Rule2026-17823
Unsafe or Unsound Practices, Matters Requiring Attention
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 1, 2026
Effective
November 2, 2026
Issuing agencies
Treasury DepartmentComptroller of the CurrencyFederal Deposit Insurance Corporation
Abstract
The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) are adopting a final rule to define the term "unsafe or unsound practice" for purposes of section 8 of the Federal Deposit Insurance Act and to revise the supervisory framework for the issuance of matters requiring attention and other supervisory communications.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 168 (Tuesday, September 1, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 168 (Tuesday, September 1, 2026)]
[Rules and Regulations]
[Pages 56004-56022]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-17823]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the Currency
12 CFR Part 4
[Docket ID OCC-2026-0174]
RIN 1557-AF35
FEDERAL DEPOSIT INSURANCE CORPORATION
12 CFR Part 305
RIN 3064-AG16
Unsafe or Unsound Practices, Matters Requiring Attention
AGENCY: Office of the Comptroller of the Currency, Treasury, and the
Federal Deposit Insurance Corporation.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Office of the Comptroller of the Currency (OCC) and the
Federal Deposit Insurance Corporation (FDIC) are adopting a final rule
to define the term ``unsafe or unsound practice'' for purposes of
section 8 of the Federal Deposit Insurance Act and to revise the
supervisory framework for the issuance of matters requiring attention
and other supervisory communications.
DATES: The final rule is effective November 2, 2026.
FOR FURTHER INFORMATION CONTACT:
OCC: Eden Gray, Assistant Director, Marjorie Dieter, Special
Counsel, Harry Naftalowitz, Attorney, Chief Counsel's Office, 202-649-
5490, Office of the Comptroller of the Currency, 400 7th Street SW,
Washington, DC 20219. If you are deaf, hard of hearing, or have a
speech disability, please dial 7-1-1 to access telecommunications relay
services.
FDIC: Brittany Audia, Chief, Exam Support Section, Division of Risk
Management Supervision, (703) 254-0801, <a href="/cdn-cgi/l/email-protection#2a484b5f4e434b6a4c4e4349044d455c"><span class="__cf_email__" data-cfemail="76141703121f173610121f1558111900">[email protected]</span></a>; Seth P.
Rosebrock, Assistant General Counsel, Legal Division, (202) 898-6609,
<a href="/cdn-cgi/l/email-protection#dba8a9b4a8beb9a9b4b8b09bbdbfb2b8f5bcb4ad"><span class="__cf_email__" data-cfemail="a9dadbc6dacccbdbc6cac2e9cfcdc0ca87cec6df">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
I. Introduction
The OCC and the FDIC (collectively, the agencies) exercise their
enforcement and supervision authority to ensure that supervised
institutions \1\ refrain from engaging in unsafe or unsound practices,
operate in compliance with applicable laws and regulations, and address
emerging supervisory concerns. To that effect, it is important to
promote greater clarity and certainty regarding certain enforcement and
supervision standards by defining them through regulation. Moreover, it
is critical that examiners and institutions prioritize material
financial risks over concerns related to policies, process,
documentation, and other nonfinancial risks, and that the agencies'
enforcement and supervision standards further that prioritization.
---------------------------------------------------------------------------
\1\ For purposes of this preamble, the term ``institution''
refers to national banks, insured State nonmember banks, Federal and
State savings associations, Federal branches and agencies of a
foreign bank, insured State licensed branches of a foreign bank, and
industrial loan corporations subject to supervision or enforcement
by the agencies.
---------------------------------------------------------------------------
On October 30, 2025, the agencies published in the Federal Register
a notice of proposed rulemaking \2\ to clarify the agencies'
supervisory and enforcement framework and focus on practices, acts, or
failures to act, that, if continued, would be likely to materially harm
the institution's financial condition or present a material risk of
loss to the Deposit Insurance Fund (DIF). Specifically, pursuant to the
provisions of section 8 of the Federal Deposit Insurance Act (FDI Act)
(12 U.S.C. 1818), the agencies are authorized to take enforcement
actions against depository institutions \3\ and
[[Page 56005]]
institution-affiliated parties \4\ that have engaged in an ``unsafe or
unsound practice.'' The agencies proposed to establish a regulatory
definition for the term ``unsafe or unsound practice'' for purposes of
section 8 of the FDI Act. Additionally, the agencies proposed to
establish standards for the issuance of Matters Requiring Attention
(MRAs) and supervisory observations.
---------------------------------------------------------------------------
\2\ See Unsafe or Unsound Practices, Matters Requiring
Attention, 90 FR 48835 (Oct. 30, 2025).
\3\ A depository institution generally refers to an insured
depository institution as defined in 12 U.S.C. 1813(c)(2); any
national banking association chartered by the OCC, including an
uninsured association; or a branch or agency of a foreign bank.
Refer to specific provisions of 12 U.S.C. 1818 regarding their
applicability to a specific institution. See 12 U.S.C. 1818(b)(4)-
(5).
\4\ See 12 U.S.C. 1813(u).
---------------------------------------------------------------------------
After considering the comments received on the proposal and as
further described in this preamble, the agencies are adopting a final
rule consistent with the objectives of the agencies' proposal, with
certain modifications. The final rule will explicitly limit its scope
to institutions the agencies supervise. The final rule will also
clarify how the agencies will exercise their enforcement and
supervisory authority, including how the agencies will tailor their use
of unsafe or unsound practices and matters requiring attention based on
risk factors specific to an institution.
II. Overview of Proposal and Summary of Comments Received
The agencies proposed to issue a rule to define the term ``unsafe
or unsound practice'' for purposes of section 8 of the FDI Act to mean
a practice, act, or failure to act, alone or together with other
practices, acts, or failures to act, that (1) is contrary to generally
accepted standards of prudent operation; and (2)(i) if continued, is
likely to (A) materially harm the financial condition of an
institution; or (B) present a material risk of loss to the DIF; or (ii)
materially harmed the financial condition of the institution. The
proposed definition would have applied to the agencies' supervisory and
enforcement actions taken against both institutions and institution-
affiliated parties. The proposed rule also sought to establish that the
agencies may only issue an MRA for a practice, act, or failure to act,
alone or together with one or more other practices, acts, or failures
to act, that (1)(i) is contrary to generally accepted standards of
prudent operation; and (ii)(A) if continued, could reasonably be
expected to, under current or reasonably foreseeable conditions, (1)
materially harm the financial condition of the institution; or (2)
present a material risk of loss to the DIF; or (B) has already
materially harmed the financial condition of the institution; or (2) is
an actual violation of a banking or banking-related law or regulation.
As proposed, the rule would have required the agencies to tailor
their respective supervisory and enforcement actions under 12 U.S.C.
1818 and issuances of MRAs both with regard to the requirements or
expectations set forth in such actions as well as whether, and the
extent to which, such actions are taken. Tailoring would have been
based on the capital structure, riskiness, complexity, activities,
asset size and any financial risk-related factor that the agencies
deemed appropriate. For matters that would not have met the criteria
for the proposed MRA standard, the agencies proposed clarifying that
they would be permitted to communicate a suggestion or observation
orally or in writing to enhance an institution's policies, practices,
condition, or operations, provided that the communication would not be,
and would not be treated by the agencies in a manner similar to, an
MRA.
The agencies received in total 36 comments on the notice of
proposed rulemaking. Many commenters generally supported the proposed
rule while others opposed it. Some commenters who supported the
proposal highlighted the need for reform of the agencies' supervisory
and enforcement practices. One commenter asserted that a high
percentage of supervisory findings, including MRAs, relate to non-
financial risks, and that bank employees spend an increasing amount of
time complying with examiner mandates. One commenter asserted that
limiting examiner discretion and eliminating many non-financial
concerns with respect to the type of concerns that could serve as the
basis for an MRA will lead to structural supervision reform that will
address debanking concerns. Another commenter thought that the proposal
would address expansive MRA usage that has shifted regulatory decision
making from public rulemaking to private supervision on an institution-
by-institution basis. Generally, the agencies agree with these
commenters that the final rule will provide important reforms to the
agencies' supervisory and enforcement practices and will help examiners
and institutions take appropriate action where action is most warranted
to promote safety and soundness.
Commenters that supported the proposal also expressed that the
proposal's emphasis on targeted supervision for material financial
risks would better focus examiners and institutions on key
considerations in furtherance of safety and soundness. For example, one
commenter indicated that clarifying unsafe or unsound practices would
benefit institutions by allowing them to prioritize issues.
