A fintech is not a bank. When its app says FDIC, a rule sets what else it must say, and how it must say it.
FDIC insurance disclosures for a fintech come from subpart B of 12 CFR part 328. The rule applies to any person, not only to banks. A fintech that mentions FDIC insurance must name the bank that holds the money, say that it is not an FDIC-insured bank itself, say that insurance covers only the failure of that bank, and, where it relies on pass-through coverage, say that conditions apply.
Two parts of one regulation
Part 328 has two subparts, and they reach different parties.
| Subpart A | Subpart B | |
|---|---|---|
| Who it binds | Insured depository institutions | Any person, including a fintech, a marketer or a publisher |
| What it governs | The official FDIC sign, the digital sign, the advertising statement | False advertising and misrepresentation of insured status, misuse of the FDIC name or logo |
| Sections | 12 CFR 328.0 to 328.8 | 12 CFR 328.100 to 328.109 |
Subpart B dates from 2022 (87 FR 33420, June 2, 2022) and was amended in January 2024 (89 FR 3531). Its scope section, 12 CFR 328.100, covers anyone who falsely uses the FDIC name or logo to suggest a product is insured, anyone who knowingly misrepresents whether or how a product is insured, and anyone who aids or abets them. That last clause reaches past the program itself to agencies and other publishers that run its ads.
What a nonbank has to disclose
Section 328.102(b)(5) lists material information that a statement about deposit insurance cannot leave out. For a fintech program, four items matter.
| When the statement… | It must clearly and conspicuously… |
|---|---|
| Is made by a nonbank and says or implies the product is FDIC insured | Identify the insured bank or banks where the consumer’s deposits may be placed |
| Is made by a nonbank about deposit insurance | Disclose that the company is not an FDIC-insured bank and that insurance covers only the failure of the insured bank |
| Appears where deposits and non-deposit products sit close together on a website | Say the non-deposit products are not insured by the FDIC, are not deposits and may lose value |
| Concerns pass-through deposit insurance | Disclose that certain conditions must be met for pass-through coverage to apply |
The rule gives an example of a clear statement for the second item: a statement that the company is not an FDIC-insured bank and that deposit insurance covers the failure of an insured bank.
Two carve-outs matter for payment apps. Services unrelated to financial products, and physical goods, are not non-deposit products for the third item. And a product that lets consumers store, send or receive fiat money and does not fluctuate in value does not need the “may lose value” line.
The pass-through item connects to the account structure. How pass-through coverage works, and the three conditions the FDIC checks when a bank fails, is covered in fbo account. How platforms describe account-like balances is covered in embedded banking.
Words and images that trigger the rule
A statement counts as a statement about deposit insurance if it uses an FDIC-associated term or image, or if it suggests anything about whether, how far or in what way FDIC insurance applies. The terms include “FDIC,” “Federal Deposit Insurance Corporation,” “FDIC-insured,” “FDIC insurance,” “insured by FDIC,” “member FDIC” and similar phrases. The images include the FDIC seal, the official sign, the official digital sign and similar marks.
A statement violates the rule if it would tend to mislead a reasonable consumer, whether or not anyone was actually misled. The rule treats some claims as material by default. Among them: that uninsured products are insured, that coverage is larger or smaller than the law provides, that insurance pays out in circumstances other than those the law sets, or that a bank can convert insured deposits into uninsured debt or equity.
One line is absolute. Under 328.102(a)(1), no person may use FDIC-associated terms in a business name or firm name to imply that an uninsured financial product is insured.
What the bank’s own app must show
Subpart A applies to the bank, not to the fintech. It still shapes program screens, because many programs share screens with the sponsor bank. The FDIC amended the digital signage rule on January 29, 2026 (91 FR 3801). The amendments took effect on March 2, 2026, and compliance is required by April 1, 2027.
Under the amended 12 CFR 328.5, a bank’s digital deposit-taking channel must display the FDIC official digital sign on:
- The initial page or homepage of the website or application.
- The login page.
- The page or screen where the consumer first starts opening a deposit account.
Pages primarily dedicated to non-deposit products need signage saying those products are not insured by the FDIC, are not deposits and may lose value. When a logged-in bank customer leaves the bank’s channel for a nonbank third party’s non-deposit product, the channel must show a one-time-per-session notice with the same three statements. The notice can close when the customer clicks or swipes, or disappear on its own after at least three seconds.
The final rule’s examples help with layout. A login page that shows the digital sign immediately next to the username and password fields meets the standard. So does non-deposit signage near the bottom of a page, if bold or larger text, or a text box, sets it apart from the smallest text on the page. How a bank applies these rules to co-branded screens is a question for the bank, and it belongs in the how to choose a sponsor bank checklist.
How the FDIC enforces it
The rule sets out a path that can start with a letter. Under 12 CFR 328.106, if the FDIC has reason to believe a person is misusing the FDIC name or making false or misleading statements about deposit insurance, it may send an advisory letter to that person and to anyone who aids or abets the conduct, including a third-party publisher.
That letter changes the legal position. A misrepresentation is deemed knowingly made if the person made it, was told by the FDIC or another authority (the rule names the FTC, the CFPB, the Department of Justice and state bank supervisors, among others) that it was false or misleading, and then kept making the same or a substantially similar statement. Investigations sit with the FDIC’s General Counsel under 328.104. Where the conduct involves a bank supervised by another federal agency, 328.105 lets the FDIC recommend action to that agency and act itself if the agency does not move within 30 days.
A disclosure checklist for program teams
- Every page, ad and app screen that mentions FDIC insurance names the bank that holds the funds.
- The same place says the company is not an FDIC-insured bank and that insurance covers only the failure of the insured bank.
- Pass-through claims say conditions must be met, and the ledger behind them can show each customer’s share.
- Stored-value balances that do not fluctuate are not described as deposits.
- Investment, crypto and other non-deposit products shown next to deposit features carry the three-part notice.
- No product, domain or business name uses FDIC terms.
- Agencies and affiliates that publish the program’s ads work from approved copy.
