Regulation W limits bank exposure to affiliates and enforces arm’s-length terms — controls that matter even more as AI and cloud make intra-group services pervasive. Here’s how to embed 23A/23B into your tech stack, by design, not after the fact.
Why Regulation W Still Matters in 2025
In a world of shared services, inter-company APIs, and AI platforms, one guardrail keeps banks from leaking safety-net support to related parties: Regulation W (12 CFR Part 223). Reg W implements Sections 23A and 23B of the Federal Reserve Act to limit exposures to affiliates and enforce arm’s-length dealings. It remains foundational to safety and soundness as banks scale AI, cloud, and data-sharing across complex groups.
What Regulation W Does
- Caps exposure to affiliates through strict quantitative limits (23A)
- Requires market terms for transactions with affiliates (23B)
- Forbids certain risky structures, such as purchasing low-quality assets from affiliates
- Demands collateral for credit transactions with affiliates at set minimum margins
Section 23A: Quantitative Limits & Collateral
Covered transactions include loans or extensions of credit to an affiliate, guarantees/letters of credit on its behalf, purchases of affiliate assets or securities, and certain derivatives/securities-financing exposures.
Collateral requirements for credit transactions with affiliates scale by asset type: at least 100% for U.S. government obligations (or other specified eligible items), 110% for state/political subdivision obligations, 120% for other debt instruments, and 130% for stock, leases, or other real/personal property. Affiliate-issued securities and low-quality assets are ineligible collateral.
Section 23B: The Market-Terms Rule
For covered transactions and other dealings — asset sales, services under contract or lease — the bank must ensure terms no less favorable to the bank than those prevailing for comparable non-affiliate transactions. This is Reg W’s arm’s-length, market-terms requirement.
Who Counts as an “Affiliate”?
“Affiliate” covers the bank’s parent, companies under common control, and certain other companies specified by rule or order. Critically, a subsidiary of the member bank is generally not an affiliate, except where the rule lists exceptions — depository institutions, financial subsidiaries, or companies directly controlled by other affiliates/shareholders. Compliance logic must reflect these carve-outs precisely.
A tech or cloud entity within the group becomes an affiliate only if it meets the control tests in §223.2 — ownership, common control, or Board/agency determination. Build systems to determine control status dynamically before applying 23A/23B logic.
Controls Operating Model: What Good Looks Like
- Affiliate Master & Entity Resolution — a single source of truth for control relationships, including exceptions for bank subsidiaries.
- Limit & Collateral Engine — automate 23A headroom (10%/20%) and collateral margining (100/110/120/130%).
- Market-Terms Evidence (23B) — comparable vendor pricing, benchmarking, and contract files linked to each transaction.
- Prohibited Asset Filters — prevent purchases of low-quality assets from affiliates; treat affiliate-issued securities as ineligible collateral.
- Reporting & Governance — FR Y-8 quarterly reporting where applicable, board-level dashboards, and exam-ready documentation.
Case Example: An AI Affiliate
A technology affiliate licenses an AI credit-risk engine to the bank. The contract sits under 23B and must be arm’s-length. Any credit features — affiliate receivables financing, guarantees — trigger 23A calculations and possibly collateral. Monitoring covers exposure headroom, collateral sufficiency, and market-terms evidence stored with the contract record.
Enforcement Themes: What Trips Firms Up
- Misclassifying subsidiaries vs. affiliates, and missing the exceptions
- Insufficient collateral or the wrong margin type — e.g., using affiliate securities
- Treating service contracts as “non-covered” and ignoring 23B comparability
Executive Takeaways
Treat Reg W logic as code, not a checklist — embed it into contracting, AP/AR, treasury, and data-sharing workflows. Tie entity resolution to limit engines and deal workflows to stop breaches before they book. Maintain evidence for market terms and collateral at the transaction level, and reconcile quarterly to FR Y-8 where required.
Conclusion
Modernization doesn’t change Reg W’s intent: prevent contagion and favoritism in intra-group dealings. The banks that move fastest safely are the ones that make Reg W machine-enforceable — measuring exposure, validating collateral, and proving market terms by design.
The views expressed in this article are solely my own and are based on a review of publicly available information from reputable sources, including 12 CFR Part 223, Federal Reserve FAQs on Regulation W, and FR Y-8 reporting guidance. This content is intended for educational and informational purposes only and does not represent the views, policies, or positions of my employer or any other organization.