OCC, FDIC Finalize New Bank Supervision Standards
2026年09月08日The Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation have finalized a rule that changes how the agencies determine whether to bring enforcement actions and how agencies identify and communicate supervisory concerns. The rule defines unsafe or unsound practices and matters requiring attention and establishes a new standard for supervisory observations, with practical implications for banks supervised by the agencies.
The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) finalized a joint final rule, to be codified at 12 CFR 4.92 (OCC) and 12 CFR 305.1 (FDIC), that will change bank supervision for those banks supervised by the agencies. The final rule establishes a definition for an unsafe or unsound practice, defines in regulation a standard for a matter requiring attention (MRA), and creates a new standard for communicating supervisory observations.
REGULATORY DEFINITION OF UNSAFE OR UNSOUND
An unsafe or unsound practice is one of the primary grounds on which the OCC or FDIC typically issues supervisory criticism or initiates an enforcement action against a bank. Safety and soundness is a central concept in bank supervision, and the primary enforcement statute, 12 USC 1818, allows the federal banking agencies to bring an enforcement action against a bank for engaging in an unsafe or unsound practice.
The statute itself does not define what constitutes an unsafe or unsound practice, and instead this has been left to the discretion of the federal banking agencies and the judgment of the courts.[1] The new rule, however, sets a clear definition for unsafe or unsound practices for banks supervised by the OCC and FDIC, tying it to material financial harm.
Specifically, the final rule defines an unsafe or unsound practice for the institutions that the OCC and FDIC supervise to mean an act, practice, or failure to act that either
- materially harmed the institution’s financial condition; or
- is contrary to generally accepted standards of prudent operation and that, if continued, is likely to
- materially harm the institution’s financial condition; or
- present a material risk of loss to the Deposit Insurance Fund.
The final rule goes on to define harm to a bank’s financial condition to mean financial losses or “negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.” Intentionally excluded from the concept of harm to a bank’s financial condition is damage to its reputation, consistent with the recent regulation eliminating consideration of reputation risk as part of bank supervision.[2]
This new regulatory definition of unsafe or unsound practices does not, however, apply to enforcement actions that the OCC or FDIC would bring against individuals.[3]
MRA STANDARD
The OCC and FDIC for the first time by regulation define the standard they will use to determine whether to issue a matter requiring attention (MRA). MRAs and their close cousins, matters requiring immediate attention from the Board of Governors of the Federal Reserve (Federal Reserve) and matters requiring board attention from the FDIC, have long been the primary tools that federal banking agencies use to identify deficient practices or communicate supervisory concerns. But each agency has applied different and often unpublished standards for issuing MRAs (and their cousins).
The new regulatory standard for issuing an MRA largely tracks the above definition for determining what constitutes an unsafe or unsound practice, again focused on material harm or risk of material harm to a bank’s financial condition. The substantive addition is that an MRA may also be issued based on a violation of banking laws or regulations.[4]
Notably, the regulation simplifies the FDIC’s historical approach to issuing supervisory criticisms. The final rule eliminates the FDIC’s use of matters requiring board attention.
TAILORING AND THE BASIS FOR AN MRA OR UNSAFE OR UNSOUND DETERMINATION
Tailoring
The regulation states that the OCC and FDIC will tailor MRAs and activities related to unsafe or unsound practices based on the risks associated with a bank’s “structure, complexity, activities, asset size” and other financial risk factors. Therefore, larger and more complex banks will face higher and more granular supervisory expectations. In other words, as the risks associated with the size and complexity of a bank increase, so too will the supervisory expectations placed on such a bank.[5]
Basis for Determinations
The regulation creates an expectation that the OCC and FDIC will bring added rigor to their unsafe or unsound and MRA determinations. It states that the agencies will base determinations on “objective facts and sound reasoning.”[6] This regulatory expectation may increase scrutiny on bank examiner judgment and give banks new arguments to appeal adverse supervisory determinations.
OTHER VIOLATIONS, OBSERVATIONS, AND ELIMINATING RECOMMENDATIONS
The final rule also constrains the types of criticisms OCC and FDIC examiners can offer banks. Gone are supervisory recommendations. OCC and FDIC bank examiners are instead limited to more objective actions, including issuing an MRA, pursuing an enforcement action, or citing what the regulation terms “other violations.” An “other violation” is any violation of banking law or regulation that is not addressed in an MRA or enforcement action. For such violations, the agencies may still require the bank to take corrective action.
Despite these more objective requirements, OCC and FDIC bank examiners may still offer supervisory observations, including those related to policies and procedures. Importantly, supervisory observations, unlike prior examiner recommendations or criticisms, do not create an obligation for the bank to respond, take corrective action, or share such observations with the bank’s board of directors.[7]THE OCC AND FDIC REMAKE SUPERVISION, BUT WHERE IS THE FEDERAL RESERVE?
