The FDIC Finalized Its Digital Sign Rule in January. April 1, 2027 Is 6 Months Out. Here's the Compliance Checklist Your Dev Team Needs.

TL;DR

• The FDIC finalized amendments to 12 CFR Part 328 on January 22, 2026. The compliance date is April 1, 2027 — about six months out.
• The rule requires the FDIC official digital sign on three specific pages: homepage, login page, and the first page of deposit account opening. Prior requirements for landing pages and every transactional page were removed.
• ATMs must display the sign on the initial screen only; screensavers and idle ads don’t count.
• Most institutions haven’t converted this into a dev ticket yet. Six months sounds like a long time. It isn’t, for anything involving a production website or mobile app.

There’s a compliance deadline that most bank compliance teams have mentally filed under “we’ll get to it” — and every month that passes without a dev ticket makes April 1, 2027 more stressful.

The FDIC finalized its amended official sign and advertising requirements in January 2026. The rule is real, the date is firm, and the requirement is straightforward: your homepage, login page, and account opening flow need to display the FDIC official digital sign clearly, continuously, and conspicuously. Your ATM initial screen too.

What it doesn’t require is almost as important as what it does. The 2023 version of the rule — which was delayed multiple times because it was genuinely difficult to implement — imposed far broader requirements. The January 2026 final rule cut the scope significantly while keeping the consumer protection purpose intact. Understanding the difference between what was required then and what’s required now matters, because some institutions are still scoping compliance work against the wrong version.

Why This Rule Exists

The FDIC official sign rule has one purpose: making sure consumers know which of their money is protected by federal deposit insurance and which isn’t.

That was relatively simple when banking happened at branches with physical signs. It got complicated as banking moved online, and it got complicated in a new way as the BaaS model created arrangements where consumers interact with a fintech app, believe they’re “banking” with that company, and hold funds that are actually sitting at a sponsor bank they’ve never heard of — or, as the Synapse collapse demonstrated in 2024, funds whose exact insurance status became genuinely ambiguous when the middleware company failed.

The FDIC’s updated sign rule is part of a broader post-Synapse effort to make deposit insurance status clear in digital contexts. The FDIC’s 2026 risk review flagged consumer protection and BaaS transparency as examination priorities precisely because the gap between consumer understanding and regulatory coverage had become too visible to ignore.

What Changed from the 2023 Rule

The original Part 328 final rule, adopted by the FDIC board on December 20, 2023 and published in January 2024, required the FDIC official digital sign in a much broader set of locations:

• Every homepage (kept)
• Every login page (kept)
• Account opening pages (kept, narrowed to first page)
• Every “landing page” (removed in 2026)
• Every page where a customer could initiate a deposit transaction (removed in 2026)
• Non-deposit product disclosures on any page where a non-deposit product was mentioned (narrowed in 2026)
• ATM: every deposit transaction screen (narrowed in 2026)

The 2023 rule also imposed specific hex color codes and wordmark size requirements — meaning the exact blue, the exact size, no variations. The FDIC delayed compliance several times after banks raised implementation questions, especially about “landing pages” and “pages where a customer may transact with deposits,” and the FDIC itself flagged the potential for consumer confusion.

The 2026 rule replaced all of that with three mandatory pages, flexible design standards, and a simplified ATM requirement. The consumer protection outcome — ensuring customers know they’re on an insured institution’s deposit platform — is preserved. The implementation complexity dropped substantially.

What the Final Rule Actually Requires

Digital Channels (Website and Mobile App)

Mandatory pages — display must be clear, continuous, and conspicuous:

Design flexibility: The 2026 rule drops the specific hex color codes and font sizes from 2023. The text must still be navy blue or black (or white where the background would make those illegible), in Source Sans Pro Web or a similar font. Text can wrap if space is constrained, and the FDIC still offers a standardized, optional sign through FDICconnect.

One-time non-deposit disclosure: If the bank’s own customers access third-party non-deposit products through the bank’s platform, the one-time notification can now either be dismissed by the customer or disappear automatically after at least three seconds. Under the 2023 rule, the customer had to act to dismiss it before reaching the third party’s platform.

ATMs and Similar Devices

Initial screen: The FDIC official digital sign must appear on the initial screen — the screen displayed when the customer approaches or activates the device, before any transaction begins.

What is NOT the initial screen: Advertising shown on an idle or standby screen — the screensaver loop promoting bank products, services, or events. That carve-out is narrow: the FDIC says every ATM will have at least one “initial screen” carrying the sign, whether or not it runs ads when idle.

Subsequent transaction screens: No requirement. Under the 2023 rule, the sign was required on every deposit transaction screen. Under the 2026 rule, initial screen only.

