Comptroller of the Currency and FDIC prioritize material financial risks in bank supervision and enforcement

As in the case of other recent regulatory actions, the joint final rulemaking by the Comptroller of the Currency and the FDIC to refocus the agencies' bank supervision and enforcement frameworks on material financial risks was not joined by the Federal Reserve Board, although the Fed's updated guidance on its supervisory operating principles indicates that all three federal bank regulatory agencies are now largely aligned as a policy matter.

Introduction

On August 27, 2026, the Office of the Comptroller of the Currency ("OCC") and the Federal Deposit Insurance Corporation ("FDIC," and together with the OCC, the "Agencies") issued a joint final rule (the "Final Rule")¹ to prioritize material financial risks over concerns related to policies, process, documentation, and other nonfinancial risks for purposes of the Agencies' supervision and enforcement frameworks and standards. The Final Rule follows the approach set forth in the Agencies' proposed rulemaking from October of 2025 (the "Proposed Rule"),² with certain modifications.

The OCC, acting on its own without the FDIC, also took a number of additional actions at the same time, issuing substantially revised versions of its internal policies and procedures manuals ("PPMs") regarding enforcement actions³ and Matters Requiring Attention ("MRAs")⁴ to reflect the enforcement and supervisory approaches in the Final Rule and to make related changes. The OCC also released for public comment a notice of proposed rulemaking to codify the OCC's supervisory framework for the issuance of MRAs in response to violations of laws or regulations.5

As explained in more detail below, the Final Rule defines the term "unsafe or unsound practice" for purposes of the Agencies' enforcement actions under section 8 of the Federal Deposit Insurance Act ("FDI Act")⁶ and supervisory activities as a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that

1. is contrary to generally accepted standards of prudent operation; and
2. (i) if continued, is likely to materially harm the financial condition of the depository institution or present a material risk of loss to the Deposit Insurance Fund (the "DIF"), or (ii) materially harmed the financial condition of the institution.

The Final Rule takes a similar approach in narrowing the scope of practices at a depository institution that would support the issuance by either Agency of an MRA to require a change in the institution's practices or the remediation of a violation. Specifically, the Final Rule provides that the Agencies may issue an MRA only for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that –

1. (i) is contrary to generally accepted standards of prudent operation; and

   (ii) (A) if continued, could reasonably be expected to, under current or reasonably foreseeable conditions, materially harm the financial condition of the depository institution or present a material risk of loss to the DIF, or (B) materially harmed the institution's financial condition; or

2. is an actual violation of a banking or banking-related law or regulation.

The Final Rule also specifies that the Agencies may communicate to depository institutions examiner findings regarding "other violations," which are violations for which the Agencies do not take an enforcement action or issue an MRA. For such "other violations," the Agencies may require the depository institution to remediate the violation but may not take any other actions unless they are required by law in connection with the violation. The Final Rule also clarifies how and when an Agency may communicate to depository institutions the Agency's "supervisory observations" -- i.e., an informal observation that identifies weaknesses in the institution's policies, practices, condition, or operations that do not rise to the level of an MRA A supervisory observation would not create a requirement or supervisory expectation that the matter be presented to the institution's board of directors or that the institution take corrective action.

Additionally, the Final Rule clarifies how the Agencies will tailor their supervisory activities and enforcement actions for unsafe or unsound practices and the issuance of MRAs based on the risks associated with a depository institution's capital structure, complexity, activities, asset size, and other financial risk-related factors that the Agencies deem appropriate. The Final Rule also provides that "objective facts and sound reasoning" will serve as the basis for Agency determinations as to whether to take an enforcement action based on an unsafe or unsound practice or issue an MRA, and the Agencies have stated that examiners must share with the institution the basis for the examiner's identification of an unsafe or unsound practice or the issuance of an MRA.

As adopted by the OCC, the Final Rule applies with regard to OCC enforcement and supervisory activities involving national banks, federal savings associations, and federal branches or agencies of foreign banks, and the Final Rule as adopted by the FDIC applies with regard to FDIC enforcement and supervisory activities involving insured state-chartered banks that are not members of the Federal Reserve System, insured state-licensed branches of foreign banks, and insured state-chartered savings associations.

Policy objectives and political considerations underlying the final rule and related actions

A key objective of the Agencies in issuing the Final Rule was "to promote greater clarity and certainty regarding certain enforcement and supervision standards by defining them by regulation."⁷

The Agencies noted in the preamble to the rulemaking release for the Final Rule (the "Rulemaking Release") that the adoption of a regulatory definition of the term "unsafe or unsound practice" was important to appropriately focus institution and examiner attention on practices that are likely to materially harm an institution's financial condition or present a material risk of loss to the DIF, which would provide the institution's board of directors and management additional flexibility to enact day-to-day decisions based on their business judgment and risk tolerance. The Agencies also explained that the definition of "unsafe or unsound practice" in the Final Rule reflects the Agencies' judgment and experience that their supervisory resources are best focused on practices that are likely to materially harm an institution's financial condition, such as risks that are more likely than other types of risks to lead to material financial losses, bank failures, and instability in the banking system.

