4 Regulatory Challenges Community Banks Face Today

The banking industry faces a dynamic regulatory and compliance environment that’s being shaped by several different factors, such as the presidential administration’s agenda, changes in control of Congress and new leaders of the regulatory bodies. All of this has caused a shift in supervisory priorities among bank regulators, including deregulatory efforts and the potential rollback or even overturning of previous administrations’ regulatory efforts.

Even in a more permissive regulatory environment, it’s important to remember that changes to banking supervision and regulations occur slowly. Community banks should remain focused on addressing their outstanding supervisory issues; prioritizing governance, risk management, compliance and controls; and demonstrating sustainable remediation. Failure to do so could lead to extended time in the regulatory penalty box.

In its 2025 Banking Regulatory Outlook, Deloitte took a deep dive into the evolving regulatory and compliance landscape that banks face this year. During transitions between administrations, interagency regulatory actions such as rulemaking and supervisory guidance generally slow down, perhaps rising modestly later in the year. On the supervisory side, the report notes, permanent staff generally aren’t affected, so banks’ primary supervisory contacts tend to remain constant.

Deloitte identified four key regulatory and compliance challenges facing community banks this year. Read on for an in-depth look at each of these challenges and how community banks can overcome them to seize new opportunities and achieve sustainable growth.

“The challenge of financial resilience is nothing new. Community banks have weathered numerous storms in the past—from banking and financial crises to inflation and times of market uncertainty.”

—Anne Balcer, ICBA

Challenge #1: Navigate an uncertain regulatory environment

According to the Deloitte report, banks should prepare for an even more complex and uncertain regulatory future. This could require heightened vigilance and adaptability by community banks for strategic planning and compliance. 

“Given the considerable difference in direction,” states the report, “banks should closely monitor regulatory developments and be prepared to invest in their regulatory change management capabilities.”

“Administration changes are always challenging for banks, because new administrations tinker and make adjustments to the regulatory landscape,” says Jenna Burke, executive vice president and general counsel for government relations and public policy at ICBA. “In the current environment, there’s a big emphasis on deregulation, so there is some optimism that there will be more regulatory certainty and straightforward reforms moving forward.”

Burke is pleased with the confirmation of Federal Reserve Board governor Michelle Bowman to the position of vice chair for supervision at the Fed. “She fulfills a seat that’s designated for someone with community banking experience, so she has a very keen understanding of the challenges community banks face,” Burke says.

Anne Balcer, senior executive vice president and chief of government relations and public policy for ICBA, says when there’s an administration change with a significant shift in its approach to regulation, there’s a tendency to think some of the old rules no longer apply. “I really caution community banks to not let their guard down or relax their standards,” she says. “The pendulum can certainly swing again in a few years.” 

Lilly Thomas, executive vice president of regulatory relations and strategy for ICBA, agrees. “As the new administration and Congress’s policy approaches evolve,” she says, “community banks need to comply with existing laws and regulations while simultaneously staying aware of the changing enforcement priorities and shifting emphasis in bank examinations.”

The biggest uncertainty surrounds rules and regulations from the Biden administration and even earlier, according to Michael Emancipator, senior vice president and regulatory counsel for ICBA. “Rules under Sections 1071 and 1033 from the Dodd-Frank Act still don’t require compliance yet,” he says. “The Trump administration is trying to use the courts to invalidate Biden-era rulemaking, especially under the CFPB, or to get legislation enacted.”

Another avenue, says Emancipator, is the administrative side, where there’s more discretion to change rulemaking. “This presents a good opportunity for ICBA to reengage with agency personnel,” he says, “since the advice and recommendations we presented to the last administration now have more fertile ground.”

“You can never overcommunicate with banking regulators. Help them focus on desired changes that specifically impact community banks.”

—James R. Gordon, Lexicon Bank

Challenge #2: Address supervisory focus on issue remediation

Despite the new administration, banks will still be expected to close outstanding issues and enforcement actions and improve or sustain risk management and controls. “A new administration does not automatically close existing supervisory findings or enforcement actions,” states the Deloitte report. “There are internal procedures and protocols that must be followed.”

Thomas says that examiners are increasingly focused on identifying issues that pose the most significant risks to a bank’s safety and soundness, rather than smaller technical issues that have minimal effects. “This will allow community banks to spend less time focusing on immaterial issues that aren’t relevant to them, which is a huge benefit,” she says.

“Issue remediation is usually the first thing examiners review during subsequent examinations, regardless of the materiality of the finding,” Balcer notes. “It could be a significant finding that’s determined to be a deficiency or something pretty benign, but that’s where the next exam usually picks up.”

