resolutions, the FDIC should ensure that 

it has clear policies, defined roles and 

responsibilities, effective organizational 

processes, trained individuals, and ample 

resources. The FDIC also should ensure 

that it makes necessary supervisory 

adjustments to policy and examinations to 

address emerging risks such as climate 

change. Further, FDIC examinations should 

review for Government-guaranteed loan 

risks, including risks related to the PPP. 

FDIC examinations also should assess 

banks’ compliance programs to block and 

reject financial transactions by individuals 

and entities subject to U.S. sanctions. 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 202
Mitigating Cybersecurity Risk at 

Banks and Third Parties Key Areas of Concern 

The primary areas of concern for this 

Challenge area are: 

• Ensuring FDIC examinations 

address cybersecurity risks at 

banks; 

• Examining for third-party risk; and

• Recording and assessing banks’ 

cybersecurity incidents.

The OIG has identified Cybersecurity in the 

banking sector as a Top Challenge for the 

FDIC since 2018.

The FSOC 2022 Annual Report recognized 

that a cybersecurity incident could threaten 

U.S. financial stability. FSOC stated that 

the “financial sector is vulnerable to 

malicious cyber incidents, including 

ransomware, denial-of-service attacks, data 

breaches, and non-malicious cyber 

incidents.” FSOC noted that millions of 

Americans could be affected by 

cybersecurity incidents that result in billions

of dollars in financial losses. 

The financial industry suffered the largest 

number of data breaches in 2021 when 

compared to 20 other industries, according 

to Verizon’s 2022 Data Breach Incident 

Report.

20 In November 2022, FinCEN 

reported 1,251 ransomware-related 

incidents at U.S. banks in 2021—which is 

more than double the 602 ransomware 

events reported in 2020. Further, the total 

value of these ransomware events in 2021 

was about $886 million, which was 68 

percent more than in 2020 ($527 million). 

Further, 74 percent of bank leaders 

surveyed stated that their institution had 

experienced one or more ransomware 

attacks, with 63 percent of institutions 

paying the ransom demanded, according to 

VMWare.21 Banks incur significant costs 

from ransomware attacks (beyond paying 

the ransom), including “data restoration, 

investigation and response, regulatory and 

legal fines, and brand damage.”22 In March 

2022, a bank in New York suffered a 

cybersecurity incident—including 

ransomware and denial of service attacks—

that resulted in the bank’s temporary loss of 

access to its internal systems and data, and 

the exfiltration of bank customers’ personal 

information.23 

The Federal Reserve Board reported that 

cybersecurity risks may affect financial 

stability, because traditional stabilizing 

responses (capital and liquidity) are not 

likely to resolve such an attack. The 

Federal Reserve Board further noted that 

interconnected payment and settlement 

systems make it difficult to restore 

operations after a cybersecurity incident. 

As a result, “[u]ncertainty about the nature 

and extent of an incident may prompt runs 

on [the bank’s] counterparties, competitors, 

or unaffected segments of the firm's 

operations.” 

The Office of the Comptroller of the 

Currency (OCC) also has observed 

“increases in the frequency and severity of 

cyber attacks against financial institutions 

and their service providers in recent years. 

Disruptive and destructive cyber attacks, 

such as ransomware, targeted at the 

financial sector have elevated risks beyond 

the mere threat of financial loss. Disruption 

to financial services can significantly impact 

banks’ abilities to deliver critical services to 

their customers and has the potential to 

affect the broader economy.”24 

In its 2022 Risk Review, the FDIC stated 

that “[m]alicous cyber actors pose serious 

risk to bank information systems by 

compromising the security of software and 

computing services provided by third-party 

suppliers.” The OCC further recognized 

that “[t]hreat actors are increasingly 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 203
exploiting vulnerabilities in IT systems and 

third-party software to conduct malicious 

cyber activities while negotiating ransom 

payments.”25 In April 2022, VMWare 

reported that “[c]ybercrime cartels have 

studied the interdependencies of financial 

institutions and now understand which 

managed service provider is used.”26 Sixty 

percent of the financial institutions in its 

survey were infiltrated through their vendor 

relationships or third-party service providers 

(TSP), a 58-percent increase from 2020, 

according to VMWare.27 In May 2022, the 

Department of Homeland Security, 

Cybersecurity & Infrastructure Security 

Agency, issued an alert, Protecting Against 

Cyber Threats to Managed Service 

Providers and their Customers, stating that 

malicious cyber actors were targeting 

service providers to “enable follow-on 

activity—such as ransomware and cyber 

espionage—against the [service provider] 

and the [service provider’s] customer base.” 

FDIC IT examinations should evaluate 

banks’ IT risk management, to ensure that 

bank and TSP cybersecurity risks are 

mitigated. 

Ensuring FDIC Examinations 

Address Cybersecurity Risks at 

Banks 

The FDIC uses the Information Technology 

Risk Examination (InTREx) Program 

procedures to conduct risk-focused 

examinations to assess banks’ 

management of IT and cybersecurity risks. 

The FDIC should ensure that its InTREx 

examinations accurately capture current 

and relevant risks and reflect the scope and 

complexity of banks’ IT security and 

systems. The FDIC should also ensure that 

it has appropriate examination processes, 

resources, and staff. FDIC examiners 

should have up-to-date information on cyber 

controls and threats, and the requisite skills 

to identify risks and complete thorough 

examinations. 

In our OIG evaluation, Implementation of 

the FDIC’s Information Technology Risk 

Examination (InTREx) Program (January

2023), we found weaknesses in the InTREx 

program that limit the ability of FDIC 

examiners to assess and address banks’ IT 

and cyber risks at financial institutions: 

• The InTREx program is outdated

and does not reflect current Federal

guidance and frameworks for three

of four InTREx Core Modules;

• The FDIC did not communicate or

provide guidance to its examiners

after updates were made to the

program;

• FDIC examiners did not complete

InTREx examination procedures and

decision factors required to support

examination findings and ratings;

• The FDIC has not employed a

supervisory process to review IT

workpapers prior to the completion

of the examination, in order to

ensure that findings are sufficiently

supported and accurate;

• The FDIC does not offer training to

reinforce InTREx program

procedures to promote consistent

completion of IT examination

procedures and decision factors;

• The FDIC’s examination policy and

InTREx procedures were unclear,

which led examiners to file IT

examination workpapers in an

inconsistent and untimely manner;

• The FDIC does not provide guidance

to examination staff on reviewing

threat information to remain apprised

of emerging IT threats and those

specific to financial institutions;

• The FDIC is not fully utilizing

available data and analytic tools to

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 204
improve the InTREx program and 

identify emerging IT risks; and

• The FDIC has not established goals 

and performance metrics to measure 

its progress in implementing the 

InTREx program.

The weaknesses detailed above collectively 

demonstrate the need for the FDIC to take 

actions to ensure that its examiners 

effectively assess and address IT and cyber 

risks during IT examinations. Without 

effective implementation of the InTREx 

program, significant IT and cyber risks may 

not be identified by examiners and 

addressed by financial institutions. We 

made 19 recommendations to the FDIC to 

improve its InTREx examination processes. 

The FDIC concurred with 16 of the 19 

recommendations and partially concurred 

with 3 recommendations. Of the 19 

recommendations, 5 are unresolved. We 

will work with the FDIC to reach resolution 

during the audit follow-up process. 

Also, the FDIC faces an upcoming wave of 

pending retirements among its IT subject 

matter experts. As described later in this 

Top Challenges Report, 36 percent of 

examiners with advanced IT skills and 20 

percent of IT examiners with intermediate 

skills were eligible to retire in 2022. These 

retirement-eligibility figures rise to 64 

percent for advanced IT examiners and 44 

percent for intermediate IT examiners in 

2027. Absent skilled IT examiners, the 

FDIC may not have the expertise to identify 

banks’ IT risks. The FDIC will need to 

replace this expertise in order to ensure it

has the requisite number of skilled staff to 

complete IT examinations.

Examining for Third-Party Risk 

Banks routinely rely on TSPs for numerous 

activities, including document processing, IT 

services, accounting, compliance, human 

resources, and loan servicing.28 According 

to the FDIC’s Supervisory Insights, “[f]ailure 

to manage [third-party] risks can expose a 

financial institution to regulatory action, 

financial loss, litigation, and reputational 

damage, and may even impair the 

institution’s ability to establish new or 

service existing customer relationships.” 

In the Semiannual Risk Perspective (Fall 

2022), the OCC noted that banks are 

increasingly reliant on TSPs, and that such 

dependence poses operational and cyber 

risks to banks. Numerous banks may rely 

on the services of at least one TSP, which 

increases the risk of a cyber incident 

passing from a TSP to other banks, or from 

one bank through a TSP to multiple banks. 

Further, the OCC stressed the importance 

of banks conducting due diligence and 

ongoing monitoring and oversight of TSPs 

“commensurate with the nature and 

criticality of the proposed activity.” 

FDIC examinations of banks’ cybersecurity 

should include an assessment of the risk 

management programs of all TSPs affiliated 

with the bank. The Federal Financial 

Institutions Examination Council’s (FFIEC) 

guidance, Supervision of Technology 

Service Providers, notes that “[a] financial 

institution’s use of a TSP to provide needed 

products and services does not diminish the 

responsibility of an institution’s board of 

directors and management to ensure that 

the activities are conducted in a safe and 

sound manner and in compliance with 

applicable laws and regulations just as if the 

institution were to perform the activities inhouse.” We have work planned to assess 

the FDIC’s examination processes for 

TSPs. 

Recording and Assessing Banks’ 

Cybersecurity Incidents 

The FDIC, along with other banking 

regulators, promulgated a rule requiring 

banks to notify the FDIC about certain 

computer security incidents within 36 hours 

of the event; this rule became effective on 

May 1, 2022.29 According to the rule, the

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 205
banks must notify the primary bank 

regulator when a computer-security incident 

materially disrupted or degraded, or is 

reasonably likely to materially disrupt or 

degrade, a banking organization’s ability to 

carry out its banking operations, the bank’s 

business lines, or operations.30

According to FDIC data, between May 1 

and July 31, 2022, banks reported 41 

cybersecurity incidents under the new 

rule.31 FDIC examinations should have 

procedures to evaluate banks’ compliance 

with the regulatory requirements and 

identify possible underreporting of incidents. 

When FDIC personnel become aware of 

cybersecurity incidents at banks, they 

should report the information to law 

enforcement, including the FDIC OIG, for 

further investigation. As of the writing of this 

Top Challenges Report, the FDIC has not 

reported these cybersecurity incidents to 

law enforcement.

In addition, the FDIC does not currently 

have processes in place to ensure that 

reported incidents are recorded in the 

FDIC’s system that supports FDIC 

supervision and insurance responsibilities 

called ViSION.32 For example, a recent 

internal FDIC review of nine reported 

incidents at the Atlanta Regional Office 

found that four of the nine incidents reported 

to the FDIC were not recorded in the 

ViSION system. 

In addition, it is critical that IT examiners are 

notified of banks’ cybersecurity incidents, 

including the range of cybersecurity 

incidents occurring across FDIC-insured

institutions. The FDIC should also look 

across all reported incidents for important 

trends and patterns of nefarious activity. 

Such trends may be helpful to examiners, 

policymakers, and banks as they assess 

cybersecurity risks at financial institutions. 

Cybersecurity is a threat to banks and 

TSPs. A single cybersecurity incident—

either alone or through interconnections—

could have a devastating impact on financial 

stability in the United States. FDIC IT 

examinations should assess emerging 

cyber risks and ensure that banks and TSPs 

take appropriate action to address these 

risks. Further, the FDIC should have 

effective processes for the intake and 

assessment of banks’ reporting of 

cybersecurity incidents, including follow-up 

to ensure their mitigation.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 206
Supervising Risks Posed by Digital Assets 

Key Areas of Concern

The primary areas of concern for this 

Challenge are: 

• Regulating digital assets in a 

coordinated fashion;

• Evaluating and supervising risks at 

banks related to digital assets; and

• Clarifying consumer risks regarding 

digital assets.

The OIG has identified Digital Asset Risk as 

a Top Challenge for the FDIC since 2018.

The Executive Order on Ensuring 

Responsible Development of Digital Assets

(March 9, 2022), defined digital assets as a 

broad term including central bank digital 

currencies, crypto assets (also known as 

cryptocurrencies), and stablecoins that are 

used to “make payments or investments, or 

transmit or exchange funds or the 

equivalent thereof, that are issued or 

represented in digital form through the use 

of distributed ledger technology.” The crypto 

asset markets have been extremely volatile

over the last 3 years. The total market 

capitalization of crypto assets fluctuated 

from about $132 billion in January 2019 

rising to $3 trillion in November 2021, and 

falling by about two-thirds to $1 trillion in 10 

months (September 2022). As of December 

2022, crypto asset market capitalization fell 

further to $840 billion.33

According to FDIC data, as of January 

2023, the FDIC was aware that 136 insured 

banks had ongoing or planned crypto assetrelated activities. For example, these banks 

have arrangements with third parties that 

allow bank customers to buy and sell crypto 

assets. Banks also provide account deposit 

services, custody services, and lending to 

crypto asset exchanges. 

For example, it was reported that 90 percent 

of Silvergate Bank’s deposit base 

Figure 1: Crypto Asset Market Capitalization—July 2010 to September 2022

Source: Statistia.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 207
(approximately $11.9 billion) were accounts 

for crypto asset customers.34 In the 4th

quarter of 2022, Silvergate Bank crypto 

asset customers withdrew funds causing 

total bank deposits to fall to $3.8 billion—a 

68-percent deposit reduction from $11.9 

billion in the 3rd quarter.35 As a result, the 

bank was forced to quickly raise funds to 

satisfy customer withdrawals. The bank 

sold $5.2 billion in debt securities at a loss 

of $718 million, which is greater than the 

bank’s total profits since about 2013. 

