New OCC and FDIC Rule Limits Bank Enforcement to Material Financial Risks

For decades, the phrase "unsafe or unsound practice" has functioned as the ultimate trump card in US bank supervision—a vague, undefined statutory hammer that regulators could drop on almost any activity they disliked. That era of open-ended discretion ended this week. The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) have finalized a joint rule that explicitly defines the term, fundamentally rewriting the boundaries of federal bank oversight.[1][2][6]

The core mechanism of the new regulation is a strict materiality threshold. Supervisors are now legally directed to focus exclusively on "material financial risks." They are barred from issuing severe penalties, downgrading ratings, or demanding corrective action based on subjective, non-financial concerns—such as internal process documentation or "reputation risk"—provided those issues do not threaten the bank's actual solvency.[3][4][7]

To qualify as an unsafe or unsound practice under the new framework, a bank's conduct must deviate from generally accepted prudent standards and be likely to cause material harm to its financial condition or the FDIC's Deposit Insurance Fund. The agencies clarified that "material harm" means direct, predictable negative impacts on capital, asset quality, earnings, liquidity, or sensitivity to market risk.[1][4][7]

While the agencies market the shift as a way to "promote greater clarity and certainty," the practical reality is a significant rollback of the supervisory perimeter. If a bank's balance sheet is sound, examiners can no longer use hypothetical reputational damage or procedural foot-faults as a pretext for formal enforcement.[2][3][8]

The rule represents the final architectural piece of a broader campaign to dismantle what critics call "politicized debanking." Earlier in 2026, the OCC and FDIC finalized a related regulation that entirely eliminated "reputation risk" from their supervisory toolkits. That earlier move responded to industry complaints that regulators were quietly pressuring banks to drop lawful but politically disfavored clients by citing vague reputational concerns.[5][8]

The digital asset sector has been particularly vocal in welcoming the new constraints. Crypto advocates have long argued that subjective risk assessments were weaponized to orchestrate "Operation Chokepoint 2.0," a coordinated effort to cut digital asset firms off from the traditional banking system. By forcing examiners to prove actual financial risk, the new rule makes informal, backdoor pressure campaigns significantly harder to execute.[5][6]

Beyond the headline definition, the rule overhauls the mechanics of how Matters Requiring Attention (MRAs) are issued. MRAs are the standard tool examiners use to force banks to fix deficiencies. Under the new regime, examiners can still flag weaker policies as informal "supervisory observations," but they are generally prohibited from escalating them to formal MRAs unless the issues cross the new risk-based materiality threshold.[1][6][7]

The OCC has also committed to a major procedural concession: it will not pursue severe Section 8 enforcement actions—such as cease-and-desist orders or civil money penalties—without first giving institutions the opportunity to remediate the identified issues during the normal supervisory process. This effectively builds a mandatory warning track into the regulatory enforcement ladder.[6]

Further limiting supervisory reach, the guidance accompanying the rule restricts examiners' ability to conduct open-ended "lookbacks." Supervisors are now generally capped at reviewing one year of historical data when searching for previously undiscovered reporting violations, unless there is clear evidence of consumer harm or widespread, systemic failure.[1]

FDIC Chairman Travis Hill characterized the rule as a necessary pivot toward underlying fundamental risks and away from micromanaging banks' internal processes. While he noted that examiners can still proactively identify problems before a bank fails, he conceded that the risk of financial harm must now be "more than speculative or merely possible" to warrant intervention.[4]

The traditional banking industry has universally praised the development. The American Bankers Association stated that the finalized definitions will bolster safety and soundness by replacing arbitrary examiner discretion with predictable, data-driven standards. The lobbying group emphasized that the rule properly tailors regulatory expectations to a bank's actual risk profile.[2]

The rule officially takes effect 60 days after its publication in the Federal Register. In the interim, the FDIC has announced it is conducting a retrospective review of all outstanding MRAs to assess which ones meet the new, stricter standard. For numerous institutions currently bogged down in procedural remediation, that lookback could quietly wipe the supervisory slate clean.[4][5][7]