Federal Reserve Regulation O Proposal: Rebuild the Control Logic, Not Just the Limits

TL;DR

• The Federal Reserve issued a Regulation O proposal on July 31, 2026, calling it the first comprehensive update since 1979.
• Proposed thresholds generally rise fourfold: the $500,000 fixed board-approval ceiling becomes $2 million, while the $15,000 credit-card exception becomes $60,000.
• The proposal also tackles loans to portfolio companies connected to passive fund complexes, incorporates existing interpretations, and reorganizes the rule.
• This is not a “change six numbers in the core” project. Insider identity, related-interest logic, approvals, abstentions, public disclosure, and evidence all need end-to-end testing.

The Federal Reserve Regulation O proposal gives banks larger dollar thresholds. The dangerous implementation is to treat that as the whole story.

On July 31, 2026, the Federal Reserve requested comment on a broad modernization of Regulation O, the rule governing credit to executive officers, directors, principal shareholders, and related interests. The release says the rule has not been comprehensively updated since 1979.

The numbers are cleaner. The control environment is not.

A bank that updates its loan-system threshold but leaves stale insider records, broken relationship aggregation, weak director abstention evidence, or ambiguous passive-fund logic has implemented the easy 10% and missed the risky 90%.

The Regulation O proposal in one control table

The proposed Federal Register notice lists these dollar changes:

The Board says it derived the proposed increases using changes in nominal gross domestic product from the fourth quarter of 1994 through the fourth quarter of 2025. It would also index thresholds going forward.

Governor Michael Barr supported publishing the proposal but asked whether nominal GDP or the consumer price index is the better index. That disagreement is not trivia. It means the indexing methodology is a live policy question, not an implementation fact.

Until a final rule becomes effective, the current limits stay in production.

Why a threshold update can create a control failure

Regulation O is relationship-driven. The correct result depends on who the borrower is, who controls the borrower, which other exposures aggregate with it, what type of credit is involved, and who approved it.

Consider a realistic hypothetical: a director owns a local construction company and personally has a home-equity line. The bank’s origination system recognizes the director’s personal customer record but does not connect the company because the ownership data lives in a separate commercial-lending file. Raising an approval threshold does nothing to fix the missing relationship. The system may route the transaction incorrectly at either the old or new amount.

A sound implementation sequence is:

1. establish the complete insider population;
2. map related interests and attribution rules;
3. aggregate exposures across products and legal borrowers;
4. apply the correct exception, limit, and approval logic;
5. prevent interested-party participation;
6. preserve evidence for monitoring and examination.

Teams often begin at step four because that is where the visible dollar amount sits. Examiners begin by asking how the bank knew the borrower was an insider or related interest in the first place.

The six tests your bank should run before changing a number

1. Can the bank prove who is an insider today?

The insider inventory should include executive officers, directors, principal shareholders, relevant affiliate insiders, and connected related interests. Each record needs an effective date, source, reviewer, and linkage to customer identifiers used by deposit, card, and loan systems.

Evidence should include:

• board and committee rosters;
• officer designation analysis;
• ownership and control records;
• annual conflict and related-interest questionnaires;
• midyear change notifications;
• customer master identifiers;
• review and certification history.

The annual questionnaire cannot be the only update mechanism. A new business interest acquired in March should not wait until next January to enter the monitoring population.

2. Does aggregation work across products?

The proposal retains the underlying architecture of individual and aggregate lending restrictions. The notice explains that the general aggregate lending limit is 100% of unimpaired capital and unimpaired surplus, while individual lending-limit calculations and collateral rules continue to matter.

Test one insider relationship across:

• commercial loans;
• consumer loans;
• credit cards;
• deposit overdrafts;
• unused lines;
• derivatives or other covered credit exposures;
• related interests.

The expected evidence is a reconciliation showing every source system, matched customer identifier, exposure amount, exception, and total. If the result requires a compliance analyst to remember that “ABC Holdings” belongs to Director Smith, that is a person-dependent control, not reliable aggregation.

3. Are approvals tied to the whole relationship?

The proposed fixed board-approval ceiling rises from $500,000 to $2 million, but Regulation O’s approval test is not simply “anything below $2 million is fine.” The current framework also uses a percentage-of-capital component, and the proposal contains extensive conforming changes.

The workflow should calculate the applicable test from current capital data and aggregate exposure, not rely on a static dollar switch.

For each approval, preserve:

• amount before and after the transaction;
• capital and surplus source date;
• triggered threshold;
• credit terms and underwriting result;
• board materials;
• vote record;
• interested-party abstention;
• minutes or written consent.

A meeting minute that says “approved insider loan” without showing abstention and the relationship amount is thin evidence.

4. Do overdraft controls distinguish an exception from a pattern?

The proposal would move the inadvertent-overdraft exception from $1,000 to $4,000 and the credit-plan exception from $5,000 to $20,000.