Additionally, commenters noted that the proposal would promote the
clarity, consistency, and transparency of bank supervision. For
example, a commenter asserted that codification of the agencies' views
of unsafe or unsound practices and the standard for issuing MRAs would
enhance institutions' dialogue with examiners and accountability for
the agencies in connection with appeals of supervisory determinations.
The agencies also agree that the proposed rule generally struck the
appropriate balance between proactive identification of material
financial risks by examiners and providing each institution's board of
directors and management with clear and transparent supervisory
findings and the flexibility to enact day-to-day decisions based on
their business judgment and risk tolerance.
Other commenters opposed the proposal, and some of these commenters
suggested that the agencies withdraw the proposal. Commenters who
opposed the proposal argued that the proposed regulatory definition of
``unsafe or unsound practice'' and standard for the issuance of MRAs
would inhibit examiners from proactive identification of risks to
institutions. For example, one of these commenters indicated that the
2008 financial crisis demonstrated that regulations could not keep up
with rapid changes in institutions' products and practices. Commenters
also indicated that the proposal disregarded the importance of
policies, procedures, documentation, and nonfinancial risks in bank
supervision, such as operational risks and risks to consumers. Some
commenters asserted that bank policies and procedures could serve as
leading indicators of financial risk without demonstrating this link.
However, these assertions are not consistent with the agencies'
supervisory experience. Rather, the final rule will encourage
institutions to focus on the most important risks to an institution's
safety and soundness. Examiners may still provide supervisory
observations related to weaknesses in policies and procedures, and, in
situations where issues related to an institution's policies or
procedures would meet the criteria to be deemed an unsafe or unsound
practice or merit the issuance of an MRA, the agencies could take
enforcement or supervisory action accordingly.
Furthermore, commenters expressed concern that the proposal's more
targeted focus on material financial risks could create incentives for
institutions to improve their financial performance at the expense of
controls. The agencies expect that institutions will prudently operate
in accordance with generally
[[Page 56006]]
accepted standards, and that any potential material financial risks
would be properly addressed by the agencies. Finally, commenters argued
that the proposal and its focus on risks to individual financial
institutions failed to consider systemic risk to the financial system.
Although macroprudential concerns are not the focus of the agencies'
unsafe or unsound practices enforcement authority or MRA supervisory
authority, the proposed standards' renewed focus on material financial
risks will also strengthen the greater financial system by encouraging
banks to address the most significant financial risks with the greatest
vigilance.
III. Final Rule
A. Unsafe or Unsound Practices
Based on the agencies' supervisory experience and as a matter of
policy, the agencies proposed to implement a definition of ``unsafe or
unsound practice'' for purposes of section 8 of the FDI Act that would
have focused on material risks to the financial condition of an
institution and would have generally required that an imprudent
practice, act, or failure to act, if continued, would be likely to
materially harm the institution's financial condition or present a
material risk of loss to the DIF. The proposal explained that, taking
into account statutory text, legislative history, and case law, the
proposed regulatory definition fit within the authority Congress
granted to the agencies to take enforcement actions based on unsafe or
unsound practices under section 8 of the FDI Act.\5\
---------------------------------------------------------------------------
\5\ See Groos Nat'l Bank v. OCC, 573 F.2d 889, 897 (5th Cir.
1978) (``The phrase `unsafe or unsound banking practice' is widely
used in the regulatory statutes and in case law, and one of the
purposes of the banking acts is clearly to commit the progressive
definition and eradication of such practices to the expertise of the
appropriate regulatory agencies.'').
---------------------------------------------------------------------------
The term ``unsafe or unsound practice'' appears in section 8 of the
FDI Act for purposes of the agencies' enforcement authority. The
statute does not define the term unsafe or unsound practice. An unsafe
or unsound practice may serve as a ground for several types of
enforcement actions under provisions of section 8 of the FDI Act. These
include involuntary termination of deposit insurance by the FDIC,\6\ a
cease-and-desist order,\7\ a temporary cease-and-desist order,\8\ or a
Tier 2 or Tier 3 civil money penalty.\9\ Most enforcement provisions in
section 8 of the FDI Act also include other potential grounds, such as
a violation of law or a breach of fiduciary duty, which are not
affected by the regulatory definition in the final rule.
---------------------------------------------------------------------------
\6\ 12 U.S.C. 1818(a)(2)-(3) (``If the [FDIC] Board of Directors
determines that an insured depository institution or the directors
or trustees of an insured depository institution have engaged or are
engaging in unsafe or unsound practices in conducting the business
of the depository institution . . . the [FDIC] Board of Directors
may issue an order terminating the insured status of such depository
institution effective as of a date subsequent to such finding.'').
\7\ Id. 1818(b)(1) (``If, in the opinion of the appropriate
Federal banking agency, any insured depository institution,
depository institution which has insured deposits, or any
institution-affiliated party is engaging or has engaged, or the
agency has reasonable cause to believe that the depository
institution or any institution-affiliated party is about to engage,
in an unsafe or unsound practice in conducting the business of such
depository institution . . . the agency may issue and serve upon the
depository institution or the institution-affiliated party an order
to cease and desist from any such . . . practice.'').
\8\ Id. 1818(c)(1) (``Whenever the appropriate Federal banking
agency shall determine that . . . the unsafe or unsound practice or
practices . . . or the continuation thereof, is likely to cause
insolvency or significant dissipation of assets or earnings of the
depository institution, or is likely to weaken the condition of the
depository institution or otherwise prejudice the interests of its
depositors prior to the completion of the proceedings conducted
pursuant to paragraph (1) of subsection (b) of this section, the
agency may issue a temporary order requiring the depository
institution or such party to cease and desist from any such . . .
practice and to take affirmative action to prevent or remedy such
insolvency, dissipation, condition, or prejudice pending completion
of such proceedings.'').
\9\ Id. 1818(i) (``[A]ny insured depository institution which,
and any institution-affiliated party who . . . recklessly engages in
an unsafe or unsound practice in conducting the affairs of such
insured depository institution . . . which practice is part of a
pattern of misconduct; causes or is likely to cause more than a
minimal loss to such depository institution; or results in pecuniary
gain or other benefit to such party, shall forfeit and pay a civil
penalty of not more than $25,000 for each day during which such . .
. practice . . . continues . . . . [A]ny insured depository
institution which, and any institution-affiliated party who
knowingly . . . engages in any unsafe or unsound practice in
conducting the affairs of such depository institution; . . . and
knowingly or recklessly causes a substantial loss to such depository
institution or a substantial pecuniary gain or other benefit to such
party by reason of such . . . practice . . . shall forfeit and pay a
civil penalty in an amount not to exceed the applicable maximum
amount determined under subparagraph (D) for each day during which
such . . . practice . . . continues.'').
---------------------------------------------------------------------------
In determining what may be considered an unsafe or unsound practice
under section 8 of the FDI Act, some courts have looked to a standard
articulated by John Horne, then Chairman of the Federal Home Loan Bank
Board (FHLBB) (Horne Standard), during congressional hearings related
to the Financial Institutions Supervisory Act of 1966 (Act of 1966),
which is the source of the agencies' cease-and-desist authority in
section 8(b) of the FDI Act.\10\ Specifically, Chairman Horne stated:
---------------------------------------------------------------------------
\10\ See, e.g., Gulf Fed. Sav. & Loan Assoc. of Jefferson Parish
v. Fed. Home Loan Bank Bd., 651 F.2d 259, 264 (5th Cir. 1981) (``The
authoritative definition of an unsafe or unsound practice, adopted
in both Houses, was a memorandum submitted by John Horne . . . .'').
Chairman Horne's articulation of what constitutes an unsafe or
unsound practice was read into the record in both chambers of
Congress. See 112 Cong. Rec. 25008, 26474 (1966) (remarks of Rep.
Thomas W.L. Ashley and Sen. Absalom W. Robertson).
Generally speaking, an ``unsafe or unsound practice'' embraces
any action, or lack of action, which is contrary to generally
accepted standards of prudent operation, the possible consequences
of which, if continued, would be abnormal risk or loss or damage to
an institution, its shareholders, or the agencies administering the
insurance funds.\11\
---------------------------------------------------------------------------
\11\ 112 Cong. Rec. at 26474.
Representative Patman further described the authority added in the
Act of 1966 as ``aimed specifically at actions impairing the safety or
soundness of . . . insured financial institutions'' and providing the
agencies with ``flexible tools [that] relate strictly to the insurance
risk and to assure the public of sound banking facilities.'' \12\
---------------------------------------------------------------------------
\12\ 112 Cong. Rec. at 24984 (remarks of Rep. Wright Patman).
