Source: https://www.ecfr.gov/cgi-bin/text-idx?mc=true&node=pt12.6.363&rgn=div5
Timestamp: 2020-08-06 14:06:44
Document Index: 756089539

Matched Legal Cases: ['art 363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', 'art 363', 'art 363', 'art 363', '§363', '§363', 'art 363', 'art 363', '§363', 'art 363', '§363', 'art 363', '§363', 'art 363', '§363', '§363', '§363', 'art 363', '§363', 'art 363', 'art 363', 'art 363', '§363', '§363', '§363', '§363', '§363', '§363', 'art 363', 'art 363', 'art 363', '§363', '§363', '§363', '§363', 'art 363', '§363', '§363', 'art 363', '§363', '§363', 'art 363', 'art 363', '§363', 'art 363', 'art 363', '§363', '§363', 'art 363', 'art 363', '§363', 'art 363', '§363', 'art 363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', 'art 363', '§363', 'art 363', '§363', 'art 363', 'art 363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', 'art 363', 'art 363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', '§363', 'art 363', '§363', '§363', '§363', '§363', '§363', 'art 363', '§363', 'art 363', 'art 363', '§363', 'art 363', 'art 363', '§363', '§363', '§363', '§363', '§363', '§363']

Title 12 → Chapter III → Subchapter B → Part 363
§363.0 OMB control number.
§363.1 Scope and definitions.
§363.2 Annual reporting requirements.
§363.3 Independent public accountant.
§363.4 Filing and notice requirements.
§363.5 Audit committees.
Source: 74 FR 35745, July 20, 2009, unless otherwise noted.
(a) Applicability. This part applies to any insured depository institution with respect to any fiscal year in which its consolidated total assets as of the beginning of such fiscal year are $500 million or more. The requirements specified in this part are in addition to any other statutory and regulatory requirements otherwise applicable to an insured depository institution.
(b) Compliance by subsidiaries of holding companies. (1) For an insured depository institution that is a subsidiary of a holding company, the audited financial statements requirement of §363.2(a) may be satisfied:
(2) The other requirements of this part for an insured depository institution that is a subsidiary of a holding company may be satisfied by the top-tier or any mid-tier holding company if the insured depository institution meets the criterion specified in §363.1(b)(1) and if:
(c) Financial reporting. For purposes of the management report requirement of §363.2(b) and the internal control reporting requirement of §363.3(b), “financial reporting,” at a minimum, includes both financial statements prepared in accordance with generally accepted accounting principles for the insured depository institution or its holding company and financial statements prepared for regulatory reporting purposes. For recognition and measurement purposes, financial statements prepared for regulatory reporting purposes shall conform to generally accepted accounting principles and section 37 of the Federal Deposit Insurance Act.
(1) AICPA means the American Institute of Certified Public Accountants.
(2) GAAP means generally accepted accounting principles.
(3) PCAOB means the Public Company Accounting Oversight Board.
(4) Public company means an insured depository institution or other company that has a class of securities registered with the U.S. Securities and Exchange Commission or the appropriate Federal banking agency under Section 12 of the Securities Exchange Act of 1934 and nonpublic company means an insured depository institution or other company that does not meet the definition of a public company.
(5) SEC means the U.S. Securities and Exchange Commission.
(6) SOX means the Sarbanes-Oxley Act of 2002.
(a) Audited financial statements. Each insured depository institution shall prepare annual financial statements in accordance with GAAP, which shall be audited by an independent public accountant. The annual financial statements must reflect all material correcting adjustments necessary to conform with GAAP that were identified by the independent public accountant.
(b) Management report. Each insured depository institution annually shall prepare, as of the end of the institution's most recent fiscal year, a management report that must contain the following:
(i) A statement identifying the internal control framework14 used by management to evaluate the effectiveness of the insured depository institution's internal control over financial reporting;
14For example, in the United States, the Committee of Sponsoring Organizations (COSO) of the Treadway Commission has published Internal Control—Integrated Framework, including an addendum on safeguarding assets. Known as the COSO report, this publication provides a suitable and available framework for purposes of management's assessment.
