Beyond the Checklist: What the Move to Materiality-Based Supervision Means for a Fast-Scaling First Citizens

Regulators are recalibrating what counts as a supervisory problem. For a bank that has more than tripled its balance sheet through acquisition in three years, the harder question isn't compliance; it's whether the risk architecture built for a simpler institution can still draw a straight line from a control gap to a dollar of exposure.

Over the past several months, U.S. banking regulators have sent a consistent signal: the supervisory relationship is being recalibrated around materiality.  The Federal Reserve's September 2026 update to its supervisory operating principles superseded its April statement, emphasizing early, proportionate action on significant risks and clarifying that quantitative indicators of harm are not currently required. Separately, the OCC and FDIC finalized revised standards for unsafe or unsound practices and matters requiring attention, effective November 2026. The FFIEC followed in May with a proposal to revise the CAMELS rating framework itself, shifting emphasis away from procedural and documentation gaps that carry limited financial consequence and toward outcomes that genuinely threaten a bank's condition. Regulators have also continued to retreat from “reputation risk” as a standalone basis for supervisory criticism.

Taken together, these moves describe a broader trend rather than a single rule change: examination regimes across the banking system are being redesigned to separate signal from noise. For institutions with mature, well-documented control environments, this can look like welcome relief from procedural friction. But it is not a lowering of the bar; it is a repositioning of it. Where a decade of post-crisis supervision rewarded banks for demonstrating that a control existed and was tested, the emerging model rewards banks for demonstrating that a control's absence would actually matter: in capital, in earnings, in liquidity, in customer harm. That is a fundamentally harder analytical task, and it requires a different kind of risk infrastructure: one that can trace a line from business activity, to risk, to control, to residual exposure, to financial or customer impact, on demand.

Why this lands differently at First Citizens

Few large U.S. banks have grown as quickly, or through as many distinct heritages, as First Citizens. A little over three years ago, First Citizens was a well-regarded but comparatively modest, deposit-funded retail and community bank rooted in Raleigh and Smithfield, North Carolina, a franchise built over more than a century on relationship banking rather than balance-sheet scale. The 2022 acquisition of CIT and the 2023 acquisition of the core operations of Silicon Valley Bank transformed that profile almost overnight, placing First Citizens among the top twenty U.S. banking institutions. First Citizens BancShares reported $236.8 billion in consolidated assets as of June 2026.  The acquisition of 138 BMO branches closed on September 4, 2026, extending the franchise's geographic footprint further, with their conversion to First Citizens platforms announced on September 8, and the planned fourth-quarter 2026 rebrand of the SVB franchise into First Citizens Innovation Banking and First Citizens Fund Banking signals continued ambition in innovation-economy and fund-finance lending, alongside stated plans to expand into cryptocurrency, payments, and international banking.

That is a remarkable growth story. It is also, from a supervisory standpoint, a genuinely complicated one. First Citizens today operates a blended risk environment: a legacy community and regional-bank control culture built for a simpler, deposit-and-loan balance sheet, sitting alongside SVB's more model-intensive, innovation-economy and fund-banking businesses and CIT's specialty commercial-finance operations, all now subject to the enhanced expectations of the large financial institution framework. Each heritage organization brought its own issue-management conventions, its own sense of what counts as a material finding, and its own vintage of RCSA and control-testing methodology into the combined enterprise.

A materiality-based exam regime does not ask whether a bank has closed its issues. It asks whether the bank can prove which issues were ever the ones that mattered, across every business it has acquired.

This is precisely the environment in which materiality-based supervision is hardest to satisfy convincingly. It is one thing to connect a control deficiency to a financial outcome within a single, homogeneous business. It is another to do so consistently across a retail branch network, a specialty commercial-finance book, and an innovation-economy lending and fund-banking franchise, each with different risk drivers, different data lineages, and different legacy definitions of severity, and to do it in a way that satisfies an examiner looking for one coherent enterprise view rather than four overlapping ones.

There is a genuine opportunity here, not just a burden. A shift to materiality gives First Citizens a rare mandate to re-rank its existing issue and RCSA inventory by true financial and customer consequence, retiring low-value remediation effort and redirecting capacity toward the exposures that would actually move the needle on capital, earnings, or client trust. Done well, that reprioritization also gives the Board and CRO a cleaner enterprise-wide narrative to bring to examiners: one line, not four.

The question worth sitting with: as First Citizens continues to integrate its acquired platforms and pushes into new product lines, does its current issue-management and control-testing framework already draw a defensible line from deficiency to material outcome across all of those businesses, or was that architecture built for a smaller, more singular bank than the one First Citizens has become?

Sources: Federal Reserve Board, Updated Statement of Supervisory Operating Principles (April 2026); FFIEC, proposed revisions to the Uniform Financial Institutions Rating System (May 2026).