Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates

OCC and FDIC Finalize Standards for Unsafe or Unsound Practices and MRAs

Skadden Publication

Mark Chorazak Monica Freas Michael P. Reed Dominic Petric

Executive Summary

  • What’s new: The U.S. Office of the Comptroller of the Currency and the FDIC issued a joint final rule to define the term “unsafe or unsound practice” and to revise the framework governing the issuance of MRAs and other supervisory communications. The two agencies also published updated policies and procedural manuals to guide examiners on implementation of the final rule. Additionally, the OCC issued a proposed rule addressing MRA treatment of violations of law.
  • Why it matters: The final rule, which takes effect on November 2, 2026, codifies the agencies’ prioritization of material financial risk when exercising supervisory and enforcement authority and will have wide impact on day-to-day supervision of regulated institutions.
  • What to do next: Supervised institutions should review the new rule alongside the revised policies and procedural manuals and the FDIC chair’s statement to understand the changes and how future supervisory examinations and communications are expected to comport with the final rule. Comments on the OCC’s proposed rule notice are due October 1, 2026.

__________

On September 1, 2026,1 the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) published a final rule to define the term “unsafe or unsound practice” and revise the supervisory framework governing the issuance of matters requiring attention (MRAs) and other regulatory communications. The final rule is intended to promote greater clarity and certainty regarding enforcement and supervision standards applicable to regulated institutions and to ensure that those standards are grounded in material financial risk.2 The OCC and FDIC also revised policies and procedural manuals for examination staff to support implementation of the rule, and the FDIC issued a concurrent statement on implementation. Finally, the OCC issued a Notice of Proposed Rulemaking (NPRM) addressing MRA treatment of violations of law.

The officially released updates, manuals and proposals are as follows:

  • The joint rule issued by the FDIC and OCC codifies the regulatory definition of an “unsafe or unsound practice” and standards for issuance of matters requiring attention (MRAs).
  • Revised OCC manuals establish procedures for examiners to issue MRAs and violations of law or regulation and update the policy on the process for issuing bank enforcement actions.
  • Revised FDIC risk management and compliance examination manuals3 (see August 2026 updates for FDIC redlines to manuals) provide additional application examples and interpretation.
  • A statement by the FDIC chair addresses “Implementation of the Final Rule on Unsafe or Unsound Practices and Matters Requiring Attention.”
  • A new proposal in the form of an NPRM focuses on clarifying the MRA rule for violations of law, drawing a formal distinction between “substantive” and “technical violations.” 

Highlights of the OCC and FDIC Final Rule on Unsafe and Unsound Practices and MRAs

Unsafe or Unsound Definition

The rule defines an “unsafe or unsound practice” as a practice, an act or failure to act, considered alone or together with other conduct, that is contrary to generally accepted standards of prudent operation and either (i) is likely to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund (DIF) if continued, or (ii) has already materially harmed the bank’s financial condition.

  • Under the rule, the agency must establish a sufficiently probable nexus to material financial harm, measured through effects on capital, asset quality, earnings, liquidity, or sensitivity to market risk or to a material risk of loss to the DIF.
  • The standard excludes purely reputational risks and is intended to focus enforcement and supervision on material financial risks rather than deficiencies involving policies, processes, or documentation alone.

    Unsafe or unsound practices:

    As defined, unsafe or unsound practices require a showing of material financial harm to the institution or the DIF, require a likelihood of material harm, not merely possible harm, and focus on financial losses or other negative impacts tied to capital, asset quality, earnings, liquidity or sensitivity to market risk.

MRA Standard

Examiners may issue an MRA for conduct that is contrary to generally accepted standards of prudent operation and that, if continued, could reasonably be expected, under current or reasonably foreseeable conditions, to cause material financial harm or present a material risk of loss to the DIF. An MRA also may address conduct that has already caused material financial harm or an actual violation of a banking or banking-related law or regulation.

  • Because “could reasonably be expected” is a lower probability threshold than the “likely” standard applicable to unsafe or unsound practices, an MRA may be issued before the underlying conduct rises to the level of an unsafe or unsound practice.
  • Speculative or merely possible future harm, however, remains insufficient.

    MRA threshold:

    The OCC may only issue an MRA for practices, acts or failures to act that are contrary to generally accepted standards of prudent operation, and, if continued, could reasonably be expected to, under reasonably foreseeable conditions, materially harm the financial condition of the institution or present harm to the DIF.

Harm Tied to Capital, Asset Quality, Earnings, Liquidity or Sensitivity to Market Risk

The final rule has an express definition of harm to financial condition. The OCC and FDIC discussed this concept in the preamble, but the final rule codifies the concept as “financial losses or other negative effects on an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.” As a result, a management, governance, policy, documentation, process or internal-control weakness cannot support an MRA merely because an examiner regards the issue as deficient. Examiners must demonstrate a reasoned connection between the weakness and actual or reasonably foreseeable material harm to one of the identified financial components or material risk to the DIF, unless the separate violation-of-law category applies.