Regarding the political considerations underlying the issuance of the Final Rule by the Agencies, the Final Rule follows after, and is generally consistent from a policy perspective with, the joint final rule issued by the OCC and the FDIC in April of 2026 that codified the elimination of reputation risk from the Agencies' supervisory frameworks⁸ and the removal by the Agencies and the Federal Reserve Board of references to reputation risk from guidance materials and various interagency documents.⁹ In taking those regulatory actions, the federal bank regulatory agencies were responding to the requirements of Executive Order 14331 of August 7, 2025 (Guaranteeing Fair Banking for All Americans)¹⁰ to remove the use of reputation risk or equivalent concepts that could result in politicized or unlawful debanking on the basis of political or religious beliefs or lawful business activities.

A significant aspect of the Final Rule and the OCC's additional actions appears to have been the removal of political issues and considerations from the Agencies' supervision frameworks. t has been reported that the Agencies, in issuing the Final Rule, were seeking to eliminate what they referred to as "virtue signaling" from regulatory oversight practices and to address the Trump Administration's policy goals of eliminating political issues such as climate change and diversity, equity and inclusion as a focus for the federal bank regulatory agencies.¹¹

As in the case of the Agencies' December 2025 withdrawal from the Interagency Guidance on Leveraged Lending from 2013 and their July 2026 issuance of a proposed rule to amend the Community Reinvestment Act regulations, the OCC and the FDIC – under the leadership of Republican appointees – are taking formal regulatory actions on the regulatory policy initiatives of the Trump Administration independently of the Federal Reserve Board.¹² However, in contrast to those other regulatory actions, as to which the Federal Reserve Board's position was not publicly expressed, the Federal Reserve Board's Updated Statement of Supervisory Operating Principles¹³ (the "Supervisory Operating Principles") makes clear that the Board's supervisory approach is substantially aligned with the approach taken by the Agencies in the Final Rule in focusing on harms to the financial condition of supervised banking organizations rather than other types of considerations.¹⁴

In particular, the Supervisory Operating Principles provide that Federal Reserve Board examiners and other supervisory staff should prioritize their attention on risks that pose a significant probability of significant harm to the financial condition of a banking organization or one or more other firms, the DIF, the banking organization's resolvability, or U.S. financial stability.¹⁵ The Supervisory Operating Principles further explain that examiners and other supervisory staff "should not become distracted from this priority by devoting excessive attention to processes, procedures, and documentation that do not pose a significant risk to a firm's safety and soundness or U.S. financial stability." Additionally, the Supervisory Operating Principles prioritize the same types of risks for purposes of the issuance by the Federal Reserve Board of MRAs or Matters Requiring Immediate Attention ("MRIAs")¹⁶ or enforcement actions,¹⁷ and provide that Federal Reserve Board examiners and other supervisory staff can address shortcomings that do not rise to the level of MRAs or MRIAs by making supervisory observations.

Key provisions of the final rule

1. Scope of the Final Rule

As noted above, the Final Rule defines the term "unsafe or unsound practice" specifically for purposes of the Agencies' enforcement actions under section 8 of the FDI Act as well as for the Agencies' supervisory activities. The Agencies clarified in the Rulemaking Release that this definition does not apply to the Agencies' rulemaking activities or authority.

Regarding the application of the definition of "unsafe or unsound practice" to enforcement actions, Section 8 of the FDI Act authorizes the FDIC or other appropriate federal bank regulatory agency to take a range of enforcement actions in response to an unsafe or unsound practice, a violation of law or regulation, or other conduct identified in the statute, against not only the depository institution itself but also an "institution-affiliated party" of the institution.¹⁸ The Proposed Rule would have applied the regulatory definition of "unsafe or unsound practice" to the Agencies' enforcement and supervisory actions taken against either a depository institution or an institution-affiliated party. In the Final Rule, however, the Agencies limited the application of that definition solely to Agency-supervised depository institutions themselves. In taking that approach, the Agencies noted in the Rulemaking Release that "applying a single uniform definition to both institutions and institution-affiliated parties could fail to account for differences in the agencies' supervisory objectives" and had the potential "to impede, or distort incentives regarding, enforcement actions against institution-affiliated parties."¹⁹ Additionally, the Agencies noted that the "primary purpose" of the rulemaking was to address the Agencies' supervisory and enforcement activities with respect to their supervised institutions.²⁰

2. Requirements for an Agency Determination that a Practice is Unsafe or Unsound

As noted above, in order for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, to come within the Final Rule's definition of "unsafe or unsound practice," it must –

1. be contrary to generally accepted standards of "prudent operation;" and
2. (i) if continued, be "likely" to "materially" "harm the financial condition" of the depository institution or present a material risk of loss to the DIF, or (ii) materially harmed the financial condition of the institution (i.e., the practice, act or failure to act actually resulted in material harm to the institution's financial condition).