---------------------------------------------------------------------------
Defining ``unsafe or unsound practice'' by regulation will provide
a clear nationwide standard and increase clarity for institutions. A
regulatory definition of the term unsafe or unsound practice is also
important to appropriately focus institution and examiner attention on
practices that are likely to materially harm an institution's financial
condition or present a material risk of loss to the DIF, providing the
institution's board of directors and management additional flexibility
to enact day-to-day decisions based on their business judgment and risk
tolerance. The definition reflects the agencies' judgment and
experience that their supervisory resources are best focused on
practices that are likely to materially harm an institution's financial
condition, such as risks that are more likely than other risks to lead
to material financial losses, bank failures, and instability in the
banking system.\13\ For the same reasons, practices that are likely to
materially harm the financial condition of an institution are critical
for an institution's board of directors and management to address.
---------------------------------------------------------------------------
\13\ In March 2023, several insured depository institutions with
total consolidated assets of $100 billion or more, including Silicon
Valley Bank, experienced significant withdrawals of uninsured
deposits in response to underlying material weaknesses in their
financial position and failed. These failures highlight the need for
the agencies to allocate supervisory resources with a focus on
material financial risks.
---------------------------------------------------------------------------
The definition of an unsafe or unsound practice will ensure
consistency in identifying practices as
[[Page 56007]]
unsafe or unsound only where they are likely to materially harm the
financial condition of an institution, are likely to present a material
risk of loss to the DIF, or have materially harmed the financial
condition of the institution. This definition will focus institution
and examiner attention on material financial risks facing an
institution and otherwise provide the institution's board of directors
and management the flexibility to enact decisions based on their
business judgment and risk tolerance.
Therefore, as explained further below, in the final rule, the
agencies define the term unsafe or unsound practice to mean a practice,
act, or failure to act, alone or together with one or more other
practices, acts, or failures to act, that (1) is contrary to generally
accepted standards of prudent operation; and (2)(i) if continued, is
likely to (A) materially harm the financial condition of the
institution; or (B) present a material risk of loss to the DIF; or (ii)
materially harmed the financial condition of the institution. This
regulatory definition will provide greater consistency for institutions
and appropriately focus supervisory and institution resources on the
most critical financial risks to institutions and the financial system.
As in the proposal, the definition of ``unsafe or unsound
practice'' in the final rule applies to the agencies' supervisory and
enforcement activities prospectively only. Moreover, it does not apply
to the agencies' rulemaking activities or authority. The agencies are
making one technical change to the definition of unsafe or unsound
practice in the final rule. Specifically, the definition of unsafe or
unsound practices in the proposed rule would have applied to the
agencies' supervisory and enforcement activities under 12 U.S.C. 1818.
In the final rule, the agencies modified this language to refer
separately to the agencies' ``supervisory activities'' and the
agencies' ``enforcement actions under 12 U.S.C. 1818.'' This change
reflects that the agencies do not engage in supervisory activities
under 12 U.S.C. 1818, and it is not a substantive change from the
proposed definition. In addition to enforcement actions under 12 U.S.C.
1818, the agencies identify unsafe or unsound practices as supervisory
findings in other communications, including reports of examination,
supervisory letters, and informal enforcement actions. These identified
unsafe or unsound practices sometimes establish a record for a later
enforcement action under 12 U.S.C. 1818.\14\
---------------------------------------------------------------------------
\14\ The agencies' identification of an unsafe or unsound
practice is distinct from standards for safety and soundness that
the agencies are required to issue pursuant to 12 U.S.C. 1831p-1.
See 12 CFR parts 30, 364.
---------------------------------------------------------------------------
Scope. The proposed rule would have applied to the agencies'
enforcement and supervisory actions taken against an institution or an
institution-affiliated party. The agencies requested comment on the
effect the proposed rule would have on the agencies' ability to address
misconduct by institution-affiliated parties under their enforcement
and supervisory authority, and the agencies carefully considered the
comments received.\15\ A few commenters asserted that the proposed
definition of unsafe or unsound practice would impede the agencies'
ability to take appropriate enforcement actions against institution-
affiliated parties that are affiliated with large institutions, even
when an institution-affiliated party's actions result in a sizeable
loss. Because the definition of unsafe or unsound practice would
require that actions be likely to cause material harm to the financial
condition of an institution or present a material risk of loss to the
DIF, it would be rare that the actions of an institution-affiliated
party could cause such harm to a large institution.
---------------------------------------------------------------------------
\15\ One commenter suggested that the agencies should not deem
directors to have engaged in an unsafe or unsound practice because
they approved a loan or an institution policy or practice unless
said approval violated their fiduciary duties under state law. The
agencies decline to adopt this suggestion, as unsafe or unsound
practices and breaches of fiduciary duty are two distinct concepts.
---------------------------------------------------------------------------
As proposed, the unsafe or unsound practice definition could result
in enforcement actions against institution-affiliated parties being
influenced by factors unrelated to the gravity of the misconduct, such
as the asset size or staffing numbers of the institution with which a
party is affiliated at the time of the misconduct. Given that an
institution-affiliated party's misconduct would be confined to the
relative scope of the party's responsibilities and sphere of influence
at the institution, such misconduct may not materially impact the
overall financial condition of the institution. Moreover, individuals
who are institution-affiliated parties may move between institutions of
various sizes. The application of this rule to institution-affiliated
parties could allow an individual to engage in misconduct (e.g.,
failing to appropriately underwrite loans or secure collateral) at a
large institution without any remedy or recourse. The individual could
then move to a smaller institution and engage in the same conduct.
Although the proposed rule attempted to create a single, uniform
standard for the phrase ``unsafe or unsound practice'' that could be
used in the context of enforcement actions under 12 U.S.C. 1818 and
supervisory activities, the agencies recognize that applying a single
uniform definition to both institutions and institution-affiliated
parties could fail to account for differences in the agencies'
supervisory objectives. Given this potential to impede, or distort
incentives regarding, enforcement actions against institution-
affiliated parties and that the primary purpose of this rulemaking was
to address the agencies' supervisory and enforcement activities with
respect to their supervised institutions, the agencies are not
finalizing the rule's application to institution-affiliated
parties.\16\ The agencies are adding a new paragraph to the final rule
to codify the refined scope of the rule.
---------------------------------------------------------------------------
\16\ Enforcement actions against institution-affiliated parties
will continue to be handled under the agencies' prior standards and
procedures and subject to controlling appellate case law.
---------------------------------------------------------------------------
Practice. The proposed rule defined an unsafe or unsound practice
for purposes of 12 U.S.C. 1818 to apply to a practice, act, or failure
to act, alone or together with one or more other practices, acts, or
failures to act, that meet the other requirements of the definition. A
few commenters asserted that the best reading of section 8 of the FDI
Act is that the term ``unsafe or unsound practice'' applies only to
practices, but not individual acts or failures to act, and that the
final rule should apply only to practices that meet the criteria of the
regulatory definition. Another commenter suggested that the agencies
not consider an isolated or technical incident a ``practice.''
Under the final rule, like the proposal, a practice, act, or
failure to act, alone or together with one or more other practices,
acts, or failures to act could be considered an unsafe or unsound
practice. An individual act or failure to act may constitute an unsafe
or unsound practice. Twelve U.S.C. 1818(b) provides that an agency may
issue a cease-and desist order when an institution is engaging or has
engaged, or the agency has reasonable cause to believe that the
institution is about to engage, in an unsafe or unsound practice in
conducting the business of the institution. For example, poor
underwriting may constitute an unsafe or unsound practice. By making a
loan that is poorly underwritten, an institution would have engaged in
an
[[Page 56008]]
unsafe or unsound practice to the extent it otherwise met the
definition of an unsafe or unsound practice.
Whether an individual act or omission, as opposed to a pattern of
conduct, could result in likely material harm to the financial
condition of the institution is generally an academic question. In
certain cases, a single event can materially impact the safety and
soundness of an institution. But a single event could readily be
described as multiple events, making the distinction between a single
act or multiple acts that constitute a practice not useful. For
example, if an institution agrees to purchase a portfolio of loans and
weaknesses in one loan in the portfolio is likely to result in a
material financial loss to the institution, the decision and act of
purchasing the loan would be considered an outgrowth of the
institution's lending practices. Accordingly, the term ``unsafe or
unsound practice'' in section 8 of the FDI Act, as reflected in the
final rule, applies to practices, acts, or failures to act, alone or
together with one or more other practices, acts, or failures to
act.\17\ If an act or failure to act materially harmed the financial
condition of an institution and met other requirements of the
regulatory definition, such an incident would be considered an unsafe
or unsound practice.\18\
---------------------------------------------------------------------------
\17\ The language of paragraph (b) of the final rule--``together
with one or more other practices, acts, or failures to act''--
emphasizes the interconnectivity between individual acts or failures
to act with other institution practices, acts, and failures to act.