(c) Management report signatures. Subject to the criteria specified in §363.1(b):
(1) If the audited financial statements requirement specified in §363.2(a) is satisfied at the insured depository institution level and the management report requirement specified in §363.2(b) is satisfied in its entirety at the insured depository institution level, the management report must be signed by the chief executive officer and the chief accounting officer or chief financial officer of the insured depository institution;
(2) If the audited financial statements requirement specified in §363.2(a) is satisfied at the holding company level and the management report requirement specified in §363.2(b) is satisfied in its entirety at the holding company level, the management report must be signed by the chief executive officer and the chief accounting officer or chief financial officer of the holding company; and
(3) If the audited financial statements requirement specified in §363.2(a) is satisfied at the holding company level and (i) the management report requirement specified in §363.2(b) is satisfied in its entirety at the insured depository institution level or (ii) one or more of the components of the management report specified in §363.2(b) is satisfied at the holding company level and the remaining components of the management report are satisfied at the insured depository institution level, the management report must be signed by the chief executive officers and the chief accounting officers or chief financial officers of both the holding company and the insured depository institution and the management report must clearly indicate the level (institution or holding company) at which each of its components is being satisfied.
(a) Annual audit of financial statements. Each insured depository institution shall engage an independent public accountant to audit and report on its annual financial statements in accordance with generally accepted auditing standards or the PCAOB's auditing standards, if applicable, and section 37 of the Federal Deposit Insurance Act (12 U.S.C. 1831n). The scope of the audit engagement shall be sufficient to permit such accountant to determine and report whether the financial statements are presented fairly and in accordance with GAAP.
(b) Internal control over financial reporting. For each insured depository institution with total assets of $1 billion or more at the beginning of the institution's fiscal year, the independent public accountant who audits the institution's financial statements shall examine, attest to, and report separately on the assertion of management concerning the effectiveness of the institution's internal control structure and procedures for financial reporting. The attestation and report shall be made in accordance with generally accepted standards for attestation engagements or the PCAOB's auditing standards, if applicable. The accountant's report must not be dated prior to the date of the management report and management's assessment of the effectiveness of internal control over financial reporting. Notwithstanding the requirements set forth in applicable professional standards, the accountant's report must include the following:
(c) Notice by accountant of termination of services. An independent public accountant performing an audit under this part who ceases to be the accountant for an insured depository institution shall notify the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor in writing of such termination within 15 days after the occurrence of such event, and set forth in reasonable detail the reasons for such termination. The written notice shall be filed at the place identified in §363.4(f).
(d) Communications with audit committee. In addition to the requirements for communications with audit committees set forth in applicable professional standards, the independent public accountant must report the following on a timely basis to the audit committee:
(e) Retention of working papers. The independent public accountant must retain the working papers related to the audit of the insured depository institution's financial statements and, if applicable, the evaluation of the institution's internal control over financial reporting for seven years from the report release date, unless a longer period of time is required by law.
(f) Independence. The independent public accountant must comply with the independence standards and interpretations of the AICPA, the SEC, and the PCAOB. To the extent that any of the rules within any one of these independence standards (AICPA, SEC, and PCAOB) is more or less restrictive than the corresponding rule in the other independence standards, the independent public accountant must comply with the more restrictive rule.
(g) Peer reviews and inspection reports. (1) Prior to commencing any services for an insured depository institution under this part, the independent public accountant must have received a peer review, or be enrolled in a peer review program, that meets acceptable guidelines. Acceptable peer reviews include peer reviews performed in accordance with the AICPA's Peer Review Standards and inspections conducted by the PCAOB.
(a) Part 363 Annual Report. (1) Each insured depository institution shall file with each of the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor, two copies of its Part 363 Annual Report. A Part 363 Annual Report must contain audited comparative annual financial statements, the independent public accountant's report thereon, a management report, and, if applicable, the independent public accountant's attestation report on management's assessment concerning the institution's internal control structure and procedures for financial reporting as required by §§363.2(a), 363.3(a), 363.2(b), and 363.3(b), respectively.
