Texas Community Banks & FFIEC CAT: 2026 Compliance Reckoning + the Wire-Fraud / Core-Processor Attack Surface
The FFIEC Cybersecurity Assessment Tool (CAT) was retired August 31, 2025, and the FFIEC's replacement guidance (FIL-21-2025) directs every bank to map controls onto NIST CSF 2.0 — re-baselining tier-2 maturity without the framework every examiner was using the year before. For community banks from El Paso to Texarkana, that retirement landed on top of GLBA's 2023 nine-element Safeguards Rule (Qualified Individual required; risk assessment annually; continuous monitoring), FDIC 12 CFR Part 304's 36-hour computer-security-incident notification (effective May 1, 2022; any computer-security-incident that the bank reasonably believes could materially disrupt, degrade, or impair its operations), Texas Department of Banking SB 1961 (effective Sep 1, 2025; cyber-incident reporting to the Department of Banking within the regulator-set window), and the Texas Data Privacy & Security Act §541 (60-day breach notice; 30-day AG cure; civil penalty up to $50K per violation). This brief walks through the four pillars — (1) FFIEC CAT prep without the framework, (2) ransomware on correspondent-banking channels, (3) third-party / core-processor vendor risk at small banks, and (4) recent Texas community-bank incidents — and shows how the V59 vertical's $89–$129/endpoint + $2,500+ Command tier maps to each.
The after-action: Heartland's holding company filed receivership with the OCC within days. The bank was a $113M-asset community bank in Elkhart, Kansas — the kind of $500M-asset-and-under institution that defines the Texas community-bank tier.
This is the precedent the OCC, FDIC, and TX Department of Banking now anchor to when examiners walk community-bank risk-assessment artifacts. It is also the precedent that forced every community bank to codify wire-authority escalation policy outside the online-banking session — the kill chain no longer starts with malware, it starts with a phone call.
The TX community-bank threat picture has fundamentally re-priced in the last 24 months. Where pre-2023 the conversation was about FFIEC CAT tier-2 maturity and quarterly board reports, today's conversation runs through the FFIEC CAT sun-setting announcement, the GLBA nine-element requirement, the FDIC 36-hour notification clock, the Heartland Tri-State precedent, the Evolve Bank / Pathward-Kemba / correspondent-banking cascade, and the offline-class-action trajectory of every multi-Texan-record breach. This brief is what the V59 TX Community Banks deliverable speaks to.
Pillar 1 — FFIEC CAT Prep Without the Framework: What "Tier-2 Maturity" Means Now
Through eight revisions the FFIEC CAT was the practical maturity scaffold — banks plotted themselves on a 1–5 baseline across five domains (Cyber Risk Management & Oversight, Threat Intelligence & Collaboration, Cybersecurity Controls, External Dependency Management, Cyber Incident Management & Resilience), and examiners' IT examination work was anchored to that plot. The CAT was retired August 31, 2025. FFIEC member agencies have not replaced it with a comparable tool — they have pointed the industry to NIST CSF 2.0 via FIL-21-2025 and the parallel FFIEC Information Technology Examination Handbook updates (InTRAC + CyFER + IT-HB).
FIL-21-2025 (May 2025) directs every bank to map controls onto NIST CSF 2.0, document tier-2-equivalent maturity across the 6 CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) and the 22 subcategories, and present the mapping at next examination. There is no FFIEC-provided maturity self-assessment score — that work now falls to the bank's own evidence. Examiner tone is already shifting away from "show your CAT profile" toward "show your NIST CSF subcategory coverage + risk-treatment rationale."
For a Texas community bank (asset size $500M and under; ~225 institutions across the state per the FDIC Regional Profile 2024), the practical consequence is that the bank's IT examination work-product must now evidence a tier-2 maturity baseline without the tool that produced it. There is no shortcut — the bank must build the CSF 2.0 subcategory evidence manually (or engage a vCISO/MSP with a pre-built artifact library), and the next IT examination will sample-test that evidence against the FFIEC IT-HB updates.