That does not turn repeated overdrafts into “inadvertent” events. Monitoring should test amount, duration, recurrence, repayment, and whether the credit plan was documented in advance.

A useful exception report includes:

A higher threshold can reduce alerts. It should not eliminate recurrence monitoring.

5. Can disclosures be regenerated under both rule versions?

The proposal would raise the related public-disclosure threshold from $500,000 to $2 million. Banks should version the reporting logic rather than overwrite it.

The implementation file should show:

• the current-rule output for the last reporting period;
• a parallel proposed-rule output;
• the transactions that drop out and why;
• effective-date logic;
• retention of historical reports under the rule then in force;
• Legal and Regulatory Reporting sign-off.

This dual-run approach catches boundary errors before production changes and preserves the audit trail when someone later asks why a transaction appeared in one year’s disclosure but not the next.

6. Does the bank test terms, not only limits?

The Federal Reserve’s release says the proposal maintains safeguards against preferential treatment. A transaction can sit below every dollar threshold and still create risk if its pricing, collateral, maturity, exceptions, or underwriting differs improperly from comparable non-insider credit.

Compliance Testing should select a matched sample of insider and non-insider transactions and compare:

• rate and fees;
• collateral type and advance rate;
• debt-service and creditworthiness analysis;
• maturity and amortization;
• covenant exceptions;
• approval authority;
• past-due treatment.

Document the matching logic. “We reviewed five normal loans” is not persuasive if they came from different products, risk grades, or time periods.

Passive fund complexes are the proposal’s least spreadsheet-friendly issue

The proposal addresses a modern complication: passive investment fund complexes may own more than 10% of a class of a banking organization’s voting securities and become principal shareholders. Under current control presumptions, a bank’s loans to portfolio companies associated with that fund complex can be pulled into Regulation O analysis even where the economic relationship does not resemble classic insider self-dealing.

The Board proposes an exemption from a presumption of control for portfolio companies of fund complexes that meet specified criteria. It also asks how banks should treat corporate lending where passive asset managers hold equity in both the bank and borrowers.

This is not a blanket “BlackRock/Vanguard exception,” and banks should not implement it from a headline. Legal needs to map the final eligibility conditions, fund-complex structure, ownership data, control indicators, and documentation standard.

The control artifact should be a legal decision tree with:

1. whether the fund complex is a principal shareholder;
2. whether the borrower is a portfolio company;
3. whether the proposed exemption’s criteria are met;
4. whether another control relationship exists;
5. the data source and as-of date for ownership;
6. the legal approver and refresh trigger.

Ownership changes. Any exception dependent on a point-in-time position needs a refresh cadence and an event-driven update for material changes.

What the proposal does not let banks stop doing

The modernization language is broad, but the proposal does not erase the core protections. Banks still need controls designed to prevent preferential insider credit, calculate lending limits, obtain approvals, enforce abstentions, maintain records, and make required reports or disclosures.

It also incorporates statutory requirements and longstanding interpretations into the rule text. That can expose undocumented practices. A bank may be operating correctly because an experienced compliance officer knows a Federal Reserve interpretation; if the logic is absent from procedure and system requirements, the control will not survive turnover.

This is a good moment to compare the proposed text against:

• the Regulation O policy;
• insider-lending procedures;
• system business requirements;
• director and officer questionnaires;
• credit committee and board charters;
• monitoring and testing scripts;
• training materials;
• exception logs.

For the broader governance discipline, see how to build a regulatory change management program and how regulatory change KRIs catch policy lag and missed deadlines. Banks reviewing governance across a holding-company structure should also read the source-of-strength control implications for fintech subsidiaries.

A 30-day Regulation O evidence sprint

Week 1 — Compliance and Corporate Secretary: certify the insider population and reconcile it to board, officer, ownership, affiliate, and customer-master records.

Week 2 — Credit Risk and Technology: run cross-product aggregation for a sample that includes a director, executive officer, principal shareholder, and related interest. Log every manual bridge.

Week 3 — Legal and Regulatory Reporting: create a redline matrix covering all proposed threshold, definition, passive-fund, disclosure, and interpretation changes. Separate proposed text from current requirements.

Week 4 — Compliance Testing: dual-run current and proposed thresholds, test abstention evidence, sample overdrafts for recurrence, and compare insider terms with appropriately matched non-insider loans.

The final deliverable is not a slide saying “Reg O limits may increase.” It is a version-controlled impact assessment with source citations, affected controls, system requirements, test results, owners, dependencies, and go-live conditions.

The Board says comments are due 60 days after Federal Register publication. That gives banks a window to identify practical defects and submit evidence-based comments rather than generic support or opposition.

If your review exposes controls that exist only in people’s heads, use the RCSA Template to document the risk, control owner, evidence, test cadence, and remediation before a final rule forces the deadline.