(2) Subject to the criteria specified in §363.1(b), each insured depository institution with consolidated total assets of less than $1 billion as of the beginning of its fiscal year that is required to file, or whose parent holding company is required to file, management's assessment of the effectiveness of internal control over financial reporting with the SEC or the appropriate Federal banking agency in accordance with section 404 of SOX must submit a copy of such assessment to the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor with its Part 363 Annual Report as additional information. This assessment will not be considered part of the institution's Part 363 Annual Report.
(3)(i) Each insured depository institution that is neither a public company nor a subsidiary of a public company that meets the criterion specified in §363.1(b)(1) shall file its Part 363 Annual Report within 120 days after the end of its fiscal year. (ii) Each insured depository institution that is a public company or a subsidiary of public company that meets the criterion specified in §363.1(b)(1) shall file its Part 363 Annual Report within 90 days after the end of its fiscal year.
(b) Public availability. Except for the annual report in paragraph (a)(1) of this section and the peer reviews and inspection reports in §363.3(g), which shall be available for public inspection, the FDIC has determined that all other reports and notifications required by this part are exempt from public disclosure by the FDIC.
(c) Independent public accountant's letters and reports. Except for the independent public accountant's reports that are included in its Part 363 Annual Report, each insured depository institution shall file with the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor, a copy of any management letter or other report issued by its independent public accountant with respect to such institution and the services provided by such accountant pursuant to this part within 15 days after receipt. Such reports include, but are not limited to:
(3) For institutions with total assets of less than $1 billion as of the beginning of their fiscal year that are public companies or subsidiaries of public companies that meet the criterion specified in §363.1(b)(1), any independent public accountant's report on the audit of internal control over financial reporting required by section 404 of SOX and the PCAOB's auditing standards; and
(4) For all institutions that are public companies or subsidiaries of public companies that meet the criterion specified in §363.1(b)(1), any independent public accountant's written communication of all deficiencies in internal control over financial reporting that are of a lesser magnitude than significant deficiencies required by the PCAOB's auditing standards.
(d) Notice of engagement or change of accountants. Each insured depository institution shall provide, within 15 days after the occurrence of any such event, written notice to the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor of the engagement of an independent public accountant, or the resignation or dismissal of the independent public accountant previously engaged. The notice shall include a statement of the reasons for any such resignation or dismissal in reasonable detail.
(e) Notification of late filing. No extensions of time for filing reports required by §363.4 shall be granted. An insured depository institution that is unable to timely file all or any portion of its Part 363 Annual Report or any other report or notice required by §363.4 shall submit a written notice of late filing to the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor. The notice shall disclose the institution's inability to timely file all or specified portions of its Part 363 Annual Report or any other report or notice and the reasons therefore in reasonable detail. The late filing notice shall also state the date by which the report or notice will be filed. The written notice shall be filed on or before the deadline for filing the Part 363 Annual Report or any other report or notice, as appropriate.
(f) Place for filing. The Part 363 Annual Report, any written notification of late filing, and any other report or notice required by §363.4 should be filed as follows:
(1) FDIC: Appropriate FDIC Regional or Area Office (Division of Supervision and Consumer Protection), i.e., the FDIC regional or area office in the FDIC region or area that is responsible for monitoring the institution or, in the case of a subsidiary institution of a holding company, the consolidated company. A filing made on behalf of several covered institutions owned by the same parent holding company should be accompanied by a transmittal letter identifying all of the institutions covered.
(a) Composition and duties. Each insured depository institution shall establish an audit committee of its board of directors, the composition of which complies with paragraphs (a)(1), (2), and (3) of this section. The duties of the audit committee shall include the appointment, compensation, and oversight of the independent public accountant who performs services required under this part, and reviewing with management and the independent public accountant the basis for the reports issued under this part.
(b) Committees of large institutions. The audit committee of any insured depository institution with total assets of more than $3 billion as of the beginning of its fiscal year shall include members with banking or related financial management expertise, have access to its own outside counsel, and not include any large customers of the institution. If a large institution is a subsidiary of a holding company and relies on the audit committee of the holding company to comply with this rule, the holding company's audit committee shall not include any members who are large customers of the subsidiary institution.
