OCC and FDIC Finalize New Bank Supervision Standards, Defining 'Unsafe Practice' and 'MRA'

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) issued a joint final rule that formally defines an "unsafe or unsound practice" under Section 8 of the Federal Deposit Insurance Act. The regulation, which takes effect on November 2, 2026, marks the first time federal banking regulators have codified the term into binding law. By anchoring the definition to material financial harm, the agencies are raising the evidentiary bar for bank examiners to issue Matters Requiring Attention (MRAs) and escalate supervisory concerns to enforcement actions. The shift represents a structural change in how federal supervisors will evaluate the safety and soundness of the institutions they oversee.[4]

Under the new framework, a practice or failure to act can only be labeled unsafe or unsound if it deviates from generally accepted standards of prudent operation and is likely to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund. The OCC explicitly defines harm to financial condition as financial losses or negative impacts on capital, asset quality, earnings, liquidity, or sensitivity to market risk. Reputation risk unrelated to financial condition is expressly excluded from the definition. "The final rule is intended to promote greater clarity and certainty regarding certain enforcement and supervision standards applicable to national banks... and to ensure that these standards prioritize material financial risks," the Office of the Comptroller of the Currency stated in its official bulletin.[1][4]

The final rule also establishes a uniform, more stringent standard for issuing MRAs. Examiners may now issue an MRA only for an actual violation of a banking law or regulation, or for conduct contrary to prudent standards that could reasonably be expected to cause material financial harm. This replaces decades of subjective supervisory standards where MRAs were frequently used as a catch-all provision for concerns related to policies, processes, and documentation. By codifying the threshold, the agencies are limiting examiner discretion to issue formal citations for nonfinancial weaknesses that do not threaten the immediate stability of the bank.[1][2]

To address less consequential weaknesses without requiring formal corrective action, the agencies created a new category called "supervisory observations." Examiners can use these informal notes to flag deficiencies in policies or procedures that do not meet the threshold for material financial risk. Unlike MRAs, supervisory observations do not require presentation to a bank's board of directors or mandate specific remediation plans. "This definition will focus institution and examiner attention on material financial risks facing an institution and otherwise provide the institution's board of directors and management the flexibility to enact decisions based on their business judgment and risk tolerance," the joint rule notes, according to American Banker.[3]

The OCC simultaneously released a revised policies and procedures manual governing bank enforcement actions, providing greater transparency on how to properly implement remediation plans. The updated guidance allows the agency to terminate an enforcement action once a bank achieves "substantial compliance" with an order, even if minor, isolated, or technical requirements remain unsatisfied. Furthermore, the OCC restricted examiners' ability to conduct "lookbacks"—retroactive reviews of a bank's data to identify previously undiscovered violations. The agency imposed a general one-year cap for reviews tied to inadequate reporting of suspicious activity, requiring approval from a deputy comptroller for any MRA that includes a lookback in its corrective action.[1]

In a notable departure from the October 2025 proposed rule, the final regulation limits its scope strictly to institutions supervised by the agencies. The definition of an unsafe or unsound practice does not apply to individual bankers, directors, officers, employees, or controlling shareholders—collectively referred to as institution-affiliated parties. The OCC and FDIC will continue to pursue enforcement actions against these individuals under their existing statutory authority and applicable legal standards, leaving the new, higher evidentiary bar applicable only to the corporate entities themselves.[2][3]

The regulation mandates that supervisory and enforcement actions be tailored to the specific risk profile of the institution. Examiners must consider factors such as a bank's capital structure, complexity, activities, and asset size when identifying unsafe practices or issuing MRAs. The agencies emphasized that determinations must be supported by objective facts and sound reasoning, a requirement designed to promote consistent application across different examination teams. This regulatory expectation increases scrutiny on bank examiner judgment and provides banks with stronger, clearer grounds to appeal adverse supervisory determinations when findings lack a direct financial nexus.[3][4]

For financial institutions, the formalized standards represent a significant shift in the supervisory landscape. By prioritizing material financial risks over procedural compliance requirements, the rule is expected to reduce the overall volume of MRAs issued by the OCC and FDIC. While the Federal Reserve did not join the joint rulemaking, it has issued a policy statement directionally consistent with the final rule, signaling a broader regulatory consensus toward risk-based supervision. The practical effect shifts the burden of proof onto examiners, requiring them to demonstrate concrete financial stakes before demanding board-level intervention.[1][2]