OCC and FDIC Overhaul Bank Supervision, MRAs, and Enforcement Framework

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) (together, the Agencies) issued a final rule (the Final Rule) adopting a regulatory definition for the term “unsafe or unsound practice” and revising the supervisory framework for issuing matters requiring attention (MRAs), as part of the Agencies’ more comprehensive efforts to focus supervisory and institution attention on material financial risks. On the same date, the OCC issued a notice of proposed rulemaking (the MRA Rule) to establish regulatory standards for the types of legal violations that can support an MRA. The OCC also issued a substantially revised edition of its policies and procedures manual governing bank enforcement actions (the Enforcement Manual), and made public its previously unreleased manual governing the use of MRAs (the MRA Manual).

Together, these developments will significantly reform the process used by the Agencies — and in particular, the OCC — to consider, issue, communicate, validate, and terminate their most commonly used supervisory tools and enforcement mechanisms.

Final Rule

The Final Rule follows an October 2025 proposal¹ from the Agencies designed to codify into regulation a prioritization of material financial risks over concerns related to policies, process, documentation, and other nonfinancial risks. As reflected in the preamble to the Final Rule, the Agencies believe it is critical that their enforcement and supervision standards further that prioritization.

The standards used to define an “unsafe or unsound practice” for purposes of Section 8 of the Federal Deposit Insurance Act, 12 U.S.C. § 1818, and for issuing MRAs, track those that were first set out in last year’s proposal (previously covered in our Advisory titled OCC and FDIC Take Steps to Refocus Supervision and Tailor the Regulatory Framework for Community Banks). After considering the public comments received, the Agencies concluded that their proposed standards struck an appropriate balance between proactive identification of material financial risks and according institutions’ boards of directors and management the flexibility to enact day-to-day decisions based upon their business judgment and risk tolerance. The Agencies also concluded that the proposed standards facilitated the communication of clear and transparent supervisory findings. Accordingly, the proposed standards were adopted in the Final Rule.

However, the Agencies determined that the Final Rule will not apply to enforcement and supervisory actions taken against individuals, known as institution-affiliated parties (IAPs). The Agencies explained that the unsafe or unsound practice definition could result in enforcement actions against IAPs influenced by factors “unrelated to the gravity of the misconduct,” such as the asset size or staff size of the institution at the time of the misconduct. The Agencies noted a concern that these types of factors could impede or distort incentives regarding enforcement actions against IAPs.

The Final Rule also emphasizes examiners’ tailoring the unsafe or unsound practice label and MRAs to risk factors specific to a given institution. Notably, the Agencies explained that their expectations for what they will consider to be material harm to an institution’s financial condition will be tailored based on risks associated with its capital structure, complexity, activities, asset size, and other financial risk-related factors. As the risks associated with these factors increase, the threshold for materiality of the harm — triggering either the unsafe or unsound label or an MRA — decreases. At the same time, the Agencies’ assessment of the harm becomes more granular, down to specific business lines, products, or services, as necessary, and the requirements to remediate the concerns increase.

The preamble to the Final Rule provides additional insight into how the Agencies will exercise their supervisory discretion in issuing MRAs that are based on actual violations of banking or banking-related laws or regulations (i.e., those “inherently associated” with the conduct of banking or financial operations). Specifically, the Agencies state that they will only issue MRAs for “substantive violations,” which fall into the following categories: (1) violations that demonstrate a pattern or are systemic; (2) violations that have a more than minimal adverse impact on a bank’s financial condition, accuracy of its books and records, or its customers; (3) violations that require, or could be reasonably expected to require, more than minimal restitution to make recipients whole; and (4) violations that involve insider misconduct or self-dealing. 

The Agencies label those violations that fall outside the scope of a “substantive violation” to be “other violations.” Examiners will only be permitted to direct, generally, that an “other” violation be remediated, unless federal or state law requires that specific additional actions be completed. Violations of guidelines, such as the Interagency Guidelines Establishing Standards for Safety and Soundness,² will no longer be considered a violation of law or regulation.

The Final Rule also codifies the framework for utilizing “supervisory observations,” which are informal observations of weaknesses that fail to rise to the standard for issuing an MRA. This framework ensures that banks will not need to present supervisory observations to the board, or take any corrective action at all to address them. Examiners will not be permitted to formally track and document the implementation of changes made in response to a given supervisory observation.

MRA Rule

The OCC’s MRA Rule is intended to supplement and formally codify the Final Rule preamble’s differentiation between “substantive” and “other” (or “technical”) violations of law and regulation for purposes of determining when examiners can issue MRAs. As the OCC explains, the MRA Rule will eventually convert what essentially is a policy distinction found in the preamble to the Final Rule into a “legally binding limit” on the agency’s ability to issue an MRA once the MRA Rule is finalized. The distinction between substantive and technical violations is intended to prioritize examiners’ and institutions’ attention on those violations that have a greater likelihood to impact banks and their customers.