The bank-aware 9-element GLBA artifact library we ship as part of the Command tier maps each of the nine Safeguards elements (1. inventory of customer information; 2. qualified individual; 3. risk assessment; 4. designed information-security program; 5. safeguards for customer information; 6. oversight of service providers; 7. incident response plan; 8. periodic evaluation + adjustment; 9. annual board report) onto the relevant NIST CSF 2.0 subcategory. That mapping is what turns FFIEC-to-NIST CSF 2.0 from a 90-day scramble into a 14-day posture delivery.
Pillar 2 — Ransomware on Correspondent Banking Channels: The Wire-Fraud Kill Chain
Correspondent banking (the channel by which a community bank's wire transfers clear through a larger institution — Bank of America / Wells Fargo / Truist / JPMorgan or the Federal Reserve's Fedwire) is now the leading ransomware attack surface for community banks. The attack progresses in three stages.
- Stage 1 — Credential-phishing the ACH / wire-approver workstation: an employee with wire-initiation authority is sent a credential-harvesting email; or in the Heartland Tri-State pattern, a deepfake voice-cloned CEO calls to authorize a wire, exploiting policy rather than credentials.
- Stage 2 — Wire-initiation from a legitimate session: the operator's session is valid; the wire is small enough to not trigger dual-control thresholds; the receiving account is a mule account at a different institution; the wire authority has been quietly elevated for the duration of the fraud.
- Stage 3 — Recall / charge-back attempt fails: by the time the bank attempts a Fedwire recall (after the 24-hour correspondent-banking settlement window), funds are gone. Heartland Tri-State lost its entire $47.1M to a single wire over a long-weekend recall gap.
The Evolve Bank & Trust incident demonstrates the parallel dual-extortion pattern. Evolve was a Tennessee-chartered bank serving a fintech / BaaS portfolio; its LockBit exposure (June–December 2024; $185M attempted ransom demand; 7.6M records exfiltrated) targeted the bank's own customer data — but fell most heavily on Evolve's correspondent-banking partners who were on the receiving end of the bank's correspondent-channel sophistication. For TX community banks, the lesson is not about Evolve's IT posture; it is about the way Evolve's correspondent-channel compromise cascades into the bank's own correspondent-banking customers.
FBI IC3 2024 reporting puts BEC losses at $2.77B for the year; community-bank correspondent channels are the second-most-targeted vector after the CFO/CFO-adjacent c-suite deepfake attack. The reason is asymmetry: a community bank's online-banking two-factor controls do not extend to caller-ID telephony, and a wire authorized by an apparently-valid CEO is not a software anomaly the SOC will detect. Detection comes from out-of-pattern wire volume, beneficiary, and time-of-day — not from credential validation.
Pre-authorized wire-channel isolation is the operational answer — what CoreRecon's Command tier delivers as a pre-authorized correspondent-channel isolation playbook — and what the 30-min IR SLA prices in as the operational floor for a community bank's wire-control program. The 4-hour "MDR-detected-but-couldn't-act" gap is what makes Heartland-class collapses possible.
Pillar 3 — Third-Party / Core-Processor Vendor Risk at Small Banks
The community bank's core-processor (the same vendor that posts the daily general ledger, handles ACH returns, and runs the book of accounts) is the single biggest fourth-party vendor risk. The top four are FIS (HORIZON / BankFusion / output solutions core), Jack Henry (SilverLake / CIF 20/20), FISERV (Premier / Precision), and Pathward-Kemba (formerly Kemba Financial, now a Pathward N.A. / Kemba-Pathward custodian capital stack — voluntary receivership + waiver-of-successor-liability precedent).
For Texas community banks, the relevant surface is not just the outright compromise of a core-processor — it is the correspondent-banking mitigation that follows: when Pathward-Kemba filed for custodianship in late 2024, the bank customers that depended on Kemba-Pathward's capital stack for correspondent-channel reserve and FDIC sweep lost their FDIC-insurance-link overnight. The precedent for community banks is this: when your correspondent-channel fourth party collapses, the cash-management and sweep-program failures cascade to your retail customers within 72 hours — and the bank's incident-response team has to absorb both the operational and the compliance-clock obligations.