Further, the recent bankruptcy of crypto 

asset exchange FTX revealed that 11 banks 

were doing business with FTX and may 

have had involvement in alleged wire 

transfer fraud – this includes Moonstone 

Bank, where an FTX-affiliated company 

invested $11.5 million, doubling the bank’s 

asset size of $5.7 million.36 Banks also 

sponsor debit cards and prepaid cards that 

provide bank customers with crypto asset 

rewards. 

Banks’ interactions with crypto assets 

present risks for the FDIC in supervising 

banks and resolving failed institutions. The 

FSOC Report on Digital Asset Financial 

Stability Risks and Regulation (FSOC 

Digital Asset Report) (September 2022) 

noted that “[c]rypto-asset activities could 

pose risks to the stability of the U.S. 

financial system.” For example, the Basel 

Committee on Banking Supervision noted 

that crypto asset price volatility could lead to 

bank “liquidity risk, credit risk, market risk, 

operational risk (including fraud and cyber 

risks), money laundering/terrorist financing 

risk, and legal and reputation risks.”37 

Banks must regularly assess the 

fluctuations in crypto asset values used as 

collateral. Further, the FDIC should 

maintain expertise in digital assets in order 

to manage bank resolutions for failed 

institutions. FinCEN also noted that the 

anonymity, lack of transparency, and speed 

of crypto assets made the use of crypto 

assets appealing for “money laundering, 

sanctions evasion, and other illicit 

financing.”38 

Executive Order 14067, Ensuring 

Responsible Development of Digital Assets

(March 9, 2022), recognized that digital 

asset growth has “profound implications” for 

the protection of consumers, including data 

privacy and security, and criminal activity. 

According to the Comprehensive 

Framework for Responsible Development of 

Digital Assets, 16 percent of Americans 

(about 52 million people) have purchased 

digital assets. The Federal Trade 

Commission reported that since 2021, 

46,000 people have lost over $1 billion to 

crypto asset scams.39 As noted in the Joint 

Statement on Crypto-Asset Risks to 

Banking Organizations (January 3, 2023), 

the FDIC and other banking regulators 

should assess banks’ crypto asset activities 

to ensure adequate safety and soundness, 

consumer protection, legal permissibility, 

and compliance with applicable laws and 

regulations, including anti-money laundering 

and illicit finance statutes and rules.

Regulating Digital Assets in a 

Coordinated Fashion 

The FSOC Digital Asset Report noted that 

the current digital asset regulatory 

landscape was opaque. FSOC noted that 

there should be a consistent regulatory 

framework for digital assets, including the

“analysis, monitoring, supervision, and 

regulation of crypto-asset activities.” FSOC 

recommended a Government-wide 

approach to the collection and sharing of 

data to enhance regulators’ understanding 

of digital assets in order to assess their 

impact on U.S. financial stability. Executive 

Order 14067, Ensuring Responsible 

Development of Digital Assets, also 

emphasized the importance of a “whole-ofgovernment approach to addressing the 

risks and harnessing the potential benefits 

of digital assets and their underlying 

technology.” 

Prior to the FSOC Digital Asset Report and 

the Executive Order, on November 23, 

2021, the Federal Reserve Board, the FDIC, 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 208
and the OCC issued a Joint Statement on 

Crypto-Asset Policy Sprint Initiative and 

Next Steps (Joint Statement) that “focused 

on quickly advancing and building on the 

agencies’ combined knowledge and 

understanding related to banking 

organizations’ potential involvement in 

crypto-asset-related activities” and provided 

a roadmap for agencies to collectively 

provide greater clarity on banks’ cryptorelated activities. The Joint Statement 

noted that “it is important that the agencies 

provide coordinated and timely clarity where 

appropriate to promote safety and 

soundness, consumer protection, and 

compliance with applicable laws and 

regulations, including anti-money laundering 

and illicit finance statutes and rules.” 

The recent Joint Statement on Crypto-Asset 

Risks to Banking Organizations (January 3, 

2023), noted risks for digital assets, 

including fraud, legal uncertainty regarding 

custody and crypto asset ownership rights,

unfair or misleading representations and 

disclosures regarding deposit insurance by 

crypto asset firms, crypto asset volatility and 

contagion risk from crypto asset 

interconnections, and potential banking 

outflow and stability risks for stablecoins. 

Regulators stated that they “continue to take 

a careful and cautious approach related to 

current or proposed crypto-asset-related 

activities and exposures at each banking 

organization.” We have ongoing work to 

determine whether the FDIC has developed 

and implemented strategies that address 

the risks posed by crypto assets.

Evaluating and Supervising Risks 

at Banks Related to Digital Assets 

Criminals use crypto assets for illicit 

activities and move funds to conceal or 

disguise the origin of funds.40 The FDIC

should ensure that its examiners have the 

appropriate training, skills, and processes to 

assess crypto asset risks at banks.41 The 

FDIC also should have resolution staff with 

the appropriate skillsets and processes to 

resolve banks involved in digital assets. 

Otherwise, examiners may be unaware of 

banks’ digital asset risks, and FDIC 

resolution and asset sales may be impacted 

by a bank’s digital-asset holdings or 

activities. 

In addition, FDIC examination, receivership, 

and other staff overseeing digital-asset 

supervision and policy should be free from 

any conflicts of interest. On July 5, 2022, in 

a Legal Advisory, the Office of Government 

Ethics stated that a Federal “employee who 

holds any amount of a cryptocurrency or 

stablecoin may not participate in a particular 

matter if the employee knows that particular 

matter could have a direct and predictable 

effect on the value of their cryptocurrency or 

stablecoins.” On August 17, 2022, the FDIC 

issued an Ethics Analysis that allows 

employees with certain interest in digital 

assets to participate in non-policymaking 

assignments. For example, if an employee 

holds the crypto asset Ethereum, the 

employee may examine a bank that is 

involved in Bitcoin provided the effect of the 

examination does not go beyond Bitcoin. 

As banks increase their involvement with 

crypto assets, the FDIC should ensure that 

it has sufficient staff that are not conflicted 

in order to meet its mission requirements. 

Clarifying Consumer Risks 

Regarding Digital Assets 

According to the Comprehensive 

Framework for Responsible Development of 

Digital Assets, approximately 52 million 

Americans have purchased digital assets. 

The FDIC has noted an “increasing number 

of instances where financial service 

providers or other entities or individuals 

have misused the FDIC’s name or logo or 

have made false or misleading 

representations about deposit insurance.”42 

For example, bankrupt crypto asset platform 

Voyager Digital (Voyager) misrepresented 

that U.S. dollars deposited with the firm for 

the purchase of crypto assets were covered 

by FDIC insurance. Voyager had deposit 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 209
accounts for the benefit of its customers at 

Metropolitan Commercial Bank that were 

used for customers’ purchase and sale of 

crypto assets, but Voyager was not FDICinsured.43 Voyager customers have not 

received their funds and await bankruptcy 

court rulings regarding potential fund 

recovery.44 

The FDIC became aware of Voyager’s 

misrepresentation of FDIC insurance in

February 2021. However, it was not until 17 

months later on July 28, 2022, that the FDIC 

and the Federal Reserve Board issued a 

letter demanding that Voyager cease and 

desist from making false and misleading 

statements regarding its FDIC deposit 

insurance status and take immediate action 

to correct any such prior statements.45 One 

day after issuing the joint letter to Voyager, 

the FDIC noted its concerns about the risks 

of consumer confusion or harm arising from 

crypto assets offered in connection with 

insured depository institutions.46 On August 

19, 2022, the FDIC issued additional cease 

and desist letters to five companies for 

making crypto-related false or misleading 

representations about deposit insurance.47 

The risks associated with digital assets and 

emerging technologies require a whole-ofgovernment response. FDIC digital asset 

guidance for banks and policies and 

procedures for examinations should be 

consistent with those of other regulators to 

ensure that similarly situated banks are 

subject to the same supervisory strategies. 

The FDIC should also have information and 

analysis regarding digital asset risks to 

make data-driven policy decisions and 

enable broad assessment of risks across 

the banking sector. 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 210
Fostering Financial Inclusion for Underserved Communities 

Key Areas of Concern

The primary areas of concern for this 

Challenge are: 

• Developing the FDIC’s strategy to 

foster financial inclusion; and

• Managing bias risk associated with 

technology.

The OIG has identified Financial Inclusion 

as a Top Challenge since 2020.

The World Bank notes that access to a bank 

account is “a first step toward broader 

financial inclusion since a transaction 

account allows people to store money, and 

send and receive payment.”48 In addition, 

bank accounts allow previously excluded 

and underserved populations to receive 

other financial products. 

Developing the FDIC’s Strategy to 

Foster Financial Inclusion 

In October 2022, the FDIC, in partnership 

with the Census Bureau, issued its biennial 

2021 National Survey of Unbanked and 

Underbanked Households. The Survey 

found that 5.4 percent were unbanked—

meaning that no one in the household had a 

checking or savings account at a bank or 

credit union (Figure 2). 

Further, the Survey found that 14.1 percent

were underbanked—meaning that someone 

in the household had a bank account, but 

they used other high-cost services, such as 

money orders, check cashing, payday 

lending, pawn shops, tax refund anticipation 

loans, or auto title loans. 

The Survey also found disparities in banking 

status based on race and ethnicity. As 

shown in Figure 3, consistent with prior 

surveys, the unbanked and underbanked 

rates were higher for Black, Hispanic, and 

Asian households than for White 

households. Further, the Federal Reserve 

Board found that on average, Black and 

Hispanic households earned half of White

households and that their net worth was 15 

to 20 percent of White households.49 

Figure 3: Banking Status by Race/Ethnicity

Figure 2: Household Unbanked Percentage Rate, 

2009-2021

Source: FDIC 2021 National Survey of Unbanked and 

Underbanked Households (October 2022). 

0.0%

5.0%

10.0%

15.0%

20.0%

25.0%

30.0%

Black Hispanic Asian White

Underbanked

Unbanked

Source: FDIC 2021 National Survey of Unbanked and 

Underbanked Households (October 2022).

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 211
In addition, the Survey noted differences 

based on household income. As shown in 

Figure 4, consistent with prior Surveys, 

households with lower income had higher 

unbanked and underbanked rates when 

compared to households with incomes of 

$50,000 or more. 

The FDIC has identified financial inclusion 

as a strategic challenge for the Agency.50 

Further, the FDIC has not completed 

development of measures to determine the 

effectiveness of its efforts to promote 

financial inclusion, including whether it is 

achieving the desired outcomes. 

 

The Government Accountability Office 

(GAO) reported that the FDIC’s plans 

(Economic Inclusion Strategic Plan and 

Annual Performance Plan) do not assess 

the outcomes of efforts to facilitate 

consumers’ access to banking services.51 

In February 2022, the GAO recommended 

that the FDIC develop and implement 

outcome-oriented performance measures 

for its strategic objective of ensuring access 

to safe and affordable bank services that 

reflect leading practices, including 

demonstrating results, measuring 

outcomes, and providing useful information 

for decision-making. The FDIC’s 2022 

Annual Performance Plan included a goal to 

track and report outcome-based 

performance measures for economic 

inclusion programs; however, the GAO 

recommendation remains unimplemented at 

the time of this Report.

Absent outcome-oriented 

performance measures for 

financial inclusion-related 

work, the FDIC is limited in 

evaluating whether these 

programs and initiatives are 

effective in increasing 

participation in the insured 

banking system. We have 

ongoing work to determine 

whether the FDIC has 

developed and implemented 

an effective strategic plan to 

increase participation in the 

banking system. 

Managing Bias Risk Associated 

with Technology 

In October 2022, the White House Office of 

Science and Technology Policy issued a 

Blueprint for an AI Bill of Rights that 

identified five principles and associated 

practices to help guide the design, use, and 

deployment of automated systems to 

protect the American public in the age of 

Artificial Intelligence (AI).52 These principles 

include: Protection from unsafe or 

ineffective automated systems; Protection 

from discrimination by algorithms and 

systems; Data privacy; Explanation of how 

an automated system is being used and 

why it contributes to outcomes; and Access 

to personnel who will remedy problems 

encountered. While AI can offer banks 

certain benefits, it can generate or amplify 

risks to consumers, such as unlawful 

discrimination; unfair, deceptive, or abusive 

acts or practices; and privacy concerns. In 

particular, AI models may use data that has 

inherent biases, and its models may be 

outdated without proper oversight.53 

0.0%

5.0%

10.0%

15.0%

20.0%

25.0%

30.0%

35.0%

40.0%

45.0%

Unbanked

Underbanked

Figure 4: Unbanked and Underbanked Rates by 

Household Income

Source: FDIC 2021 National Survey of Unbanked and

Underbanked Households (October 2022). 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 212
In May 2022, a working paper from the 

Federal Reserve Bank of Minneapolis found 

bias in conventional mortgage data 

processed between 2018 and 2020. 

Specifically, data indicates that Black 

applicants were 2.9 percent more likely to 

have their mortgage denied than White 

applicants, and Asian and Latinx applicants 

were 2.2 percent and 1.5 percent more 

likely to face denials, respectively, than 

White applicants. The study concluded that 

biased systems and data can adversely 

affect minority communities.

On March 31, 2021, the FDIC and other 

financial regulators issued a Request for 

Information (RFI) to gather information and 

public comments on financial institutions’ 

use of AI, including machine learning. The 

purpose of this RFI was to understand 

respondents’ views on the use of AI by 

financial institutions in their provision of 

services to customers and for other 

business or operational purposes. On May 

17, 2021, the RFI comment period was 

extended from June 1, 2021 to July 1, 2021. 

Although the FDIC has stated that it has 

engaged with other regulators on this topic, 

as of the date of this Top Challenges 

Report, the FDIC has not promulgated AI 

policy guidance.

Also, in a November 29, 2021 letter, the 

Chairwoman of the House Financial 

Services Committee and Chairman on the 

Task Force on Artificial Intelligence 

requested that the FDIC, in assessing 

banks’ use of AI, “prioritize principles of 

transparency, enforceability, privacy, and 

fairness and equity ... [to] ensure AI 

regulation and rulemaking can meaningfully 

address appropriate governance, risk 

management, and controls over AI.” 

