$150M in Flood Penalties. The Rules Didn't Change, the Banks Didn't Learn.

What did the FDIC's $150M in flood penalties actually cover?

In late April, the FDIC released its spring 2026 consumer compliance supervisory highlights, the annual public scorecard of how supervised banks are performing on consumer compliance. One figure stood out: $150 million in civil money penalties tied specifically to flood insurance violations and unfair practices, alongside 16 formal enforcement actions. The single most cited violation behind those actions was banks approving loans on properties in flood zones without the required flood insurance in place at closing.

The requirement itself is decades old. At least 13% of all US commercial properties require flood insurance under the National Flood Insurance Act and the Flood Disaster Protection Act of 1973, which require federally regulated lenders to mandate flood coverage on any loan secured by a property in a special flood hazard area. The FDIC's role is enforcement: as the regulator of FDIC-insured banks, it examines whether those banks comply, and when they do not, it is the body issuing penalties, ordering restitution, and putting enforcement actions on the record.

If the violation count fell, why is this getting worse?

At a glance the numbers look like improvement. In 2025 the FDIC cited 1,155 consumer protection violations, and the Flood Disaster Protection Act came in third with 131, down slightly from the prior year. But the type of failure has not changed at all. In the prior year's report, this exact violation, closing loans in flood zones without required coverage, made up 45% of all flood-related citations. Banks are not learning from it, and the same mistake repeats year after year.

Two things make that more alarming, not less. The FDIC's workforce dropped about 20% this year, and its Office of Inspector General has openly questioned whether the agency has enough skilled examiners to conduct the exams it is statutorily required to perform. So there are fewer people looking, and flood is still a top-three issue. If exam capacity returned to historical levels, that 131 would climb far faster, because the base rate of the problem has not moved.

Why does flood insurance compliance keep failing?

If everyone knows the rules, why does this keep happening? The hosts pointed to three structural reasons.

The statute has four compliance moments, not one. Adequate flood coverage has to be in place when a loan is made, increased, extended, or renewed. That means verifying coverage at renewal, at extension, and when limits change, not just at origination. Most of the tracking failures in these reports happen at renewal or extension, and every one of those moments is a handoff: loan officer to underwriter to closing to servicing to a third-party tracking vendor to the borrower's broker to the carrier. That is six or more places a file can break, and at most banks no single person owns the whole chain, so failures fall through institutionally.

The private flood insurance final rule is a test most lenders cannot run. For decades the National Flood Insurance Program (NFIP) was effectively the only option lenders could accept. Since 2019, regulators have allowed private-market flood policies as an alternative, which sounds like more capacity and more options. The catch is that a private policy must meet specific federal criteria: coverage at least as broad as the NFIP, issued by a state-licensed insurer or eligible surplus-lines carrier, with specific cancellation-notice requirements and a flood definition that meets federal standards. Miss one box and the lender is in violation. Most lenders are not insurance compliance attorneys, so they either default to the NFIP, which caps at $500,000 per commercial building and is inadequate for most CRE assets, or they accept private flood without running the compliance check and roll the dice.

Risk Rating 2.0 changed the paperwork. FEMA's newer NFIP pricing methodology changed how policies present on a declarations page, and some private and NFIP policies no longer show flood-zone information the way they used to. Lenders whose tracking systems were built around old documentation patterns are now missing signals they used to catch. The rules barely changed, but the documentation did, and the old templates cannot see the new format.

Stack it up, a top-three FDIC violation, fewer examiners, six handoffs, a private-flood test most lenders skip, and a changing declarations page, and you have a problem that will not resolve on its own.

What the data shows: a 4x spread on nearly identical flood risk

To make it concrete, the team pulled Florida multifamily flood data from the Advocate terminal. Every policy in the view is a standalone flood policy on a property in a designated flood zone, and the asset profile is tight: a median of 36 units, roughly 17,000 square feet, two stories, built in 1981, and about eight miles from the coast. Standard Florida garden-style multifamily, the bread and butter of that commercial property insurance segment.

The pricing is anything but uniform. The median rate on line is $4.77, but the range runs from $1.47 at the low end to $5.91 at the high end, a 4x spread for the same broad asset profile in the same kind of flood zone. Premium per door tells the same story: a median of $132, with a range from $50 to $276, a $226 gap on comparable buildings. Ten carriers write the segment, with Homesite near the low end and Great Lakes Insurance at the high end, and the highest placement volume going to Wright National Flood Insurance Company and Lloyd's.

Ratings look reassuring at first: 79% of these policies sit with an A+ rated carrier and 16% with an A-rated one. But an AM Best rating is only one of the boxes a private flood policy has to check to be federally compliant. On exam day, the FDIC is asking whether the policy meets the private flood insurance final rule, not whether the carrier is well rated.

What lenders, owners, and brokers should do

Three audiences, three sets of actions.

Lenders have three things to tighten before the next exam. Audit the tracking workflow at every loan lifecycle moment, not just origination, including renewals, extensions, and limit changes. Build a documented process for evaluating private flood policies against the final-rule criteria rather than accepting whatever lands in the inbox. And review force-placed coverage triggers and timing, because most of what the FDIC cites are timing failures, not coverage failures.

Owners and operators should treat it simply: a lender's tracking failure becomes the borrower's problem the moment it becomes the lender's finding. Force-placed coverage typically costs two to five times the market rate, so the borrower pays the penalty for a process failure that was not theirs. Pull the flood policy, confirm it clears the federal compliance bar, and confirm the lender holds clean documentation. Verify the chain rather than assuming it.

Brokers are the connective tissue. The lenders getting this right tend to work with brokers who proactively confirm compliance status at each renewal rather than assuming it. That is the difference between a clean exam and a cited one.

Why the data gap is the real problem

The throughline is that the cost of getting flood wrong has gone up while visibility into the problem has stayed flat, and that gap is what the FDIC is working with on exam day. The data needed to close it exists; it just sits in places most market participants cannot see. The carrier list, the rate-on-line ranges, and the per-door spreads walked through above live in the Advocate terminal for every zip code, which means a lender can pull them before accepting a private flood policy, and an owner can pull them before signing a renewal. It is the same picture the regulator sees, on your side of the table for once. For owners staring at a renewal quote of $5.91 when the median is $4.77, that benchmark is not trivia, it is leverage.