- Correspondent-banking model: FIS / Jack Henry / FISERV / Pathward-Kemba / Kemba-Pathward. Fourth-party risk: a core-processor compromise cascades into the bank's correspondent channel.
- Wire-authority policy: the Heartland Tri-State kill chain — deepfake voice-cloned CEO + wire authority escalation + out-of-pattern hour + recalled wire — is the 2023–2026 community-bank template.
- Online-banking credential-stuffing: the dual path through ACH-initiation + wire-initiation is the BEC primary vector. Credential stuffing on standing online-banking sessions remains the most common initial vector.
- Outsourced IT / managed-services: the bank that delegates IT to a 4–12-person regional MSP without a tabletop-tested wire-isolation playbook pays the price during the first corporate-account-takeover event.
- Insurance broker / asset-management fourth parties: the asset-management and insurance-broker comfort letters the bank's CFPB examiners review often expose the bank's wire and ACH partners to non-bank MFSP risk.
Pillar 4 — Recent Texas Community Bank Incidents
The 2026 data-anchor for Texas community banks is the Texas Capital Bank class action filed July 2026. Texas Capital is a Dallas-headquartered, super-community-bank with $70B+ assets — outside the strict "community-bank" tier by asset size but inside the threat-model surface area. The class action followed a May 2026 breach that affected 86,067 Texans; the breach notification document filed within TDPSA §541 timelines enumerated the producer / customer-data compromise but did not surface details of the underlying IT compromise. The case is the leading 2026 community-bank-class breach exposure precedent — and the filing is the live reminder that any Texan-record breach produces class-action litigation, regardless of bank size.
Heartland Tri-State Bank was a $113M-asset community bank in Elkhart, Kansas — the kind of institution that defines the small-bank tier common across the Texas panhandle and East Texas. On July 28, 2023, an apparent deepfake voice-cloned CEO authorized a $47.1M wire to a Hong Kong beneficiary over the long-weekend settlement window. A second $20M wire initiated Sunday afternoon failed.
Signal characteristics: out-of-pattern wire authority + Saturday afternoon + Hong Kong correspondent channel + beneficiary that had not appeared in the bank's earlier wire history. Within 48 hours of fraud discovery the holding company filed receivership with the OCC. The bank was unable to recover a single dollar from the wire.
Why this is the precedent: this is the case the FFIEC, OCC, FDIC, and TX Department of Banking now reference when examiners cite wire-authority escalation as a tier-2 GLBA Safeguards element. Every community bank with $1B and under in assets has, in the last 36 months, been asked to produce its wire-isolation policy under examination. Many cannot produce evidence of a tabletop-tested wire-isolation playbook within the same envelope.
Evolve Bank & Trust (Tennessee-chartered, Federal Reserve-regulated; total assets $14.2B as of Q4 2024) was breached by LockBit in June 2024. The exfiltration ran through September; the data was published and re-aggregated through November–December 2024. The breach notification filings in early 2025 quantified 7.6M records exfiltrated; the LockBit demand was $185M.
The correspondent-banking nexus: Evolve serves as a key correspondent / BaaS / fintech partner for community banks and fintechs. LockBit's compromise of Evolve's data systems (rather than its wire-rail) nonetheless cascaded into the bank's correspondent partners, because Evolve's data exposure included beneficiary lists / EFTPS-CIP records / online-banking treasury credentials that downstream banks used to anchor their own correspondent-channel vendor due diligence. For TX community banks, this is the case that re-priced the Pathward-Kemba / Kemba-Pathward custodian-capital-stack and forced every Texas super-community into a 90-day correspondent-channel re-evaluation.
Texas Capital Bancshares (the holding company, NASDAQ: TCBI) is a Dallas-headquartered super-community / commercial bank with ~$70B+ assets, large-business / private-banking focus. The May 2026 breach and July 2026 class-action filing produced 86,067 Texans affected by the personal-data compromise. The case is the leading 2026 community-bank / super-community-bank class-action precedent and the data point the TDPSA §541 enumeration + class-action filing cycle now anchors to.