Tailored Application

Tailoring is generally based on an institution’s capital structure, riskiness, complexity, activities, asset size and other financial risk factors. The final rule explains that as the risks associated with those factors increase, (i) the threshold at which harm is considered material decreases, (ii) the assessment of harm becomes more granular and (iii) the remediation requirements and expectations concerning prudent operation increase. Consequently, a higher-risk or more complex institution may receive an MRA based on material effects within a particular business line, product or service, while a lower-risk institution generally should be evaluated at a less granular, more institution-wide level.

Standard of Objective Facts and Sound Reasoning

The rule expressly requires that agency determinations rest on “objective facts and sound reasoning.”

IAPs Excluded From Final Rule

A notable change from the original proposed rule is that the final rule removes institution-affiliated parties (IAPs) from its scope. The OCC and FDIC removed references to IAPs due to concerns that the materiality standard could create inequities for treatment of the same misconduct by individuals employed at smaller institutions versus employees of larger banks.

Supervisory Observations

The final rule creates a distinction between MRAs and supervisory observations. The final rule defines a supervisory observation as an informal observation that does not rise to the MRA threshold and that creates no requirement or supervisory expectation that the matter be presented to the board of directors or corrected by the institution. The preamble to the final rule further provides that examiners may not require an action plan, track remediation or escalate the observation into an MRA solely because the bank declined to implement the examiner’s suggestion. Nevertheless, an examiner may consider the facts underlying a supervisory observation in assigning supervisory ratings.

Other Violations

Lastly, the final rule specifies the treatment for “other violations.” These are actual violations of banking or banking-related laws or regulations for which the OCC neither takes an enforcement action nor issues an MRA. The OCC may require the institution to correct the violation, but generally may not prescribe how the institution must do so, require unrelated corrective measures or impose additional actions unless those actions are required by law. This provision allows examiners to identify less significant violations without treating the violation as an MRA. Importantly, although the final regulatory text continues to refer broadly to an actual violation as a permissible basis for an MRA, the preamble to the final rule states that violations-based MRAs generally should be reserved for substantive violations. The OCC’s NPRM issued on August 27 (see immediately below) seeks to formalize this proposal.

OCC’s NPRM on Violations of Law

The OCC’s NPRM focuses on clarifying the MRA rule for violations of law, drawing a formal distinction between “substantive” and “technical” violations. The proposal defines a “substantive” violation as one where the violation’s “nature, duration, frequency, or severity could meaningfully impact” a bank or its customers. To rise to a “substantive” violation, the rule would require the violations to fall into one of five set categories that span systemic violations, violations causing more than minimal harm and insider abuses. The stated goal of the new NPRM is to “properly focus institution and examiner attention on the violations of law or regulation that are most critical to the prudent operation of a financial institution.”

Guidance to Examiners

Along with the final rule, the OCC published updates to two related examiner manuals (OCC Policies and Procedures Manual, PPM 5400-11 and PPM 5310-3) governing MRAs and recommendations for enforcement actions, respectively. The FDIC issued a statement, “Implementation of the Final Rule on Unsafe or Unsound Practices and Matters Requiring Attention,” and shared that the agency has already begun reviewing and closing prior MRAs that do not meet the rule standards. The FDIC indicated it would continue its efforts to rescind or revise outstanding agency issuances and manuals and has already updated key portions of its risk management and compliance examination manuals.

Notable Observations From the Issuance and Updates to Examiner Manuals

Tailoring will mean more flexibility to issue MRAs for larger, complex institutions. Tailoring under the final rule is a subjective standard that provides examiners with flexibility to determine whether a practice is unsafe or unsound or an MRA is warranted based on, as mentioned above, the risks associated with a bank’s capital structure, complexity, activities, asset size and any other financial risk-related factor that examiners deem appropriate. Because there is a higher bar for harm to financial condition to be considered material for a community bank than for larger banks, larger and more complex institutions may expect to see MRAs issued where the financial condition of the entire institution is not impacted but there are material impacts to “specific business lines, products, or services.”

Supervisory observations have limits. Both the FDIC and OCC manuals expand further on supervisory observations for findings that do not rise to the level of an MRA but identify weaknesses in a bank’s policies, practices, condition or operations. Supervisory observations highlight practices or omissions that have the potential to cause harm to the bank or lead to future violations, even if such practices or omissions do not yet rise to foreseeable material harm to the financial condition of the bank.

