The OCC revised its enforcement manual, revised and publicly released its MRA manual, and proposed a new rule to codify a supervisory framework for the issuance of MRAs in response to violations of law or regulations.[1] The FDIC issued a statement that summarized its implementation approach, including updating examination communications, Reports of Examination (ROEs), manuals, and related supervisory materials.[2]
OCC ENFORCEMENT POLICY: ESCALATION, TAILORING, FOCUS, TERMINATION
The OCC’s Revised Enforcement Action Policies and Procedures Manual (PPM) articulates three guiding principles when it considers enforcement actions: “escalation, tailoring, and focus on the actions essential to correcting specific deficiencies.”[3]
Escalation. The PPM explains that an appropriate supervisory or enforcement response to a deficiency should use the least degree of OCC intervention reasonably necessary for timely and satisfactory remediation. Implicit in the new policy is that the most likely first tool OCC examiners will use to address a deficiency is an MRA, and immediate escalation to an informal or formal enforcement action will be unusual. The OCC nevertheless reserves the right to take any legally supportable action when circumstances warrant.[4] Note that PPMs are internal guidance and do not create enforceable rights, but the standards articulated will shape supervisory practice.
Tailoring. The OCC will tailor the type of enforcement action, the speed of escalation, and the required corrective actions to the specific bank’s financial risk–related factors, including capital structure, complexity, and asset size. Management responsiveness is a central consideration to whether the OCC pursues an enforcement action. A history of correction or prompt steps to remediate the issue may make escalation unnecessary, but larger or more complex banks may face quicker escalation.
Focus. Enforcement actions should include only the provisions necessary to address the identified deficiencies and should not elevate process over substance. Time will tell whether future OCC enforcement actions in fact become more targeted.
Termination. The OCC also will terminate an action upon substantial compliance, meaning the OCC will terminate an action after satisfaction of the essential requirements even if minor, isolated items remain unresolved. This is a significant policy modification and could result in the duration of new enforcement actions shrinking. These new standards should support requests for narrower provisions, de-escalation, modification, or termination once the risk is addressed.
OCC MRA POLICY ESTABLISHES CONCRETE STANDARDS FOR DRAFTING AND IDENTIFYING LESS SERIOUS ISSUES
For many years, the OCC has followed internal guidance defining the structure and process for MRAs. This is the first time the OCC has released its internal MRA guidance, PPM 5400-11, publicly, while updating it to be consistent with the Final Rule. The guidance directs examiners to draft each MRA to address one concern using the Five Cs: concern, cause, consequence, corrective action, and commitment.[5]
Mirroring the Final Rule, examiners must rely on objective facts and sound reasoning and avoid vague or overbroad language. A violation-based MRA must identify the legal authority and supporting facts, and corrective actions must be timely, measurable, and connected to the concern while not being overly prescriptive.[6] In all cases and as with enforcement actions, examiners are expected to tailor the MRA to be consistent with the size and complexity of the bank.
The policy also separates less serious findings from MRAs. Examiners may identify “other violations” and make supervisory observations. An “other violation” should be communicated to the bank in an appendix to the ROE or supervisory letter providing a legal citation and brief factual basis.
The OCC may direct correction but may not prescribe the method, require an action plan, track correction, or require notification after a bank has corrected the violation. Supervisory observations are nonbinding, generally go to executive management, and may not appear in an ROE or be subject to an action plan. The policy provides that examiners cannot escalate the observation into an MRA solely for inaction.
The PPM further limits costly remediation demands. Lookbacks are reserved for specified circumstances, must be tailored, and must balance burden against benefit. Independent consultants are also limited to defined cases and require senior approval.
Once corrective actions are implemented and validated, examiners must close the MRA without delaying closure to test sustained performance; this is a change from the OCC’s historical practice where often examiners were expected to see sustained effectiveness of the remediation prior to closing the MRA.[7]
OCC REGULATORY PROPOSAL WOULD MAKE THE SUBSTANTIVE-VIOLATION THRESHOLD BINDING
The OCC also proposed a revision to the newly issued Final Rule to limit MRAs for legal violations to substantive violations whose nature, duration, frequency, or severity could meaningfully affect the bank or its customers.
To meet the standard for an MRA, a violation would need to satisfy at least one of five criteria:
- Be systemic or constitute a pattern;
- Have, or reasonably be expected to have, a direct, clear, predictable, and more than minimal impact on the bank’s financial condition;
- Have, or reasonably be expected to have, a more than minimal impact on the accuracy of the bank’s books and records;
- Require more than minimal restitution or have, or reasonably be expected to have, a more than minimal adverse impact on customers; or
- Involve insider misconduct or self-dealing.
Under the proposal, violations for which the OCC does not take an enforcement action or issue an MRA would be cited as technical violations. Examiners could require correction but could not prescribe the manner of remediation. The revised MRA PPM already adopts this framework as policy; the proposal would give it regulatory force.[8]
FDIC IMPLEMENTATION: RECLASSIFICATION AND CLOSURE OF EXISTING FINDINGS
The FDIC issued a supervisory Financial Institution Letter explaining how it intends to implement the Final Rule across its risk-management and consumer-protection examination and enforcement functions. For ROEs issued after August 31, 2026, the FDIC will replace Matters Requiring Board Attention and Supervisory Recommendations with MRAs for supervisory criticisms.
The FDIC has committed to completing a lookback with state supervisors, after which the FDIC will notify each institution in writing which outstanding items are redesignated as MRAs and which are closed. It will not convert legacy findings into supervisory observations. A closed criticism that contains an actual legal violation, however, may be redesignated as an “other violation,” with correction or restitution still required. Closure therefore may end the criticism without ending every remedial obligation.[9]
FDIC MRA IMPLEMENTATION IN REPORTS OF EXAMINATION
Similar to the OCC, the FDIC states that formal ROE communications requiring remedial action generally will be issued as MRAs or enforcement actions, but institutions must still remediate legal violations below the MRA threshold. Examiners are to focus on objective evidence of material financial harm, material risk of loss to the Deposit Insurance Fund (DIF), and substantive violations, considering the institution’s business model, activities, and circumstances.
They may address reasonably foreseeable harm before it occurs, but the concern must be more than speculative. ROE comments generally will be more concise, and each MRA will follow a standard three-part format: a description of the issue, the rationale tying it to material harm, DIF risk, or an actual violation requiring remediation, and the FDIC’s expectations for corrective action.[10]
FDIC MANUAL REVISIONS PUT PART 305 INTO EXAMINATION PRACTICE
The FDIC revised core Risk Management Manual sections on examination concepts, legal violations, ROE instructions and examples, and examination planning. It also revised Consumer Compliance Examination Manual chapters on examination documentation, investigations, appeals, Home Mortgage Disclosure Act, and small-dollar lending.
The changes embed Part 305 into prudential and consumer-compliance examinations; broader manual revisions are expected next year.[11]
HOW WE CAN HELP
Our lawyers stand ready to assist banks in reviewing existing MRAs and enforcement actions for compliance with the Final Rule and help banks respond to supervisory requests and avoid supervisory criticisms.