The FDIC should ensure that it takes a

holistic, outcome-based approach in its 

efforts to address unbanked and 

underbanked individuals. This may include 

new methods or strategies to reach Black, 

Hispanic, Asian, and low-income 

communities. Further, FDIC examinations 

should ensure that banks’ decision-making 

technologies and analytics are unbiased 

measures of creditworthiness.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 213
Fortifying IT Security at the FDIC 

Key Areas of Concern

The primary areas of concern for this 

Challenge are:

• Improving the FDIC’s information 

security profile; 

• Protecting the FDIC’s wireless 

network; 

• Assessing the FDIC’s readiness for 

a ransomware attack;

• Migrating the FDIC’s IT systems to 

the cloud;

• Addressing weaknesses in the 

FDIC’s personnel security program; 

and

• Ensuring the security and privacy of 

FDIC information.

The OIG has identified IT Security as a Top 

Challenge for the FDIC since 2018.

According to the Cybersecurity & 

Infrastructure Security Agency (CISA), the 

Federal Government must improve its 

efforts to protect against malicious cyber 

campaigns to ensure the security of Federal 

IT assets.54 In 2022, the GAO continued to 

recognize Federal IT security as a high risk 

across the Federal Government,55 and in 

2021, Federal IT systems suffered 32,543 

incidents, a 6-percent increase from 2020.56 

For example, on November 16, 2022, CISA 

issued an alert that the network of a Federal 

agency was compromised by Iranian 

Government-sponsored actors.57 The 

threat actors exploited unpatched 

vulnerabilities in a certain proprietary server, 

were able to move laterally throughout the 

network, compromised credentials, and 

installed mining and other software. 

CISA further noted that IT and cyber 

vulnerabilities used to exploit private 

organizations, as shown in Figure 5, pose 

similar risks to Federal agencies.58 

According to a report from cybersecurity 

firm Comparitech, there were 330 

ransomware attacks on state and local 

government organizations between 2018 

and October 2022 that impacted data for 

over 230 million individuals with ransom 

demands totaling $36.5 million. For 

example, in August 2022, the City of Wheat 

Ridge, Colorado was attacked by 

ransomware, and the town refused to pay 

the ransom. It took more than 3 weeks to 

determine whether the town could resume 

operations through backup data.

The FDIC relies heavily on information

systems, data, and personnel to carry out its 

mission. The FDIC is custodian of about 

1.8 petabytes of sensitive and Personally 

Identifiable Information (PII) relating to failed 

banks and more than 4,700 insured banks. 

FDIC IT systems also contain sensitive 

information, such as PII that includes 

names, Social Security Numbers, and bank 

account numbers for FDIC employees and 

depositors of failed financial institutions; 

confidential bank examination information, 

including supervisory ratings; and sensitive 

financial data, including credit card 

numbers. 

Figure 5: Infrastructure Sectors Victimized by Ransomware

Source: FBI Internet Crimes Complaint Center.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 214
The FDIC should have effective controls in 

place to protect the information contained in 

its IT systems. The FDIC has a duty to 

ensure the safekeeping of sensitive 

information and PII that it collects, 

maintains, uses, and discloses.59 A 

cybersecurity incident at the FDIC could 

severely limit its capabilities to meet mission 

requirements, particularly during a crisis. 

The FDIC should also ensure that its 

employees and contractors possess the 

requisite suitability to ensure the safety and 

security of the FDIC workplace and 

information. An FDIC data breach could 

result in FDIC employees and contractors, 

bank customers, and bank employees and 

executives suffering identity theft, and 

affected banks and the FDIC experiencing 

operational and reputational risk. 

Improving the FDIC’s Information 

Security Profile 

In our OIG report, The FDIC’s Information 

Security Program –2022 (September 2022), 

we evaluated the effectiveness of the 

FDIC’s information security program and 

practices. We found security control 

weaknesses that reduced the effectiveness 

of the FDIC’s information security program 

and practices: 

• The FDIC’s Supply Chain Risk 

Management (SCRM) Program 

Lacks Maturity: The FDIC is still 

developing its policies and 

procedures to address the SCRM 

finding from our Information Security 

report in 2021. Additionally, in our 

OIG evaluation report, The FDIC’s 

Implementation of Supply Chain 

Risk Management (March 2022), we 

found that the FDIC had not 

implemented several objectives 

outlined in its SCRM Implementation 

Project Charter; did not conduct 

supply chain risk assessments in 

accordance with best practices; had 

not ensured that its Enterprise Risk 

Management processes fully capture 

supply chain risks; and FDIC 

Contracting Officers did not maintain 

contract documents in the proper 

system. We issued nine 

recommendations, five of which 

remain unimplemented.

• The FDIC Did Not Adequately 

Oversee and Monitor Information 

Systems: Federal agencies must 

conduct security risk assessments 

for the information and information 

systems that support the operations 

and assets of the agency, including 

those provided or managed by 

contractors and other entities. We 

concluded that the FDIC had not 

conducted security risk assessments 

in accordance with National Institute 

of Standards and Technology (NIST) 

guidance for approximately 52 

percent of its legacy systems and 

subsystems (as of May 19, 2022).

• The FDIC Did Not Address Flaw 

Remediation Plans of Action and 

Milestones (POA&M) in a Timely 

Manner: A POA&M is a tool used 

by agency Chief Information 

Officers, security personnel, 

program officials, and others to track 

the progress of corrective actions 

pertaining to security vulnerabilities 

identified through security control 

assessments and other sources. 

We found that the FDIC had 31 

POA&Ms related to flaw remediation 

open past their estimated completion 

dates (as of June 21, 2022). 

• The FDIC Did Not Configure 

Privileged Accounts in 

Accordance with the Principle of 

“Least Privilege”: We are currently 

conducting an audit of the FDIC’s 

security controls over its Windows 

Active Directory. During the course 

of our work, we identified instances 

where accounts were configured 

with elevated account settings; 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 215
however, there was no justification 

provided for such settings, and the 

elevated settings were no longer 

needed for administrators to perform 

their business roles. Additionally, we 

identified concerns relating to the 

Background Investigations for 

Privileged Account Holders at the 

FDIC and issued a Management 

Advisory Memorandum in June 

2022.

• The FDIC Did Not Fully Implement 

Its Document Labeling Guide: In 

a previous OIG report, The FDIC's 

Information Security Program - 

2021, we recommended that the 

FDIC implement document labeling 

guide requirements across the 

organization. However, the FDIC 

had not yet implemented this 

recommendation and did not 

anticipate implementation until 2023. 

These control weaknesses must be 

improved to reduce the impact to the 

confidentiality, integrity, and availability of 

the FDIC’s information systems and data. 

Protecting the FDIC’s Wireless 

Network 

The FDIC provides wireless access (WiFi)

throughout its facilities. Absent effective 

security controls, WiFi access provides an 

avenue into FDIC systems that could 

compromise the confidentiality, availability, 

and integrity of FDIC data and systems. In 

our OIG review of Security Controls Over 

the FDIC’s Wireless Network (December 

2022), we found that the FDIC did not 

comply or partially complied with five 

practices recommended by NIST and 

guidance from the FDIC and other Federal 

agencies in the following areas:

• Configuration of Wireless 

Networks: The FDIC did not 

properly configure its Policy 

Manager, which enforces security 

policies for wireless network 

connectivity. Also, the FDIC’s Chief 

Information Officer Organization’s 

(CIOO) Wi-Fi Operations Group did 

not have control or awareness of the 

set-up and configuration of 

numerous wireless devices 

operating in FDIC buildings and 

facilities. 

• Wireless Signal Strength: The 

FDIC did not have processes to 

examine and modify the signal 

strength of wireless devices and 

networks broadcasting throughout its 

buildings and leaking outside of 

FDIC facilities. 

• Security Assessments and 

Authorizations: The FDIC did not 

maintain a current Authorization to 

Operate for its wireless network and 

did not conduct sufficient continuous 

monitoring testing activities to 

support the Agency’s ongoing 

authorization of its wireless network. 

• Vulnerability Scanning: The FDIC 

did not include certain wireless 

infrastructure devices in its 

vulnerability scans. In addition, the 

FDIC did not use credentialed scans 

on wireless infrastructure devices. 

• Wireless Policies, Procedures, 

and Guidance: The FDIC did not 

maintain policies and procedures 

addressing key elements of the 

FDIC’s wireless networks, including 

roles and responsibilities for the 

CIOO’s Wi-Fi Operations Group; 

procedures for remediating wireless 

equipment alerts; standards for 

configuration settings; updates of 

wireless inventory records; and 

detection of rogue access points. 

As a result, the FDIC faces potential 

security risks based upon its current 

wireless practices and controls, including 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 216
unauthorized access to the FDIC networks 

and insecure wireless devices broadcasting 

Wi-Fi signals. We made eight 

recommendations to strengthen FDIC 

wireless networks. 

 

Assessing the FDIC’s Readiness 

for a Ransomware Attack 

According to CISA, “[r]ansomware is an 

ever-evolving form of malware designed to 

encrypt files on a device, rendering any files 

and systems that rely on them unusable.” 

The goal of most ransomware attacks is to 

halt processes, interrupt services, and 

cause disruption until a ransom payment is 

made in exchange for decrypting files and 

systems. CISA notes that ransomware “can 

severely impact business processes and 

leave organizations without the data they 

need to operate or deliver mission-critical 

services.” 

The FDIC relies on its IT systems for day-today activities and especially during crises. 

A ransomware attack on the FDIC could 

hinder the FDIC’s ability to resolve failed 

banks, issue deposit insurance payments to 

bank account holders, examine and 

supervise financial institutions, and manage 

receiverships. Disruption of any of these 

FDIC core functions could lead to financial 

system instability, including a loss of public 

confidence in the FDIC’s ability to pay 

depositors. We have work planned to 

assess the FDIC’s activities to prepare for 

and respond to a ransomware attack. 

Migrating the FDIC’s IT Systems to 

the Cloud 

Executive Order 14028, Improving the 

Nation’s Cybersecurity, requires Federal 

agencies to adopt security best practices, 

including accelerating the transition of IT 

systems to secure cloud environments. 

Cloud transition requires the secure and 

effective transfer of data from legacy 

systems into new cloud environments 

hosted by outside organizations. According 

to the GAO, Federal agencies face four key 

risks in their cloud transitions: 

• Ensuring the cybersecurity of cloud 

service providers. 

• Procuring cloud services through 

agreements that define security 

breaches and responsibilities, how 

data will be managed, and the 

possible consequences for noncompliance with the agreement.

• Maintaining a skilled workforce for a 

cloud environment.

• Tracking cloud transition costs and 

savings.60 

The FDIC accelerated its multi-year 

transition to a cloud-based environment and 

has spent over $100 million on this effort 

since 2021. The FDIC should ensure that it 

safeguards FDIC data and information 

during the cloud transition. FDIC cloud 

computing contracts should include 

information security provisions, and the 

FDIC should have knowledgeable staff and

governance processes to manage these 

contracts. We have ongoing work to assess 

the governance, strategy, and security of 

the FDIC’s cloud-based systems. 

Addressing Weaknesses in the 

FDIC’s Personnel Security Program 

According to the 2022 Verizon Data Breach 

Investigations Report, data breaches 

involving misuse of access are almost 

entirely conducted by insiders. To protect 

FDIC personnel, systems, and information, 

the FDIC vets all employees and 

contractors for standards of fitness and 

integrity and conducts background 

investigations commensurate with an 

individual’s duties.61 The FDIC’s personnel 

security and suitability program is the first 

line of defense to ensure a safe workplace 

and to mitigate the risk of unauthorized IT 

access to FDIC sensitive information and 

PII.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 217
In our OIG Management Advisory 

Memorandum, Background Investigations 

for Privileged Account Holders (June 6, 

2022), we identified that the FDIC did not 

have adequate controls to ensure that 

certain contractors and employees who 

require privileged access to FDIC 

information systems and data had 

background investigations commensurate 

with their positions. As a result, the FDIC 

could not be sure that certain employees 

and contractors who were granted 

privileged access to the FDIC’s information 

systems and related data subsequent to 

their onboarding would have an appropriate 

risk designation level and related 

background investigation. The FDIC took 

actions to address our findings. 

In 2021, we also found several deficiencies 

in the FDIC’s background investigation 

program. In our OIG evaluation, The 

FDIC’s Personnel Security and Suitability 

Program (January 2021), we concluded that 

the FDIC’s program was not fully effective in 

ensuring the timely completion of 

preliminary suitability screenings, 

background investigations commensurate 

with position risk designations, and 

reinvestigations. Specifically we found that 

two contractors with IT administrator rights 

remained with the FDIC despite unfavorable 

background adjudications. These 

individuals had access to FDIC databases 

and information for nearly 6 years and over 

4 years, respectively. The FDIC took action 

to close the 21 recommendations from our 

report.

The FDIC should maintain and sustain 

controls over its personnel security program 

as it hires and transfers employees and 

contractors in a changing work environment. 

Ensuring the Security and Privacy 

of FDIC Information 

In recent reports, both the GAO and the OIG 

have found that the FDIC should strengthen 

controls to secure sensitive information and 

PII. The GAO found that the FDIC had “not 

established metrics to measure its overall 

implementation of privacy controls.”62 

Absent such metrics, the FDIC is 

challenged to report on the sufficiency of its 

privacy controls. The GAO recommended 

that the FDIC identify and specify privacy 

metrics. 