\18\ The agencies could nonetheless exercise their discretion
regarding whether it would be appropriate to take an enforcement
action in response to an isolated or technical incident.
---------------------------------------------------------------------------
Imprudence. Consistent with the Horne Standard, the agencies
proposed that a practice, act, or failure to act would have to be
contrary to generally accepted standards of prudent operation to be
considered an unsafe or unsound practice.\19\ A practice, act, or
failure to act could only have been considered an unsafe or unsound
practice if it deviated from generally accepted standards of prudent
operation (and otherwise met the proposed definition).\20\ Two
commenters recommended that the agencies revise the definition of
unsafe or unsound practice to not require a finding that an institution
acted contrary to generally accepted standards of prudent operation.
Removal of the generally accepted standards provision could result in
strict liability for assuming a risk of likely material harm to the
financial condition of the institution. Consistent with the Horne
Standard and relevant caselaw, a determination that a practice, act, or
failure to act is unsafe or unsound is most appropriately found when
the institution acted contrary to generally accepted standards of
prudent operation.\21\ The agencies also acknowledge that an essential
role of institutions is to identify, measure, incur, and manage risk.
As provided in the proposal, the agencies do not intend to take
enforcement actions under section 8 of the FDI Act for prudent
operations merely because they result in risk-taking. Under the final
rule, a practice, act, or failure to act will only be considered an
unsafe or unsound practice if it deviates from generally accepted
standards of prudent operation (and otherwise meets the definition).
For these reasons, the agencies are adopting the requirement that for a
practice, act, or failure to act to be considered unsafe or unsound, it
must be contrary to generally accepted standards of prudent operation.
---------------------------------------------------------------------------
\19\ See, e.g., Frontier State Bank Okla. City, Okla. v. FDIC,
702 F.3d 588, 604 (10th Cir. 2012) (citing Simpson v. OTS, 29 F.3d
1418, 1425 (9th Cir. 1994)).
\20\ The agencies decline to adopt a commenter's recommendation
to reorder the elements of the definition of unsafe or unsound
practice and the standard for the issuance of MRAs to place the
generally accepted standards provision after the material harm
provision. The action or inaction contrary to generally accepted
standards of prudent operation is the source of the relevant risk of
or actual material harm to the financial condition of an
institution, and accordingly, should be enumerated first. As the
agencies implement the final rule, they will provide training for
examiners that will, among other things, indicate that a practice
cannot be considered unsafe or unsound or support the issuance of an
MRA solely on the basis of likely or actual material harm to the
financial condition of an institution.
\21\ One commenter suggested that the agencies' adoption of a
requirement that unsafe or unsound practices be contrary to
generally accepted standards of prudent operation may be
inconsistent with the Fifth Circuit's decision in Gulf Fed. Sav. &
Loan Assoc. of Jefferson Parish, 651 F.2d at 264-265. The agencies
do not share the commenter's reading of the case. As described
above, the Gulf Fed. court cited the Horne Standard, including the
statement that an unsafe or unsound practice is one ``which is
contrary to generally accepted standards of prudent operation,'' as
the ``authoritative definition.'' The Gulf Fed. case otherwise does
not focus on this part of the definition. In a later case, MCorp
Financial, Inc. v. Board of Governors Federal Reserve System of
U.S., 900 F.2d 852, 863 (5th Cir. 1990), the Fifth Circuit
explicitly relied on the generally accepted standards of prudent
operation requirement in the Horne Standard.
---------------------------------------------------------------------------
Several commenters requested that the agencies clarify what
constitutes generally accepted standards of prudent operations. One
commenter requested that the agencies codify a list of generally
accepted standards of prudent operation and commit to publish any
updates to these standards. Some commenters requested clarification
specifically regarding emerging risks and novel activities. One
commenter requested clarification on what would qualify as a deviation
from generally accepted standards of prudent operations. Another
commenter requested that the agencies establish a safe harbor or
include a rebuttable presumption regarding when an institution may be
presumed to be acting in accordance with generally accepted standards
of prudent operation. Finally, one commenter requested that the
agencies clarify that best practices, including those identified
through horizontal reviews, should not be the basis for findings of
imprudent practices.
The agencies decline to codify a list of or adopt a bright line for
generally accepted standards of prudent operation, which are concepts
the agencies consider to be a matter of examiner judgment, based on
objective facts and sound reasoning. Further, as discussed below, the
agencies' expectations for what they consider to be generally accepted
standards for prudent operation will be tailored based on the risks
associated with an institution's capital structure, complexity,
activities, asset size, and other financial risk-related factors. As
the risk associated with these factors for an institution increases,
the agencies' expectations for that institution's prudent operations
would also increase.
The agencies agree with commenters that pointed out that generally
accepted standards of prudent operation do not require an institution
to adopt what the agencies consider to be best practices, including
those practices identified in horizontal reviews of peer institutions.
The agencies reserve the right to determine whether widespread
practices are generally imprudent, taking into account the facts and
circumstances, based on objective facts and sound reasoning.
For these reasons, the agencies are adopting the requirement that,
for practices, acts, or failures to act to be considered unsafe or
unsound, they must be contrary to generally accepted standards of
prudent operation. The agencies also note that practices, acts, or
failures to act that are imprudent, without more, would not be
considered unsafe or unsound practices unless they also satisfied the
other prong of the definition.
Likely. To qualify as an unsafe or unsound practice under the
proposed definition, it also would have had to be likely--as opposed
to, for example, merely possible--that the practice, act, or failure to
act, if continued, would materially harm the financial condition of the
institution or present a material
[[Page 56009]]
risk of loss to the DIF. As explained in the proposal, the agencies
believed that including the term ``if continued'' was important to
allow for identification of an unsafe or unsound practice before it
impacts an institution's financial condition. However, conduct would
have had to be sufficiently proximate to material harm to an
institution's financial condition to meet the proposed definition.\22\
Moreover, the agencies invited comment on, but did not propose, more
precisely defining the requisite likelihood under the proposed
definition, such as through a minimum percentage (e.g., 10 percent, 51
percent).
---------------------------------------------------------------------------
\22\ Additionally, under the proposal, practices, acts, or
failures to act that have already caused material harm to the
financial condition of the institution would not have to meet the
``likely'' standard, as there would be certainty with respect to the
harm.
---------------------------------------------------------------------------
Many commenters opined on ``likely'' as the proposed probability
threshold for unsafe or unsound practices. Some commenters suggested
that the agencies specify that ``likely'' has the same meaning as
``more likely than not'' or a likelihood of at least 51 percent.\23\
One commenter noted that a potential meaning of likely is not just
probable but ``very probable.''
---------------------------------------------------------------------------
\23\ One commenter indicated that defining likely to mean
``probably'' or ``more likely than not'' was most in line with
certain case law, citing to Michael v. FDIC, 687 F.3d 337, 349 (7th
Cir. 2012). The cited case, however, does not use these terms to
refer to the standard for what constitutes an unsafe or unsound
practice generally and instead refers to the specific requirement in
12 U.S.C. 1818(e)(1) that permits removal and prohibition of an
institution-affiliated party when, inter alia, by reason of the
party's conduct an institution ``has suffered or will probably
suffer financial loss or other damage.''
---------------------------------------------------------------------------
Other commenters suggested that the agencies should not quantify a
specific threshold for harm to qualify as ``likely.'' These commenters
suggested that precise quantification as to the likelihood of future
events is not possible and would not be credible. Further, a commenter
suggested that quantifying a threshold for harm to be considered
``likely'' could introduce unnecessary complications and legal risk
because likelihood is often qualitative and context dependent.
One commenter asserted, however, that it should be insufficient for
the nexus between an imprudent practice and material financial harm to
be conclusory or speculative. Some commenters suggested that the
agencies identify a time horizon over which material financial harm
must be likely.\24\ One commenter suggested that harm must be
``imminent'' or ``near imminent,'' as opposed to speculative. One
commenter suggested that, without a defined time horizon, the
likelihood of material financial harm based on a practice differs.
---------------------------------------------------------------------------
\24\ One commenter requested the agencies clarify the ``if
continued'' language in the proposed definition of unsafe or unsound
practice. Under the final rule, the agencies will use objective
facts and sound reasoning to determine whether a practice, act, or
failure to act, if continued, is likely to cause the requisite harm.
