The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC and, collectively, the Agencies) issued a joint final rule to define the term “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act (FDIA) and revise the supervisory framework for the issuance of matters requiring attention (MRAs) and other supervisory communications (the Final Rule).
The Final Rule:
- Establishes new definitions and standards for certain supervisory activities and enforcement actions;
- Clarifies how the Agencies will tailor their supervisory activities and enforcement actions based on unsafe or unsound practices under 12 S.C. § 1818, and their issuance of MRAs; and
- Sets new rules for how the Agencies communicate less significant violations of law and informal supervisory observations.
The Final Rule is intended to promote greater clarity and certainty regarding supervision and enforcement standards applicable to national banks, federal savings associations and federal branches and agencies (collectively, banks) and to ensure that these standards, and the Agencies’ application of them, prioritize material financial risks.
The Final Rule will become effective on November 2, 2026.
In connection with the Final Rule, the OCC released for public comment a notice of proposed rulemaking to codify its supervisory framework for the issuance of MRAs in response to violations of laws or regulations (the Proposed Rule on Violations of Law).
The Proposed Rule on Violations of Law would:
- Clarify that the OCC may only issue an MRA in response to a “substantive violation” of a banking or banking-related law or regulation (i.e., a violation the nature, duration, frequency or severity of which could meaningfully impact the bank or its customers); and
- Modify the “other violation” provision of the OCC’s version of the Final Rule to clarify that the OCC will not take an enforcement action or issue an MRA for a “technical violation.”
The OCC also:
- Released PPM 5400-11, “Matters Requiring Attention,” publicly for the first time to provide greater clarity and transparency regarding its standards for issuing and monitoring MRAs; and
- Substantially revised PPM 5310-3, “Bank Enforcement Actions and Related Matters,” regarding enforcement actions.
In connection with the Final Rule, the FDIC completed a “lookback” review of all outstanding matters requiring board attention and supervisory recommendations to assess which meet the MRA standard under the Final Rule and which should be closed out.
The FDIC concluded that a large majority of outstanding supervisory criticisms do not meet the standard under the Final Rule and thus will be closed
- Additionally, many outstanding supervisory criticisms meet the standard under the Final Rule and thus will be converted into MRAs.
The FDIC also issued a Financial Institutional Letter to summarize its approach to implementing the Final Rule and updated sections of the Consumer Compliance Examination Manual and the Risk Management Manual of Examination Policies to align with the Final Rule.
- The FDIC is also conducting further review and will incorporate updates based on the Final Rule and make other changes to align with the FDIC’s supervisory approach.
The Final Rule signals the Agencies’ desire for more uniformity in enforcement actions and MRAs by narrowing the range of conduct that is considered an unsafe or unsound practice and that can lead to an MRA.
- More findings will be “supervisory observations,” which are informal observations that identify weaknesses in a bank’s policies, practices, condition or operations that are not required to be presented to the board of directors or require the bank to take corrective action.
- In an implicit critique of horizontal reviews, the Agencies state that prudent operations do not require a bank to adopt Agency identified best practices.
Materiality will be assessed based on financial losses or other negative impacts to a bank’s capital, asset quality, earnings, liquidity or sensitivity to market risk.
- Nonfinancial factors will be considered only to the extent that they cause material harm to a bank’s financial condition (e.g., critical infrastructure, information technology or cybersecurity deficiencies that are so severe as to reasonably be expected to cause material financial harm to a bank).
- The Agencies declined to adopt a quantitative definition for what qualifies as material or otherwise clarify the definition of material, despite a number of comments requesting them to do so.
MRAs going forward can be validated and closed in a shorter time frame, at least by the OCC.
- Under the OCC’s revised PPMs, an MRA can close once remediation is in place and validated, with no “sustainability” assessment period, and an enforcement action can be terminated once a bank achieves “substantial compliance.”
- The sustainability of remediation remains important, given that repeat MRAs must be labeled as such and invite escalation under the OCC’s revised PPMs.
The OCC is now much more explicit about its ability to modify or de-escalate a bank enforcement action when a portion of the action is no longer necessary or has become outdated or irrelevant, or the bank has substantially remediated portions of the enforcement action.
The standard for issuing an MRA for a violation of law as well as the practical implementation of the Final Rule remain in flux, given the OCC’s Proposed Rule on Violations of Law and the Agencies’ continued efforts to update their examination policies and procedures.
The Final Rule
The Final Rule defines the term “unsafe or unsound practice” and sets the standards for the issuance of an MRA.
An unsafe or unsound practice may serve as a ground for several types of enforcement actions.
- These include a cease-and-desist order, a civil money penalty or, in rare cases, involuntary termination of deposit insurance by the FDIC.
The FDIA does not define “unsafe or unsound practice.”