In our OIG report, The FDIC’s Privacy 

Program (December 2019), we found that 

the FDIC’s Privacy Program controls and 

practices we assessed were not effective or 

partially effective in four areas:

• The FDIC did not fully integrate 

privacy considerations into its risk 

management framework designed to 

categorize information systems, 

establish system privacy plans, and 

select and continuously monitor 

system privacy controls; 

• The FDIC did not adequately define 

the responsibilities of the Deputy 

Chief Privacy Officer or implement 

Records and Information 

Management Unit responsibilities for 

supporting the Privacy Program; 

• The FDIC did not effectively manage 

or secure PII stored in network 

shared drives and in hard copy, or 

dispose of PII within established 

timeframes; and 

• The FDIC did not ensure that 

Privacy Impact Assessments were 

always completed, monitored, and 

retired in a timely manner. 

These weaknesses in the FDIC’s Privacy 

Program increased the risk of PII loss, theft, 

and unauthorized access or disclosure, 

which could lead to identity theft or other 

forms of consumer fraud against individuals. 

We made 14 recommendations that have 

been implemented by the FDIC. 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 218
The security of FDIC systems impacts bank 

employees and their customers, FDIC 

employees and contractors, and the U.S. 

financial sector. The FDIC should ensure 

that its IT security can withstand risks to 

Federal systems, including the increasing 

risks posed by ransomware and those 

posed when systems transition to the cloud. 

Further, the FDIC should have robust 

personnel security and suitability program 

and privacy controls to safeguard sensitive 

information and guard against insider 

threats. Strong IT systems ensure that the 

FDIC can securely carry out day-to-day 

activities and respond to crisis events.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 219
Managing Changes in the FDIC Workforce 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are: 

• Managing a wave of pending 

retirements at the FDIC; and

• Addressing increased resignations 

by examiners-in-training. 

The OIG has identified FDIC Workforce 

Changes as a Top Challenge for the FDIC 

since 2019.

The GAO has recognized strategic human 

capital management as a high-risk area 

across the Federal Government. The FDIC 

faces challenges in the strategic 

management of its workforce. In 2022, 

more than 21 percent of the FDIC workforce 

was eligible to retire. Retirement-eligibility 

rates were higher for senior FDIC leaders 

and Subject Matter Experts, and in certain 

FDIC Divisions and Offices with critical roles 

for the Agency’s Crisis Readiness. In 

addition, in 2021 and 2022, the FDIC 

experienced a substantial number of 

resignations among bank examiners-intraining—at rates greater than prepandemic levels. Examiners play key roles 

in assessing the safety and soundness of 

banks, and it is costly for the FDIC to hire 

and train replacement examiners. 

The FDIC should ensure strategic 

management of its workforce and manage 

the loss of employees to retirements and 

resignations, while navigating its postpandemic hybrid work environment where 

80 percent of FDIC employees are working 

remotely. Without strategic workforce 

planning, retirements and resignations could 

result in the FDIC experiencing missioncritical skills and leadership gaps.

Managing a Wave of Pending 

Retirements at the FDIC

The FDIC’s ability to execute its mission 

may be affected by numerous departures of 

its personnel. A total of 21 percent (1,264 

individuals) of the FDIC workforce was 

eligible to retire in 2022 (Table 1); this figure 

is significantly higher than the Governmentwide rate of 15 percent.63 This retirementeligibility figure climbs to more than a third 

of the FDIC workforce—-38 percent (2,215 

individuals)—within 5 years (in 2027). 

Further, all FDIC Divisions have current 

retirement-eligibility rates that are greater 

than the 15-percent Government-wide 

average rate of retirement-eligibility. 

Division 2022 (%) 2027 (%)

Legal Division 39 50

Division of Finance (DOF) 39 49

Division of Resolutions and Receiverships (DRR) 36 54

Division of Administration (DOA) 28 45

Division of Risk Management Supervision (RMS) 18 34

Division of Information Technology (DIT) 16 33

Division of Insurance and Research (DIR) 16 30

Division of Depositor and Consumer Protection (DCP) 16 32

Division of Complex Institution Supervision & Resolution (CISR) 15 36

Overall for the FDIC 21 38

Table 1: FDIC Employee Retirement Eligibility Percentage

Source: OIG analysis of DOA retirement data as of June 2022. 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 220
Retirements in Key Crisis Readiness 

FDIC Divisions. The FDIC faces 

significant risks regarding retirement 

eligibility in key Divisions involved in Crisis 

Readiness efforts. In 2022, 36 percent of all 

employees in the Division of Resolutions 

and Receiverships were eligible to retire 

(Table 1). This figure rises to 54 percent in 

5 years. DRR employees are critical in 

crises, because they work to resolve failed 

banks by arranging the sale of assets and 

liabilities to healthy banks, ensure timely 

payment of deposit insurance to bank 

customers when an acquiring bank is not 

found, and sell failed bank assets that are 

not sold at the time of resolution using a 

variety of sales strategies and techniques.

In addition, Divisions that support the 

FDIC’s efforts to resolve failed banks also 

face significant retirement challenges. For 

example, the FDIC attorneys in its Legal 

Division execute documents to support the 

FDIC’s failed bank transactions and 

investigate professional liability claims 

against failed bank management. In 2022, 

the Legal Division’s retirement-eligibility rate 

was 39 percent and rising to half of the 

Division (50 percent) in 5 years. The 

Division of Finance and Division of 

Administration also play important roles 

during crises through the provision of 

deposit insurance and receivership funding, 

and contracting for goods and services, 

respectively. DOF had retirement-eligibility 

rates of 39 percent for 2022 and 49 percent 

in 5 years. DOA staff retirement-eligibility 

rates were 28 percent in 2022 and 

increased to 45 percent in 5 years. Absent 

seasoned professionals from key Divisions 

with institutional knowledge of lessons 

learned from past crises, the FDIC may not 

be able to execute its responsibilities with 

respect to resolution and receivership 

activities. 

Retirements for FDIC Subject Matter 

Experts. In addition, nearly a third of FDIC 

employees who are considered Subject 

Matter Experts (SME) in risk areas related 

to consumer compliance matters, trusts, 

and IT were eligible to retire at the end of 

2022 (Table 2). The FDIC designates 

certain personnel as SMEs because of the 

individuals’ deep understanding and 

experience regarding certain functions or 

subject areas, and retirement rates for these 

experts climb within the next 5 years. 

The retirement-eligibility rates for FDIC 

Advanced and Intermediate IT SMEs 

escalates at a time when cyber threats at 

banks and their TSPs are increasing (as 

noted in the Mitigating Cybersecurity Risk at 

Banks and Third Parties section of this 

Report). In 2022, Advanced IT SME 

retirement-eligibility rates were 31 percent

rising to 64 percent in 5 years. For 

Intermediate IT expertise, retirementeligibility rates for 2022 were 21 percent and 

increasing to 45 percent in 5 years. 

Similarly, retirement-eligibility rates for FDIC 

Consumer Compliance experts is 

increasing. 

SME Designation 2022 (%) 2027 (%)

Consumer Compliance 39 56

Trusts 32 55

Advanced IT 31 64

Intermediate IT 21 45

Bank Secrecy Act/Anti-Money Laundering (BSA/AML) 18 45

Accounting 16 37

Capital Markets 11 30

Table 2: FDIC Subject Matter Expert Employee Retirement Eligibility Percentage

 Source: OIG analysis of RMS and DCP SME data in combination with DOA retirement data as of June 2022.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 221
Executive and Managerial Retirements. 

As noted in Table 3, a total of 40 percent of 

FDIC Executives and 30 percent of FDIC 

Managers were eligible to retire in 2022. 

These rates climb to 67 percent for FDIC 

Executives and 56 percent for Managers in 

5 years. 

Certain FDIC Regional Offices have 

significantly higher retirement rates for their 

Executives and Managers. For example, 75 

percent of all Executives in Kansas City, 

and 60 percent or more of the Executives 

from the Chicago, Dallas, and San 

Francisco Regional Offices were eligible to

retire in 2022. 

Beginning in 2023, the FDIC’s Atlanta 

Regional Office faces a 100-percent 

retirement-eligibility rate for its Executives. 

Further, over 40 percent of the Managers in 

the Dallas and Kansas City Regional Offices 

were eligible to retire in 2022. 

These retirements may result in gaps in 

leadership positions. Leadership gaps can 

cause delayed decision-making, reduced 

program oversight, and failure to achieve 

Agency goals.

 

Addressing Increased 

Resignations by Examiners-inTraining 

The FDIC is also facing increasing 

resignation rates for its examiners-intraining known as Financial Institution 

Specialists (FIS). As shown in Figure 6, the 

FDIC saw more than a doubling of FIS 

resignations after 2020—with 54 

Regional Office 2022 (%) 2027 (%)

Executives

Atlanta 50 100

Chicago 67 80

Dallas 60 80

Kansas City 75 75

New York 20 60

San Francisco 67 100

Headquarters 37 64

All EMs 40 67

Managers

Atlanta 18 51

Chicago 23 64

Dallas 44 71

Kansas City 41 74

New York 17 49

San Francisco 29 57

Headquarters 30 49

All CMs 30 56

Table 3: FDIC Executives and Managers Retirement Eligibility Percentage

Source: OIG analysis of DOA retirement data as of June 2022.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 222
resignations in 2021 and another 62 

resignations for the first 9 months of 2022. 

FIS resignations are costly to the FDIC. 

The FDIC invests in approximately 4 years 

of training from the time a FIS is hired until 

that individual earns an examination 

commission. Such commissioning requires 

that employees meet benchmarks, training, 

and other technical requirements, including 

passing a Technical Examination. Of the 62 

FIS resignations in 9 months of 2022, 32 

percent had 3 or more years of FDIC 

training, 53 percent had between 1 and 2 

years of FDIC training, and 15 percent had 

less than one year of FDIC training. The 

total cost to train each new FIS is about 

$400,000.

Further, the departure of FIS personnel 

impacts FDIC succession planning and 

management. More than 17 percent of all 

current FDIC examiners were eligible to 

retire 2022, and this figure rises to 36 

percent in 5 years (2027). Given the 

timeline for FIS training, the FDIC may have 

a limited number of new examiners to fill the 

positions of retiring seasoned examiners. 

We had previously identified concerns with 

the FDIC’s management of its employee 

retention, including a lack of established 

metrics or indicators to measure the 

effectiveness of its retention activities or 

actions for examination staff. In our OIG 

memorandum, The FDIC’s Management of 

Employee Talent (September 2021), we 

found that the FDIC: 

• Did not have clear goals to manage 

employee retention. 

• Did not have a systematic process 

for collecting and analyzing 

employee retention data. The FDIC 

did not have a systematic process to 

holistically capture and analyze data, 

and to ensure that the information 

flowed to the Divisions and Offices. 

• Did not establish metrics or 

indicators to measure the 

effectiveness of its retention 

activities or actions. The FDIC could 

not determine whether or not its 

retention activities were working 

effectively. 

We made three recommendations to 

improve the FDIC’s management of talent at 

the Agency. One recommendation remains 

unimplemented as of the writing of this Top 

Challenges report. 

 

The FDIC should continue to focus on 

managing its human capital lifecycle—

hiring, talent management, resignations, 

and retirements. 

39

24

54

62

0

10

20

30

40

50

60

70

2019 2020 2021 2022

Figure 6: FIS Resignations by Year

Source: OIG analysis of DOA separation data 2019-

September 2022.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 223
Improving the FDIC’s Collection, Analysis, 

and Use of Data Key Areas of Concern 

The primary areas of concern for this 

Challenge are: 

• Facilitating threat information 

sharing among financial sector 

participants; and

• Ensuring adequate data collection 

and analysis. 

The OIG has identified Sharing of Threat 

Information as a Top Challenge for the 

FDIC since 2018.

Federal Government agencies gather a 

substantial volume of information related to 

financial institutions and their operations in 

the United States, and thus, relevant to 

FDIC supervisory and other activities. For 

example, Government agencies collect 

information about cyber threats, money 

laundering, and illicit financing activity.64 

Figure 7 depicts the GAO’s 

determination of entities that hold 

information relevant to banks and 

the financial services sector.

The FDIC collects threat 

information relevant to the financial 

services sector regarding cyber 

attacks, money laundering, terrorist 

financing, pandemics, and natural 

disasters. Both the FSOC and 

OCC have encouraged greater 

information sharing among public 

and private entities to safeguard 

against threats to the financial 

sector.65 Effective sharing of threat 

information helps the FDIC develop 

situational awareness, supports 

informed decision-making, 

enhances supervisory strategies, 

and assists in ensuring financial 

stability in the United States. 

According to NIST, information 

sharing also allows organizations to 

leverage “knowledge, expertise, 

and capabilities ... to gain a more 

complete understanding of threats” and 

allows for informed decision-making.66 

Further, multiple sources of threat 

information can allow an organization to 

enrich existing information and make it 

actionable. 

In addition, agencies may use data to 

understand and improve their programs and 

operations, and enable data-driven 

decision-making.67 Federal agencies are 

also using sophisticated data analytics such 

as AI and machine learning. The FDIC 

should ensure that it receives and accesses 

actionable and relevant information 

regarding threats to the financial sector, 

analyzes such information, and shares it 

with its own Agency personnel and banks in 

order to mitigate the threats. The FDIC 

should also collect and analyze data in 

order to guide FDIC decision-making, 

Figure 7: Sources of Threat Information for Financial Institutions

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 224
identify trends and patterns, and proactively 

address threats and vulnerabilities. 

Facilitating Threat Information 

Sharing Among Financial Sector 

Participants 

As shown in Figure 8, the FDIC is a 

member of the financial services sector, 

which is one of 16 critical infrastructure 

sectors with “physical and cyber systems 

and assets that are so vital to the United 

States that their incapacity or destruction 

would have a debilitating impact on our 

physical or economic security or public 

health or safety.”68 

In our OIG report, Sharing of Threat 

Information to Guide the Supervision of 

Financial Institutions (January 2022), we 

assessed whether the FDIC established 

effective processes to acquire, analyze, 

disseminate, and use relevant and 

actionable threat information to guide the 

supervision of financial institutions. We 

found that the FDIC did not establish 

effective processes to acquire, analyze, 

disseminate, and use relevant and 

actionable threat information to guide the 

supervision of financial institutions. We 

identified gaps in the FDIC’s Threat Sharing 

Framework. Specifically: 

• The FDIC did not establish a written 

governance structure to guide its 

threat information sharing activities; 

• The FDIC had not completed or 

implemented a governance Charter 

that established a common 

understanding of the role for the 

Intelligence Support Program or 

defined an overall strategy and 

requirements for it; 

• The FDIC had not developed goals, 

objectives, or measures to guide the 

performance of its Intelligence 

Support Program; 

• The FDIC did not establish adequate 

policies and procedures that defined 

roles and responsibilities for key 

stakeholders involved in the 

threat information sharing 

program and activities; and 

• The FDIC did not fully 

consider the risks 

discussed in our report for 

its Enterprise Risk 

Inventory and Risk Profile. 

