OCC and FDIC Redefine “Unsafe or Unsound Practices”: The New Supervisory Framework for Banks

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) jointly issued a final rule that, for the first time, gives the term “unsafe or unsound practice” a binding regulatory definition.^[1] With it came a uniform standard for Matters Requiring Attention (MRAs) and revised OCC examination manuals.^[2]The Federal Reserve did not join the rulemaking, but has adopted comparable standards through guidance. What that means for holding companies and state-chartered institutions is addressed below.^[3] The regulation takes effect November 2, 2026, and the revised OCC examination manuals took effect upon their issuance on August 27.

For boards, general counsel, and risk and compliance leaders, the headlines suggest clarity and potential relief. However, while the rule changes what federal bank examiners may require to bring enforcement, it does not change the standards of prudent risk management a bank is held to, the discretion examiners keep over ratings, or the exposure that sits with state supervisors, the holding company, and individual officers and directors. This client alert explains what changed and how to consider responding.

What Changed

The rule creates two standards and three tiers of supervisory communication:

Financial institutions should be aware of three key points.

First, materiality is assessed on a financial basis. Harm is measured against capital, asset quality, earnings, liquidity, and market risk, and reputational concerns alone are not sufficient to support a finding. Non-financial risks still count when their consequences are financial: a serious cyber breach that produces litigation, restitution, or deposit flight could meet the test. However, materiality is not applied as a uniform standard under the final rule — rather, it is tailored to the institution. What constitutes material harm for a large, complex bank will not necessarily meet that threshold for a community bank.^[7]

Second, this definition of unsafe or unsound practice is only applicable to a bank, not institution-affiliated parties. In a reversal of the originally proposed version of the rule, the new definition does not apply to individuals. For officers and directors, “unsafe or unsound” keeps its longstanding case law meaning — conduct contrary to prudent operation that creates an abnormal risk of loss to the bank — with no requirement that material financial harm be likely. A director’s or officer’s personal exposure did not narrow under the final rule.^[8]

Third, an MRA can also be issued for any violation of banking or banking-related law, with no materiality test.^[9] Examiners may use that path for weaknesses they used to frame as risk-management concerns. Furthermore, by framing these as violations, rather than weaknesses, these determinations can carry civil money penalties. The agencies have said they intend, as a matter of supervisory discretion, to reserve that path for “substantive” violations: those that are patterned or systemic; have more than a minimal impact on the bank, its books and records, or its customers; require more than minimal restitution; or involve insider misconduct. An OCC proposal published September 1, with comments due October 1, would codify that position in a regulation.^[10]

The OCC has revised its manuals to put these new standards into practice.^[11] Pursuant to these manual revisions, lookbacks — the historical file reviews that have dominated remediation budgets — would now be the exception. To mandate a lookback, examiners now need specified grounds and senior regulatory approval, must weigh cost against benefit, and, going forward, are expected in the ordinary course to let the bank do the review itself, as opposed to mandating an independent consultant. Reviews tied to suspicious-activity reporting will generally be capped at one year.^[12] This relief is specific to the OCC. The CFPB’s authority over larger banks is not affected,^[13] and FinCEN, the U.S. Department of Justice (DOJ), OFAC, and state authorities are not bound by the manual.^[14] A review scoped to the OCC’s one-year cap narrows what the OCC demands; it does not narrow the bank’s exposure to FinCEN, which has six years from a transaction to assess a civil penalty and two more to sue on it; to OFAC, which has a 10-year window to act; or to the DOJ, so a decision not to look further back should be documented and made with counsel.

