Tioga Franklin Is the Fifth Bank Failure of 2026. What Should Community Banks Take From It?
By Kalgi Ganatra, Director of Advisory, Cathedral CPAs & Advisors
On August 21, 2026, the Pennsylvania Department of Banking and Securities took possession of Tioga Franklin Savings Bank in Philadelphia, citing an unsafe and unsound condition. The FDIC was appointed receiver, and Second Federal Savings and Loan Association of Philadelphia agreed to assume the bank’s deposits and ds purchase azhefuebloiiq all of its assets. Tioga Franklin was a small institution: as of June 30, it reported approximately $68 million in assets and $67 million in deposits, and the FDIC estimates the failure will cost the Deposit Insurance Fund roughly $5.5 million. It is the fifth bank failure of 2026, though five failures are not a signal that the banking industry as a whole is in trouble.
What makes Tioga Franklin worth examining is not the failure itself, but the fact that it was not a surprise. The problems that led to the bank’s closure did not appear on August 21; there was a public regulatory record well before the bank failed, and it offers a useful roadmap for what other community banks should be checking in their own institutions.
The Warning Signs Were Already There
In April 2024, the FDIC issued a Consent Order involving Tioga Franklin following a 2023 examination. The order addressed a wide range of areas: board supervision, management performance, capital planning, liquidity and funds management, interest rate risk, audit, credit administration, BSA/AML, internal controls, and information systems. That breadth is the important detail. This was not an isolated issue within a single department; it was a set of weaknesses spanning management, financial performance, compliance, audit, technology, liquidity, and board oversight, all at once, which is precisely what makes problems like these difficult to correct once they take hold. That combination is what makes Tioga Franklin relevant to other community banks, whether or not they share any of the same specific issues.
An Audit Finding Is Only Useful If Something Changes
Community banks deal with findings constantly. Internal Audit identifies something, Compliance identifies something, an outside consultant makes a recommendation, or an examiner raises an issue. Management responds, an action plan is created, and eventually the item gets closed. But there is an important difference between closing a finding and fixing the problem that caused it. The FDIC’s Consent Order required Tioga Franklin to complete internal and external audits on a timely basis, communicate findings to management and the board, and ensure corrective action was actually taken — a basic requirement that is harder to meet in practice than it sounds. Deadlines get extended. The same issues resurface. Testing gets completed because it’s on the audit calendar, even after the institution’s risk profile has shifted, and management often fixes the immediate issue without checking whether the same weakness exists elsewhere.
The question worth asking is whether an Internal Audit function is telling management something it does not already know. If it only confirms what management already believes, the process likely does not have enough independent challenge built into it. Many community banks close that gap with outsourced or cosourced Internal Audit support that brings a genuinely independent perspective to the process.
Your Audit Plan Should Change When Your Bank Changes
Most community banks operate with limited people and resources, which makes prioritization critical. When a deposit mix shifts, lending concentrations increase, a new system goes live, a key employee leaves, the bank enters a new market or product line, or third-party reliance grows, the institution’s risk profile changes and the Internal Audit plan should change with it. The areas receiving the most audit attention today are not always the areas carrying the most risk today. Audit plans have a tendency to keep testing the same areas simply because they have always been part of the annual plan; that satisfies the calendar, but it does not necessarily address the risk.
Capital and Liquidity Plans Need to Work Outside of the Boardroom
The Tioga Franklin Consent Order also required significant work around capital and liquidity. The bank had to revise its strategic plan and establish a path to maintaining a leverage ratio of at least 9 percent and a total capital ratio of at least 12 percent, while identifying primary and contingent sources of capital and outlining strategies for a sale, merger, or liquidation if sufficient capital could not be obtained. Liquidity requirements went well beyond maintaining a policy: the FDIC required analysis of funding needs, deposit concentrations, noncore funding, cash flows, stress scenarios, and early warning indicators.
A capital plan or contingency funding plan can look sound under normal conditions; the real test is what happens when conditions are not normal. What happens if deposits leave faster than expected? How quickly can the institution access additional funding, and has that funding source actually been tested? What happens to capital if credit quality deteriorates or earnings stay under pressure, and at what point do management and the board take action? Those questions are far easier to work through before an institution actually needs the answers.
BSA/AML Needs the Right Resources Behind It.