We also identified gaps in 

the FDIC’s processes for 

acquiring, analyzing, and 

disseminating threat 

information, and in its 

processes for obtaining 

feedback from stakeholders 

regarding how the use of threat 

information can be improved. 

We made 25 recommendations to the FDIC 

to close these gaps and to ensure effective 

sharing of threat information to guide the 

FDIC’s supervision of financial institutions. 

As of this Top Challenges Report, 20 

recommendations remain unimplemented. 

Two of the recommendations are 

Unresolved, which means that the FDIC has 

not provided an acceptable solution to 

resolve the recommendations. These 

recommendations include establishing and 

implementing a means to share classified 

information with Regional Offices, and ways 

Figure 8: 16 Critical Infrastructure Sectors in the U.S.

Source: DHS Critical Infrastructure Threat Sharing Framework, A Reference 

Guide for the Critical Infrastructure Community (October 2016).

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 225
for Regional Offices to handle classified 

information once received. 

In addition to ensuring the FDIC’s receipt of 

relevant and actionable threat information, 

the FDIC should have assurances that 

banks obtain such threat information. We 

have work ongoing to determine whether 

the FDIC has implemented effective 

processes to ensure that FDIC-supervised 

and insured institutions receive actionable 

and relevant threat and vulnerability 

information. 

Ensuring Adequate Data Collection 

and Analysis 

The Government’s Federal Data Strategy

(FDS) promotes harnessing existing data; 

anticipating future uses of existing and 

potentially available data; and 

demonstrating responsiveness by improving 

data collection, analysis, and dissemination 

by seeking input from users and 

stakeholders. The FDS also highlights the 

critical importance of sharing data among 

Government agencies to inform decisionmaking and allow for thorough analyses. 

The FDIC should have reliable data for 

decision-making at all levels of the Agency 

and to enable the FDIC Board to exercise 

its governance responsibilities. Further, the 

FDIC should have capabilities to analyze 

data to identify important trends. Incorrect, 

incomplete, and otherwise faulty data can 

lead to ineffective decision-making 

especially when data is the basis for policy 

determinations. Therefore, it is critical that 

the FDIC support and maintain data 

integrity. 

In our recent OIG audits, evaluations, and 

reviews, we have found several examples of 

significant shortcomings in FDIC data, 

including: 

• Inadequate Use and Analysis of 

FDIC Data. In our OIG review, 

Implementation of the FDIC’s 

Information Technology Risk 

Examination (InTREx) Program

(January 2023), we found that the 

FDIC is not fully utilizing available 

tools and data to improve the 

effectiveness of the FDIC’s IT 

examination program and to identify 

emerging risks at financial 

institutions. In 2017, the FDIC 

developed a tool to conduct analysis 

of unstructured data from IT 

examinations to improve IT 

examinations. However, the FDIC 

had not used the tool’s analytics 

measures in the past 4 years (since 

2018). In our OIG review, Sharing 

of Threat Information to Guide the 

Supervision of Financial Institutions

(January 2022), we found that the 

FDIC was not performing trend 

analysis of data collected by FDIC 

examiners, such as those available 

in electronic documents and other 

supervisory records, nor had the 

FDIC established procedures to 

guide its data analysis. In our OIG 

report, The FDIC’s Management of 

Employee Talent (September 2021), 

we found that the FDIC did not have 

a process for collecting and 

analyzing the various types of data 

that can be used to assess 

employee retention across the 

Agency as part of its talent 

management strategy. Specifically, 

the FDIC did not have a systematic 

process to holistically capture and 

analyze data, and to ensure that the 

information flowed to the FDIC 

Divisions and Offices. 

• Unreliable Data and Incorrect 

Reporting. In four OIG reports, we 

found that FDIC data was unreliable, 

and in one report, unreliable data led 

to inaccurate reports to the FDIC 

Board of Directors. 

o In our OIG evaluation, 

Termination of Bank Secrecy 

Act/Anti-Money Laundering 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 226
Consent Orders (December 

2021), we found that the FDIC 

did not consistently track 

Consent Order termination data 

in its system of record. As a 

result, the FDIC provided nine 

incorrect reports to the FDIC 

Board of Directors concerning 

enforcement actions; and did not 

report three BSA/AML Consent 

Order terminations in a quarterly 

report to FinCEN. 

o In our OIG evaluation, The 

FDIC’s Personnel Security and 

Suitability Program (January 

2021), we found that contractor 

position risk levels recorded in 

FDIC systems were unreliable. 

As a result, the FDIC could not 

determine whether these 

contractors received background 

investigations commensurate 

with their positions. We also 

found that FDIC systems were 

missing data for employee and 

contractor preliminary 

background investigation 

completion dates. 

o In our OIG audit, FDIC’s 

Compliance under the Digital 

Accountability and Transparency 

Act of 2014 (November 2021), 

we found that the FDIC’s 

submission of financial and 

award data excluded information 

for the Federal Savings and 

Loan Insurance Corporation 

Resolution Fund and the 

Resolution Trust Corporation. 

o In our OIG evaluation, Reliability 

of Data in the FDIC Virtual 

Supervisory Information on the 

Net System (November 2021), 

we found that two of the four key

data elements we tested in the 

FDIC’s ViSION system, were not 

reliable. Errors in either date 

increase the risk of inaccurate 

reporting of examination 

performance metrics to FDIC 

management.

The FDIC has addressed the 

recommendations in these reports.

A key element to ensuring financial stability 

is the flow of timely and actionable threat 

information from across the Federal 

Government. Banks’ receipt of threat 

information allows them to take mitigating 

action. Threat information also assists the 

FDIC in conducting bank examinations, 

implementing supervisory approaches, and 

making policy determinations. In addition, 

analysis of reliable and accurate FDIC 

program data facilitates measurement and 

assessment of FDIC programs by the FDIC 

Board and senior management.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 227
Strengthening FDIC Contracting and 

Supply Chain Management Key Areas of Concern 

The primary areas of concern for this 

Challenge are: 

• Addressing continued weaknesses

in FDIC contracting systems and 

processes; 

• Managing the FDIC’s supply chain; 

and 

• Ensuring whistleblower rights and 

protections for contractor personnel.

The OIG has identified Contracting and 

Supply Chain Management as a Top 

Challenge for the FDIC since 2018.

The FDIC awards nearly $600 million in 

contracts every year. Over a 5-year period, 

the FDIC awarded more than 2,600 

contracts valued at $2.85 billion. The FDIC 

procures goods and services, including for 

the continuity of its operations, IT systems 

support, legal services, and resolution and 

receivership activities. For its IT needs 

alone, the FDIC contracts for about $400 

million per year, and the Agency has more 

than 3,700 contract employees. The FDIC 

should have an effective internal control 

environment and culture to ensure that its 

procurements are timely, cost-effective, and 

within the terms of the awards. 

Goods and services should also be 

rendered to the FDIC through secure supply 

chains. The Federal Government has 

acknowledged the need for secure supply 

chains in order to maintain its economic 

strength and national security.69 On 

November 16, 2022, CISA issued an alert 

that a Federal Executive Branch Agency’s 

network was compromised through a 

software vulnerability.70 In this instance, the 

threat actors exploited unpatched 

vulnerabilities in a server, were able to 

move laterally throughout the network, 

compromised credentials, and implanted 

mining and other software.

The FDIC also should ensure that its 

contract employees are able to report fraud, 

waste, abuse, and mismanagement at the 

Agency without fear of retaliation or reprisal, 

and that they are aware of their 

whistleblower rights and protections.

Addressing Continued Weaknesses 

in FDIC Contracting Systems and 

Processes 

FDIC contracting efforts require significant 

improvement. The former FDIC Chairman 

recognized the urgent need for 

improvements in the area of contract 

oversight management. In June 2021, the 

former FDIC Chairman acknowledged that 

“[i]n the last 10 years, the [FDIC CIOO] has 

been the subject of 303 recommendations 

from the [OIG] or the GAO. Roughly 61 of 

these recommendations, or 20 percent, 

related to program management or 

acquisition issues. About 62 reflected 

inadequate policies, procedures or program 

documentation.”71 Further, the former FDIC 

Chairman stated that “[t]he FDIC acquisition 

process has also been routinely criticized 

during this period with [an] additional 55 

contracting recommendations. ...[t]hey point 

to systemic cultural shortfalls that must be 

remedied.” 

In March 2021, the FDIC began moving its 

entire acquisition processes to a new 

procurement system known as the FDIC 

Acquisition Management System (FAMS). 

In June 2022, FAMS was deployed to all 

users. However, in September 2022, just 

16 months later, the Agency decided to 

revert back to its earlier system known as 

the Automated Procurement System (APS)

and reassess the use of FAMS. The FDIC 

installed FAMS at a cost of $7.6 million and 

more than 8,300 staff hours. In order for the 

FDIC to transition from FAMS back to APS, 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 228
Agency personnel needed to manually enter 

contracts into the old APS. We have work 

planned to assess the FAMS procurement.

Also, in our OIG evaluation, Contract 

Oversight Management (October 2019), we 

determined that the APS had limited data 

and reporting capabilities for Agency-wide 

oversight of its contract portfolio. We found 

that the FDIC was overseeing acquisitions 

on a contract-by-contract basis, rather than 

on a portfolio basis. Therefore, the FDIC 

did not have an effective contracting 

management information system to readily 

gather, analyze, and report portfolio-wide 

contract information across the Agency. As 

a result, FDIC Board Members and other 

senior management officials were not 

provided with a portfolio-wide view or the 

ability to analyze historical contracting 

trends across the portfolio, identify 

anomalies, and perform ad hoc analyses to 

identify risks or plan for future acquisitions. 

We recommended that the FDIC provide 

enhanced contract portfolio reports to FDIC 

Executives, senior management, and the 

Board of Directors. This recommendation 

remains unimplemented since the issuance 

of the report more than 3 years ago. 

For the past 2 years, the GAO has also 

identified significant deficiencies in the 

FDIC’s internal controls over financial 

reporting related to FDIC contracting. In 

2020, the GAO identified deficiencies in the 

FDIC’s controls over contract payment 

review processes and stated that “the FDIC 

cannot reasonably assure internal controls 

over contract payments are operating 

effectively, which increases the risks of 

improper payments and financial statement

misstatements.”72 In 2021, the GAO 

identified significant deficiencies in the 

FDIC’s controls over contract payment 

review and documentation processes. The 

GAO noted that the deficiencies may have 

resulted in a “misstatement in unaudited 

financial information FDIC reported 

internally and externally.”73 

Further, in our OIG evaluation, Critical 

Functions in FDIC Contracts (March 2021), 

we found that the FDIC did not have policies 

and procedures to identify Critical Functions 

at the Agency, nor did it implement any 

heightened monitoring of these Critical 

Functions.74 Therefore, the FDIC could not 

be assured that it would provide sufficient 

management oversight of contractors 

performing Critical Functions or supervision 

to ensure that the Agency did not lose 

control of its mission or operations. We 

made 13 recommendations to strengthen 

the FDIC’s identification and monitoring of 

contracts involving Critical Functions, and 

as of the date of this Top Challenges 

Report, 12 recommendations remain 

unimplemented. We have additional work 

ongoing to assess other FDIC contracts.

Managing the FDIC’s Supply Chain 

According to NIST, organizations face risks 

that the products and services they acquire 

“may contain potentially malicious 

functionality, are counterfeit, or are 

vulnerable to poor manufacturing and 

development practices within the supply 

chain.”75 An agency may have reduced 

visibility, understanding, and control of 

these risks when its vendors rely on 

second- and third-tier suppliers and service 

providers. The GAO noted that Federal 

agencies face supply chain risks, “including 

threats posed by malicious actors who may 

exploit vulnerabilities in the supply chain, 

and, thus compromise the confidentiality, 

integrity, or availability of an organization’s 

systems and the information they contain.”76 

Because the FDIC is a financial regulator 

and holds vast amounts of sensitive and 

nonpublic information, adversaries may 

seek to disrupt the Agency’s operations, 

programs, and functions and may 

manipulate or exploit the sensitive 

information for their own purpose or benefit. 

As noted by NIST, “adversaries are using 

the supply chain as an attack vector and [as 

an] effective means of penetrating [United 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 229
States’ public and private] systems, 

compromising the integrity of system 

elements, and gaining access to critical 

assets.”77

In our OIG report, The FDIC’s 

Implementation of Supply Chain Risk 

Management (March 2022), we examined 

whether the FDIC developed and 

implemented its SCRM Program in 

alignment with the Agency’s objectives and 

best practices. We found that the FDIC was 

not conducting supply chain risk 

assessments in accordance with best 

practices. Specifically: 

• The FDIC had not identified known 

risks to the FDIC’s supply chain; 

• The FDIC did not define a risk 

management framework to evaluate 

risks to non-IT procurements; and 

• The FDIC had not established 

metrics and indicators related to 

continuous monitoring and 

evaluation of supply chain risks.

Absent SCRM implementation and risk 

assessments, supply chain risks could 

compromise FDIC IT and data and provide 

adversaries a means to exfiltrate sensitive 

information such as confidential bank 

examination information. Further, the 

FDIC’s supply chain could compromise the 

products, services, and facilities that enable 

the FDIC to perform its mission. 