MRAs going forward can also be validated and closed on a shorter timetable. An MRA can close once remediation is in place and validated, with no “sustainability” holding period, and an enforcement action can end at “substantial compliance.”^[15] For FDIC-supervised institutions, the rule also changes the FDIC’s longstanding examination practice. For examination reports issued after August 31, 2026, the FDIC will no longer use Matters Requiring Board Attention (MRBAs) or Supervisory Recommendations (SRs), the two categories through which it has historically communicated findings, and will use the single MRA category under the new rule.^[16]

Considerations for Financial Institutions in Light of Regulatory Changes

Under the new standards, most findings will now be observations with no required action plan, no board reporting, and no formal examiner validation requirements. The issue-management frameworks built over the last decade may at first glance appear mismatched to the current state; however, banks, particularly large complex institutions, may determine that it is in their best interest to recalibrate these frameworks as opposed to making wholesale changes.^[17]

Continue tracking observations. Banks may wish to continue tracking observations, even though it is not required. An observation cannot be escalated just because the bank did not act on it.^[18] However, examiners keep full discretion over CAMELS ratings, and the management rating in particular may be impacted by outstanding observations, whether a single observation or a group of observations considered collectively.^[19]

Document the decision: remediate, tailor, or accept. Banks may also wish to assess each observation against the bank’s approved risk appetite, and under the new framework, three responses are available. Banks may remediate the matter as recommended by examiners; tailor the remediation, agreeing with the concern but implementing remediation suited to the bank, which the manuals expressly permit;^[20] or accept the risk, concluding, within the approved risk appetite, that no action is warranted. A record of why the bank chose its course is its best protection if a finding is revisited under a different standard.

Banks should continue to address sustainability. The OCC can no longer hold an MRA open to test whether a remediation endures. But repeat findings now must be labeled as such and invite escalation.^[21] Sustainability testing therefore remains a priority, whether it is completed by an independent compliance testing function or by internal audit, provided the function validating the remediation is not the one that implemented it.

Redesign board reporting around fiduciary oversight. The rule removes the requirement to present observations to the board. However, directors’ oversight duties under Delaware law, the OCC’s heightened standards for larger banks, and public-company disclosure controls all operate independent of supervisory requirements.^[22] A periodic summary of observation themes, the decisions taken, and the items the bank chose not to pursue keeps the board’s oversight record documented. Because such a summary may be discoverable, banks may wish to frame decisions as risk determinations against the approved risk appetite and to conduct any analysis of potential violations of law, and of the related legal exposure, under privilege.

Why the Governance Discipline Is Worth Keeping

Supervisory philosophy has historically shifted with agency leadership, and administrations change. The rule itself is durable: the agencies are bound by their own regulations, and undoing one typically requires notice and comment.^[23] The manuals, however, are not, and examiner practice will move faster than the Federal Register in either direction. A bank that stops tracking observations and faces a differently oriented examination team in the future will be reconstructing the intervening dialogue from institutional memory. A bank that keeps its documentation discipline will be in a better position during future exams, regardless of the administration and supervisory approach.

Two additional considerations strengthen the case for documentation discipline for many organizations. The Federal Reserve adopted similar standards to those in the new OCC/FDIC rule, but only by guidance, so holding company relief is the least durable aspect of the change in supervisory posture. The Federal Reserve also assesses a holding company’s risk management itself, and that assessment reflects how the organization tracks and resolves supervisory feedback. If the bank has a state supervisor, the state’s approach has not changed. That includes the New York Department of Financial Services (NYDFS), which supervises some of the largest U.S. banking organizations through their New York-chartered banks, as well as many foreign bank branches.^[24] State supervisors flagged this divergence in the rulemaking and asked the agencies to wait for the Federal Reserve prior to issuing a final rule. The agencies did not.^[25] Where a federal examiner would log an observation, a state examiner may write a formal finding on the same facts, and that finding informs the Federal Reserve’s holding company assessment. For New York-chartered institutions, the NYDFS record, not the narrowed federal one, will continue to define the examination approach.

Conclusion

The final rule narrows the range of conduct that regulators may require institutions to remediate. However, it does not explicitly alter the standards of prudent risk management to which institutions remain subject. Institutions may appropriately avail themselves of the relief the rule provides but should give attention to maintaining a record of how each supervisory concern was evaluated and resolved. The record is what will render the relief durable as supervisory approaches evolve over time.