FDIC 2026 Risk Review: The 5 Risk Areas That Will Drive Bank Exam Priorities for the Rest of the Year

TL;DR:

• The FDIC’s 2026 Risk Review, released in early May 2026, flags five elevated-risk areas that will shape supervisory examination priorities for the remainder of the year: CRE concentrations, nonbank financial institution lending, consumer credit delinquencies (credit cards and auto), residential real estate, and funding stability.
• Mid-sized banks ($1B–$100B in assets) have median CRE concentrations near the 300% supervisory threshold — and the CRE PDNA rate ticked up to 1.45% in 2025.
• NDFI lending (loans to nonbank credit intermediaries) is the fastest-growing bank loan segment since the financial crisis, creating second-order transmission risk the FDIC is actively examining.
• Consumer credit card and auto charge-off rates remain above pre-pandemic averages. Examiners in 2026 will be looking at credit loss reserve adequacy, concentration limits, and whether stress testing assumptions are still defensible.

Reading the Risk Review as an Exam Prep Document

The FDIC publishes its annual Risk Review each spring, covering the credit, market, and operational risk trends the agency observed in banking data from the prior year. Most compliance and risk teams at community and regional banks treat it as a macroeconomic briefing — interesting, but not operationally urgent.

That’s the wrong read.

The FDIC’s Risk Review isn’t just a retrospective. It’s a forward signal about where examiners are looking — the risk areas where the agency has concentrated analytical attention, where it observed trends that concern supervisors, and where it expects portfolio review questions to sharpen in upcoming examinations. Banks in the flagged risk areas that aren’t already tracking the relevant metrics and testing their assumptions are going to face harder examiner questions than they’re prepared for.

The 2026 Risk Review, released in early May, identifies five risk areas where the FDIC’s supervisory attention is elevated. Each has specific implications for what your risk management documentation needs to show.

Risk Area 1: Commercial Real Estate Concentrations

The CRE risk in the 2026 Risk Review is a concentration story as much as a credit quality story.

The total CRE past-due and nonaccrual (PDNA) rate ticked up to 1.45% — not a crisis level, but a trend direction that matters. What’s more immediately exam-relevant is the concentration picture: institutions with $1 billion to $100 billion in assets have median CRE concentrations hovering around 300% of tier 1 capital and reserves. That’s the threshold the interagency CRE concentration guidance (2006) uses to flag institutions for enhanced supervisory oversight.

The FDIC is particularly focused on office and retail sub-segments, where elevated vacancy rates and high operating costs are compressing borrower cash flows and limiting refinancing options. High interest rates — even as the Fed has cut modestly — mean refinancing events that were routine at 2020–2021 rates are now stress events.

What examiners will look for:

• Whether your institution has documented concentration limits by CRE sub-segment (office vs. multifamily vs. industrial vs. retail)
• Stress testing under vacancy rate + interest rate scenarios: what does 20% office vacancy do to your largest 10 CRE credits?
• Loan maturity schedules: how many CRE credits mature in 2026–2028, and what does the refinancing environment look like for each?
• Loan modification and extension tracking: are you documenting TDRs and modifications, or have extensions become a way to avoid reporting?

If your CRE concentration is above 200% of tier 1 capital, it’s worth reviewing your ALLL/ACL adequacy analysis specifically for CRE loss projections, because an examiner is going to scrutinize that methodology.

Risk Area 2: Nonbank Financial Institution (NDFI) Lending

The fastest-growing bank loan segment since the Global Financial Crisis gets relatively little attention in most community bank risk programs — which is exactly why the FDIC dedicated specific coverage to it in the 2026 Risk Review.

NDFI lending refers to bank loans to nonbank credit intermediaries: mortgage companies, consumer finance companies, fintech lenders, auto finance companies, and other non-depository institutions that originate loans to end consumers or businesses. More than half of NDFI loans are to credit intermediaries for mortgages, business loans, and consumer loans, meaning the ultimate credit quality depends on the NDFI’s underwriting standards and the underlying consumer or business credits they hold.