The words ``if continued'' do not permit the agencies to identify an
unsafe or unsound practice based on the mere possibility that the
continuation of a practice, act, or failure to act would cause
material harm to the financial condition of an institution.
---------------------------------------------------------------------------
Some comments opposed ``likely'' as the applicable probability
threshold for an unsafe or unsound practice. A few commenters indicated
that if the supervisory process only stepped in when material harm
already is likely, that would often be too late to prevent the material
harm, thereby making the process pointless. Other commenters suggested
a ``likely'' standard would prevent the agencies from addressing low-
probability, high-impact risks or preclude reasonable supervisory
activities to proactively address risks.
Some commenters suggested alternatives to ``likely'' as the
appropriate threshold for the likelihood necessary for an unsafe or
unsound practice. A few commenters suggested ``reasonably foreseeable''
as the appropriate standard. These commenters pointed out that a risk
can be excessive, unsafe, and unsound without a likely bad outcome and
noted that ``reasonably foreseeable'' is more frequently used as a
standard in legal contexts. Other commenters stated that Chairman Horne
used ``possible consequences'' to refer to the probability of harm
necessary for an unsafe or unsound practice. One commenter suggested
that the agencies consider ``under stress conditions that are
plausible'' as the appropriate standard, as systemic crises occur
suddenly and this would allow the agencies to take proactive action.
Another commenter noted that section 8 of the FDI Act provides for
different probabilities of harm for different causes of action.\25\
---------------------------------------------------------------------------
\25\ See 12 U.S.C. 1818(e) (removal where unsafe or unsound
practice ``could'' prejudice depositors), (i)(B)(ii)(II) (removal
where unsafe or unsound practice ``will probably'' result in
financial loss or other damage to an institution). The agencies
adoption of the final rule does not affect the fact that any
statutory requirements must be met for the agencies to pursue an
enforcement action.
---------------------------------------------------------------------------
After consideration of these comments, the agencies are adopting
``likely,'' as proposed. Under this provision of the final rule, to be
considered an unsafe or unsound practice, a practice, act, or failure
to act, if continued, must be likely to materially harm the financial
condition of the institution or present a material risk of loss to the
DIF. The agencies considered commenter suggestions for different
standards and ultimately determined that ``likely'' struck the right
balance in terms of probability, clarity, and simplicity. This standard
is sufficient to confirm that the agencies do not intend to identify
unsafe or unsound practices by extrapolating from deficient conduct
that could potentially result in, alone or in combination with other
factors or events, material harm to the financial condition of an
institution but is not likely to do so. The probability that a
practice, act, or failure to act, if continued, will materially harm
the financial condition of the institution or present a material risk
of loss to the DIF must be more than speculative or merely possible. At
the same time, a ``likely'' standard acknowledges that it is impossible
to quantify the probability of future events with precision, such as by
requiring that a specific result is more likely than not to occur. For
the same reasons, the agencies decline to adopt a quantitative
threshold for a result to be likely or identify a time horizon on which
a result must be likely to occur. The agencies did not specify a time
horizon over which the requisite harm could occur, as the appropriate
time horizon would be a fact-specific determination based on multiple
factors, including the certainty of projected conditions or harm and
the magnitude of potential harm.
Harm to financial condition. Under the proposal, an unsafe or
unsound practice would have included a practice, act, or failure to act
that, if continued, was likely to materially harm the financial
condition of an institution. In the preamble to the proposal, the
agencies explained that they believed that harm to financial condition
included practices, acts, or failures to act that are likely to
directly, clearly, and predictably impact an institution's capital,
asset quality, earnings, liquidity, or sensitivity to market risk. One
commenter suggested that the agencies add this concept to the
regulatory text to prevent reputational or other non-financial impacts
from being considered. As described in section III.C of this preamble,
the agencies have added paragraph (d) of the final rule to clarify that
``[h]arm to financial condition refers to financial losses or other
negative impacts to an institution's capital, asset quality, earnings,
liquidity, or sensitivity to market risk.'' In addition, described in
section III.D of this preamble, the agencies are adding a provision to
require that examiner determinations with respect to unsafe or unsound
[[Page 56010]]
practices, as well as MRAs, are based on objective facts and sound
reasoning.
Materiality. The proposed standard for unsafe or unsound practices
would have applied to practices, acts, or failures to act that, if
continued, were likely to materially harm the financial condition of an
institution or that had already resulted in actual material harm to the
institution. The preamble to the proposal explained that neither actual
but non-material financial losses to the institution nor risks of minor
harm to an institution's financial condition, even if imminent, would
have been sufficient to meet the proposed standard.
Many commenters commented on the concept of materiality. Some of
these commenters asserted that the agencies should define material or
provide more information regarding when the agencies would consider
financial harm to be material. Commenter suggestions for how the
agencies should define materiality varied widely.\26\
---------------------------------------------------------------------------
\26\ A few commenters noted that materiality is used as a
threshold under securities laws or accounting standards with varying
definitions. These commenters were split as to whether it may be
helpful for the agencies to refer to these definitions of
materiality. In the agencies' judgment, these situations, which
generally refer to the materiality of misstatements or disclosure
issues, are sufficiently distinct from the materiality of harm to
financial condition so as to not warrant adoption. For purposes of
securities laws or accounting standards, materiality standards
generally refer to the likelihood that an individual viewing
disclosures will be confused. See Basic Inc. v. Levinson, 485 U.S.
224, 232 (1988). Materiality in this case generally refers to
information that is not available to the public.
---------------------------------------------------------------------------
A few commenters indicated that the agencies' consideration of
materiality should focus on whether practices, acts, or failures to act
are likely to threaten an institution's financial integrity or
financial stability, or call into question the ability of the
institution to continue to conduct its business. These commenters
indicated that defining materiality in this manner would better align
with case law.\27\ One commenter suggested that the agencies define
material harm as harm that, in conjunction with the reasonably
foreseeable operational and economic conditions that the institution is
likely to be subject to, causes an institution to no longer be
financially viable or to impose a loss on the DIF.
---------------------------------------------------------------------------
\27\ See Michael, 687 F.3d at 352 (referring to ``abnormal risk
to the financial stability of the . . . institution''); Johnson, 81
F.3d at 204 (referring to practices that ``threaten the financial
integrity'' of the institution). These commenters do not cite case
law for their argument that conduct would need to be sufficient to
call into question the ability of the bank to continue to conduct
its business to qualify as an unsafe or unsound practice. Moreover,
the agencies do not view the cited case law as necessarily requiring
any question about the institution's viability.
---------------------------------------------------------------------------
A few commenters suggested the agencies specify concrete, absolute
dollar floors or percentages for harm that would be considered
material, such as a specified basis point reduction in common equity
tier 1 capital or an amount that could endanger the supervised
institution's adequately capitalized status. One the other hand, one
commenter suggested that the agencies should not adopt a quantitative
threshold for materiality to allow the agencies to consider all aspects
of harm, while another commenter suggested that the threshold for
material harm should not be defined too narrowly, as it may constrain
the agencies' ability to respond to emerging risks.
One commenter recommended clarifying that ``material risk'' must be
tied to objective, demonstrable impacts on solvency, liquidity,
capital, operations, or compliance--not reputational theories. Another
commenter requested a concrete definition to ensure the definition is
not susceptible in the future to regulatory drift that would include
immaterial process or documentation issues. Other commenters suggested
that any definition of material should consider the systemic impact
caused by the bank's action. One commenter expressed that large banks,
specifically, could be causing or distributing a problem but may not be
directly financially impacted enough by their actions.
Several commenters proposed that the agencies use a term other than
material to describe the threshold for potential or actual harm to the
financial condition of an institution necessary to constitute an unsafe
or unsound practice. One commenter suggested ``undue'' be used instead
of material because it would preclude actions against a wide range of
imprudent activities. A few commenters referred to ``abnormal'' as the
threshold for risk or damage referred to by Chairman Horne in his
statement.
Several commenters expressed disagreement with the materiality
threshold. One commenter stated the standard would disproportionally
affect smaller institutions while providing few scenarios to apply to
larger institutions. Several commenters expressed concern that the new
standard would permit banks to take too much risk or would prevent the
agencies from intervening to correct bank deficiencies before there is
a likelihood of material harm to financial condition.