(c) Independent public accountant engagement letters. (1) In performing its duties with respect to the appointment of the institution's independent public accountant, the audit committee shall ensure that engagement letters and any related agreements with the independent public accountant for services to be performed under this part do not contain any limitation of liability provisions that:
Scope of Rule and Definitions (§363.1)
Annual Reporting Requirements (§363.2)
Role of Independent Public Accountant (§363.3)
Filing and Notice Requirements (§363.4)
Audit Committees (§363.5)
3. Compliance by Holding Company Subsidiaries. Audited consolidated financial statements and other reports or notices required by this part that are submitted by a holding company for any subsidiary institution should be accompanied by a cover letter identifying all subsidiary institutions subject to part 363 that are included in the holding company's submission. When submitting a Part 363 Annual Report, the cover letter should identify all subsidiary institutions subject to part 363 included in the consolidated financial statements and state whether the other annual report requirements (i.e., management's statement of responsibilities, management's assessment of compliance with designated safety and soundness laws and regulations, and, if applicable, management's assessment of the effectiveness of internal control over financial reporting and the independent public accountant's attestation report on management's internal control assessment) are being satisfied for these institutions at the holding company level or at the institution level. An institution filing holding company consolidated financial statements as permitted by §363.1(b)(1) also may report on changes in its independent public accountant on a holding company basis. An institution that does not meet the criteria in §363.1(b)(2) must satisfy the remaining provisions of this part on an individual institution basis and maintain its own audit committee. Subject to the criteria in §§363.1(b)(1) and (2), a multi-tiered holding company may satisfy all of the requirements of this part at the top-tier or any mid-tier holding company level.
4A. Financial Statements Prepared for Regulatory Reporting Purposes. (a) As set forth in §363.3(c) of this part, “financial reporting,” at a minimum, includes both financial statements prepared in accordance with generally accepted accounting principles for the insured depository institution or its holding company and financial statements prepared for regulatory reporting purposes. More specifically, financial statements prepared for regulatory reporting purposes include the schedules equivalent to the basic financial statements that are included in an insured depository institution's or its holding company's appropriate regulatory report (for example, Schedules RC, RI, and RI-A in the Consolidated Reports of Condition and Income (Call Report) for an insured bank; and Schedules SC and SO, and the Summary of Changes in Equity Capital section in Schedule SI in the Thrift Financial Report (TFR) for an insured thrift institution). For recognition and measurement purposes, financial statements prepared for regulatory reporting purposes shall conform to generally accepted accounting principles and section 37 of the Federal Deposit Insurance Act.
5A. Institutions Merged Out of Existence. An institution that is merged out of existence after the end of its fiscal year, but before the deadline for filing its Part 363 Annual Report (120 days after the end of its fiscal year for an institution that is neither a public company nor a subsidiary of a public company that meets the criterion specified in §363.1(b)(1), and 90 days after the end of its fiscal year for an institution that is a public company or a subsidiary of a public company that meets the criterion specified in §363.1(b)(1)), is not required to file a Part 363 Annual Report for the last fiscal year of its existence.
6. Holding Company Statements. Subject to the criterion specified in §363.1(b)(1), subsidiary institutions may file copies of their holding company's audited financial statements filed with the SEC or prepared for their FR Y-6 Annual Report under the Bank Holding Company Act of 1956 to satisfy the audited financial statements requirement of §363.2(a).
8A. Management's Reports on Internal Control over Financial Reporting under Part 363 and Section 404 of SOX. An institution with $1 billion or more in total assets as of the beginning of its fiscal year that is subject to both part 363 and the SEC's rules implementing section 404 of SOX (as well as a public holding company permitted under the holding company exception in §363.1(b)(2) to file an internal control report on behalf of one or more subsidiary institutions with $1 billion or more in total assets) can choose either of the following two options for filing management's report on internal control over financial reporting.