The Agencies clarified in the Rulemaking Release that an individual act or failure to act could, on its own, constitute an unsafe or unsound practice under the Final Rule, with poor underwriting of a loan being cited as an example.

The Rulemaking Release contains guidance as to the manner in which the Agencies will interpret and apply certain terms used in the Final Rule that are not already defined in the Final Rule itself.

"Prudent operation" / imprudence.

The Agencies explained in the Rulemaking Release that "an essential role of institutions is to identify, measure, incur, and manage risk" and accordingly that the Agencies do not intend to take enforcement actions "for prudent operations merely because they result in risk-taking."²¹ Rather, a practice, act, or failure to act would only be considered an unsafe or unsound practice "if it deviates from generally accepted standards of prudent operation" and meets the other required elements of the regulatory definition of "unsafe or unsound practice."²² The Agencies declined to include in the Final Rule a list of, or bright line standard for, generally accepted standards of prudent operation, as had been requested by some commenters on the Proposed Rule, instead leaving those matters to the judgment of bank examiners based on objective facts and sound reasoning.

The Agencies also explained that their expectations for what would be considered to be generally accepted standards for prudent operation will be tailored based on the risks associated with an institution's capital structure, complexity, activities, asset size, and other financial risk-related factors, and that as the risk associated with those factors for an institution increases, the Agencies' expectations for that institution's prudent operations would also increase. In that connection, the Agencies have stated that there would be "a much higher bar" for a finding of an unsafe or unsound practice at a community bank compared to a larger institution.²³

"Likely."

The Agencies explained in the Rulemaking Release that they do not intend to identify unsafe or unsound practices "by extrapolating from deficient conduct that could potentially result in, alone or in combination with other factors or events, material harm to the financial condition of an institution but is not likely to do so."²⁴ Similarly, the Agencies declined to adopt, as had been requested by some commenters on the Proposed Rule, a quantitative threshold for a result to be considered to be "likely" to materially harm an institution's financial condition or to identify a specific time horizon during which a result would have to be likely to occur.

"Harm to the financial condition."

The Final Rule defines this term as financial losses or other negative impacts to an institution's capital, asset quality, earnings, liquidity, or sensitivity to market risk. With regard to a material risk of loss to the DIF, an unsafe or unsound practice would include a practice, act, or failure to act that, if continued, is likely to negatively affect a depository institution's ability to avoid FDIC receivership.

Materiality.

The Agencies noted that the rulemaking release for the Proposed Rule had explained that neither actual but non-material financial losses to a depository institution nor risks of minor harm to an institution's financial condition, even if imminent, would be sufficient to cause a practice, act, or failure to act to be identified as an unsafe or unsound practice. The Agencies have retained that approach in the Final Rule, explaining that the adoption of materiality as the threshold for potential or actual harm to a depository institution's financial condition would permit institutions to take on appropriate risks in line with their business judgment while focusing supervisory resources on serious financial risks. Similarly to the Agencies' approach with regard to other criteria in the definition of "unsafe or unsound practice," the Agencies declined to adopt a quantitative definition for what would qualify as material, as had been requested by some commenters on the Proposed Rule, with the Agencies explaining that this assessment would instead rely on examiner judgment based on objective facts and sound reasoning.

Additionally, the Agencies explained that their expectations for what would be considered to be material harm to the financial condition of an institution, as in the case of other aspects of the Final Rule, would be tailored based on the risks associated with the institution's capital structure, complexity, activities, asset size, and other financial risk-related factors. Specifically, as the risk associated with those factors increases, the threshold for materiality of the harm would decrease and the assessment of the harm to the financial condition of institution would become more granular (e.g., specific business lines, products, or services).²⁵

The Agencies have also acknowledged that, in limited circumstances, nonfinancial risks may be likely to result in material harm to an institution's financial condition and consequently could be treated as an unsafe or unsound practice. The example cited by the Agencies in the Rulemaking Release is a significant risk of disruption of an institution's operations through its information technology systems, with the Agencies explaining that whether or not a cybersecurity vulnerability would meet the definition of an unsafe or unsound practice would depend on the potential severity and likelihood of material harm to the financial condition of the institution. Mitigating factors such as compensating controls associated with a specific gap or weakness would also be considered. The Agencies further clarified, however, that the nonfinancial risks that could be identified as an unsafe or unsound practice would not include reputational risks that were unrelated to financial condition.