After consideration of these comments, the agencies have determined
to adopt materiality as the appropriate threshold for potential or
actual harm to the financial condition of an institution for practices,
acts, or failures to act to be considered an unsafe or unsound
practice. This threshold strikes the right balance between permitting
both small and large institutions to take on appropriate risks in line
with their business judgment, while focusing supervisory resources on
serious financial risks. Some alternative suggestions, such as abnormal
or undue risk, would not add clarity as compared to material financial
risk and may cause confusion between the concepts of financial risk and
practices that are opposed to generally accepted standards of prudent
operation. In addition, as described above, systemic risk is a separate
concept from safety and soundness and the scope of this rulemaking. The
agencies also decline to adopt a quantitative definition for what
qualifies as material because assessment of what qualifies as material
harm to the financial condition of an institution relies on examiner
judgement, based on objective facts and sound reasoning, as described
in section III.D of this preamble.
Some commenters expressed concern that the proposed definition of
unsafe or unsound practices would be insufficient to address imprudent
practices by large or complex institutions. As discussed further below,
the agencies' expectations for what they consider to be material harm
to the financial condition of an institution will be tailored based on
the risks associated with the institution's capital structure,
complexity, activities, asset size, and other financial risk-related
factors. Specifically, as the risk associated with the factors
identified in the tailoring provision increases, the threshold for
materiality of the harm to the financial condition of an institution
that constitutes an unsafe or unsound practice or warrants an MRA
decreases and the assessment of the harm to the financial condition of
institution becomes more granular (e.g., specific business lines,
products, or services).
As noted in the preamble to the proposal, the agencies acknowledge
that, in limited circumstances, other practices, acts, or failures to
act may be captured because, if continued, they are likely to result in
material harm to an institution's financial condition. For example, a
significant risk of disruption of an institution's operations through
its information technology systems may, in some cases, be likely to
cause material financial harm. Whether a cybersecurity vulnerability
would meet the definition of an unsafe or unsound practice under this
rule depends on the potential
[[Page 56011]]
severity and likelihood of material harm to the financial condition of
the institution. Mitigating factors such as compensating controls
associated with a specific gap or weakness would also be considered. As
an example, weaknesses surrounding unsupported operating systems and
patch management may not be readily mitigated by controls in other
areas. Such weaknesses are commonly leveraged by threat actors to
interrupt and exploit institutions (via ransomware, data exfiltration,
etc.). Such exploits may cause direct financial harm to institutions
through the denial of banking services, data exfiltration, or other
damaging actions, as well as costs associated with investigating and
remediating such incidents.
The standard would not include risks to the institution's
reputation unrelated to financial condition.\28\
---------------------------------------------------------------------------
\28\ See Gulf Fed. Sav. & Loan Assoc. of Jefferson Parish, 651
F.2d at 264-65 (``Approving intervention under the [FHLBB]'s `loss
of public confidence' rationale would result in open-ended
supervision. . . . The Board's rationale would permit it to decide,
not that the public has lost confidence in Gulf Federal's financial
soundness, but that the public may lose confidence in the fairness
of the association's contracts with its customers.'').
---------------------------------------------------------------------------
Risk of Loss to the Deposit Insurance Fund. Under the proposal, an
unsafe or unsound practice also included a practice, act, or failure to
act that, if continued, was likely to negatively affect an
institution's ability to avoid FDIC receivership and present a material
risk of loss to the DIF as a result of the failure. For example, the
failure of an institution to implement appropriate contingency funding
arrangements might not pose a risk of material harm to the financial
condition of the institution, but could impair the institution's
liquidity under stress and thus present an increased risk to the DIF.
In other words, the proposed definition was intended to capture a
practice, act, or failure to act that materially increases the
probability that an institution would fail and impose a material risk
of loss to the DIF.
The agencies received several comments relating to the agencies'
proposed treatment of the risk of loss to the DIF. Two commenters
asserted that the provision on material risk of loss to the DIF is
superfluous, given that a loss to the DIF necessarily entails the
failure of an institution, which in turn would have experienced
material harm to its financial condition. As noted in the preamble to
the proposal, inadequate contingency funding arrangements could impair
an institution's liquidity under stress and present a material risk to
the DIF without posing a risk of material harm to the financial
condition of the institution. The agencies therefore decline to remove
the DIF provision.
One commenter recommended that the agencies, when analyzing whether
a practice presents ``a material risk of loss to the DIF,'' account for
factors impacting the difficulty of resolving a particular institution.
The agencies decline to adopt this suggestion. Specifically, the
agencies' unsafe or unsound authority under section 8 of the FDI Act
and the purpose of MRAs applies to the safety and soundness of
institutions that are a going concern. The agencies will not consider a
material risk of loss to the DIF as a means to consider an
institution's resolution planning for their wind-down as a gone
concern. The agencies' consideration under this prong will generally be
limited to the likelihood that an institution's going-concern practices
would cause it to fail in a manner that poses a material risk of loss
to the DIF.
Another commenter asserted that a small institution is incapable of
presenting a material risk of loss to the DIF. The materiality
threshold is based on the risk of loss, not the potential amount of
loss, so a small institution could still present a material risk of
loss.
Taken together, the proposed provisions related to actual or
potential material harm to the financial condition of the institution
and a material risk of loss to the DIF provide the agencies with
sufficient latitude to address imprudent practices, acts or failures to
act that pose material financial risks. Accordingly, the agencies are
adopting the DIF provision as proposed.
For these reasons, the agencies are defining the term unsafe or
unsound practice, for purposes of the agencies' enforcement activities
under 12 U.S.C. 1818, to mean a practice, act, or failure to act, alone
or together with other practices, acts, or failures to act, that (1) is
contrary to generally accepted standards of prudent operation; and
(2)(i) if continued, is likely to (A) materially harm the financial
condition of an institution; or (B) present a material risk of loss to
the DIF; or (ii) materially harmed the financial condition of the
institution.
B. Matters Requiring Attention
The agencies also proposed to establish uniform standards for
examiners' issuance and communication of MRAs. Specifically, the
proposed rule provided that the agencies would only be permitted to
issue an MRA for a practice, act, or failure to act, alone or together
with one or more other practices, acts, or failures to act, that (1)(i)
is contrary to generally accepted standards of prudent operation; and
(ii)(A) if continued, could reasonably be expected to, under current or
reasonably foreseeable conditions, (1) materially harm the financial
condition of the institution; or (2) present a material risk of loss to
the DIF; or (B) has already material harmed the financial condition of
the institution; or (2) is an actual violation of a banking or banking-
related law or regulation.
The proposed standard for MRAs differed from the proposed standard
for unsafe or unsound practices in two significant respects. First, for
the agencies to issue an MRA if imprudent practices, acts, or failures
to act continued, material harm to the financial condition of an
institution would have needed to be reasonably expected to under
current or reasonably foreseeable conditions result in material
financial harm, which is a lower bar than the likeliness requirement
for unsafe or unsound practices. Second, the agencies could have issued
an MRA for an actual violation of a banking or banking-related law or
regulation. With respect to common terms between the proposed MRA
standard and the proposed unsafe or unsound practices standard, the
agencies are adopting those portions of the proposed MRA standard for
the reasons discussed in section III.A of this preamble.
Many commenters supported the agencies' proposed standard for the
issuance of an MRA. One commenter suggested that the agencies clarify
that MRAs are not binding orders but are a warning of a potential
enforcement action if the practice or violation is not corrected within
a reasonable amount of time and that failure to remediate an MRA, in
and of itself is not an unsafe or unsound practice.\29\ Under the final
rule, mere failure to remediate an MRA does not constitute an unsafe or
unsound practice. The agencies characterize MRAs as concerns that, in
the agencies' judgment, rise to the level of requiring presentation to
the board of directors and for which an institution must take
corrective action.\30\
---------------------------------------------------------------------------
\29\ Another commenter recommended that the FDIC continue to
refer to matters requiring correction as ``Matters Requiring Board
Attention,'' because communications that the OCC labels ``matters
requiring attention'' are unenforceable guidance. Under the final
rule, institutions will be required to take action in response to an
MRA, so the FDIC declines to adopt the commenter's recommendation.
\30\ The commenter further suggested that the agencies'
respective authority to issue MRAs is based on their authority to
take enforcement actions pursuant to section 8 of the FDI Act and
the agencies should revise the statutory authority section of the
proposal accordingly. The agencies do not believe that any change is
necessary. Through statutory examination and reporting authorities,
Congress has conferred upon the agencies the authority to exercise
visitorial powers with respect to supervised institutions. 12 U.S.C.
481, 1463, 1464, 1820, 3105(c), 5412(b). The Supreme Court has
indicated support for a broad reading of the agencies' visitorial
powers. See, e.g., Cuomo v. Clearing House Ass'n, L.L.C., 557 U.S.