(b) If the acquired business is or has a consolidated subsidiary that is an insured depository institution subject to part 363 and the institution is not merged out of existence before the deadline for filing its Part 363 Annual Report (120 days after the end of its fiscal year for an institution that is neither a public company nor a subsidiary of a public company that meets the criterion specified in §363.1(b)(1), and 90 days after the end of its fiscal year for an institution that is a public company or a subsidiary of public company that meets the criterion specified in §363.1(b)(1)), the acquired institution must continue to comply with all of the applicable requirements of part 363, including filing its Part 363 Annual Report.
15It is management's responsibility to establish policies concerning underwriting and asset management and to make credit decisions. The auditor's role is to test compliance with management's policies relating to financial reporting.
18A. Internal Control Attestation Standards for Independent Auditors. (a) §363.3(b) provides that the independent public accountant's attestation and report on management's assertion concerning the effectiveness of an institution's internal control structure and procedures for financial reporting shall be made in accordance with generally accepted standards for attestation engagements or the PCAOB's auditing standards, if applicable. The standards that should be followed by the institution's independent public accountant concerning internal control over financial reporting for institutions with $1 billion or more in total assets can be summarized as follows:
(4) For an insured institution that is a subsidiary of a public company that is required to comply with the auditor attestation requirement of section 404 of SOX, but is not itself a public company, the institution and its independent public accountant have flexibility in complying with the internal control requirements of part 363. If the conditions specified in §363.1(b)(2) are met, management and the independent public accountant may choose to report on internal control over financial reporting at the consolidated holding company level. In this situation, the independent public accountant's work would be performed for the public company in accordance with the PCAOB's auditing standards. Alternatively, the institution may choose to comply with the internal control reporting requirements of part 363 at the institution level and its independent public accountant could follow the AICPA's attestation standards.
20. Notice of Termination. The notice of termination required by §363.3(c) should state whether the independent public accountant agrees with the assertions contained in any notice filed by the institution under §363.4(d), and whether the institution's notice discloses all relevant reasons for the accountant's termination. Subject to the criterion specified in §363.1(b)(1) regarding compliance with the audited financial statements requirement at the holding company level, the independent public accountant for an insured depository institution that is a public company and files reports with its appropriate Federal banking agency, or is a subsidiary of a public company that files reports with the SEC, may submit the letter it furnished to management to be filed with the institution's or the holding company's current report (e.g., SEC Form 8-K) concerning a change in accountant to satisfy the notice requirements of §363.3(c). Alternatively, if the independent public accountant confirms that management has filed a current report (e.g., SEC Form 8-K) concerning a change in accountant that satisfies the notice requirements of §363.4(d) and includes an independent public accountant's letter that satisfies the requirements of §363.3(c), the independent public accountant may rely on the current report (e.g., SEC Form 8-K) filed with the FDIC by management concerning a change in accountant to satisfy the notice requirements of §363.3(c).
23. Notification of Late Filing. (a) An institution's submission of a written notice of late filing does not cure the requirement to timely file the Part 363 Annual Report or other reports or notices required by §363.4. An institution's failure to timely file is considered an apparent violation of part 363.
(b) If the late filing notice submitted pursuant to §363.4(e) relates only to a portion of a Part 363 Annual Report or any other report or notice, the insured depository institution should file the other components of the report or notice within the prescribed filing period together with a cover letter that indicates which components of its Part 363 Annual Report or other report or notice are omitted. An institution may combine the written late filing notice and the cover letter into a single notice that is submitted together with the other components of the report or notice that are being timely filed.
26. Notices Concerning Accountants. With respect to any selection, change, or termination of an independent public accountant, an institution's management and audit committee should be familiar with the notice requirements in §363.4(d) and guideline 20, and management should send a copy of any notice required under §363.4(d) to the independent public accountant when it is filed with the FDIC. An insured depository institution that is a public company and files reports required under the Federal securities laws with its appropriate Federal banking agency, or is a subsidiary of a public company that files such reports with the SEC, may use its current report (e.g., SEC Form 8-K) concerning a change in accountant to satisfy the notice requirements of §363.4(d) subject to the criterion of §363.1(b)(1) regarding compliance with the audited financial statements requirement at the holding company level.