3. Standards for the Issuance of an MRA

Standard for the issuance of an MRA based on financial harm

The Agencies have noted that the standard in the Final Rule for the issuance of an MRA for a practice, act or failure to act that may result in material harm to a depository institution's financial condition or a material risk of loss to the DIF requires a lower probability of material harm than does the Final Rule's definition of :unsafe or unsound practice." Specifically, the Final Rule provides that the Agencies may issue an MRA for a practice, act or failure to act that is contrary to generally accepted standards of prudent operation and that, if continued, "could reasonably be expected to, under current or reasonably foreseeable conditions," materially harm the financial condition of the institution or present a material risk of loss to the DIF. In contrast, as noted above, the Final Rule's definition of "unsafe or unsound practice" provides that the practice, act or failure to act must be "likely," if continued, to materially harm the institution's financial condition or present a material risk of loss to the DIF.

The Agencies noted in the Rulemaking Release that for this reason, examiners may issue an MRA before an unsafe or unsound practice is present, and they also stated that in their opinion, the Final Rule's standard for the issuance of an MRA "would have been capable of proactively addressing the risks that precipitated the failure of Silicon Valley Bank" in March of 2023.²⁶ FDIC Chairman Travis Hill issued a statement in connection with the issuance of the Final Rule in which he noted that "the final rule does not prevent examiners from proactively identifying issues" and "does not require examiners to wait until a financial harm actually occurs to issue a supervisory criticism."²⁷

The Agencies also explained in the Rulemaking Release that for this purpose, "reasonably foreseeable" does not necessarily mean the most likely future outcome and "could include a range of possible outcomes," although "speculative concerns about future harm . . . should not support the issuance of an MRA."²⁸

Standard for the issuance of an MRA for a violation of a banking or banking-related law or regulation

The Final Rule provides that the Agencies may issue an MRA for an "actual violation" of a "banking or banking-related law or regulation" regardless of whether or not the violation could reasonably be expected to materially harm the financial condition of the depository institution or present a material risk of loss to the DIF. The Agencies explained in the Rulemaking Release that an "actual violation" of a law or regulation would not include a violation that an examiner expects might occur in the future, although the Agencies noted that examiners would be permitted to offer supervisory observations to improve an institution's policies, practices, condition, or operations.

The Rulemaking Release explains that the Agencies would interpret the phrase "banking or banking-related laws or regulations" to involve federal or state laws or regulations that are "inherently associated with the conduct of banking or financial operations and related activities."²⁹ The Agencies also stated in the Rulemaking Release that nonconformance with regulatory guidelines, such as the Interagency Guidelines Establishing Standards for Safety and Soundness, would not be considered by the Agencies to be a violation of a banking or banking-related law or regulation.

Additionally, the Agencies clarified in the Rulemaking Release that the Agencies "intend to exercise their supervisory discretion to issue MRAs for violations only in response to substantive violations,"³⁰ and they identified four specific categories of substantive violations that would support the issuance of an MRA.

1. Violations that demonstrate a pattern or are systemic -- The Rulemaking Release explains that a violation demonstrates a pattern if there are repeated or ongoing violations, considering the number of violations and the length of time in which the violations occurred. Systemic violations of laws or regulations would be violations that are widespread or prevalent within an institution or business line.
2. Violations that have, or could be reasonably expected to have, a more than minimal adverse impact on a depository institution's financial condition, the accuracy of the institution's books and records, or its customers -- The Agencies explained in the Rulemaking Release that this "more than minimal" threshold for impacts or restitution is a lower threshold than "material" but excludes trivial or de minimis impacts or restitution. The Rulemaking Release additionally notes that a violation that results in a more than minimal adverse impact on an institution's financial condition "must have a direct, clear, and predictable connection between the violation and the impact on an institution."³¹ The example cited by the Agencies of a violation that could have a more than minimal impact on the books and records of an institution is the filing of inaccurate Consolidated Reports of Condition and Income, depending on the relative and absolute impact of the inaccuracy as well as other qualitative and quantitative factors the Agencies deem appropriate.
3. Violations that require, or could be reasonably expected to require, more than minimal restitution by the depository institution to make the recipients whole -- The Agencies explained that whether restitution is considered "more than minimal" would be based on the reasonably expected size of the restitution payments, the degree of the adverse impact, and the number of persons affected by the violation.
4. Violations that involve insider misconduct or self-dealing at the depository institution.

The Agencies also explained in the Rulemaking Release that violations of laws or regulations for which the Agencies do not issue an MRA could be taken into consideration by the Agencies in examination ratings determinations. The Rulemaking Release additionally states that in the case of FDIC-supervised depository institutions, if the FDIC determines at a subsequent examination or visitation that a supervised institution has failed to remediate any "other violations" after the FDIC had previously directed the institution to remediate the violation, the FDIC would be permitted to cite such an uncorrected violation as an MRA as part of the follow-up examination or visitation.