- The meaning of the term historically has been shaped in an unclear and shifting fashion by legislative history, judicial interpretations and supervisory practice.
The Final Rule is intended to provide a clear nationwide standard for unsafe or unsound practices and the issuance of MRAs for OCC and FDIC supervised banks.
- It is also intended to focus bank and examiner attention on practices that are likely to materially harm a bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund (DIF), while providing the bank’s board of directors and management flexibility to enact day-to-day decisions based on their business judgment and risk tolerance.
The Agencies elected not to apply the Final Rule to individuals who are institution-affiliated parties (IAPs) under the FDIA.
The proposed rule would have applied the definition of unsafe or unsound practice to the Agencies’ supervisory and enforcement actions taken against both banks and IAPs.
The Agencies received comments that the proposed definition of unsafe or unsound practices would:
- Impede the Agencies’ ability to take appropriate enforcement actions against IAPs that are affiliated with large banks; and
- Cause enforcement actions against IAPs to be influenced by factors unrelated to the gravity of the misconduct, such as the asset size or staffing numbers of the bank with which a party is affiliated at the time of the misconduct.
The Agencies agreed with commenters that having a single definition for both banks and IAPs could fail to account for differences in the Agencies’ supervisory objectives for IAPs as compared to banks.
Under the Final Rule, examiners must justify a determination that a practice, act or failure to act is unsafe or unsound or meets the standard for the issuance of an MRA based on objective facts and sound reasoning.
This provision was not included in the proposed rule.
The Agencies declined suggestions to require examiners to provide demonstrable and quantifiable evidence to determine whether the criteria for the definition of unsafe or unsound practice or the issuance of an MRA are met.
- The Agencies stated that such a requirement would be difficult to administer and speculative in nature and would result in a false sense of precision due to its reliance on subjective assumptions about the size or probability of any harm rather than empirical evidence.
The Agencies also declined to codify a burden of proof or burden of persuasion requirement.
In response to comments, the Agencies added a paragraph to the Final Rule to further explain how tailoring would apply to banks of different asset sizes, complexity and risk profile.
The Agencies will tailor their supervisory activities and enforcement actions based on the risks associated with the bank’s capital structure, complexity, activities, asset size and any other financial risk-related factor that the Agencies deem appropriate.
As the risk associated with the factors identified in the tailoring provision increases:
- The threshold for materiality of the harm to the financial condition of a bank that constitutes an unsafe or unsound practice or warrants an MRA decreases;
- The assessment of the harm to the financial condition of a bank becomes more granular (e.g., business lines, products or services); and
- The requirements under an enforcement action or MRA relating to remediation and the expectations regarding prudent operation increase.
Unsafe or unsound practice
The Final Rule defines the term “unsafe or unsound practice” and sets the standards to mean a practice, act or failure to act, alone or together with one or more other practices, acts or failures to act, that:
- is contrary to generally accepted standards of prudent operation; and;
- if continued, is likely to
- materially harm the financial condition of the bank; or
- present a material risk of loss to the DIF; or
- materially harmed the financial condition of the bank.
An individual act or failure to act may be an unsafe or unsound practice.
Under the Final Rule, like the proposed rule, a practice, act or failure to act, alone or together with one or more other practices, acts or failures to act, could be considered an unsafe or unsound practice.
The Agencies disagreed with commenters’ assertions that the best reading of section 8 of the FDIA is that the term unsafe or unsound practice applies only to practices, but not individual acts or failures to act.
- The Agencies stated that whether an individual act or omission, as opposed to a pattern of conduct, could result in likely material harm to the financial condition of the bank is generally an academic question and that a single event could readily be described as multiple events.
For example, if a bank agrees to purchase a portfolio of loans, and weaknesses in one loan in the portfolio are likely to result in a material financial loss to the bank, the decision and act of purchasing the loan would be considered an outgrowth of the bank’s lending practices.
The Agencies do not intend to take enforcement actions for prudent operations merely because they result in risk-taking.
Under the Final Rule, like the proposed rule, a practice, act or failure to act will only be considered an unsafe or unsound practice if it deviates from generally accepted standards of prudent operation.
The Agencies declined to codify a list of or adopt a bright line for generally accepted standards of prudent operation, or establish a safe harbor or rebuttable presumption regarding when a bank may be presumed to be acting in accordance with generally accepted standards of prudent operation.
Instead, the OCC states that generally accepted standards for prudent operation:
- Are concepts the Agencies consider to be a matter of examiner judgment, based on objective facts and sound reasoning;
- Will be tailored based on the risks associated with a bank’s capital structure, complexity, activities, asset size and other financial risk-related factors; and
- Do not require a bank to adopt what the Agencies consider to be best practices.