The OCC manual further prescribes that examiners may not require the submission of an action plan or track a bank’s response to a supervisory observation and should not use language that suggests any expectation that the bank take any corrective action. As mentioned in the rule highlights above, examiners may not escalate a supervisory observation into an MRA solely because the bank did not address the concern raised in a supervisory observation. The FDIC manual updates contain the same general process and standards for observations, but lack the stronger prescriptive language found in the updated OCC manuals.

Examiners are expected to make supported judgments. Both the OCC and FDIC manuals expressly provide that determining whether a supervisory finding should be issued as an observation or an MRA that meets the standard of generating a reasonable expectation to materially harm the bank’s financial condition is an examiner judgment, based on objective facts and sound reasoning, and is subject to MRA tailoring.

Proof of remedy sustainability is no longer required. The OCC’s updates have eliminated any prior practice of requiring seasoning or “sustainability” of the corrective action prior to MRA closure: “Examiners must not delay closing an MRA to assess the sustainability of the corrective action.” Examiners are expected to close the MRA after validation is complete and may hold the bank accountable should the practice, act or failure to act reoccur in the future.

The OCC manuals place significant limitations on future lookbacks and independent third-party reviews (including a one-year limit on SAR reporting lookbacks). Lookbacks involve banks reviewing or analyzing historical data over a specified period to identify additional instances of a violation or inaccuracies in a bank’s books and records. The OCC updated manual directly addresses lookbacks and provides that examiners may only include a lookback as part of the corrective action for an MRA when they identify one of the following:

  • The concern is reasonably expected to involve substantial harm to consumers.
  • The concern is reasonably expected to be systemic or demonstrate a pattern of violations.
  • There are concerns about widespread fraud or inaccuracies in a bank’s books and records.
  • Other exceptional circumstances exist.

Third-party lookbacks require OCC deputy-level approval and the methodologies must be tailored to the size and complexity of the bank and the nature, duration, frequency and severity of the concern.

The OCC manual directs examiners to balance the burdens associated with the lookback (particularly costs associated with manual reviews and data limitations) with the benefits of the review (e.g., timely restitution to any harmed consumers or other reduction of financial risks to the bank). Absent special circumstances, lookbacks associated with a bank’s failure to detect or report suspicious activity in a timely manner are limited to one year or less.

While the FDIC has not expressly addressed lookbacks, examiners for FDIC-regulated institutions will likely take into account similar considerations when ordering lookbacks.

Examiners should rely on internal audit results for validation. The OCC directs examiners to rely on an internal audit to validate corrective action. Specifically, the examining manual provides that examiners “must” substantially rely on work performed by the bank’s internal audit when two conditions are met: (i) that function is rated satisfactory and (ii) when the audit has performed validation work. Where a bank has implemented corrective actions and their effectiveness has been validated by the bank’s audit function, examiners “must” close the MRA. The OCC manual further explains that examiners do not need to complete verification activities separate from the validation work.

The FDIC updates to the examiner manuals to date have more general language regarding reliance on an internal audit, to encourage leveraging internal audits and avoiding duplication of work, but the FDIC language is not as strong as the OCC’s.

The permitted reliance on internal audits in place of examiner-led reviews of MRAs and enforcement action compliance means that regulated financial institutions will need to maintain strong, credible audit teams.

Escalation can lead to enforcement. The OCC will generally provide the bank an opportunity to correct MRAs or deficiencies before taking enforcement action, but can take action when the situation warrants. The OCC manual indicates when a bank has engaged in substantive violations or failed to correct concerns communicated through MRAs in a timely manner, escalation to an enforcement action may be appropriate.

Given the high materiality standards in place following the final rule, any institution receiving a substantive violation-of-law citation or MRA should take the matter very seriously and ensure all required corrective action is timely met.

_______________

1 The final rule expressly states that it is prospective: “The definition of ‘unsafe or unsound practice’ in the final rule applies to the agencies’ supervisory and enforcement activities prospectively only.” 91 Fed. Reg. 56005, 56007 (Sept. 1, 2026). Although the rule becomes effective in November 2026, the OCC and FDIC have already moved on to implementation. The FDIC, for example, shared that it had conducted reviews of outstanding supervisory criticisms and determined that a majority of the FDIC’s existing MRAs do not meet the new rule’s standards and are being closed. In February 2026, the OCC also shifted its supervisory strategies and previously issued examiner guidance to align with a focus on material financial risk for MRAs.

2 The Board of Governors of the Federal Reserve System did not join in sponsoring the final rule. However, the Federal Reserve’s vice chair for supervision, Michelle Bowman, has previously called for supervisors to prioritize material financial risks in the examination process.

3 The FDIC has made updates to certain sections of its examiner manuals and indicated it will continue to make further revisions to align with the final rule in the coming weeks and months.

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.

BACK TO TOP