4. Tailoring of Supervisory and Enforcement Actions

With regard to the provision in the Final Rule requiring the Agencies to tailor their supervisory activities and enforcement actions and their issuance of MRAs based on the risks associated with the institution's capital structure, complexity, activities, asset size, and other financial risk-related factors, the Rulemaking Release explains that the Agencies determined not to develop tiers based on asset size or complexity, a matrix, or similar guidance on the tailoring standard. In the Agencies' view, such an approach could have had an inappropriate limiting effect on the application of examiner judgment for determinations that are fact-specific assessments. The Agencies further explained that for all institutions, the Agencies would not expect the assessment of the harm to the financial condition of the institution to be so granular that it would entail consideration of narrow products or services that were immaterial to the institution overall.

Additionally, the Agencies clarified in the Rulemaking Release that, in contrast to the approach for tailoring that had been contained in the Proposed Rule, the tailoring provisions in the Final Rule only apply to enforcement actions based on unsafe or unsound practices, with enforcement actions based on other conduct being beyond the scope of the Final Rule.

5. Supervisory Observations

The Agencies explained in the Rulemaking Release that a supervisory observation, which would not create a requirement or supervisory expectation that the matter be presented to an institution's board of directors, would allow examiners to share their expertise with an institution's management and board of directors about potential enhancements while leaving decisions regarding the implementation of any enhancements to the institution itself. The Agencies would not be permitted to criticize an institution for declining to remediate a concern or weakness that had previously been identified in a supervisory communication or to escalate the communication into an MRA on the sole basis of the institution's lack of adoption of an examiner's suggestion offered in multiple examination cycles.

In that regard, the Agencies clarified in the Final Rule that supervisory observations would not warrant escalation into an MRA absent a change in the institution or its operating environment that would support the issuance of an MRA in accordance with the Final Rule's standard for MRAs. "To the extent there is an actual or increased probability of deterioration to an institution's condition following the communication of a supervisory observation, the circumstances underlying the observation could later be the basis for an MRA or enforcement action, but only if the criteria for an MRA or enforcement action are satisfied."³²

Related actions taken by OCC without involvement of the FDIC

As noted above, the OCC, acting independently of the FDIC, took a number of additional actions contemporaneously with the issuance of the Final Rule, issuing substantially revised versions of its PPM 5310-3 (Bank Enforcement Actions and Related Matters) and PPM 5400-11 (Matters Requiring Attention) to reflect the enforcement and supervisory approaches in the Final Rule and to make related changes, as well as to provide greater transparency as to the OCC's enforcement and MRA standards and procedures. Additionally, the OCC issued a notice of proposed rulemaking on violations of laws and regulations to codify the OCC's supervisory framework for the issuance of MRAs in response to such violations.

Revisions to OCC PPMs

The revisions made by the OCC to its PPM on Bank Enforcement Actions and Related Matters emphasize the critical importance of material financial risks in OCC enforcement actions and highlight the OCC's "three guiding principles"³³ when considering bank enforcement actions -- escalation, tailoring, and focusing required corrective actions on those essential to address specific deficiencies. As explained in an OCC Bulletin accompanying the revised PPMs,³⁴ "the OCC's response to deficiencies is generally escalatory and provides banks an opportunity to remediate deficiencies, both before escalation to an enforcement action and before escalation to a more severe enforcement action." The revised PPM also provides that an appropriate supervisory or enforcement response should focus on requiring the bank to take corrective action targeted to correct specific deficiencies with the least degree of OCC intervention that is reasonably necessary for the bank to remediate the deficiency in a satisfactory and timely manner.

Additionally, the revisions to the PPM for Bank Enforcement Actions and Related Matters, among other changes made, include an explanation of how the OCC tailors the type of enforcement action, the speed of escalation, and the contents of the accompanying corrective actions based upon the particular bank's financial risk-related factors, including capital structure, complexity, activities, asset size, and other financial risk-related factors. The revised PPM states that "[t]he OCC's enforcement approach reflects the increased regulatory and supervisory expectations for large or complex banks. For example, the OCC may escalate to an enforcement action against a large or complex bank based on practices that would not trigger a similar response against a community bank."³⁵

Additionally, the OCC states in the revised PPM on Bank Enforcement Actions and Related Matters that "The OCC terminates a bank enforcement action once the bank has achieved substantial compliance with an enforcement action," with "substantial compliance" meaning the satisfaction by the bank of the essential requirements of the enforcement action in the judgment of the examiner "even if minor, isolated requirements have not been fully satisfied."³⁶ The revised PPM also provides that examiners "must substantially rely on applicable work performed a bank's internal audit" for confirming whether the corrective actions taken by the bank have been effective and also identifies when examiners "may request limited additional information outside of audit workpapers."³⁷

The revisions made to the OCC's PPM on Matters Requiring Attention, which is a PPM that the OCC made public for the first time, conform the OCC's internal rules and procedures to the standards for the issuance of an MRA under the Final Rule. The revisions include statements that the OCC intends to exercise its supervisory discretion to issue MRAs only in response to substantive violations of law or regulation, that examiners must tailor their issuance of MRAs in accordance with the requirements of the Final Rule, and that examiners must use objective facts and sound reasoning to determine whether they issue an MRA. With regard to which types of violations of law or regulation are treated as substantive for the issuance of an MRA, the revised PPM generally follows the approach taken by the Agencies in the Final Rule.

