OCC And FDIC Put Guardrails Around “Unsafe Or Unsound” Practices And MRAs

On August 27, the Office of the Comptroller of the Currency (“OCC”) and Federal Deposit Insurance Corporation (“FDIC”) jointly finalized a rule defining an “unsafe or unsound practice” and establishing binding standards governing when examiners may issue matters requiring attention (“MRAs”). The final rule is accompanied by revised OCC enforcement and MRA procedures and an OCC-only proposal that would further limit MRAs based on violations of law.

The agencies’ stated objective is to concentrate supervisory attention on material financial risks rather than deficiencies involving policies, processes or documentation that do not meaningfully threaten a bank’s financial condition. Although the rule does not eliminate examiner judgment, it provides banks with a more concrete basis for challenging supervisory findings that appear untethered to material financial risk. The rule becomes effective 60 days after publication in the Federal Register.

Defining unsafe and unsound

The rule defines an unsafe or unsound practice as a practice, act or failure to act—considered alone or together with other conduct—that:

Prudence is contrary to generally accepted standards of prudent operation; and

Material financial harm has materially harmed the institution’s financial condition or, if continued, is likely either to materially harm its financial condition or present a material risk of loss to the Deposit Insurance Fund.

“Harm to financial condition” means financial losses or other negative effects on capital, asset quality, earnings, liquidity or sensitivity to market risk. The agencies declined to assign numerical thresholds to “likely” or “material,” concluding that doing so would create a false appearance of precision. Examiners must instead rely on “objective facts and sound reasoning.”

Importantly, the final rule applies only to the agencies’ actions involving supervised institutions. The October 2025 proposed rule would also have governed enforcement against institution-affiliated parties (“IAPs”), but the agencies removed IAPs from the final rule after concluding that an institution-level materiality standard might unduly constrain actions against individuals at large banks. Enforcement against IAPs will continue under existing standards and controlling case law.

MRAs

In addition to the focus on unsafe and unsound practices, the final rule provides that an MRA may be issued by an OCC or FDIC examiner when an imprudent practice has caused material financial harm or, under current or reasonably foreseeable conditions, “could reasonably be expected” to cause such harm or a material risk of loss to the DIF. This is deliberately a lower probability threshold than the “likely” standard for an unsafe or unsound practice, allowing examiners to act before a risk fully matures. Speculative concerns, however, should not support an MRA.

The rule separately permits an MRA for an actual violation of a banking or banking-related law or regulation. In the preamble, the agencies state that they intend to issue violation-based MRAs only for “substantive” violations, including systemic or patterned violations; violations producing more-than-minimal effects on the bank, its records or customers; violations requiring more-than-minimal restitution; and violations involving insider misconduct or self-dealing. Lesser violations may be classified as “other violations.” The agencies may require their correction, but generally may not prescribe additional corrective measures unless required by law.

Tailoring

The agencies also provided that examiners must tailor MRAs and unsafe-or-unsound-practice enforcement to a bank’s capital structure, complexity, activities, asset size and other financial risk factors. As those risks increase, the materiality threshold decreases, supervisory analysis may become more granular, and remediation requirements may become more demanding. Conversely, the agencies state that there generally will be a higher bar for treating harm as material at a community bank than at a large or complex bank. Thus, conduct affecting a particular business line at a large bank might support an MRA even where comparable conduct would be assessed only at the institution-wide level at a community bank.

Supervisory observations

Examiners may continue to communicate “supervisory observations” concerning weaknesses that do not meet the MRA standard. However, an observation cannot require corrective action, an action plan or presentation to the bank’s board, and examiners may not track voluntary remediation. Nor may an observation be converted into an MRA merely because the bank declined to follow the examiner’s suggestion. The underlying facts may support a later MRA only if changed circumstances independently satisfy the MRA standard.

OCC’s additional releases

The OCC simultaneously revised its enforcement and MRA procedure manuals to implement the new framework. Revised PPM 5310-3 directs the agency to follow three principles: escalation, tailoring and corrective measures limited to those essential to remedy identified deficiencies. The OCC generally should give a bank an opportunity to remediate before escalating and should use the least degree of intervention reasonably necessary—while preserving authority to proceed immediately when circumstances warrant.

Revised PPM 5400-11 provides more detailed MRA procedures. Among other things, MRAs must use the “Five Cs”—concern, cause, consequence, corrective action and management commitment—and must not prescribe in detail how management should address a concern. Examiners must close an MRA once implementation and effectiveness have been validated; they may not keep it open merely to assess whether corrective action remains sustainable over time.

Finally, the OCC’s separate violations notice of proposed rulemaking would codify for national banks and federal savings associations the distinction between “substantive” and “technical” violations. Only substantive violations—those whose nature, duration, frequency or severity could meaningfully affect the bank or its customers—would support an MRA. Technical violations could still be cited and ordered corrected, but the OCC ordinarily would not prescribe the method, require an action plan or track remediation.

Taken together, these actions represent more than a change in supervisory vocabulary. They seem to move the boundary between mandatory remediation and supervisory advice, place greater weight on material financial consequences, and preserve more room for board and management judgment. Their practical significance, however, will depend heavily on implementation—particularly how examiners apply inherently flexible concepts such as “material,” “reasonably foreseeable” and “generally accepted standards of prudent operation.”

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.