The FDIC’s concern is transmission risk. The bank’s direct NDFI borrower may look creditworthy on its own balance sheet — but the NDFI’s credit quality is a function of the consumer loans it originated. If those consumer loans deteriorate (rising delinquencies in the credit card or auto portfolios the NDFI financed), that flows through to the NDFI’s ability to service its bank debt.

What examiners will look for:

• Whether your credit analysis of NDFI borrowers includes review of the end-portfolio composition, not just the NDFI’s financial statements
• Covenant structures: do your NDFI loan agreements include portfolio performance triggers (delinquency rates, net charge-off rates) as early-warning covenants?
• Whether your loan policy has NDFI-specific concentration limits and underwriting criteria
• For fintechs and lending-as-a-service relationships: whether the arrangement is structured as a true NDFI loan or has characteristics of a bank partnership that should be governed by the interagency BaaS guidance

If your institution has meaningful NDFI exposure, build a data request into your credit monitoring process: quarterly NDFI loan performance data, updated financial statements, and any material changes to the NDFI’s underwriting guidelines or capital position.

Risk Area 3: Consumer Credit — Credit Cards and Auto

The 2026 Risk Review confirms what most credit risk teams have been tracking: credit card and auto net charge-off rates remain above pre-pandemic averages, with increases in these categories outweighing declines elsewhere. The combined trend — charge-off rates elevated relative to historical baselines in these two high-volume consumer segments — is exactly the kind of signal that generates examiner questions about loss reserve adequacy.

PDNA rates for non-owner-occupied CRE, multifamily, auto, and credit card portfolios specifically remain above pre-pandemic levels. The practical implication: banks with meaningful consumer credit card or auto portfolios should expect examiner questions about:

• CECL allowance adequacy and the vintage-loss methodology underlying the reserve calculation
• Whether your qualitative factors in the ACL have been updated to reflect current charge-off trends, not just modeled losses from historical loss rates
• Concentration limits in consumer lending sub-segments and whether those limits have been stress-tested
• Origination standards: have underwriting standards tightened in response to elevated charge-off trends, and is that documented?

This doesn’t mean the consumer credit environment is in crisis — the overall banking industry performance in 2025 was generally stable. But “above pre-pandemic averages” in these specific portfolios signals that examiners will probe whether your reserve methodology captures the current trend, not just the pre-COVID baseline.

Risk Area 4: Funding Stability and Net Interest Margin Recovery

The 2026 Risk Review’s market risk section covers what happened to bank funding structures in 2025: net interest margins improved modestly as funding costs declined, but deposit composition and repricing sensitivity remain examination topics.

The key exam angle here is interest rate risk documentation. Institutions that repriced deposits heavily during the 2023–2024 rate environment — shifting customers into time deposits at rates that are now above the deposit cost floor — face a maturity schedule question as those CDs roll off. If your ALM model assumptions about deposit repricing were calibrated to the 2021 rate environment, they may no longer be defensible.

Examiners have been asking about:

• Non-maturity deposit assumption currency: are your NMD decay rates and rate sensitivity assumptions updated for the 2022–2024 rate cycle experience?
• Brokered deposit reliance: what percentage of your funding base is wholesale or brokered, and does your concentration limit policy address the scenario where that funding becomes unavailable?
• Contingent funding capacity: has your contingency funding plan been tested, and are your contingent funding sources (FHLB capacity, Fed discount window, correspondent lines) documented with tested availability?

This is an area where community banks sometimes have the documentation but not the tested evidence. An examiner who asks “show me the test of your contingent funding sources” and gets a list instead of test records has found a gap.