Among other changes, this revised PPM also sets forth guidance and procedures for OCC examiners to make determinations as to "other violations" (i.e., actual violations of banking or banking-related laws or regulations for which the OCC does not take an enforcement action or issue an MRA) and make supervisory observations. The revised PPM states that although examiners are permitted to direct an institution to correct "other violations," they cannot prescribe how the institution must do so or require remediation steps unrelated to correction of the violation unless such actions are required by applicable state or federal law. Examiners also may not require an institution to submit a corrective action plan for "other violations," and although examiners are required to document "other violations" in the OCC's supervisory information system, they may not track whether the institution has corrected the violation. Similarly, the institution is not required to inform the OCC when it has corrected the other violation.³⁸

OCC proposed rulemaking on violations of law or regulation

The OCC's proposed rule would further refine that Agency's supervisory framework for the issuance of MRAs in response to violations of laws or regulations as well as for addressing violations for which the OCC does not take an enforcement action or issue an MRA. The proposed rule is generally consistent with the approach taken by the Agencies in the Final Rule, which identifies four categories of substantive violations that would support the issuance of an MRA, and as to which the Agencies stated in the Rulemaking Release that they intend to exercise their supervisory discretion to issue MRAs for violations only in response to substantive violations.

The proposed regulation would add new paragraphs to the OCC's regulation on enforcement and supervision standards (as adopted in the Final Rule)³⁹ that would specifically limit the issuance of MRAs in response to a violation of a banking or banking-related law or regulation only to substantive violations and also specify the standards for a violation of law or regulation to be treated as substantive.⁴⁰ By reflecting this approach from the Final Rule in the OCC's formal regulations on enforcement and supervision standards rather than merely relying on the Agencies' statements in the Rulemaking Release for the Final Rule that the Agencies "intend" to exercise their supervisory discretion under the Final Rule to issue MRAs only in response to substantive violations, this proposed rulemaking – if adopted in final form – would make more official and permanent this change in the OCC's approach for issuing MRAs. Comptroller of the Currency Jonathan V. Gould described this proposed rulemaking, along with the revisions to the OCC's PPMs, as "[codifying] the agency's return to risk-based supervision, helping to ensure that its more reasonable, intentional approach to bank supervision endures."⁴¹

Under the proposal, a violation of a law or regulation would be treated as substantive "if its nature, duration, frequency, or severity could meaningfully impact the bank or its customers."⁴² The proposed rule would additionally provide more concrete parameters as to the types of violations that would qualify as substantive violations. Specifically, a substantive violation would need to meet at least one of the following criteria for the OCC to issue an MRA:

1. Be systemic, or constitute a pattern;
2. Have had or reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the bank's financial condition;
3. Have had or reasonably be expected to have a more than minimal impact on the accuracy of the bank's books and records;
4. Require more than minimal restitution to, or reasonably be expected to have a more than minimal adverse impact on, customers; or
5. Involve insider misconduct or self-dealing.

The rulemaking release for the proposed regulation identifies the circumstances under which various types of violations could meet the criteria for a substantive violation.

The proposed regulation would also add clarifications as to how the OCC would treat "technical violations" and non-compliance with certain supervisory guidelines. A "technical violation," which term would replace the term "other violations" from the Final Rule, would be a violation for which the OCC does not take an enforcement action or issue an MRA. Examiners would be permitted under the proposed regulation to direct a bank to correct the violation but could not prescribe how the bank must do so or require remediation steps unrelated to correction of the violation.

The proposed regulation would also make clear, consistent with the Agencies' explanations in the Rulemaking Release for the Final Rule, that noncompliance by an institution with the guidelines set forth in the appendices to the OCC's Safety and Soundness Standards regulation⁴³ would not be a substantive violation or a technical violation. The rulemaking release for the proposed regulation notes in this regard that "the OCC believes that existing supervisory mechanisms provide the appropriate degree of examiner and institution focus on addressing such noncompliance."⁴⁴

The OCC additionally clarified that if noncompliance with the guidelines would later meet the criteria for the issuance of an MRA in response to a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and presents certain risks of material harm to the financial condition of the institution, the OCC would then be permitted to issue an MRA. The OCC also specifically requested public comment as to whether there are other illustrative examples of guidelines that the OCC should specify as being excluded from the definitions of substantive and technical violations.