27. Composition. The board of directors of each institution should determine whether each existing or potential audit committee member meets the requirements of section 36 and this part. To do so, the board of directors should maintain an approved set of written criteria for determining whether a director who is to serve on the audit committee is an outside director (as defined in §363.5(a)(3)) and is independent of management. At least annually, the board of each institution should determine whether each existing or potential audit committee member is an outside director. In addition, at least annually, the board of an institution with $1 billion or more in total assets as of the beginning of its fiscal year should determine whether all existing and potential audit committee members are “independent of management of the institution” and the board of an institution with total assets of $500 million or more but less than $1 billion as of the beginning of its fiscal year should determine whether the majority of all existing and potential audit committee members are “independent of management of the institution.” The minutes of the board of directors should contain the results of and the basis for its determinations with respect to each existing and potential audit committee member. Because an insured branch of a foreign bank does not have a separate board of directors, the FDIC will not apply the audit committee requirements to such branch. However, any such branch is encouraged to make a reasonable good faith effort to see that similar duties are performed by persons whose experience is generally consistent with the Rule's requirements for an institution the size of the insured branch.
(c) An insured depository institution that is a public company and a listed issuer (as defined in Rule 10A-3 of the Securities Exchange Act of 1934 (Exchange Act)), or is a subsidiary of a public company that meets the criterion specified in §363.1(b)(1) and is a listed issuer, may choose to use the definition of audit committee member independence set forth in the listing standards applicable to the public institution or its public company parent for purposes of determining whether an outside director is “independent of management.”
30. Holding Company Audit Committees. (a) When an insured depository institution satisfies the requirements for the holding company exception specified in §§363.1(b)(1) and (2), the audit committee requirement of this part may be satisfied by the audit committee of the top-tier or any mid-tier holding company. Members of the audit committee of the holding company should meet all the membership requirements applicable to the largest subsidiary depository institution subject to part 363 and should perform all the duties of the audit committee of a subsidiary institution subject to part 363, even if the holding company directors are not directors of the institution.
(b) When an insured depository institution subsidiary with total assets of $1 billion or more as of the beginning of its fiscal year does not meet the requirements for the holding company exception specified in §§363.1(b)(1) and (2) or maintains its own separate audit committee to satisfy the requirements of this part, the members of the audit committee of the top-tier or any mid-tier holding company may serve on the audit committee of the subsidiary institution if they are otherwise independent of management of the subsidiary institution, and, if applicable, meet any other requirements for a large subsidiary institution covered by this part.
(c) When an insured depository institution with total assets of $500 million or more but less than $1 billion as of the beginning of its fiscal year does not meet the requirements for the holding company exception specified in §§363.1(b)(1) and (2) or maintains its own separate audit committee to satisfy the requirements of this part, the members of the audit committee of the top-tier or any mid-tier holding company may serve on the audit committee of the subsidiary institution provided a majority of the institution's audit committee members are independent of management of the subsidiary institution.
31. Duties. The audit committee should perform all duties determined by the institution's board of directors and it should maintain minutes and other relevant records of its meetings and decisions. The duties of the audit committee should be appropriate to the size of the institution and the complexity of its operations, and, at a minimum, should include the appointment, compensation, and oversight of the independent public accountant; reviewing with management and the independent public accountant the basis for their respective reports issued under §§363.2(a) and (b) and §§363.3(a) and (b); reviewing and satisfying itself as to the independent public accountant's compliance with the required qualifications for independent public accountants set forth in §§363.3(f) and (g) and guidelines 13 through 16; ensuring that audit engagement letters comply with the provisions of §363.5(c) before engaging an independent public accountant; being familiar with the notice requirements in §363.4(d) and guideline 20 regarding the selection, change, or termination of an independent public accountant; and ensuring that management sends a copy of any notice required under §363.4(d) to the independent public accountant when it is filed with the FDIC. Appropriate additional duties could include:
33. Large Customers. Any individual or entity (including a controlling person of any such entity) which, in the determination of the board of directors, has such significant direct or indirect credit or other relationships with the institution, the termination of which likely would materially and adversely affect the institution's financial condition or results of operations, should be considered a “large customer” for purposes of §363.5(b).