Pathward (formerly MetaBank) completed its acquisition of Kemba Financial in late 2024; the combined Pathward-Kemba / Kemba-Pathward custodian entity serves as a critical correspondent / capital-stack custodian for a network of community-bank sweep programs and BaaS-fintech correspondent channels. The custodian's custodian of record — the entity responsible for the FDIC-sweep / IPO-reserve settlement — encountered capital-stack shortfall and filed voluntary receivership. The cost to community-bank customers is the loss of FDIC-insurance-link during the transition; the cost to community-bank compliance programs is the contemporary re-evaluation of every correspondent-channel and core-processor fourth-party relationship.
This is the precedent the V59 TX Community Banks vertical deliverable speaks to: when a community bank's fourth-party custodian collapses, the bank must reconcile the GLBA nine-element vendor oversight (Safeguards element 6) with its FDIC 36-hour computer-security-incident notification obligation within 36 hours of discovery.
The Compliance Stack: Five Concurrent Clocks for a Community Bank in 2026
Community banks do not have a single regulator — they have five concurrent reporting clocks, and each one fires from a different triggering event with a different format, recipient, and penalty.
| Regulatory track | Trigger | Clock | Penalty / consequence |
|---|---|---|---|
| FDIC 12 CFR Part 304 | Computer-security incident that could "materially disrupt, degrade, or impair" bank operations | 36 hours from discovery to the bank's primary federal regulator (FDIC, OCC, or FRB) | Heightened FDIC attention + Part 308 / 309 enforcement-action posture |
| GLBA 16 CFR 314.4 nine-element Safeguards Rule | Information-security program effectiveness | Annual risk assessment + annual board report + Qualified Individual internal report | Up to $100K per violation per day for institutions under FTC / CFPB jurisdiction (effective 2023 amendments) |
| FFIEC IT Examination Handbook InTRAC / CyFER (replacing CAT) | Examination day | NIST CSF 2.0 subcategory coverage | Matter Requiring Attention (MRA) for any gap; consent-order precedent for sustained gaps |
| TDPSA §541 (Texas) | Breach of personal data; >250 Texans at once triggers AG-equivalent notice | 60-day breach notice; 30-day AG cure before enforcement | Civil penalty up to $50K per violation; AG injunctive relief |
| TX Department of Banking SB 1961 | Cyber-incident affecting bank operations | Regulator-set window (effective Sep 1, 2025) | Department of Banking informal enforcement + national-bank multi-agency posture |
| CIRCIA 72-hr | Covered cyber-incident at CISA-designated entity | 72 hours from discovery to CISA | Future criteria-jurisdiction enforcement once final rule is operative |
Read those rows together: a single correspondent-channel BEC + dual-extortion incident fires FDIC + GLBA + FFIEC + TDPSA + SB 1961 + CIRCIA within a week. Where the bank is a holding-company-subsidiary of a regional bank holding company, the OCC / FRB reporting track adds a fifth. The 14-day posture assessment + 36-hour IR SLA floor means the bank cannot afford to absorb a 100K-per-day per-violation rate citation; the multiplier that comes from running reports in parallel is the right answer.
Eight Bank-Aware Controls That Close the Gap in 90 Days
These are the controls we deploy most often for TX community banks with $1B and under in total assets. Each maps to a specific GLBA Safeguards element and a specific FFIEC IT-HB / NIST CSF 2.0 subcategory.
The 90-Day Compliance Roadmap for a Texas Community Bank
Days 1–30: Discovery & risk-assessment rebuild. Inventory every correspondent-channel leg, every core-processor surface, every Pathward-Kemba / Kemba-Pathward fourth-party relationship, every wire-elevation policy. Rebuild the bank's FFIEC CAT → NIST CSF 2.0 subcategory mapping using the bank-aware 9-element GLBA artifact library. This is what 14-day delivery looks like.
Days 31–60: Identity & wire-control hardens. Deploy phishing-resistant MFA on every online-banking / ACH / wire touchpoint. Codify the wire-authority escalation policy and dual-control thresholding (every wire > $250K through a beneficiary-confirmed telephone verification). Document the pre-authorized wire-channel isolation playbook and tabletop it at 30-min SLA pacing.