_{1 OCC and FDIC, Unsafe or Unsound Practices, Matters Requiring Attention, 91 Fed. Reg. 56004 (Sept. 1, 2026).
2 OCC and FDIC, Notice of Proposed Rulemaking -- Unsafe or Unsound Practices, Matters Requiring Attention, 90 FR 48835 (Oct. 30, 2025).
3 OCC PPM 5310-3 (Bank Enforcement Actions and Related Matters) (rev. Aug. 27, 2026), https://occ.gov/news-issuances/news-releases/2026/ppm-5310-3.pdf.
4 OCC PPM 5400-11 (Matters Requiring Attention) (rev. Aug. 27, 2026), https://www.occ.gov/news-issuances/news-releases/2026/ppm-5400-11.pdf. As a general matter, an MRA is a formal supervisory communication issued by a depository institution's examiner to the institution's management or board of directors to communicate examination findings as to significant deficiencies or violations for which corrective action will be required.
5 OCC, Notice of Proposed Rulemaking -- Violations of Laws or Regulations, 91 Fed. Reg. 56074 (Sept. 1, 2026).
6 12 U.S.C. § 1818 (Termination of status as insured depository institution). Although the statute provides that an unsafe or unsound practice by a depository institution may serve as a basis for several types of regulatory enforcement actions, including involuntary termination of deposit insurance by the FDIC, a cease-and-desist order or temporary cease-and-desist order, or civil money penalties, the statute does not define that term.
7 OCC Bulletin 2026-40, Unsafe or Unsound Practices and Matters Requiring Attention: Final Rule (August 27, 2026), https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-40.html.
8 OCC and FDIC, Prohibition on the Use of Reputation Risk by Regulators, 91 Fed. Reg. 18279 (April 10, 2026).
9 See, e.g., Federal Reserve Board, OCC and FDIC Joint Press Release, "Agencies remove additional references to reputation risk" (June 2, 2026), https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260602a.htm.
10 90 Fed. Reg. 38925 (Aug. 12, 2025).
11 See Bloomberg Law, "Top Bank Watchdogs Adopt Plan to Narrow Oversight to Core Risks" (Aug. 27, 2026), https://www.bloomberg.com/news/articles/2026-08-27/top-bank-watchdogs-adopt-plan-to-refocus-oversight-on-core-risks.
12 See White & Case Alert, "Comptroller of the Currency and FDIC withdraw from Interagency Leveraged Lending Guidance" (Dec. 18, 2025), https://www.whitecase.com/insight-alert/comptroller-currency-and-fdic-withdraw-interagency-leveraged-lending-guidance; White & Case Alert, "Comptroller of the Currency and FDIC announce proposed changes to Community Reinvestment Act regulations" (Sept. 18, 2026), https://www.whitecase.com/insight-alert/comptroller-currency-and-fdic-announce-proposed-changes-community-reinvestment-act.
13 Federal Reserve Board Div. of Supervision and Regulation, Updated Statement of Supervisory Principles (Sept. 24, 2026), https://www.federalreserve.gov/supervisionreg/files/statement-of-supervisory-operating-principles-20260924.pdf.
14 The Federal Reserve Board has also issued, but not yet finalized, a proposed rule that would codify the removal of reputation risk from the Board's supervisory programs, which would take a generally similar approach to that taken in the April 2026 joint final rule by the OCC and the FDIC on reputation risk. Federal Reserve Board, Notice of Proposed Rulemaking -- Prohibition on Use of Reputation Risk or Other Supervisory Tools to Encourage or Compel Banking Organizations to Engage in Politicized or Unlawful Discrimination, 91 Fed. Reg. 9499 (Feb. 26, 2026).
15 Id. It should be noted that in contrast to the Final Rule, which focuses largely on material financial risks for OCC- and FDIC-supervised depository institutions themselves and treats U.S. financial stability as a separate regulatory matter that is beyond the scope of the Final Rule, the Supervisory Operating Principles provide that banking organization activities or practices that implicate U.S. financial stability should be included as an area of focus for the Federal Reserve Board's examiners and supervisory staff. That difference in approach presumably reflects the somewhat different objectives of the Agencies and the Federal Reserve Board in issuing the Final Rule and the Supervisory Operating Principles, as well as the central role of the Federal Reserve Board in addressing financial stability risks following the financial crisis of 2008-2009.
16 Under the Supervisory Operating Principles, Federal Reserve Board or Federal Reserve Bank supervisory staff "may issue an MRA or MRIA based on a threat to the safety and soundness of a Board-supervised banking organization if they determine in good faith that a financial or nonfinancial deficiency exists that, if not remediated in a timely manner, would create a significant probability of significant harm to the financial condition of the banking organization or one or more other banking organizations, the DIF, the firm's resolvability, or U.S. financial stability, or has resulted in significant actual harm to the financial condition of the banking organization or one or more other banking organizations, the DIF, the firm's resolvability, or U.S. financial stability."
17 Federal Reserve Board or Federal Reserve Bank supervisory staff "may issue an enforcement action based on an unsafe or unsound practice by a Board-supervised banking organization if they determine in good faith that an act or failure to act by the banking organization would, if not remediated in a timely manner, create an abnormal probability of abnormal harm to the financial condition of the banking organization or has resulted in abnormal actual harm to the financial condition of the banking organization." Id. The term "unsafe or unsound practice" is not defined in the Supervisory Operating Principles, in contrast to the approach taken in the Final Rule, but the term "abnormal" is defined to mean substantially higher than normal or significant.
