Industry-Wide (All FDIC/OCC-Supervised Banks)
On April 15, 2026, the FDIC and OCC jointly adopted a final rule that bars both agencies from using reputation risk as a basis for adverse supervisory action against regulated financial institutions. The rule specifically protects banks from being penalized for serving customers based on those customers' political, social, cultural, or religious views, or for facilitating lawful business activities. This 'debanking' rule is significant for the BaaS industry because sponsor banks have historically faced supervisory pressure over the types of fintech partners and end customers they serve, sometimes leading to program terminations. The rule takes effect on June 6, 2026, and could encourage sponsor banks to be more willing to onboard fintech partners in politically sensitive or reputationally complex sectors. It represents a meaningful shift in how regulators evaluate the risk profiles of bank-fintech partnerships.
Verified from source: The FDIC and OCC adopted a joint final rule prohibiting the agencies from criticizing or taking adverse action against financial institutions based on reputation risk, including actions based on customers' political, social, cultural, or religious views, constitutionally protected speech, or lawful business activities. The rule is effective June 6, 2026.
- Sponsor banks may face less supervisory pressure when onboarding fintech partners in controversial but lawful sectors
- Could reduce 'debanking' of fintech programs serving cannabis, cryptocurrency, firearms, or other politically sensitive industries
- May encourage broader BaaS program diversity as reputation risk is no longer a valid basis for adverse supervisory action
- Banks still must manage BSA/AML and safety-and-soundness risks; only reputation-based adverse actions are prohibited