We made nine recommendations to the 

FDIC to improve its SCRM program and 

ensure contract document retention. As of 

the date of this Top Challenges Report, six 

recommendations remain unimplemented, 

nearly a year after issuance of our report. 

In our OIG report, the FDIC’s Information 

Security Program—2022 (September 2022), 

we similarly found that the FDIC had not yet 

developed its policies and procedures to 

address SCRM. 

Ensuring Whistleblower Rights and 

Protections for Contractor 

Personnel 

In our OIG report, Whistleblower Rights and 

Protections for FDIC Contractors (January 

2022), we found that the FDIC had not 

aligned its procedures and processes with 

laws, regulations, and policies designed to 

ensure notice to contractor and 

subcontractor employees about their 

whistleblower rights and protections. The 

FDIC also did not always comply with the 

requirements to notify contractors of their 

whistleblower rights and protections. 

The FDIC’s Legal Division did not adopt any 

whistleblower rights notification provisions 

for contractors or include any whistleblower 

clauses in its contracts. The FDIC also did 

not verify that contractors and 

subcontractors notified employees of their 

whistleblower rights and protections. We 

made nine recommendations to improve the 

FDIC’s compliance with legal requirements 

for whistleblower contractor clauses. As of 

this Top Challenges Report, four 

recommendations remain unimplemented, 

more than a year after issuance of our 

report. 

Contract and supply chain management are 

critical to the FDIC’s mission. Absent an 

accountable organizational culture and 

effective internal controls, the FDIC may not 

have insight into the reliability and integrity 

of the supply chain for its procured goods

and services. Further, absent whistleblower 

protections, contractors may not report 

waste, fraud, and abuse in FDIC contracts.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 230
Implementing Effective Governance at the FDIC 

Key Areas of Concern 

The primary areas of concern for this 

Challenge are:

• Capturing the FDIC’s enterprise 

risks; 

• Addressing repeat and 

unimplemented recommendations in 

a timely manner;

• Using outcome measures of 

performance;

• Explaining whether the FDIC will 

follow Executive Branch guidance; 

and

• Ensuring the validity and efficacy of 

FDIC rulemaking.

The OIG has identified Governance as a 

Top Challenge at the FDIC since 2018. 

The FDIC Board of Directors (FDIC Board) 

and senior officials are responsible for the 

governance of the FDIC.78 Governance 

refers to a management framework that 

incorporates operational, financial, risk 

management, and reporting processes, so 

that FDIC Board members and senior 

officials can effectively plan, govern, and 

meet strategic objectives.79 A governance 

framework should ensure strategic 

guidance, effective monitoring of 

management, and accountability to 

stakeholders.80 Effective governance is 

critical to ensure that the FDIC assesses 

and addresses risks—especially those 

identified in this Report. Governance also 

should ensure consistent implementation of 

FDIC policies and effective rulemaking. 

Capturing the FDIC’s Enterprise 

Risks

An important role for the FDIC Board is 

oversight of the Agency’s ERM program.

81 

ERM is an essential component of 

governance that provides an entity-wide 

view of the full spectrum of internal and 

external risks facing an organization. 

Effective ERM provides information to FDIC 

Board members and senior officials, so that 

they can allocate resources appropriately, 

effectively prioritize and proactively manage 

risk, improve the flow of risk information, 

and work towards achieving the FDIC’s 

mission. Further, the FDIC should use its 

ERM process whenever it makes significant 

decisions or organizational changes 

affecting the enterprise. Absent robust 

identification, assessment, and mitigation of

these risks, and the use of ERM in FDIC 

decision-making, the FDIC may be hindered 

in its ability to achieve its mission. 

In our OIG evaluation, The FDIC’s 

Implementation of Enterprise Risk 

Management (July 2020), we determined 

that ERM was not fully implemented at the 

FDIC, and, therefore, proper execution of 

program activities, roles, and responsibilities 

had yet to take place. In recent OIG reports 

issued since that time, we continue to find 

that the FDIC has not considered or 

captured important internal and external 

risks into its ERM processes. For example: 

Contracting. In our OIG report 

Critical Functions in FDIC Contracts

(March 2021), we found that the 

FDIC’s Risk Inventory did not 

recognize procured Critical 

Functions as a separate and distinct 

risk, or as an analytical factor in 

determining inherent or residual risk 

associated with cybersecurity and 

privacy support services. As a 

result, the FDIC relied heavily on a 

contractor to mitigate controls for 

potential FDIC cyber-attacks and/or 

data breach losses. 

Climate-related Financial Risk. In 

our Top Challenges Report for 2021, 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 231
we noted that the FDIC’s ERM 

program had not fully considered the 

financial risks associated with

climate change as identified in the 

FSOC Climate Report. Absent 

identification of climate-related risk 

within the ERM program, the FDIC 

budget, staff, and efforts did not 

focus on identifying and addressing 

related risks. In November 2022, 

the FDIC added climate-related risks 

to its ERM program.

Operations in a Continuing Hybrid 

Work Environment. The FDIC has 

not identified risks for its hybrid work 

model. Beginning in September 

2022, 80 percent of FDIC staff chose 

a home-based work option, meaning 

their home has become their primary 

place of work. The FDIC has not 

assessed how its new hybrid 

environment may impact the FDIC’s 

crisis readiness. 

Sharing of Threat Information. In 

our OIG report, Sharing of Threat 

Information to Guide the Supervision 

of Financial Institutions (January 

2022), we found that the FDIC did 

not establish effective processes to 

acquire, analyze, disseminate, and 

use relevant and actionable threat 

information to guide the supervision 

of financial institutions. The FDIC 

had not included threat sharing as 

an ERM risk.

Addressing Repeat and 

Unimplemented 

Recommendations in a Timely 

Manner

The FDIC Board and senior officials should 

ensure that program weaknesses are 

promptly resolved and remediated in a 

timely manner. If recommendations are not 

addressed expeditiously, the FDIC faces an 

increased likelihood that the underlying 

vulnerabilities or deficiencies will continue or 

recur until remediated by the FDIC. 

Therefore, the FDIC should prioritize the 

corrective actions intended to address the 

recommended improvements, in line with 

the timing and representations made by the 

Agency at the time of our reports, and it 

should allocate sufficient resources to 

implement such corrective actions.

The OIG has made repeated 

recommendations for several programs and 

processes at the FDIC, including:

• Cybersecurity Vulnerabilities. In 

each of our past five annual OIG 

reviews of FDIC Information Security 

(2018 through 2022), we reported 

weaknesses related to the FDIC’s 

management of Administrative 

Accounts. Weaknesses in the 

FDIC’s processes for managing 

Administrative Accounts increase 

the risk of unauthorized activity, 

such as individuals accessing, 

modifying, deleting, or exfiltrating 

sensitive information. We also found 

that the FDIC has not taken timely 

action or has not addressed 

POA&Ms, which is a management 

tool used by the Agency to track the 

progress of corrective actions 

pertaining to security vulnerabilities 

identified through security control 

assessments and other sources. 

Without consistently addressing 

control deficiencies in a timely 

manner, FDIC data is vulnerable to 

security exploits from unmitigated 

threats.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 232
• Weaknesses in the FDIC’s 

Personnel Security and Suitability 

Program. In our OIG evaluation, 

The FDIC’s Personnel Security and 

Suitability Program (PSSP) (January 

2021), we found several deficiencies 

that were similar to those identified 

in previous reports—including our 

OIG evaluation of the FDIC’s PSSP 

conducted 6 years earlier in 2014. 

Specifically, a number of issues had 

not been corrected, including: 

Completing preliminary background 

investigations within allowed 

timeframes; Keeping records of 

background investigation 

documentation; Ensuring that 

background investigation levels 

match an individual’s position risk; 

and Ensuring the reliability of 

background investigation data in 

FDIC systems. Similarly, in our OIG 

Management Advisory 

Memorandum, Background 

Investigations for Privileged Account 

Holders (June 6, 2022), we identified 

that the FDIC did not have adequate 

controls to ensure that certain 

contractors and employees who 

require privileged access to FDIC 

information systems and data had 

background investigations 

commensurate with their positions. 

As a result, the FDIC could not be 

sure that certain employees and 

contractors who were granted 

privileged access to the FDIC’s 

information systems and related 

data subsequent to their onboarding 

would have an appropriate risk 

designation level and related 

background investigations. 

Further, for 73 percent of the outstanding 

OIG report recommendations (53 of 73 

recommendations), the FDIC amended its 

initial corrective action completion dates 

several times. At the time of the issuance of 

an OIG report, the FDIC sets the timeframe 

to implement changes to address OIG 

recommendations. In general, it takes the 

FDIC an average of 8 months to take 

corrective action. However, when the FDIC 

extends its implementation timeframe, the 

weaknesses that we identified continue to 

persist. As shown in Figure 9, the FDIC 

amended its implementation dates by 

moving them from 3 to more than 12 

months beyond the FDIC’s initial 

implementation dates. 

Using Outcome Measures of 

Performance

The GPRA Modernization Act of 2010

requires that agencies measure program 

performance. Further, according to the 

GAO, “[p]erformance measures may 

address the direct products and services 

delivered by a program (outputs), or the 

results of those products and services 

(outcomes).” The GAO noted that 

“agencies should make every attempt to 

identify and use outcome goals whenever 

possible to reflect the results of their 

activities.”82 The key to outcome-oriented 

performance measures is that they allow an 

agency to assess whether it is meeting a 

program’s strategic objectives.

We found instances where the FDIC either 

did not have program performance 

measures in place, or used output rather 

than outcome measures to assess program 

3

21

13

15

1

0

5

10

15

20

25

0-3 months 3-6 Months 6-9 Months 9-12 Months Over 12

Months

Figure 9: FDIC Extension of Corrective Action Dates

Source: OIG analysis of corrective action dates and extensions.

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 233
performance. As a result, the FDIC cannot 

assess whether its programs are achieving 

the desired outcomes. For example, in our 

report Implementation of the FDIC’s 

Information Technology Risk Examination 

(InTREx) Program (January 2023), we 

found that the FDIC established goals 

focused on improving the FDIC’s 

supervision program, but did not have a way 

to measure the outcome of this goal. 

Without establishing metrics for the FDIC’s 

IT examinations, the FDIC is unable to 

determine whether its IT examination 

activities under the InTREx Program are 

achieving their desired outcomes or results. 

The GAO’s report, Banking Services: 

Regulators Have Taken Actions to Increase 

Access, but Measurement of Actions’ 

Effectiveness Could be Improved (February 

2022), found that the FDIC lacked outcomeoriented measures to assess FDIC efforts to 

increase banking access for unbanked and 

underbanked individuals. For example, the 

GAO stated, the “FDIC piloted a public 

awareness campaign on the benefits of 

bank accounts. Yet, its measures indicate 

only whether a task was completed and do 

not incorporate information on the outcomes 

(which could be used to assess the 

activities).” 

Also, in our OIG Memorandum, The FDIC’s 

Management of Employee Talent

(September 2021), we found that the FDIC 

had not established metrics or indicators to 

measure the effectiveness of its retention 

activities or actions for examination staff. 

Instead, the FDIC tracked its “inputs” – that 

is, the implementation status of the activities 

or actions designed to meet its employee 

retention goals. The FDIC did not measure 

whether its activities were achieving their 

desired outcomes or results. Thus, the 

FDIC could not determine whether its 

retention activities were working effectively 

nor how to make improvements to its 

processes.

Explaining Whether the FDIC Will 

Follow Executive Branch Guidance

The Executive Branch regularly issues 

guidance for Federal agencies, in the form 

of Executive Orders, Presidential Directives, 

Office of Management and Budget (OMB) 

Circulars and Memoranda, and NIST 

guidance. Such guidance often addresses 

risks in operational areas, such as 

information technology, security, privacy, 

contracting, and risk management. The 

policies and guidance provide best practices 

that Executive Branch agencies should 

implement to mitigate operational risks. 

The FDIC makes policy decisions to 

sometimes follow such requirements, and 

other times not. It is not clear under what 

circumstances and which specific portions 

or provisions of the policies or guidance are 

to be followed. Ambiguity in the FDIC’s 

determinations and lack of clarity may result 

in inconsistencies with other agencies 

(including other bank regulators) and may 

cause uncertainty and confusion among 

FDIC employees in the application of such 

policies and guidance. For example, in our 

OIG report, Whistleblower Rights and 

Protections for FDIC Contractors (January 

2022), we found that the FDIC’s DOA 

Acquisition Services Branch voluntarily 

adopted some of the Federal whistleblower 

provisions and requirements for insertion 

into its contracts. However, the FDIC’s 

Legal Division, under its separately 

delegated contracting authority, did not 

operate consistently with the FDIC’s DOA. 

The FDIC Legal Division had neither 

adopted any whistleblower rights notification 

provisions for contractors nor included any 

whistleblower clauses in its contracts. We 

also found that FDIC procedures and 

processes were not aligned with laws, 

regulations, and policies designed to ensure 

notice to contractor and subcontractor 

employees about their whistleblower rights 

and protections. 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 234
Further, in our recent OIG reports, we found 

that when the FDIC did not implement 

Executive Branch guidance regarding 

administration, management, and 

governance, its programs incurred risks that 

these policies were intended and designed 

to address or mitigate: 

• Contracting: The OMB issued 

Policy Letter 11-01 to provide 

Federal agencies with guidance on 

managing contracts for the 

performance of Critical Functions.83 

The FDIC’s Legal Division 

concluded that the Policy Letter did 

not apply to the FDIC, but it may be 

used for guidance. In our OIG 

evaluation, Critical Functions in 

FDIC Contracts (March 2021), we 

found that the FDIC did not have 

policies and procedures for 

identifying Critical Functions in its 

contracts, as recommended by the 

OMB Policy Letter. Without these 

practices, the FDIC could not be 

assured that it will provide sufficient 

management oversight of 

contractors performing Critical 

Functions.