The probability that a practice, act or failure to act, if continued, will materially harm the financial condition of the bank or present a material risk of loss to the DIF must be more than speculative or merely possible.
Under the Final Rule, like the proposed rule, to qualify as an unsafe or unsound practice, it needs to be likely that the practice, act or failure to act, if continued, would materially harm the financial condition of the bank or present a material risk of loss to the DIF.
The Agencies declined to adopt comments suggesting a quantitative threshold for a result to be likely or identify a time horizon on which a result must be likely to occur.
The Agencies believe “likely” strikes the right balance in terms of probability, clarity and simplicity, as it is impossible to quantify the probability of future events with precision.
The Agencies codified a definition of harm to financial condition in the Final Rule.
Unlike the proposed rule, the Final Rule makes clear that harm to financial condition refers to financial losses or other negative impacts to a bank’s capital, asset quality, earnings, liquidity or sensitivity to market risk.
The Agencies included this language in the preamble of the proposed rule but added it to the text of the Final Rule in response to a comment that doing so would prevent reputational or other non-financial impacts from being considered.
The Agencies noted that consumer harm will be captured under the Final Rule to the extent the underlying issues result in safety and soundness concerns or violations of law or regulation.
Neither actual but nonmaterial financial losses to the bank nor risks of minor harm to a bank’s financial condition, even if imminent, are sufficient to create an unsafe or unsound practice.
Under the Final Rule, like the proposed rule, the standard for unsafe or unsound practices applies to practices, acts or failures to act that, if continued, are likely to materially harm the financial condition of a bank or that had already resulted in actual material harm to the bank.
The Agencies declined to adopt a quantitative definition for what qualifies as material or otherwise clarify the definition of material, despite a number of comments requesting them to do so.
Rather, the Agencies stated that the assessment of what qualifies as material harm to the financial condition of a bank will rely on examiner judgment, based on objective facts and sound reasoning, and will be tailored based on the risks associated with the bank’s capital structure, complexity, activities, asset size and other financial risk-related factors.
The Agencies stated that this threshold strikes the right balance between permitting both small and large banks to take on appropriate risks in line with their business judgment, while focusing supervisory resources on serious financial risks.
For the first time, the Agencies addressed the difference between the concept of “material” as applied to the securities and banking laws.
A few commenters on the proposed rule noted that materiality is used as a threshold under securities laws or accounting standards with varying definitions, and some suggested that the Agencies should refer to those definitions of material in the Final Rule.
The Agencies declined to do so on the reasoning that situations covered by those laws and standards, which refer to the materiality of misstatements or disclosure issues, are sufficiently distinct from the materiality of harm to financial condition so as to not warrant adoption.
The Agencies explained that, for purposes of securities laws or accounting standards, materiality standards generally refer to the likelihood that an individual viewing disclosures will be confused and to information that is not available to the public.
The Final Rule retains a provision addressing risk of loss to the DIF.
Under the Final Rule, like the proposed rule, an unsafe or unsound practice includes a practice, act or failure to act that, if continued, was likely to negatively affect a bank’s ability to avoid FDIC receivership and present a material risk of loss to the DIF as a result of the failure.
The Agencies declined to:
- Remove the DIF provision in response to a comment that it is superfluous because inadequate contingency funding arrangements could impair an institution’s liquidity under stress and present a material risk to the DIF without posing a risk of material harm to the financial condition of the bank; and
- Adopt a provision requiring the Agencies to account for factors impacting the difficulty of resolving a particular bank in response to a comment.
The Agencies’ emphasized that their consideration will generally be limited to the likelihood that a bank’s going concern practices would cause it to fail in a manner that poses a material risk of loss to the DIF.
MRAs
The Agencies characterize MRAs as concerns that, in the Agencies’ judgment, rise to the level of requiring presentation to the board of directors and for which a bank must take corrective action. The Final Rule states that the Agencies are only permitted to issue an MRA for a practice, act or failure to act, alone or together with one or more other practices, acts or failures to act, that:
- is contrary to generally accepted standards of prudent operation; and;
- i. if continued, could reasonably be expected to, under current or reasonably foreseeable conditions,
- materially harm the financial condition of the bank; or
- present a material risk of loss to the DIF; or
- ii. has already material harmed the financial condition of
the bank; or - iii. is an actual violation of a banking or banking-related law or regulation.
“Reasonably foreseeable” does not necessarily mean the most likely future outcome or include speculative concerns about future harm.
Under the Final Rule, like the proposed rule, for the Agencies to issue an MRA material harm to the financial condition of a bank must be reasonably expected, under current or reasonably foreseeable conditions, to result in material financial harm if imprudent practices, acts or failures to act continued.
The Agencies declined to lower the probability of material harm from the proposed rule or broaden the types of harm cognizable under the MRA standard to include emerging risks.