18 The term "institution-affiliated party" is defined in the FDI Act to include (among other things) a director, officer, employee, or controlling stockholder of, or agent for, a depository institution, as well as an independent contractor (such as an attorney, appraiser, or accountant) who knowingly or recklessly participates in certain specified conduct at the institution. 12 U.S.C. § 1813(u).
19 Final Rule, supra, 91 Fed. Reg. at 56007.
20 Id.
21 Final Rule, supra, 91 Fed. Reg. at 56008.
22 Id.
23 Final Rule, supra, 91 Fed. Reg. at 56014.
24 Final Rule, supra, 91 Fed. Reg. at 56009.
25 The Agencies also noted in the Rulemaking Release that the inverse is also true for purposes of the tailoring requirement – i.e., as the risk associated with the factors identified in the tailoring provision decreases, the threshold for materiality of the harm to financial condition increases, the Agencies would consider harm to financial condition with less granularity, and the requirements related to remediation, and expectations regarding prudent operation, would decrease.
26Final Rule, supra, 91 Fed. Reg. at 56012.
27 Statement of FDIC Chairman Travis Hill (Aug. 27, 2026), https://www.fdic.gov/news/speeches/2026/final-rule-unsafe-or-unsound-practices-matters-requiring-attention}.
_{28 Final Rule, supra, 91 Fed. Reg. at 56012.
29 Final Rule, supra, 91 Fed. Reg. at 56013. As examples of banking or banking-related laws or regulations, the Agencies cited in the Rulemaking Release (i) statutes or regulations that establish prudential requirements for depository institutions, such as the FDI Act or Federal Reserve Board Regulation W (Transactions between Member Banks and their Affiliates), (ii) consumer protection laws or regulations applicable to bank products or services, such as the Electronic Funds Transfer Act and the Equal Credit Opportunity Act, (iii) anti-money laundering, counter-terrorist financing, and sanctions laws or regulations, including regulations issued by the Office of Foreign Assets Control to enforce economic and trade sanctions, and (iv) state laws, such as state legal lending limits, that are relevant to the safety and soundness of state-chartered depository institutions. The Agencies further explained that, in contrast, laws that are "wholly unrelated to the business of banking," including zoning or environmental laws and regulations, would not be considered banking or banking-related even though such laws and regulations apply to banks in addition to other parties, and that the nature of other laws and regulations could be dependent on the context in which they are being applied. Id.
30 Final Rule, supra, 91 Fed. Reg. at 56012.
31 Id.
33 OCC News Release 2026-72 (Aug. 27, 2026), https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-72.html.
34 OCC Bulletin 2026-41 (Aug. 27, 2026), https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-41.html.
35 OCC PPM 5310-3 (Bank Enforcement Actions and Related Matters), supra.
36 Id.
37 Id. In OCC Bulletin 2026-41 that accompanied the issuance of the revised PPMs, the OCC also noted that the revisions made to the PPM on Bank Enforcement Actions and Related Matters included the deletion of former Appendix C, "Actions Against Banks with Persistent Weaknesses." That Appendix, which focused on the larger and more complex banks that the OCC supervises, explained how the OCC determined if a bank had persistent weaknesses and the possible additional actions the OCC could take to address them, including requirements that a bank improve its capital or liquidity position, restrictions on the bank's growth, business activities, or payments of dividends, and, as warranted, a requirement that the bank simplify or reduce its operations (including reducing assets, divesting subsidiaries or business lines, or exiting from one or more markets of operation). See OCC News Release 2023-49 (May 25, 2023), https://occ.gov/news-issuances/news-releases/2023/nr-occ-2023-49.html.
38 OCC PPM 5400-11 (Matters Requiring Attention), supra.
39 12 C.F.R. § 4.92.
40 The term "substantive violation" would replace the term "actual violation" in the OCC's standard for the issuance of MRAs under the Final Rule.
41 OCC News Release 2026-72, OCC Acts to Improve Transparency and Consistency to Bank Enforcement and Supervisory Standards (Aug. 27, 2026), https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-72.html.
42 OCC Bulletin 2026-42 (Aug. 27, 2026), https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-42.html.
43 12 C.F.R. Part 30. The guidelines that are set forth in the appendices to that regulation include, among other things, the Interagency Guidelines Establishing Standards for Safety and Soundness, the Interagency Guidelines Establishing Information Security Standards, the OCC Guidelines Establishing Standards for Residential Mortgage Lending Practices, and the OCC's Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches.
44 OCC, Notice of Proposed Rulemaking -- Violations of Laws or Regulations, supra, 91 Fed. Reg. at 56077.}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2026 White & Case LLP}