The Consent Order also included extensive requirements around Tioga Franklin’s BSA/AML program, covering internal controls, staffing, customer due diligence, monitoring, reporting, training, risk assessment, independent review, and the responsibilities of the BSA Officer. The broader lesson extends beyond BSA/AML: a community bank does not need the staffing of a national bank, but it does need staffing, systems, and outside resources that match the size and complexity of what it is doing. That balance gets harder to maintain when an institution grows, introduces new products, expands digitally, serves new types of customers, or relies more heavily on third-party providers. The business can change faster than the control environment supporting it, and that is when gaps form.
The answer is not necessarily adding headcount every time something changes; outsourcing or cosourcing specialized areas is often the more practical path. Firms with dedicated BSA/AMLcompliance support can help close that gap without adding full-time staff. What matters most is whether the people responsible for a given risk area have the experience, authority, technology, time, and support to manage it properly.
IT Risk Is Not Just an IT Issue
Technology is another area where this plays out. Community banks depend on core systems, online banking platforms, third-party vendors, cybersecurity tools, access controls, and data across nearly every part of the institution, and a weakness in IT rarely stays contained to the IT department it can quickly become an operational issue, a compliance issue, a fraud issue, a financial reporting issue, or a business continuity issue. The FDIC’s 2024 order specifically addressed Tioga Franklin’s internal controls and information systems.
For management and boards, the practical question is whether the institution has had a genuinely independent IT and cybersecurity assessment recently, not just whether a penetration test was completed or a cybersecurity policy was approved. Are access controls actually working? Are vendors being appropriately monitored, and are changes to critical systems controlled? Are identified vulnerabilities being corrected, and can the institution recover if something goes wrong? These are management and board questions, not just technology questions.
The Board Has to Be Able to See the Risk
One of the first areas addressed in the Tioga Franklin Consent Order was board supervision and oversight. The FDIC required the board to receive the information it needed to monitor the bank’s financial condition, operations, risk profile, policies, findings, and corrective actions. A board can receive a tremendous volume of information and still not have a clear picture of where the biggest risks sit; more reporting is not automatically better reporting. Board members need to be able to see what is changing, which limits are being approached, which findings remain unresolved, where corrective action is falling behind, and where management may need additional resources. Burying the most important risk information on page 87 of a board package technically satisfies a reporting requirement, but it does not make that information useful. The goal is to give the board enough information to ask the right questions while there is still time to act on them.
The Questions Worth Asking Right Now
Community banks should not look at Tioga Franklin and assume they have the same problem. But it is a good time for management teams and boards to ask themselves a few direct questions: Are regulatory and Internal Audit findings being corrected on time, and are any of them repeating? Does the enterprise risk assessment still reflect how the bank operates today? Is the Internal Audit plan focused on the highest-risk areas, and have liquidity and contingency funding plans been meaningfully tested? Does the BSA/AML program reflect current customers, products, transaction activity, and risk profile? Have IT controls and the cybersecurity environment been independently assessed, and do the people responsible for the highest-risk areas have enough resources to do their jobs? Is the board getting information early enough to act on it?
If any of those questions are difficult to answer, that is worth examining not because another bank failed, but because identifying a weakness internally is always better than having a regulator identify it first.
Where Cathedral Can Help
At Cathedral CPAs & Advisors, we work with banks, credit unions, broker-dealers, mortgage banks, fintech companies, and other financial institutions on Internal Audit, risk, compliance, BSA/AML, IT, cybersecurity, technical accounting, FDICIA readiness, and related advisory needs. For community banks specifically, we provide outsourced and cosourced Internal Audit, enterprise risk assessments, BSA/AML reviews, regulatory compliance support, IT audits, cybersecurity assessments, and other independent testing.
The purpose is not to create another report that gets put on a shelf. It is to give management and the board an independent view of where risk exists, whether controls are working, and what needs attention.
Tioga Franklin is a timely reminder that serious problems rarely begin on the day everyone hears about them. There are usually warning signs first, and the important part is recognizing them and acting on them while there is still time.
About the Author
Kalgi Ganatra is Director of Advisory at Cathedral CPAs & Advisors, where she leads the firm’s Risk & Compliance Advisory practice. She works with banks, credit unions, broker-dealers, mortgage banks, specialty finance companies, and fintech companies on Internal Audit, regulatory compliance, risk management, and related advisory matters.