The Agencies stated that this standard will allow the Agencies, as commenters suggested, to address reasonably foreseeable economic shocks before they materialize and affect the financial condition of a bank.
The Agencies noted their belief that this standard would have been capable of proactively addressing the risks that precipitated recent bank failures.
Although not codified in the Final Rule, the Agencies intend to exercise their supervisory discretion to issue MRAs for violations only in response to a substantive violation of banking or banking-related law.
Under the Final Rule, like the proposed rule, examiners can issue an MRA for an actual violation, not a violation that may occur in the future, of a banking or banking-related law or regulation.
The Agencies declined to enumerate a list of all such banking or banking-related laws and regulations, but stated that the following four categories of violations would support the issuance of an MRA:
- Violations that demonstrate a pattern or are systemic;
- Violations that have, or could be reasonably expected to have, a more than minimal adverse impact on a bank’s financial condition, the accuracy of the bank’s books and records or its customers;
- Violations that require, or could be reasonably expected to require, more than minimal restitution to make the recipients whole; and
- Violations that involve insider misconduct or self-dealing.
The OCC also issued the Proposed Rule on Violations of Law, which if finalized would further revise this standard as applied by the OCC. See slides 31-35 for additional information on the proposed rule.
The Final Rule adopts uniform standards for examiners’ issuance and communication of MRAs.
This standard differs from the unsafe or unsound practice standard in that:
- For the Agencies to issue an MRA if imprudent practices, acts or failures to act are continued, material harm to the financial condition of a bank needs to be reasonably expected under current or reasonably foreseeable conditions to result in material financial harm, which is a lower bar than the likeliness requirement for unsafe or unsound practices; and
- The Agencies can also issue an MRA for any actual violation of a banking or banking-related law or regulation.
Under the Final Rule, mere failure to remediate an MRA is not an unsafe or unsound practice.
The Final Rule does not address the closure of MRAs.
The Agencies have often kept MRAs outstanding for a prolonged period of time after a bank has fully completed its remediation of the underlying practice, act or failure to act because examiners seek to see demonstrated sustainability of the remediation before an MRA is closed.
The Agencies noted that the practice of keeping MRAs open past the point of full remediation has the potential to distract a bank’s board of directors and management, as well as examiners, by inflating the number of MRAs based on practices, acts or failures to act that have already been remediated.
The Agencies received many comments relating to:
- The time frame for remediation and closure of MRAs; and
- The information the Agencies should consider when determining whether to close an outstanding MRA.
However, the Agencies determined that the comments would be best incorporated outside of the context of the Final Rule.
The newly released PPM 5400-11, which is discussed on slides 37-40, directs OCC examiners to close MRAs when a corrective action has been implemented and the effectiveness has been validated. Examiners must not review a corrective action for sustained performance prior to closing an MRA.
The FDIC’s updated manuals do not have a similar standard for the closure of MRAs, though the FDIC’s Formal and Informal Enforcement Actions manual includes a similar standard for the termination of a cease-and-desist order.
Other violations and supervisory observations
The Final Rule adds a provision to address “other violations” of law, which can be considered in ratings determinations.
Unlike the proposed rule, the Final Rule states that the Agencies may direct a bank to remediate other violations of law and take other actions as required by applicable state or federal law in connection with the violation.
- The Agencies will not direct a bank to take any action other than to remediate the violation, unless such other actions are required by applicable state or federal law
For FDIC-supervised institutions, if the FDIC determines at a subsequent examination or visitation that a bank has failed to remediate any other violations after the FDIC has directed the bank to remediate the violation, the FDIC would be permitted to cite such an uncorrected violation as an MRA as part of the follow-up examination or visitation.
The OCC’s Proposed Rule on Violations of Law would modify this “other violation” provision to clarify that the OCC will not take an enforcement action or issue an MRA for a “technical violation.”
For concerns that do not rise to the level of an MRA, examiners may provide informal supervisory observations to enhance a bank’s policies, practices, condition or operations without a requirement for corrective action.
Unlike the proposed rule, the Final rule codifies that a supervisory observation does not create a requirement or supervisory expectation that either:
- The observation will be presented to a bank’s board of directors; or
- The bank will take corrective action in response to the obersvation.
Each bank’s board of directors and management, informed by supervisory observations and independent judgment, can determine whether to implement changes to enhance the bank’s policies, practices, condition or operations in response to a supervisory observation.
Supervisory observations do not warrant escalation into an MRA absent a change in the bank or its operating environment that would support the issuance of an MRA, in accordance with the Final Rule’s standard for issuing MRAs.
This post is based on a Davis, Polk & Wardwell LLP memorandum, “OCC and FDIC change the rules for supervision,” dated September 10, 2026, and available here.