What You'll Learn

If you work in bank compliance, you know Regulation W 23A is no joke. It’s the Federal Reserve’s main weapon to stop banks from making sweetheart loans to their own insiders—think executive officers, directors, and their family businesses. I’ve spent years advising mid-size banks on this rule, and I can tell you: the details are brutal. One slip on the 10% limit or a poorly documented exception, and you’re looking at a formal enforcement action.

This article breaks down Regulation W 23A in plain language, highlights the traps that catch even experienced teams, and gives you a real-world example of what happens when compliance fails. No fluff, just what you need to know.

What Is Regulation W 23A?

At its core, Regulation W (12 CFR 223) implements Sections 23A and 23B of the Federal Reserve Act. Section 23A—often called “23A”—restricts transactions between a bank and its affiliates. An affiliate includes any company the bank controls, or that controls the bank, plus directors, executive officers, and their immediate family.

The rule caps covered transactions at 10% of the bank’s capital stock and surplus for any single affiliate, and 20% in aggregate for all affiliates. Covered transactions include loans, asset purchases, guarantees, and even certain derivatives. And the collateral requirements are strict: loans to affiliates must be fully secured with a 100% to 130% collateral margin, depending on the type.

What Counts as a Covered Transaction?

It's broader than you think:

  • Loans or extensions of credit to an affiliate (including overdrafts).
  • Asset purchases from an affiliate (including loan participations).
  • Investments in affiliate securities.
  • Guarantees, letters of credit, and acceptances on behalf of an affiliate.
  • Certain derivative transactions that expose the bank to affiliate credit risk.

I once worked with a community bank that thought intraday overdrafts for an affiliate didn’t count—they did. That mistake cost them a consent order.

Why It Matters for Every Bank

Regulation W 23A is a hard limit, not a guideline. Exceed it, and you violate the Federal Reserve Act. The Fed’s enforcement division treats 23A violations seriously—I’ve seen civil money penalties, prohibitions on asset growth, and even removal of officers.

But the real pain? Reputational damage. If your bank gets tagged for insider lending abuse, investors and depositors lose trust. And examiners will dig into every related transaction for years after.

Key takeaway: 23A compliance isn’t just about legal risk. It’s about protecting your bank’s charter and reputation. One big violation can trigger a downgrade in your CAMELS rating.

How to Comply with 23A (Without Losing Your Mind)

Compliance starts with mapping every affiliate relationship. I recommend a living affiliate inventory updated at least quarterly. Then, for each transaction, you need to:

  1. Measure the size of the transaction against the 10%/20% caps (based on the most recent capital and surplus).
  2. Check collateral requirements – loans must be secured with eligible collateral, and the margin depends on the collateral type (e.g., U.S. Treasuries need 100% margin, other collateral may need 130%).
  3. Document the arms-length term – the transaction must be on terms consistent with what the bank would offer a non-affiliate. This is where most banks slip.
  4. Get prior board approval for large transactions (aggregate of $500,000 or more, or any amount that would push the total over 5% of capital).

The Most Overlooked Exception: The 17-A(3) Exemption

Many compliance teams forget that intraday credit extensions to affiliates can be exempt if they are covered by the bank’s daylight overdraft program and are pre-approved by the Fed. But I’ve seen banks rely on this exemption without proper documentation – then fail an exam.

Another common mistake: assuming “low-risk” transactions like overnight repurchase agreements are fully exempt. They’re not. Repurchase agreements with affiliates are covered unless they meet narrow conditions in Section 23A(d).

Common Pitfalls That Trigger Fed Enforcement

From my field experience, here are the top 3 traps:

PitfallWhy It HappensHow to Avoid It
Misidentifying affiliates Banks forget to include family members of executive officers or out-of-state portfolio companies. Run a quarterly affiliate tree with input from HR and legal.
Ignoring aggregate limits Tracking only the single-affiliate 10% cap, but the 20% aggregate cap gets busted. Build a dashboard that sums all affiliate exposures in real time.
Poor collateral documentation Valuation is stale or margin is miscalculated. Require monthly collateral revaluation for all affiliate loans.

I once visited a bank where the compliance officer confidently said “we don’t have any affiliates.” Turned out the CEO personally guaranteed a loan to a company owned by his brother-in-law – classic affiliate under 23A(b)(3). They got a written agreement as a result.

Case Study: Northern Trust's $20M Lesson

In a widely publicized enforcement action, the Federal Reserve fined Northern Trust Company $20 million for repeated violations of Regulation W 23A. The bank had engaged in securities lending transactions that effectively provided unsecured credit to an affiliate – the investment advisor. The transactions were structured as overnight lending, but they failed to meet the exemption for intraday credit because they weren't fully collateralized within the same business day.

Northern Trust also lacked adequate internal controls to identify and measure affiliated transactions. The Fed’s order required the bank to revamp its compliance system, hire an independent consultant, and submit to quarterly reporting for two years.

The lesson? Even sophisticated banks can trip on the technicalities of 23A. If you're doing any securities lending or repo with affiliates, get a regulatory lawyer to review the structure before you execute.

Frequently Asked Questions

Does Regulation W 23A apply to foreign affiliates of a U.S. bank?
Yes, if the foreign affiliate is a company that the bank controls (more than 25% voting shares) or that controls the bank. The Fed’s rule covers both domestic and foreign affiliates. But there are special exemptions for certain foreign branches and subsidiaries – consult with a specialist because the intercompany funding rules are notoriously tricky.
What happens if we accidentally exceed the 10% limit for one day?
Technically, a violation occurs the moment the cap is exceeded, even intraday. The Fed expects you to have systems that prevent the breach. If it’s a genuine error, immediate remediation (e.g., calling the excess loan) may reduce but not eliminate the penalty. I’d recommend self-reporting to your primary regulator within 30 days – the severity of enforcement often depends on how quickly you correct it.
Are there any exceptions for small banks?
The rule applies to all banks regardless of size. However, the Fed provides a “small bank” exception for banks with less than $500 million in assets: they can use a simplified calculation for aggregate limits based on Tier 1 capital instead of total capital. But the substantive limits on transactions remain the same. Don’t assume you’re off the hook just because you’re small – examiners still check.

This article draws from my experience as a banking compliance advisor and publicly available enforcement actions. All information reflects current rules under Regulation W as interpreted by the Federal Reserve Board. For specific guidance, consult your legal team.