Emancipator says Bowman and FDIC acting chairman Travis Hill have asserted that they believe the current examination and appeals process is stacked against banks. 

“They have talked about how the regulators have kind of taken their eyes off the ball and not focused on the things that actually affect banking safety and soundness,” he says. “They want to reprioritize bank regulation and supervision on things that are more tried and true, and give banks more discretion in terms of making some of those business decisions.”

One positive change Balcer notes is the removal by the OCC and the Federal Reserve Board of reputational risk as a factor in a bank’s CAMELS rating. “This is a significant improvement,” she says, “because reputational risk has always been somewhat of a catchall that’s not well-defined and leaves banks vulnerable to an overzealous examiner using broad discretion.”

Challenge #3: Establish financial resilience

According to the Deloitte report, supervisors are closely examining banks’ financial vulnerabilities and ability to respond appropriately to changing financial conditions. “The new administration is likely to focus on balancing core financial resilience within the banking system and promoting financial market growth,” it states. “New banking agency leadership and upcoming changes to financial standards may have significant implications for banks’ cost of capital and liquidity.”

Regulators are taking an especially close look at liquidity, since previous liquidity stress events have caught their attention. Commentary has focused on the need to reevaluate the current liquidity risk frameworks. 

“From our experience,” the report says, “supervisors are concentrating on banks’ intraday liquidity risk capabilities, the operational readiness of banks’ contingency funding plans, and the requisite controls and risk management practices of each.”

Regulators are also considering policy options that could affect liquidity requirements significantly. These include restricting banks’ reliance on held-to-maturity assets in liquidity buffers and changing the treatment of certain types of deposits (such as uninsured deposits) in the current liquidity framework.

“The challenge of financial resilience is nothing new,” says Balcer. “Community banks have weathered numerous storms in the past, from banking and financial crises to inflation and times of market uncertainty. Community banks aren’t beholden to the kinds of quarterly earnings reports that larger publicly traded banks are, so they typically run with excess capital. The fact that community banks operate in local markets also bolsters their resiliency.”

“With increased [cyber threat] complexity, there’s a greater need to develop, maintain and document adequate internal controls to guard against these risks.”

—Lilly Thomas, ICBA

Challenge #4: Monitor nonfinancial risks and internal controls

The Deloitte report identifies several key nonfinancial risks that regulators will continue to focus on and where the banking industry at large may still need improvement. These include operational resilience and cybersecurity, evolving financial crime and fraud typologies, and third-party relationships. “Additionally, banks should consider the emerging development of artificial intelligence (AI) and how it may fit within the institution’s risk management framework,” states the report.

Many community banks maintain a patchwork of legacy systems. At the same time, cyber threats continue to evolve and become more sophisticated. “With increased complexity, there’s a greater need to develop, maintain and document adequate internal controls to guard against these risks,” says Thomas.

Risks to community banks may also be exacerbated by outsourcing to third-party service providers that help deliver and monitor core operations. Regulators are focusing more on the connection points between banks and service providers and emphasizing the importance of third-party risk management processes.

“Community banks need to stay on top of their vendors to be aware of any changes or developments that could impact them,” says Burke. “Additionally, community banks need to remain vigilant amid heightened cybersecurity and check fraud risk, which we often hear are among bankers’ top concerns.” ICBA offers helpful resources to members, including a Cyber and Data Security Resource Center and Check Fraud Resource Guide. 

Meanwhile, the risks of AI have prompted significant attention from regulators. “While AI offers the potential to improve efficiency and reduce costs,” the Deloitte report notes, “it may also amplify traditional risks and require banks to incorporate new technology applications within their risk management frameworks.”

Business as usual … while navigating uncertainty

Community banks face both challenges and opportunities in the current regulatory and compliance landscape. While the new administration offers an opportunity to redefine banking regulations and discover pathways for new business opportunities, it will also require navigating a great deal of complexity and uncertainty.

James R. Gordon, chief operating and financial officer at $400 million-asset Lexicon Bank in Las Vegas, encourages community bankers to keep the lines of communication open with regulators. “You can never overcommunicate with banking regulators,” he says. “Help them focus on desired changes that specifically impact community banks.”

For example, as the regulators focus on revisiting examination procedures, community banks can help focus them on the specific risks of their institutions, including identifying policies that impede their ability to serve local clients. “This will allow the regulatory agencies to address the highest areas of risk,” Gordon says, “versus a checklist approach that paints all community banks with the same brush.”