Non-deposit products on ATMs: If the ATM allows customers to access non-deposit products (insurance, investments, etc.), a non-deposit disclosure appears on the first screen after the customer initiates that transaction. This applies only to the bank’s own customers — not to every person who uses the ATM.

Physical sign exception: Institutions can continue using the physical FDIC sign on ATMs placed into service by April 1, 2027 — or on devices that don’t offer non-deposit products.

The BaaS and Fintech Partnership Question

Here’s where the rule gets more complicated for sponsor banks.

The rule applies to insured depository institutions. It covers their digital channels — their websites, their mobile apps, their ATMs. But for BaaS arrangements, the question is: whose channel is it?

If a sponsor bank issues accounts that customers access through a fintech-branded app, the answer depends on the architecture. If the fintech app is a white-label front end to the bank’s core account infrastructure, the bank’s sign requirements likely apply to those digital touchpoints. If the fintech app is genuinely a separate interface to the bank’s accounts, the analysis is less clear, and that ambiguity is exactly what you don’t want to be sorting out mid-exam.

The practical compliance position for sponsor banks: confirm in your BaaS partnership agreements which party is responsible for ensuring the FDIC digital sign appears in the required locations in any interface through which end customers access deposit products. If you don’t have that provision in your agreements, add it before April 2027. If you do have it, verify that your fintech partners are actually building against the right version of the requirement — the 2026 rule, not the more demanding 2023 rule they may have last read.

This connects directly to the broader vendor oversight obligations sponsor banks carry. For a recent enforcement example, see our analysis of the OCC’s BSA/AML consent order against Community Federal Savings Bank.

The Compliance Checklist

This is the practical audit your team should run in the next 30 days:

Step 1: Map your digital channels List every website, mobile app, and ATM you operate. For each, identify: who built it, who maintains it, what the deployment process looks like, and how long a change typically takes to reach production.

Step 2: Confirm the sign is present on mandatory pages For each digital channel, check homepage, login page, and account opening first page. If the sign is already present and meets the “clearly, continuously, and conspicuously” standard, document it. If it’s absent or doesn’t meet the standard, open a defect ticket now.

Step 3: Audit non-deposit product pages Identify every page in your digital channels that is primarily dedicated to a non-deposit product (investment accounts, insurance, etc.). Confirm non-deposit disclosures are present on those pages. Confirm the disclosure is not appearing on pages it doesn’t need to appear on — over-disclosure creates consumer confusion, which is the opposite of what the rule is trying to achieve.

Step 4: Check ATM initial screen configuration For each ATM model, confirm that the initial screen — the screen displayed before a customer begins a transaction — carries the FDIC sign. Confirm the screensaver/idle screen does not trigger the requirement (you don’t need to put the sign on an idle display, but making sure your ATM software knows the difference matters).

Step 5: Review BaaS partner agreements For any fintech partner whose app gives end customers access to your deposit products, confirm the contract assigns responsibility for the digital sign requirement, specifies compliance with the April 1, 2027 deadline, and gives you audit rights to verify compliance.

Step 6: Open dev tickets Any gap found in Steps 1–5 becomes a dev ticket now. Six months is a reasonable timeline for a straightforward front-end change. It’s a stressful timeline if legal review, accessibility testing, UI QA, and production deployment all have to happen in weeks four through six.

A Note on Examiner Expectations

Compliance isn’t required until April 1, 2027, so there’s nothing for an examiner to cite yet. But examiners can ask how you’re planning for it, and the fix runs straight through your website and app change-management process, which is the kind of control the FDIC’s IT examinations already look at.

An institution that can show documented compliance planning for the April 2027 deadline — including a gap assessment, assigned owners, open dev tickets, and a completion timeline — is in a materially different examination posture than one that hasn’t started yet.

So What? Six Months Is a Realistic Window If You Start Now

The FDIC’s final rule is a more reasonable compliance task than the 2023 version was. Three mandatory pages, flexible design, simpler ATM requirements. No reason this should be a fire drill.

But it will become a fire drill for institutions that wait until Q1 2027, discover that a change to the login page requires a security review, an accessibility audit, and a UI regression test cycle, and are staring at an April 1 deadline with two weeks of slack.

The compliance essentials bundle includes an incident response kit, data privacy compliance kit, BCP/DR kit, and SOC 2 checklist — the broader regulatory compliance infrastructure that examiners review alongside specific rule requirements like the digital sign. For FDIC-examined institutions managing multiple compliance obligations, having consistent, documented programs across domains matters as much as any single rule’s requirements.

The FDIC’s final rule was published in the Federal Register on January 29, 2026. Analyses from Davis Wright Tremaine, ABA Banking Journal, Winthrop, and Pinion provide additional detail. This post is for informational purposes and does not constitute legal advice.