519 (2009); United States v. Gaubert, 499 U.S. 315 (1991); United
States v. Phila. Nat'l Bank, 374 U.S. 321 (1963). The visitorial
powers facilitate early identification and communication of
supervisory concerns that may not rise to a violation of law, unsafe
or unsound banking practice, or breach of fiduciary duty under
section 8 of the FDI Act. The agencies' use of MRAs to identify
material financial risks, as proposed and finalized, fits squarely
within the agencies' visitorial powers. Indeed, the agencies issued
MRAs or their equivalent long before Congress provided the agencies
with plenary enforcement authority. See, e.g., Comptroller of the
Currency: Treasury Department, Instructions to National Bank
Examiners 17-18 (1951) (``The `Examiners Comments on Matters
Requiring Attention' is one of the most important sections of the
report [of examination].'').
---------------------------------------------------------------------------
[[Page 56012]]
Reasonable Expectation of Harm
Under the proposal, for the agencies to issue an MRA if imprudent
practices, acts, or failures to act continued, material harm to the
financial condition of an institution would have needed to be
reasonably expected to, under current or reasonably foreseeable
conditions, result in material financial harm. Some commenters
suggested that the agencies lower the required probability of material
harm to the financial condition of the institution to promote proactive
identification of risks. A few commenters indicated that the proposed
MRA standard would only permit the agencies to issue an MRA in response
to an unsafe or unsound practice. One commenter suggested that the
agencies broaden the types of harm cognizable under the proposed MRA
standard to include emerging risks that could eventually cause material
financial harm to consumers. Some commenters opined that the agencies
should issue MRAs to address institutions that are highly vulnerable to
reasonably foreseeable economic shocks, including when institutions
adopt a niche business model or have high concentrations in certain
types of customers, market interest rates rise, or credit quality
erodes. One commenter referred to the FDIC's post-failure review report
for Signature Bank and identified scenarios in which MRAs could be
issued to institutions before institutions' financial condition and
performance ratios decline.
The agencies reiterate that the MRA standard of the final rule
requires a lower probability of material harm to the financial
condition of an institution than does the final rule's definition of
unsafe or unsound practice. Accordingly, examiners may issue an MRA
before an unsafe or unsound practice is present. With that framing in
mind, the agencies are of the opinion that the MRA standard would have
been capable of proactively addressing the risks that precipitated the
failure of Silicon Valley Bank. As described in the preamble to the
proposal, ``reasonably foreseeable'' does not necessarily mean the most
likely future outcome and could include a range of possible outcomes.
For example, throughout 2022, the agencies could have considered it
``reasonably foreseeable'' that the federal funds rate and other market
interest rates would rise considerably, and an institution's
vulnerability to a significant rise in interest rates could have been
grounds for an MRA. As described in section III.D of this preamble,
examiners' determination that a significant increase in interest rates
was reasonably foreseeable would need to be based on objective facts
and sound reasoning. The MRA standard of the final rule is broad enough
to proactively capture priority supervisory issues and the
identification of material financial risks without overbroad issuances
of MRAs. The breadth of the MRA standard will allow the agencies to, as
commenters suggested, address reasonably foreseeable economic shocks
before they materialize and affect the financial condition of an
institution. Speculative concerns about future harm, however, should
not support the issuance of an MRA. Thus, whether an MRA in a specific
situation would be tailored to the unique facts and circumstances at a
given institution and time.
Violations of Law
The agencies proposed that examiners could issue an MRA for an
actual violation of a banking or banking-related law or regulation.
Many commenters offered recommendations and requests for clarification
on which types of violations should support the issuance of an MRA.
Some commenters recommended that the use of violations of law to
support the issuance of an MRA be limited to only ``substantive''
violations of law. These commenters also made suggestions for what
should be considered a substantive violation of law, such as those that
are systemic, recurring, or repetitive or that represent a failure of
an institution to meet a key purpose of the underlying regulation or
statute or have resulted in significant harm to consumers or members of
a community. The agencies find that judicious use of MRAs to address
violations will best position the agencies and institutions to address
institution and customer harm. Consistent with these commenters'
recommendations and as described below, the agencies intend to exercise
their supervisory discretion to issue MRAs for violations only in
response to substantive violations, as described below.
The following four categories of violations would support the
issuance of an MRA.\31\ The first category of substantive violations
are violations that demonstrate a pattern or are systemic. For these
purposes, a violation demonstrates a pattern if there are repeated or
ongoing violations, considering the number of violations and the length
of time in which the violations occurred. Systemic violations of laws
or regulations are violations that are widespread or prevalent within
an institution or business line.
---------------------------------------------------------------------------
\31\ Under the agencies' substantive violation policies,
examiners must review objective facts and apply sound reasoning to
determine whether a violation is substantive and, in turn, supports
the issuance of an MRA.
---------------------------------------------------------------------------
The second category of substantive violations are violations that
have, or could be reasonably expected to have, a more than minimal
adverse impact on an institution's financial condition, the accuracy of
the institution's books and records, or its customers. The ``more than
minimal'' threshold for impacts or restitution is a lower threshold
than ``material'' but excludes trivial or de minimis impacts or
restitution. A violation that results in a more than minimal adverse
impact on an institution's financial condition must have a direct,
clear, and predictable connection between the violation and the impact
on an institution. Violations that have a more than minimal impact on
the books and records of an institution include the filing of
inaccurate Consolidated Reports of Condition and Income, depending on
the relative and absolute impact of the inaccuracy, as well as other
qualitative and quantitative factors the agencies deem appropriate. A
more than minimal adverse impact to customers includes both financial
and nonfinancial adverse impacts to customers, with ``customers''
referring to applicants, current customers, and former customers
protected by applicable laws or regulations.
The third category of substantive violations are violations that
require, or could be reasonably expected to require, more than minimal
restitution to make the recipients whole. Whether restitution is
considered more than minimal is based on the reasonably expected size
of the restitution
[[Page 56013]]
payments, the degree of the adverse impact, and the number of persons
affected by the violation.
Finally, the fourth category of substantive violations are
violations that involve insider misconduct or self-dealing. Examples of
violations involving insider misconduct or self-dealing would include
violations of any law or regulation perpetrated by an insider knowingly
or for the benefit of the insider or the insider's associate.
One commenter recommended that all violations should require
correction. While not every violation may be correctable, and while
some de minimis violations may not warrant corrections, the agencies
believe that they should retain the discretion to require institutions
to correct violations of law or regulation through means other than the
issuance of an MRA, when appropriate. Additionally, the agencies
recognize that Federal law expressly requires the agencies to take
certain actions in the event of violations (e.g., the imposition of
civil money penalties for violations of the National Flood Insurance
Act of 1968 and the Flood Disaster Protection Act of 1973 (Flood
Act)).\32\ Therefore, the agencies are adding a new paragraph to the
rule to provide additional clarification regarding violations of
banking or banking-related laws or regulations for which the agencies
do not issue an MRA or take an enforcement action, which are referred
to as ``other violations.'' Under paragraph (h), as added to the final
rule, the agencies may direct an institution to remediate ``other
violations'' and take other actions as required by applicable state or
Federal law in connection with the violation. The agencies will not
direct an institution to take any action other than to remediate the
violation, unless such other actions are required by applicable state
or Federal law.
---------------------------------------------------------------------------
\32\ Depending on the facts and circumstances, a violation of
the Flood Act, like any violation of a banking or banking-related
law or regulation, could meet the criteria of a substantive
violation.
---------------------------------------------------------------------------
Violations for which the agencies do not issue an MRA can be
considered in ratings determinations. Additionally, for purposes of
FDIC-supervised institutions, if the FDIC determines at a subsequent
examination or visitation that a supervised institution has failed to
remediate any ``other violations'' after the FDIC has directed the
institution to remediate the violation, the FDIC would be permitted to
cite such an uncorrected violation as an MRA as part of the follow-up
examination or visitation.
Under the proposed rule, examiners could use the violation of law
prong of the MRA standard only to issue MRAs for actual violations of
law and not for violations of law that may occur in the future. One
commenter expressed concern that the proposed MRA standard would not
permit the agencies to cite an MRA in response to imminent violations
of consumer financial protection laws. The agencies note that the final
rule permits examiners to offer supervisory observations to improve an
institution's policies, practices, condition, or operations, as
discussed in section III.F of this preamble.\33\
---------------------------------------------------------------------------
\33\ An act, practice, or failure to act that is not an actual
violation of a banking or banking-related law may nonetheless
support the issuance of an MRA if the act, practice, or failure to
act meets the criteria of the safety and soundness prong of the MRA.