(a) When an insured depository institution's total assets as of the beginning of its fiscal year are $500 million or more for the first time and it thereby becomes subject to part 363, no regulatory action will be taken if the institution (1) develops and approves a set of written criteria for determining whether a director who is to serve on the audit committee is an outside director and is independent of management and (2) forms or restructures its audit committee to comply with §363.5(a)(2) by the end of that fiscal year.
(b) When an insured depository institution's total assets as of the beginning of its fiscal year are $1 billion or more for the first time, no regulatory action will be taken if the institution forms or restructures its audit committee to comply with §363.5(a)(1) by the end of that fiscal year, provided that the composition of its audit committee meets the requirements specified in §363.5(a)(2) at the beginning of that fiscal year, if such requirements were applicable.
(c) When an insured depository institution's total assets as of the beginning of its fiscal year are $3 billion or more for the first time, no regulatory action will be taken if the institution forms or restructures its audit committee to comply with §363.5(b) by the end of that fiscal year, provided that the composition of its audit committee meets the requirements specified in §363.5(a)(1) at the beginning of that fiscal year, if such requirements were applicable.
[74 FR 35745, July 20, 2009, as amended at 78 FR 55596, Sept. 10, 2013; 83 FR 17742, Apr. 24, 2018]
1. General. The reporting scenarios, illustrative management reports, and the cover letter (when complying at the holding company level) in Appendix B to part 363 are intended to assist managements of insured depository institutions in complying with the annual reporting requirements of §363.2 and guideline 3, Compliance by Holding Company Subsidiaries, of Appendix A to part 363. However, use of the illustrative management reports and cover letter is not required. The managements of insured depository institutions are encouraged to tailor the wording of their management reports and cover letters to fit their particular circumstances, especially when reporting on material weaknesses in internal control over financial reporting or noncompliance with designated laws and regulations. Terms that are not explained in Appendix B have the meanings given them in part 363, the FDI Act, or professional accounting and auditing literature. Instructions to the preparer of the management reports are shown in brackets within the illustrative reports.
2. Reporting Scenarios for Institutions that are Holding Company Subsidiaries. (a) Subject to the criteria specified in §363.1(b), an insured depository institution that is a subsidiary of a holding company has flexibility in satisfying the reporting requirements of part 363. When reporting at the holding company level, the management report, or the individual components thereof, should identify those subsidiary institutions that are subject to part 363 and the extent to which they are included in the scope of the management report or a component of the report. The following reporting scenarios reflect how an insured depository institution that meets the criteria set forth in §363.1(b) could satisfy the annual reporting requirements of §363.2. Other reporting scenarios are possible.
3. Illustrative Statements of Management's Responsibilities. The following illustrative statements of management's responsibilities satisfy the requirements of §363.2(b)(1).
4. Illustrative Reports on Management's Assessment of Compliance with Designated Laws and Regulations. The following illustrative reports on management's assessment of compliance with Designated Laws and Regulations satisfy the requirements of §363.2(b)(2).
5. Illustrative Reports on Management's Assessment of Internal Control Over Financial Reporting. The following illustrative reports on management's assessment of internal control over financial reporting satisfy the requirements of §363.2(b)(3).
6. Illustrative Management Report—Combined Statement of Management's Responsibilities, Report on Management's Assessment of Compliance With Designated Laws and Regulations, and Report on Management's Assessment of Internal Control Over Financial Reporting, if applicable. The following illustrative management reports satisfy the requirements of §§363.2(b)(1), (2), and (3).
Independent auditor's internal control
ABC Depository Institution Holding Company Level Holding Company Level Holding Company Level Holding Company Level Holding Company Level.
DEF Depository Institution Holding Company Level Institution Level Institution Level Institution Level Institution Level.