• Enterprise Risk Management: In 

2016, in an effort to modernize 

existing agency risk management 

efforts across the Federal 

Government, the OMB updated its 

Circular A-123.84 The FDIC took the 

position that it was not required to 

follow OMB Circular A-123. As 

noted earlier, in our OIG evaluation, 

The FDIC’s Implementation of 

Enterprise Risk Management (July 

2020), we found that the FDIC did 

not fully implement its ERM program 

in accordance with OMB criteria. 

Specifically, the FDIC did not 

establish a clear governance 

structure, and clearly define 

authorities, roles, and 

responsibilities related to ERM. 

Further, the FDIC did not clearly 

define the roles, responsibilities, and 

processes of the committees and 

groups involved in ERM.

• Rulemaking Cost Benefit 

Analysis: In our report, Cost 

Benefit Analysis Process for 

Rulemaking (February 2020), we 

found that the FDIC did not follow 

identified best practices from 

Executive Orders, the GAO, and 

other Federal agencies to establish 

and document a process for 

determining when to perform cost 

benefit analyses and how the 

analyses should be conducted. We 

made five recommendations to 

improve the FDIC’s cost benefit 

analyses. The FDIC has 

implemented all five 

recommendations.

The FDIC should clearly articulate and 

explain its determinations regarding whether 

or not to follow Executive Branch policies 

and guidance, and it should be transparent 

under what circumstances and which 

specific portions or provisions of the policies 

or guidance are to be followed. Consistent 

analysis and application, and 

documentation of these decisions would 

enhance public confidence and 

transparency of FDIC operations, programs, 

and functions. 

Ensuring the Validity and Efficacy 

of FDIC Rulemaking

On October 19, 2022, the U.S. Court of 

Appeals for the Fifth Circuit ruled that the 

funding of the Bureau of Consumer 

Financial Protection (CFPB) violated the 

appropriations clause of the Constitution 

and, as a result, the CFPB’s Payday 

Lending Rule was invalid.85 The CFPB 

receives it funding from the Federal 

Reserve, which is funded through bank 

assessments. The Court explained that this 

funding structure is not subject to the 

Congressional appropriations process and 

therefore violated the Appropriations 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 235
Clause. There is a risk that the Fifth 

Circuit’s ruling could also be applied to the 

FDIC. The FDIC is funded outside of the

Congressional appropriations process 

through bank assessments (similar to the

Federal Reserve). 

Also, FDIC rulemaking should be a 

transparent process that analyzes the need 

for bank regulation and the compliance 

burden placed on banks. A foundational 

component of transparent rulemaking is the 

FDIC’s access to reliable information to 

measure a regulation’s costs and benefits. 

1 Board of Governors of the Federal Reserve, Financial 

Stability Report (May 2022). 2 FSOC, Report on Digital Asset Financial Stability Risks and 

Regulation (2022); FSOC, Report on Climate-Related 

Financial Risk (2021); FSOC Annual Report 2022. 3 European Central Bank Working Paper Series, A Wake-up 

Call Theory of Contagion (May 2022). 4 OECD, Financial Markets and Climate Transition, 

Opportunities, Challenges and Policy Implications (April 10, 

2021). 

5 Rainforest Action Network, Banking on Climate Chaos, 

Fossil Fuel Finance Report 2022 (March 30, 2022). 6 Journal of Finance, Did FinTech Lender Facilitate PPP 

Fraud? (August 18 2021, revised August 17, 2022). 7 According to the Government Accountability Office, 

“[t]he Dodd-Frank Act does not use the term ‘systemically 

important financial institution (SIFI).’ This term is 

commonly used by academics and other experts to refer to 

bank holding companies with $50 billion or more in total 

consolidated assets and nonbank financial companies 

designated by the Financial Stability Oversight Council.” 

GAO, Bank Regulation: Lessons Learned and a Framework 

for Monitoring Emerging Risks and Regulatory Response

(June 2015).

8 12 USC § 5326. Bear Sterns and AIG received loans 

through the Federal Reserve Bank of New York, but 

Lehman Brothers did not receive loans.

9 Notice and request for comment, Federal Register, 

Resolution of Systemically Important Financial Institutions: 

The Single Point of Entry Strategy 78 Fed. Reg. 76,614 

(December 18, 2013); Notice extension of comment 

period, Federal Register, Resolution of a Systemically 

Important Financial Institution: The Single Point of Entry 

Strategy 79 Fed. Reg. 9,899 (February 21, 2014). 10 In 2013, the OIG reviewed FDIC OLA planning efforts. In 

our report, The FDIC’s Progress in Implementing Systemic 

Resolution Authorities (November 2013), we found that 

more work needed to be done by the FDIC to establish an 

FDIC-wide capability to implement systemic resolutions 

Effective governance is critical to ensure 

proper oversight of the FDIC and the 

accomplishment of its mission. The FDIC 

Board and management should ensure that 

the FDIC is identifying and managing risks 

through an effective ERM program and 

promptly addressing recommendations 

made by the OIG and GAO to address 

identified risks. The FDIC should measure 

program effectiveness by establishing 

outcome measurements and also address

whether the FDIC will follow Executive 

Branch guidance. The FDIC should ensure 

the validity of its rulemaking and ensure that 

rules are premised on solid cost benefit 

analyses. 

under the Dodd-Frank Act. As a result, we made six 

recommendations aimed at enhancing the FDIC’s longterm strategic planning efforts, strengthening coordination 

among FDIC Divisions, and building out the Office of 

Complex Financial Institution’s infrastructure to support 

systemic resolution activities. The FDIC provided a plan for 

future actions to implement these recommendations. The 

OIG closed the recommendations based on the FDIC’s 

plans for future actions and stated that the OIG would 

continue to monitor the FDIC progress. In 2017, the OIG 

revised its process and now reviews all corrective actions 

to determine whether the FDIC’s actions satisfy the 

recommendation before the recommendation is 

considered closed.

11 The Financial Stability Board (FSB) has designated the 

following U.S.-based companies as “global systemically 

important banks”: Bank of America, Bank of New York 

Mellon, Citigroup, Goldman Sachs, JP Morgan Chase, 

Morgan Stanley, State Street Corporation, and Wells 

Fargo. The FSB is an international body that monitors and 

makes recommendations about the global financial 

system. The FSB publishes annually a list of GSIBs using 

calendar year-end data and an assessment methodology 

designed by the Basel Committee on Banking Supervision 

(BCBS). The FSB, consulting with BCBS and national 

authorities, has identified GSIBs since 2011. 12 Foreign GSIBs that have systemically important 

operations in the United States include: Barclays, Credit 

Suisse, Deutsche Bank, HSBC, and UBS.

13 Financial Market Utilities are multilateral systems that 

provide infrastructure for transferring, clearing, and 

settling payments, securities, and other financial 

transactions among financial institutions or between 

financial institutions and the clearing/settlement system. 

FSOC was created by the Dodd-Frank Wall Street Reform 

and Consumer Protection Act (Dodd-Frank Act) and is 

responsible for identifying threats to the financial stability 

of the country, promoting market discipline, and 

responding to emerging risks to the stability of the 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 236
Nation’s financial system. FSOC consists of 10 voting 

members and 5 non-voting members. FSOC voting 

members include: The Secretary of the Treasury, 

Chairman of the Board of Governors of the Federal 

Reserve System, Comptroller of the Currency, Director of 

the Bureau of Consumer Financial Protection, Chairman of 

the Securities and Exchange Commission, Chairman of the 

Federal Deposit Insurance Corporation, Chairman of the 

Commodity Futures Trading Commission, Director of the 

Federal Housing Finance Agency, Chairman of the National 

Credit Union Administration, and an independent member 

having insurance expertise who is appointed by the 

President and confirmed by the Senate for a 6-year term. 

The non-voting members include the Director of the Office 

of Financial Research, the Director of the Federal 

Insurance Office, a state banking supervisor, state 

insurance commissioner, and state securities 

commissioner. 14 The Dodd-Frank Act created the Council of Inspectors 

General on Financial Oversight (CIGFO) to oversee the 

activities of the Financial Stability Oversight Council. 

CIGFO is chaired by the Inspector General of the 

Department of the Treasury and its membership includes 

the Inspectors General of the Board of Governors of the 

Federal Reserve System, Commodity Futures Trading 

Commission, Department of Housing and Urban 

Development, Federal Deposit Insurance Corporation, 

Federal Housing Finance Agency, National Credit Union 

Administration, Securities and Exchange Commission, and 

Special Inspector General for the Troubled Asset Relief 

Program.

15 Statement of Martin J. Gruenberg, Acting Chairman, 

FDIC, before the United States Senate, Committee on 

Banking, Housing, and Urban Affairs, Oversight of Financial 

Regulators: A Strong Banking System for Main Street

(November 15, 2022).

16 OCC Bulletin 2021-34, Small Business Administration 

Lending: Risk Management Principles (August 5, 2021). 

Additional risks include: Operational risk: A financial 

institution that does not have staff with the requisite 

knowledge of Government-guaranteed loan program 

requirements may realize losses due to its inability to 

operate within the Government-guaranteed loan program 

requirements. Compliance risk: A financial institution 

that does not comply with the Government-guaranteed 

loan program requirements could face civil money 

penalties or restitution. Liquidity Risk: Financial 

institutions can sell Government-guaranteed loans in the 

secondary market at a premium, which increases liquidity. 

Reputation risk: A financial institution that haphazardly 

engages in Government-guaranteed loan programs can 

result in negative public opinion or costly litigation. 

Strategic risk: A financial institution that makes a strategic 

decision to only originate Government-guaranteed loans 

may realize reduced revenue, resulting in operating losses 

if a Federal agency suspends its ability to originate 

Government-guaranteed loans. 

17 Congress of the United States, House of 

Representatives, Select Committee on the Coronavirus 

Crisis, Staff Report, "We Are Not The Fraud Police”: How 

Fintechs Facilitated Fraud In The Paycheck Protection 

Program (December 2022). 18 Department of Commerce, International Trade 

Administration, Russia – Country Commercial Guide, 

Sanctions Framework (July 21, 2022). 19 FinCEN, FinCEN Advises Increased Vigilance for Potential 

Russian Sanctions Evasion Attempts (March 7, 2022). 20 Verizon data showed that the financial industry 

accounted for 690 data breaches (13 percent) of the 5,212 

data breaches reviewed in 2021. 21 VMWare, Modern Bank Heist 5.0 (April 2022). 22 Fitch Ratings, Exploratory Research: Quantifying U.S.

Bank Systemic Cybersecurity Risk (August 10, 2021). 23 American Banker, Small New York bank reports data 

breach (March 14, 2022). 24 Remarks by Acting Comptroller of the Currency Michael 

J. Hsu before the Joint Meeting of the Financial and 

Banking Information Infrastructure Committee and the

Financial Services Sector Coordinating Council (August 2,

2022). 

25 OCC Semiannual Risk Perspective Spring 2022. 26 VMWARE, Modern Bank Heist 5.0 (April 20, 2022). 

Island hopping refers to infiltrating a bank through its 

vendor relationships that are also known as its third 

parties.

27 VMWare, Modern Bank Heist 5.0 (April 2022). 28 See Proposed Interagency Guidance on Third-Party 

Relationships: Risk Management, 86 Fed. Reg. 38,182 

(September 17, 2021). 29 Final Rule, Computer-Security Incident Notification 

Requirements for Banking Organizations and Their Bank 

Service Providers, 86 Fed. Reg. 66,424 (November 23, 

2021). 

30 12 C.F.R. § 304.22(b)(7). 31 The 41 banks include banks supervised by the FDIC and 

other regulators.

32 ViSION is the FDIC’s Virtual Supervisory Information On 

the Net. 33 Cointelegraph, Total Crypto Market Cap Falls to $840 

billion, but Derivatives Data Show Traders are Neutral

(December 8, 2022). 34 The Washington Post, These Banks Were Left Holding 

the Bag in Crypto Implosion (November 23, 2022). 35 Wall Street Journal, Silvergate Raced to Cover $8.1 

Billion in Withdrawals During Crypto Meltdown (January 5, 

2023); Wolf Street, Crypto-Bank Silvergate Details its Own 

Implosion, Much of its Equity Capital Wiped Out, I’m 

waiting for the FDIC to Show Up (January 5, 2023). 36 American Banker, What the Indictments Against FTX’s 

Sam Bankman-Fried Means for Banks (December 28, 

2022); Forbes, Why Did FTX Buy Into a U.S. Bank Owned by 

a Co-Creator of ‘Inspector Gadget' (December 2, 2022). 37 Basel Committee on Banking Supervision, Discussion 

Paper: Designing a Prudential Treatment for Crypto-assets

(May 2021). 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 237
38 FinCEN, Advisory on Illicit Activity Involving Convertible 

Virtual Currency (May 9, 2019). 39 Federal Trade Commission, Reported Crypto Scam Losses 

Since 2021 Top $1 Billion, Says DTC Data Spotlight (June 3, 

2022). 

40 Reuters, Cryptocurrency and Anti-money laundering 

Enforcement (September 26, 2022). 41 The Department of Justice has noted the importance of 

training and retaining investigators and prosecutors to 

handle changing and complex digital asset-related matters 

such as money laundering. See Department of Justice, The 

Role of Law Enforcement In Detecting, Investigating, and 

Prosecuting Criminal Activity Related to Digital Assets

(September 2022).

42 Final Rule, False Advertising, Misrepresentation of 

Insured Status, and Misuse of the FDIC’s Name or Logo

(June 2, 2022).

43 FDIC Press Release, FDIC and Federal Reserve Issue 

Letter Demanding Voyager Digital Cease and Desist from 

Making False or Misleading Representations of Deposit 

Insurance Status (July 28, 2022). 44Forbes, Binance.US Is Not Buying Voyager’s Crypto Assets 

for $1.02 Billion. Here’s What Really Happening

(December 19, 2022). Bloomberg, Voyager Customers 

With Frozen Savings on “Edge of Seat” Ahead of Auction

(September 12, 2022); CNBC, Voyager Customer Lost $1 

Million Saved Over 24 Years And Is One Of the Many Now 

Desperate To Recoup Funds (August 15, 2022). 45 Joint Letter Regarding Potential Violations of Section 

18(a)(4) of the Federal Deposit Insurance Act (July 28, 

2022). 