Under the MRA Rule, a violation can be deemed “substantive” if its “nature, duration, frequency, or severity” could “meaningfully impact” a bank or its customers, and the violation fits within the parameters of at least one of a set of specified categories. This assessment may be affected by the size of an institution and the scope of its operations.

The categories the Agencies outlined in the preamble to the Final Rule generally track to the categories the OCC delineates in the MRA Rule. In the latter, the agency provides more detail about each category and illustrates a number of examples within the enumerated categories.

• Systemic/Pattern of Violations: those violations that are widespread or prevalent in an institution or business line, repeated or ongoing, and are not isolated, e.g., a BSA compliance program violation or a pillar violation.
• More Than Minimal Impact on Financial Condition: those violations that could “reasonably” be expected to have a direct, clear, predictable, and greater than de minimis financial impact on a bank, without considering any impact from the regulators’ response, e.g., the purchase of low-quality assets from an affiliate in violation of Section 23A of the Federal Reserve Act and Regulation W.
• More Than Minimal Impact on Books and Records: those violations with more than a de minimis impact on the accuracy of an institution’s books and records, e.g., a Call Report inaccuracy that would rise to the level of requiring an amendment under relevant call reporting guidance.
• Violations Requiring Restitution: those violations having either a financial or nonfinancial impact on any of a bank’s applicants, current customers, or former customers, and which could prompt either a large amount of restitution to a few customers or a small amount of restitution to many customers, e.g., a failure to establish an adequate identity theft program in violation of the Fair Credit Reporting Act and its implementing regulations.
• Insider Violations: those violations that are knowing or for the benefit of an insider or an insider’s associate, regardless of the size or prevalence of the violations, e.g., violations of Regulation O.

Under the MRA Rule, the OCC would retain discretion to cite a technical violation instead of issuing an MRA, even if the violation meets the criteria of a substantive violation. Although OCC examiners will be allowed to tell banks to correct technical violations, they will not be permitted under the MRA Rule to specify individual corrective actions to be taken or to direct corrective actions be taken if those actions are unrelated to the cited violation. The OCC will not track the status of corrective actions for technical violations under the MRA Rule. Nonetheless, technical violations can be factored into ratings determinations.

Enforcement Manual

In making the first changes to the Enforcement Manual in three years, the OCC significantly overhauled its existing procedures to both align with the Final Rule and reveal a far more moderated posture towards the implementation and termination of enforcement actions. In the Enforcement Manual, the OCC elucidates its “three guiding principles” for enforcement actions: (1) escalation, providing banks an opportunity to remediate deficiencies before imposing, or issuing a more severe, action; (2) tailoring, both in terms of the type of action used, the speed in escalating actions, and requiring corrective actions; and (3) focus on those corrective actions that are essential to remediate specific deficiencies. The revised Enforcement Manual repeatedly stresses that examiners use “objective facts and sound reasoning” in every aspect of their enforcement action assessments, including when they consider initiating an action, debate the type of action to use, and contemplate proposed corrective actions. The revised Enforcement Manual sets out the factors it will consider when making escalation and tailoring decisions.

Drawing in the terminology of the Final Rule and the MRA Rule, the Enforcement Manual illustrates the dividing line between informal, nonpublic actions and formal, public actions. For example, the OCC explains that failure to timely correct an MRA may appropriately lead to an informal action. The agency will generally seek to use a memorandum of understanding (MOU) as its preferred informal action, though MOUs are “not appropriate” if the bank has engaged in an unsafe or unsound practice or a substantive violation of law. The OCC may use individual minimum capital ratios (IMCRs) if the focus is on capital improvement, and the Enforcement Manual provides a list of situations that could prompt IMCRs. Conversely, a public cease-and-desist order (C&D) is appropriate under the Enforcement Manual when a bank has engaged in an unsafe or unsound practice or substantive violation, or a violation of an agency order, agreement, or condition.

The Enforcement Manual instructs examiners to take steps to increase the clarity and transparency of its required corrective actions and supervisory expectations that comprise the enforcement actions, including as related to the supporting facts, the legal basis, restrictions and limitations on activities, and the deadlines for corrective actions. Examiners will not be allowed to impose affirmative requirements lacking a tie to the deficiencies that prompted the action. Under the revised Enforcement Manual, bank boards and management retain the discretion and responsibility to determine the best way to achieve compliance with the required corrective actions.

The Enforcement Manual sets out specific deadlines for examiners to present enforcement actions to banks, issue determinations of no supervisory objections for required submissions, and assess compliance with an action plan or with corrective action requirements.

Examiners validating the corrective action taken by a bank will be required to “substantially rely” on work performed by that bank’s internal audit function, so long as it has been rated satisfactory. OCC staff will have limited ability to seek additional information to independently confirm the effectiveness of the corrective action. In addition, supervisory communications regarding the current state of a bank’s compliance with existing enforcement actions must be clear.