Risk Area 5: Agriculture and Small Business — The Regional Divergence

The FDIC’s 2026 Risk Review doesn’t flag agriculture credit as a system-wide concern, but it notes regional divergence that makes it a local examination risk. Banks in agricultural-heavy markets — particularly those with exposure to cattle, grain, or commodity operations — are seeing different credit quality trends than banks in coastal urban markets.

Small business lending quality similarly varies by region and industry concentration. Institutions with SBA portfolio concentrations should review their guarantee documentation and servicing completeness; FDIC examiners reviewing small business loan quality will look at whether guarantee eligibility is maintained on SBA-guaranteed loans, particularly as some 2020–2022 originations start reaching their monitoring milestones.

Translating the Risk Review into Exam Prep

The FDIC’s Risk Review isn’t a checklist — it’s a signal about examiner attention. The practical prep steps from the 2026 review:

1. Know your own numbers before the examiner does. For every risk area the FDIC flagged, your risk team should have the current metrics: CRE concentration ratio, NDFI loan balances and counterparty composition, consumer credit net charge-off rates by sub-segment, NMD assumptions, contingent funding test dates. Walking into an exam without knowing these numbers puts you on defense from the first question.

2. Update your qualitative CECL factors. If your allowance model is still running on pre-pandemic historical loss rates as the primary driver, and you’re now seeing above-average charge-off rates in credit cards or auto, there’s a gap between your model inputs and current conditions. The examiner will see it. Update the qualitative factor documentation to reflect current trends explicitly.

3. Review concentration policy against current exposure. If your CRE concentration is near the 300% supervisory threshold, verify your credit policy documents the concentration limit and that there’s documented management analysis of the composition and risk. “We know our CRE is high but we’ve stress-tested it” is a better answer than “we haven’t looked at our concentration limits since 2019.”

4. Test, don’t just document, your contingent funding sources. FDIC examiners reviewing funding risk ask specifically whether contingent funding capacity has been tested. A documented list of available FHLB borrowing capacity that has never been tested against the institution’s systems — can you actually draw on it within 24 hours? — is a gap.

5. Document your response to elevated risk trends. If consumer credit metrics are deteriorating in your portfolios, what management action have you taken? Tightened underwriting criteria? Adjusted concentration limits? Modified the CECL qualitative factors? The 2026 FDIC exam focus is on whether management has noticed the risk trends and responded to them — not whether your portfolio is perfect.

So What? The Exam Advantage of Reading the Risk Review Early

Most bank compliance teams don’t start exam prep until there’s an examination notice. The FDIC’s Risk Review is a pre-exam notice — not for your specific institution, but for the risk areas where the agency is concentrating attention system-wide.

Banks that are already tracking the right metrics, have updated their qualitative CECL factors, and have tested their contingent funding sources won’t be caught off-guard by the questions the 2026 exam environment will generate. Banks that read the Risk Review as a macroeconomic briefing and don’t connect it to their own portfolio and documentation will be.

For a comprehensive set of KRIs mapped to the risk areas the FDIC flagged — credit, operational, liquidity, and compliance — including the Credit Risk KRIs: Delinquency, Concentration, and CECL Metrics That Examiners Actually Check post covers the specific metrics with Green/Amber/Red thresholds. For the annual compliance risk assessment methodology that should incorporate these FDIC-flagged risk areas as inputs, see How to Build an Annual Compliance Risk Assessment: Methodology, Scoring, and What Regulators Look For. And for the contingent funding documentation that examiners will test, see Key Risk Indicators Examples: 40 KRIs for Operational and Financial Risk Teams.

For the operational templates — compliance risk assessment frameworks, exam management documentation, and board reporting tools — the Compliance Essentials bundle includes the core program components that map directly to the risk areas the FDIC is examining.

Sources: FDIC 2026 Risk Review (full report); FDIC — 2026 Risk Review landing page; Schneider Downs — Key Risks and Takeaways from the FDIC’s 2026 Risk Review; Orrick InfoBytes — FDIC releases annual risk review report, May 2026