46 Financial Institution Letter 35-2022, Advisory to FDICInsured Institutions Regarding Deposit Insurance and 

Dealings with Crypto Companies (July 29, 2022). 47 FDIC Press Release, FDIC Issues Cease and Desist Letters 

to Five Companies For Making Crypto-Related False or 

Misleading Representations about Deposit Insurance 

(August 19, 2022). 48 The World Bank, Financial Inclusion. 49 Federal Reserve Board FED Notes, Wealth Inequality 

and the Racial Wealth Gap (October 22, 2021). 50 The FDIC’s Economic Inclusion Strategic Plan is intended 

to promote the widespread use of affordable and 

sustainable products and services from insured depository 

institutions that help consumers meet their financial goals.

51 GAO, Banking Services: Regulators Have Taken Actions 

to Increase Access, but Measurement of Actions’ 

Effectiveness Could Be Improved (February 2022). 52 The Blueprint for an AI Bill of Rights is intended to 

support the development of policies and practices that 

protect civil rights and promote democratic values in the 

building, deployment, and governance of automated 

systems. However the Blueprint is non-binding and does 

not constitute U.S. Policy. 53 Federal Register, Request for Information and Comment 

on Financial Institutions’ Use of Artificial Intelligence, 

Including Machine Learning, 86 Fed. Reg.16,837 (March 

31, 2021).

54 CISA, Binding Operational Directive 22-01-Reducing the 

Significant Risk of Known Exploited Vulnerabilities

(November 3, 2021).

55 GAO, High Risk Area: Ensuring Cybersecurity of the 

Nation. 56 Executive Office of the President of the United States, 

Federal Information Security Modernization Act of 2014 

Annual Report to Congress Fiscal Year 2021. 57 CISA Alert (AA-22-320A) Iranian Government-Sponsored 

Actors Compromise Federal Network, Deploy Crypto Miner, 

Credential Harvest (November 16, 2022). 58 CISA, Binding Operational Directive 22-01-Reducing the 

Significant Risk of Known Exploited Vulnerabilities

(November 3, 2021).

59 12 C.F.R. Parts 309, 310. 60 GAO Snapshot, Cloud Computing: Federal Agencies Face 

Four Challenges (September 2022). 61 FDIC Directive 2120.1, Personnel Security and Suitability 

Program for Applicants and Employees (updated January 

15, 2020).

62 GAO, Privacy: Federal Financial Regulators Should Take 

Additional Actions to Enhance Their Protection of Personal 

Information (January 2022). 63 FedWeek, Federal workforce attrition rises back up to 

pre-pandemic levels (August 3, 2022). 64 GAO, Cybersecurity: Bank and Other Depository 

Regulators Need Better Data Analytics and Depository 

Institutions Want More Usable Threat Information (July 

2015), Figure 7 notes Federal sources of cyber threat 

information relevant to banks. Examples of Federal threat 

information include: The Financial and Banking 

Information Infrastructure Committee chartered under the 

President's Working Group on Financial Markets shares 

non-public cyber threat information pertaining to financial 

institutions. The Treasury Department and its component 

organizations: The Office of Cybersecurity and Critical 

Infrastructure Protection shares information about 

cybersecurity and physical threats and vulnerabilities; the 

Office of Intelligence and Analysis (OIA) has responsibility 

for the receipt, analysis, collation, and dissemination of 

foreign intelligence and foreign counterintelligence 

information related to the operation; FinCEN collects and 

analyzes financial transaction information

provided by financial institutions; OFAC publishes lists of 

individuals and companies owned or controlled by, or 

acting for or on behalf of, countries subject to sanctions. 

OFAC also lists individuals, groups, and entities, such as 

terrorists and narcotics traffickers. The Department of 

Homeland Security provides analysis, expertise, and 

technical assistance to critical infrastructure owners and 

operators, and conducts vulnerability assessments. The FBI 

also disseminates information regarding specific threats to 

entities, including insured financial institutions through 

various methods, including Private Industry Notifications 

and Liaison Alert System reports. 65 See FSOC 2022 Annual Report and the OCC Semiannual 

Risk Perspective (Spring 2022). 

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 238
66 NIST, Special Publication 800-150, Guide to Cyber Threat 

Information Sharing (October 2016). 67 GAO Issue Summary, Using Data and Evidence to 

Improve Federal Programs. Forbes, How The U.S. Federal 

Government Is Mobilizing To Enable Data-Driven Decision 

Making (June 1, 2022). 68 See CISA critical infrastructure definition. 69 Executive Order 13806, Assessing and Strengthening the 

Manufacturing and Defense Industrial Base and Supply 

Chain Resiliency of the United States ( July 21, 2017), 

emphasizes that resilient supply chains are essential to the 

economic strength and national security of the U.S.; 

Executive Order 14017, Executive Order on America’s 

Supply Chains (February 24, 2021), states that the U.S. 

needs resilient, diverse, and secure supply chains to 

ensure our economic prosperity and national security; and 

Executive Order 14028, Improving the Nation’s 

Cybersecurity (May 17, 2021), includes actions to enhance 

software supply chain security. 

70 CISA Alert (AA-22-320A) Iranian Government-Sponsored 

Actors Compromise Federal Network, Deploy Crypto Miner, 

Credential Harvest (November 16, 2022). 71 Minutes of the Meeting of the Board of Directors – 

Federal Deposit Insurance Corporation (June 2021). 72 GAO, Management Report: Improvements Needed in 

FDIC’s Internal Control over Contract-Payment Review 

Processes (May 13, 2021). 73 GAO, Management Report: Improvements Needed in 

FDIC’s Internal Control over Contract-Payment Review 

Processes (May 19, 2022). 74 OMB Policy Letter 11-01, Performance of Inherently 

Governmental and Critical Functions (February 13, 2012), 

defined a Critical Function as “a function that is necessary 

to the agency being able to effectively perform and 

maintain control of its mission and operations. Typically, 

critical functions are recurring and long-term in duration.” 75 NIST SP 800-161r1, Cybersecurity Supply Chain Risk 

Management Practices for Systems and Organizations

(May 2022).

76 GAO, Cybersecurity: Federal Agencies Need to 

Implement Recommendations to Manage Supply Chain 

Risks (May 25, 2021). 77 NIST Special Publication 800-37, Risk Management 

Framework for Information Systems and Organizations: A 

System LifeCycle Approach for Security and Privacy

(December 2018)

78 The FDIC Board has five members who are appointed by 

the President and confirmed by the Senate. Board 

members include: the FDIC Chairman, FDIC Vice Chairman, 

Comptroller of the Currency, Director of the Bureau of 

Consumer Financial Protection (CFPB), and an 

independent Director. The FDIC Board has designated the 

FDIC Operating Committee as the “focal point” for the 

coordination of risk management at the FDIC. 79 Deloitte, Developing an effective governance operating 

model – A guide for financial services boards and 

management teams. 80 Organization for Economic Co-operation and 

Development (OECD), G20/OECD Principles of Corporate 

Governance (2015). 81 ERM is a governance issue that falls within the oversight 

responsibility of boards of directors. See Harvard Law 

School Forum on Corporate Governance and Financial 

Regulation, Risk Management and the Board of Directors 

(March 20, 2018).

82 GAO, Banking Services: Regulators Have Taken Actions 

to Increase Access, but Measurement of Actions’ 

Effectiveness Could be Improved (February 2022). 83 OMB Office of Federal Procurement Policy, Policy Letter 

11–01, Performance of Inherently Governmental and 

Critical Functions (February, 13, 2012). 84 OMB Circular No. A-123, Management’s Responsibility 

for Enterprise Risk Management and Internal Control (July

15, 2016). 85 Community Financial Services of America v. Consumer 

Financial Protection Bureau (October 19, 2022).

APPENDICES FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 239
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 240 

AEI Alliances for Economic Inclusion 

AFS Available-For-Sale 

AHDP Affordable Housing Disposition Program

AML Anti-Money Laundering 

AML/CFT Anti-Money Laundering and Countering the Financing of Terrorism 

ANPR Advance Notice of Proposed Rulemaking

ASBA Association of Supervisors of Banks of the Americas 

BCBS Basel Committee on Banking Supervision 

BDC Backup Data Center

BIPOC Black, Indigenous, and People of Color

BoA Bank of America 

BOA Basic Ordering Agreement

BPM Business Process Modernization

Call Report Consolidated Reports of Condition and Income 

CAMELS Capital adequacy; Asset quality; Management capability; Earnings 

quality; Liquidity adequacy; Sensitivity to market risk

CARES Act Coronavirus Aid Relief and Economic Security Act

CBAC Advisory Committee on Community Banking

CCPs Central Counterparties 

CDFI Community Development Financial Institution 

CECL Current Expected Credit Losses 

CEO Chief Executive Officer 

CFO Act Chief Financial Officers’ Act 

CFPB Consumer Financial Protection Bureau 

CFR Center for Financial Research 

CFT Countering the Financing of Terrorism

CFTC Commodity Futures Trading Commission 

D. ACRONYMS 

(INCLUDES ACRONYMS IN THE FINANCIAL STATEMENTS)
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 241 

CIO Chief Information Officer 

CIOO Chief Information Officer Organization

CISR Division of Complex Institution Supervision and Resolution

CMG Crisis Management Group 

CMP Civil Money Penalty 

ComE-IN Advisory Committee on Economic Inclusion 

COVID-19 Coronavirus Disease 2019

CRA Community Reinvestment Act 

CRC Consumer Response Center

CRE Commercial Real Estate 

CSBS Conference of State Bank Supervisors

CSRS Civil Service Retirement System 

DCP Division of Depositor and Consumer Protection

DEIA Diversity, Equity, Inclusion, and Accessibility 

DIF Deposit Insurance Fund 

DIR Division of Insurance and Research 

DOA Division of Administration 

DRR Division of Resolutions and Receiverships 

EDIE Electronic Deposit Insurance Estimator

ERM Enterprise Risk Management 

EU European Union

FASB Financial Accounting Standards Board 

FBO Foreign Banking Organization 

FDI Act Federal Deposit Insurance Act 

FDIC Federal Deposit Insurance Corporation 

FEHB Federal Employees Health Benefits 

FERS Federal Employees Retirement System 

FFB Federal Financing Bank 

FFIEC Federal Financial Institutions Examination Council 

FFMIA Federal Financial Management Improvement Act 
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 242 

FID Financial Institution Diversity

FIL Financial Institution Letter

FinCEN Financial Crimes Enforcement Network

FinTech Financial Technology 

FIRREA Financial Institutions Reform, Recovery and Enforcement Act 

FISs Financial Institution Specialists 

FISMA Federal Information Security Modernization Act of 2014 

FMFIA Federal Managers’ Financial Integrity Act 

FOCUS Framework for Oversight of Compliance and CRA Activities User Suite

FRB Board of Governors of the Federal Reserve System 

FRF FSLIC Resolution Fund 

FSB Financial Stability Board 

FS-ISAC Financial Services Information Sharing and Analysis Center

FSLIC Federal Savings and Loan Insurance Corporation 

FSOC Financial Stability Oversight Council 

FTE Full-Time Equivalent 

GAAP Generally Accepted Accounting Principles 

GAO U.S. Government Accountability Office 

GPRA Government Performance and Results Act 

G-SIBs Global Systemically Important Banks 

G-SIFIs Global SIFIs 

IADI International Association of Deposit Insurers 

IDI Insured Depository Institution 

IMF International Monetary Fund 

IT Information Technology 

LCFI Large Complex Financial Institution

LIBOR London Inter-bank Offered Rate

LIDI Large Insured Depository Institution 

LMF Labor Management Forum

LMI Low- Moderate-Income
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 243 

LURAs Land Use Restriction Agreements

MDI Minority Depository Institutions 

MOL Maximum Obligation Limitation 

MOU Memoranda of Understanding 

MRBA Matters Requiring Board Attention 

MSSP Managed Security Services Provider

MWOB Minority- and Women-Owned Business 

MWOLF Minority-and Women-Owned Law Firms

NAMWOLF National Association of Minority-and Women-Owned Law Firms

NCDA National Center for Consumer and Depositor Assistance

NCUA National Credit Union Administration 

NPR Notice of Proposed Rulemaking 

NSFR Net Stable Funding Ratio

NTEU National Treasury Employee Union

OCC Office of the Comptroller of the Currency

OIG Office of the Inspector General 

OLF Orderly Liquidation Fund

OMB U.S. Office of Management and Budget 

OMWI Office of Minority and Women Inclusion 

OO Office of the Ombudsman 

OPM Office of Personnel Management 

ORMIC Office of Risk Management and Internal Controls

OTS Office of Thrift Supervision 

PPE Primary Purpose Exception

PPP Paycheck Protection Program

Q&A Question and Answer

QFC Qualified Financial Contract

REFCORP Resolution Funding Corporation 

ReSG FSB’s Resolution Steering Committee 

RFI Request For Information
APPENDICES

FEDERAL DEPOSIT INSURANCE CORPORATION ANNUAL REPORT 2022 244 

RMS Division of Risk Management Supervision 

RTC Resolution Trust Corporation

RTO Return to the Office 

SARC Supervision Appeals Review Committee 

SEC Securities and Exchange Commission 

SIFI Systemically Important Financial Institution 

SNC Shared National Credit

SPPS Security and Privacy Professional Services

SRAC Systemic Resolution Advisory Committee

SRR SIFI Risk Report 

SSGN Structured Sale of Guaranteed Note

TDR Troubled Debt Restructuring

TSP Federal Thrift Savings Plan 

UDAA Unclaimed Deposits Amendments Act of 1933

UFIRS Uniform Financial Institutions Rating System

UK United Kingdom

Treasury U.S. Treasury

WE Workplace Excellence