This new regulation may be the most meaningful element thus far in the larger ongoing effort by the OCC and FDIC to remake the way agencies conduct bank supervision. Those efforts have to date included a final regulation to remove the use of reputation risk from the supervisory process; proposed revisions to the rules governing how banks must handle and may disclose confidential supervisory information, generally making information sharing more conducive to the way banks operate; and proposed revisions (the OCC) or implemented changes (the FDIC) to how supervisory appeals are handled, generally making them more independent and more reasonable for banks.
Together with the Federal Reserve and National Credit Union Administration, the OCC and FDIC also proposed revamping the CAMELS rating system for the first time in 30 years, the system that federal banking agencies use to evaluate over 8,500 financial institutions, reorienting the rating system to focus on material financial risk.
The Federal Reserve did not join in this regulation, which is part of a larger recent pattern. The OCC and FDIC have been active in reforming the way these agencies conduct bank supervision, while the Federal Reserve has only joined some of those efforts and not others. The Federal Reserve’s absence from the present final rule creates the possibility of differing views between the OCC and FDIC on one side as bank regulators and the Federal Reserve on the other as holding company regulator.[8] This potential for disagreement may be purely academic for now because the Federal Reserve, as holding company regulator, typically will, and in many cases must, defer to the primary federal supervisor of the bank.[9]
ADDITIONAL POLICY CHANGES AND ACTIONS
Both the OCC and FDIC issued important companion policy changes along with the final regulation. For the OCC, these actions include revised guidance on bank enforcement actions, guidance on MRAs (revised and newly issued to the public), and a proposed regulation to further define what constitutes a substantive legal violation. The FDIC revised its examination manual and issued a policy statement on implementing the new rule.
HOW WE CAN HELP
Our lawyers stand ready to assist banks in reviewing existing MRAs and enforcement actions for compliance with the new rule and to help banks respond to supervisory requests and avoid supervisory criticisms.
Contacts
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following:
[1] Federal courts have applied differing definitions to the term as have the banking agencies at various times. Much of the disagreement has centered on whether the conduct at issue had to threaten a bank’s financial integrity in order for it to be unsafe or unsound. This interpretive issue raised the reality of differing standards for banks depending on their size and business model, where imprudent practices at a small bank could significantly harm the bank, while the same conduct at a larger bank would not. This result can present an incongruity where misconduct at one bank could be deemed unsafe or unsound while the same or worse conduct at a much larger bank would not. The OCC and FDIC sought to avoid that outcome in the final rule.
[2] See 12 CFR 4.91 (Prohibition on the use of reputation risk) and 12 CFR 302.100 (Prohibition on the use of reputation risk by regulators).
[3] The preamble to the final rule is explicit that the OCC and FDIC considered and decided not to apply the regulatory definition of unsafe or unsound practices to individuals, referred to in the statute as institution-affiliated parties. See Unsafe or Unsound Practices, Matters Requiring Attention, 91 Fed. Reg. 56,004, 56,007 (Sept. 1, 2026) (to be codified at 12 CFR pts. 4, 305). Instead, the OCC and FDIC would continue to apply the existing case law definition of unsafe or unsound practices to enforcement actions brought against individuals, which for some cases and courts will be an easier standard for the agency to meet than this new regulatory definition.
[4] 12 CFR 4.92(c)(2) and 12 CFR 305.1(c)(2).
[5] Specifically, the regulation provides that as risks associated with a bank’s “structure, complexity, activities, asset size” or other financial risk factors increase, “the threshold for materiality of the harm to the financial condition” of a bank decreases, the focus of supervisory evaluation becomes more granular (focusing on a business line or product), and the requirements or expectations for the bank increase. 12 CFR 4.92(e) and 12 CFR 305.1(e).
[6] 12 CFR 4.92(f) and 12 CFR 305.1(f).
[7] 12 CFR 4.92(g) and 12 CFR 305.1(g).
[8] The Federal Reserve, for its part, has issued a policy statement directionally consistent with the final rule. See Board of Governors of the Federal Reserve System, Updated Statement of Supervisory Operating Principles (Div. of Supervision & Regulation, April 21, 2026) (stating in part that “examiners and other supervisory staff should prioritize their attention on a firm’s material financial risks. They should not become distracted from this priority by devoting excessive attention to processes, procedures, and documentation that do not pose a material risk to a firm’s safety and soundness.”).
[9] We must wait and see whether, and if so how, the Federal Reserve revises its own approach to unsafe or unsound practices and MRAs.