Mirroring an earlier policy shift by the FDIC in 2025, the Enforcement Manual specifies that the OCC will terminate an enforcement action with a bank once it has achieved “substantial compliance” with the order, even if minor, isolated, or technical requirements have not been fully satisfied. The OCC can also terminate an existing enforcement action if examiners determine that action has become outdated or irrelevant to the current circumstances facing the bank. The Enforcement Manual implies that modifications or de-escalation of certain sections of existing actions could become more common if a bank has made significant improvements to its condition or certain requirements have already been successfully completed.

Finally, the OCC removed former Appendix C from its manual; the Appendix, added during the Biden Administration, had established an escalation process for banks with “persistent weaknesses.”

MRA Manual

Alongside the revised Enforcement Manual, the OCC publicized the MRA Manual, which it issued earlier in 2026 but had kept strictly internal. The MRA Manual generally collects the various MRA-related policy statements and standards articulated in the Final Rule, MRA Rule, and Enforcement Manual into a single cohesive document. The MRA Manual also includes policy statements and standards applicable to the use of non-binding supervisory observations.

The MRA Manual revisions reflect the OCC’s focus on distinguishing financial-related weaknesses from other deficiencies, tailoring of corrective action to identified issues, providing transparency and clarity in supervisory communications, and deferring to boards and management in implementing specific corrective action. Under the MRA Manual, self-identification of violations and initiation of remediation will be important considerations for determining the extent of required corrective action. If the root cause of an issue is not apparent, examiners will be required to direct a bank to perform a root cause analysis as part of an MRA.

The MRA Manual also sets out a specific standard for the OCC’s use of lookback reviews. Under the MRA Manual, examiners can include a lookback as part of corrective action for an MRA only when: (1) the concern is reasonably expected to involve substantial harm to consumers; (2) the concern is reasonably expected to be systemic or demonstrate a pattern of violations; (3) there are concerns about widespread fraud or inaccuracies in a bank’s books and records; or (4) other exceptional circumstances exist. The MRA Manual will require examiners to balance the burdens associated with a proposed lookback, including costs, with the benefits to be obtained through the review. A requirement to use an independent consultant to perform a lookback can only be included in an MRA when examiners do not have confidence in management’s abilities, the bank has taken steps to conceal the concern, or other exceptional circumstances exist. Absent special circumstances, lookbacks related to suspicious activity and the use of SARs will be limited to one year or less.

Finally, under the MRA Manual, examiners cannot delay closing out an MRA to assess sustainability of corrective action.

Takeaways

• Examination teams and regional leadership at the Agencies will be responsible for complying with the new regulations and policies, so the impact of these collective policy changes swill take some time to filter through in practice. However, with the new standards in place, banks should expect the number of new MRAs issued by the OCC and FDIC to fall significantly. While examiners will continue to work through the exact contours of the new unsafe or unsound practice definition, the use of the term in routine supervisory correspondence and reports of examination should also drop dramatically. OCC- and FDIC-supervised institutions should review their supervisory records and consider whether any existing MRAs (1) fail to meet the new thresholds, (2) include corrective actions that do not relate to the identified deficiencies, and/or (3) have been held open longer than the agencies now suggest is appropriate, and consider petitioning the agency for modification or closure.
• At both Agencies, bank boards and management should have a better opportunity to seek a supervisory response in lieu of an enforcement action, and will likely find a more receptive audience for their advocacy. Self-identification and proactive remediation, combined with a more relaxed enforcement posture, should go a long way to staving off the enforcement process for many institutions.
• The collective issuances from both Agencies suggest that the supervisory and regulatory expectations for large and complex banks will be higher than for smaller community banks. Practices at community banks may fall below any of the newly announced thresholds, while triggering a supervisory or enforcement response for a bigger bank. Due to the tailoring approach adopted, the Agencies’ assessment of the impact of any practice will be more granular at a larger institution; what is considered “material” at a smaller bank and a larger bank will not be the same. The OCC in particular noted it would more quickly and more severely escalate through the enforcement process if a larger institution is involved.
• For supervisory decisions that fail to meet the new standards, banks should more seriously consider a challenge through the Agencies’ appeals processes. In addition to the reforms the Agencies have rolled out to those processes during the Trump administration, these issuances’ suggest part of the reason examiners should be clear, direct, and transparent in their supervisory correspondence is to inform banks’ decisions to appeal and assist agencies in administering those appeals.
• Banks should take advantage of the Agencies’ policy shifts to have frank discussions with their examination teams in advance of all supervisory decisions, written determinations, and approaching deadlines, as Agency leadership has pledged that their staffs will be more responsive and engaged with bank requests as to the scope and requirements of MRAs and enforcement actions.
• For those OCC-supervised institutions with existing formal or informal enforcement actions, boards and management should evaluate whether they can credibly assert that the corrective actions taken to date can collectively represent substantial compliance, and contend that termination of the action is warranted. At a minimum, a request to terminate could elucidate which of the outstanding requirements the OCC considers to be central to the enforcement action, and which the staff believes are merely isolated or technical, meaning they may not need to be completed before the action can be lifted.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.