Days 61–90: Detection & response activation. Deploy correspondent-channel anomaly detection (out-of-pattern wires + new beneficiary + off-hours timing). Build the FDIC 36-hr computer-security-incident-notification pre-built narrative template. Run the first wire-channel tabletop (Heartland scenario). Document the 36-hour IR pacing and the FTC Safeguards 9-element artifact library for examiner review.
Assess Your Community Bank Readiness
Get a focused review of FFIEC/GLBA readiness, correspondent-channel and core-processor exposure, and the evidence your team needs for the next examiner conversation.
Start the Bank Assessment →Get the V59 Texas Community Banks Cyber Threat Brief
Review the community-bank threat landscape, FFIEC/GLBA controls, FDIC 36-hour notification workflow, and 90-day hardening roadmap. This link opens the email-gated brief for Texas community banks.
Open the Community-Bank Threat Brief →View the V59 TX Community Banks Landing Page
$89–$129/endpoint. SDVOSB-certified, TX-resident SOC, 30-min IR SLA. Bank-aware 9-element GLBA artifact library + 36-hr FDIC notification workspace + correspondent-banking / core-processor / Pathward-Kemba fourth-party mapping. 14-day FFIEC-to-NIST CSF 2.0 posture delivery.
View TX Community Banks Vertical →
Sources & further reading:
FFIEC FIL-21-2025 (May 2025) — FFIEC CAT retirement & replacement pathway; FFIEC → NIST CSF 2.0 subcategory mapping guidance (effective Aug 31, 2025).
NIST CSF 2.0 (Feb 2024) — 6 functions (Govern, Identify, Protect, Detect, Respond, Recover); 22 subcategories; tier-1 to tier-3 scaling backbone.
FDIC FIL-13-2024 / FIL-46-2024 — computer-security-incident reporting requirements under 12 CFR Part 304.18; 36-hour clock from discovery.
12 CFR Part 304 (effective May 1, 2022) — computer-security-incident notification rule; primary federal regulator reporting.
16 CFR 314.4 (effective Jun 9, 2023) — GLBA Safeguards Rule nine-element information-security program; Qualified Individual required; FTC enforcement jurisdiction.
Texas Department of Banking SB 1961 (effective Sep 1, 2025) — cyber-incident reporting window; Department of Banking reporting requirement.
TDPSA §541 — 60-day breach notice; 30-day AG cure; civil penalty up to $50K per violation.
Heartland Tri-State Bank OCC receivership filing (Jul 31, 2023) — $47.1M CEO-fraud wire + total bank failure; OCC press release.
Evolve Bank & Trust LockBit notification (Feb 2025) — 7.6M records exfiltrated; $185M demand (public notification).
Pathward-Kemba / Kemba-Pathward custodian capital stack voluntary-receivership filings (Q4 2024 — 2025) — waiver-of-successor-liability precedent for correspondent / custodian fourth-party risk.
Texas Capital Bank class action (filed Jul 2026) — 86,067 Texans affected by May 2026 breach; TDPSA §541 enumeration + class-action precedent.
FBI IC3 2024 BEC report — $2.77B annual BEC losses; community-bank correspondent-channel second-most-targeted vector.
Mandiant M-Trends 2024 / 2025 — median dwell time; financial-services sector.
CrowdStrike 2024 / 2025 Global Threat Report — LockBit / Akubra / BianLian / Bl00dy / Play / Rhysida actor profiles affecting community-bank correspondent channels.
FFIEC IT Examination Handbook InTRAC / CyFER updates (2024 — 2025) — IT Examination post-CAT-retirement update path.
Deutsche Bank / Heartland Tri-State post-mortem analyses (Aug 2023 — 2025) — voice-clone / wire-authority escalation / correspondent-channel mitigation.
KY3 / Heartland Tri-State verified reporting (Aug 2023) — $47.1M Hong Kong wire + receivership timeline.
Texas Department of Banking Bulletin (Q4 2024) — community-bank correspondent-channel / fourth-party guidance.
Federal Reserve SR 22-4 / SR 23-4 — third-party / fourth-party risk management for community banks.
OCC Bulletin 2013-29 / 2020-5 — third-party / fourth-party core-processor risk; vendor management updates.