---------------------------------------------------------------------------
Some commenters recommended that only federal banking or banking-
related laws, and only those that the agencies are specifically or
solely authorized to enforce, should support the issuance of an MRA.
Commenters also recommended that the agencies exclude principles-based
requirements, such as the Interagency Guidelines Establishing Standards
for Safety and Soundness, from being used to support the issuance of an
MRA.\34\ One commenter recommended that the agencies publish a list of
categories of laws the agencies would generally consider to constitute
``banking or banking-related laws.'' Another commenter argued that the
exclusion of violations other than banking or banking-related laws is
both inconsistent with the scope of the agencies' enforcement authority
under section 8 of the FDI Act and imprudent.\35\
---------------------------------------------------------------------------
\34\ See 12 CFR part 30, appendix A (OCC); 12 CFR part 364,
appendix A (FDIC).
\35\ As previously discussed, the agencies' authority to take an
enforcement action under section 8 of the FDI Act based on
violations of law is unaffected by this rulemaking, which only
addresses the agencies' issuance of MRAs based on violations of law.
---------------------------------------------------------------------------
For purposes of the final rule, after consideration of the
comments, the agencies are retaining the words ``banking or banking-
related'' in the final rule.\36\ The agencies continue to believe that
bank supervision, including the issuance of MRAs, should be focused on
banking-related issues. While the agencies recognize that greater
clarity may be beneficial regarding what was intended by this phrase,
the agencies believe that providing an enumerated list of all such
banking or banking-related laws and regulations could be overly
restrictive and could prevent the agencies from effectively
implementing and examining compliance with newly-adopted laws and
regulations (e.g., the Guiding and Establishing National Innovation for
U.S. Stablecoins Act).
---------------------------------------------------------------------------
\36\ Consistent with the proposal, the agencies will not issue
MRAs in response to violations of Federal consumer financial laws,
as defined by 12 U.S.C. 5481(14), for insured depository institution
with total assets of more than $10 billion and any affiliate
thereof. See 12 U.S.C. 5515-5516. Commenter's concerns regarding the
potential for increased consumer harm resulting from the focused
scope of the agencies' MRA authority does not allow for the agencies
to exceed their statutory authority. See Patel v. Garland, 596 U.S.
328, 346 (2022) (citing Niz-Chavez v. Garland, 593 U.S. 155, 171
(2021) and Jay v. Boyd, 351 U.S. 345, 357 (1956)).
---------------------------------------------------------------------------
Therefore, the agencies are providing a general, non-exhaustive
overview of how they interpret the terms ``banking or banking-related
laws or regulations.'' Such laws or regulations involve both Federal or
applicable state laws or regulations that are inherently associated
with the conduct of banking or financial operations and related
activities.\37\ Certain state laws, like state legal lending limits,
are relevant to the safety and soundness of state-chartered
institutions and are accordingly considered banking or banking related
laws or regulations.
---------------------------------------------------------------------------
\37\ A State law that purports to apply to national banks,
Federal savings associations, or Federal branches or agencies of a
foreign bank may be preempted, for example when it prevents or
significantly interferes with their exercise of Federal powers. See
Cantero v. Bank of Am., N. A., 602 U.S. 205 (2024); Barnett Bank of
Marion Cnty., N.A. v. Nelson, 517 U.S. 25, 33 (1996); 12 U.S.C.
25b(b)(1)(B), 1465(a), 3102(b).
---------------------------------------------------------------------------
Various categories of laws or regulations are properly classified
as banking or banking-related. For example, laws or regulations that
establish prudential requirements for institutions, such as the FDI Act
or Regulation W, are banking or banking-related. Consumer protection
laws or regulations applicable to bank products or services, like the
Electronic Fund Transfer Act and the Equal Credit Opportunity Act, are
also considered banking or banking-related. Anti-money laundering,
counter-terrorist financing, and sanctions laws or regulations,
including regulations issued by the Office of Foreign Assets Control to
enforce economic and trade sanctions, are banking or banking-related as
well. By contrast, laws that are wholly unrelated to the business of
banking, including zoning or environmental laws and regulations would
not be considered banking or banking-related, even though such laws and
regulations apply to banks. The nature of other laws and regulations
may be dependent on the context in which they are being applied. For
example, an Internal Revenue Service (IRS) regulation requiring the
delivery of tax forms to depositors or borrowers would be considered a
banking or banking-related
[[Page 56014]]
regulation, whereas an IRS regulation requiring employers to deliver
tax forms to their employees would not be considered a banking or
banking-related regulation.
Nonconformance with guidelines, such as the Interagency Guidelines
Establishing Standards for Safety and Soundness, is not considered a
violation of banking or banking-related law or regulation.
Other Comments About MRAs
In the proposal, the agencies noted that the agencies have often
kept MRAs outstanding for a prolonged period of time after an
institution has fully completed its remediation of the underlying
practice, act, or failure to act because examiners seek to see
demonstrated sustainability of the remediation before an MRA is closed.
The agencies' practice of keeping MRAs open past the point of full
remediation has the potential to distract an institution's board of
directors and management, as well as examiners, by inflating the number
of MRAs based on practices, acts, or failures to act that have already
been remediated. The agencies received many comments relating to the
timeframe for remediation and closure of MRAs, the information the
agencies should consider when determining whether to close an
outstanding an MRA, and various ways in which the agencies can further
enhance their respective supervisory frameworks. The agencies have
determined that these suggestions, where warranted, would be best
incorporated outside of the context of this rulemaking. Moreover,
experience with administering the supervisory and enforcement framework
described in the final rule will inform future agency deliberations on
whether revisions to the framework, consistent with these comments, are
advisable.\38\
---------------------------------------------------------------------------
\38\ One commenter requested that the agencies issue a request
for information (RFI) in approximately 36 months of implementing the
final rule to determine whether additional revisions to the
agencies' supervisory or enforcement standards are needed to
effectuate the goals of the rulemaking. The agencies cannot at this
time commit to issuing such an RFI but will consider institutions'
feedback on the final rule, once implemented.
---------------------------------------------------------------------------
C. Harm to Financial Condition
As described above, the agencies have added paragraph (d) of the
final rule to clarify that ``[h]arm to financial condition refers to
financial losses or other negative impacts to an institution's capital,
asset quality, earnings, liquidity, or sensitivity to market risk.''
This codifies language included in the preamble to the proposal and
defines harm to financial condition for purposes of the agencies'
definition of unsafe or unsound practices definition and MRA standard.
A commenter suggested that the agencies codify this definition of harm
to financial condition.
Some commenters recommended that the agencies make revisions in the
final rule to capture consumer harm, other than consumer harm that
results from a violation of law or regulation, which may be covered by
the violation of law prong of the MRA standard. The agencies decline to
adopt this suggestion, as it is beyond the scope of the agencies'
statutory authorities underlying the rulemaking. Consumer harm will be
captured under the final rule to the extent the underlying issues
result in safety and soundness concerns or violations of law or
regulation that meet the requisite standards described above.
D. Basis for Agency Determinations
The preamble to the proposed rule explained that the agencies
proposed to rely on examiner judgment, based on objective facts and
sound reasoning, to determine whether a practice, act, or failure to
act met the criteria for the issuance of an MRA. Many commenters
supported the agencies' proposed reliance on objective facts and sound
reasoning to determine not only whether the criteria for the issuance
of an MRA are met but also whether the criteria for the definition of
unsafe or unsound practice are met. The agencies agree with these
commenters and have added at paragraph (f) in the final rule a
statement that the agencies will use objective facts and sound
reasoning to determine whether, in accordance with the requirements of
the rule, the agencies may take an enforcement action based on an
unsafe or unsound practice under 12 U.S.C. 1818 or issue a matter
requiring attention.
To further promote objectivity and consistency, several commenters
suggested that the agencies require examiners to provide demonstrable
and quantifiable evidence to determine whether the criteria for the
definition of unsafe or unsound practice or the issuance of an MRA are
met. Other commenters, however, objected to requiring examiners to
quantify the probability and materiality of harm, as the difficulty in
making such predictions would make a quantification requirement
difficult to administer and speculative in nature. The agencies agree
with commenters that examiners must share with an institution the basis
for their identification of an unsafe or unsound practice or the
issuance of an MRA. However, the agencies also agree that a
quantification requirement would give a false sense of precision due to
its reliance on subjective assumptions rather than empirical evidence.
Essentially, a quantification requirement would not solve for the
inherent uncertainty regarding whether an institution will suffer
material harm in the future. Accordingly, the agencies decline to
require examiners to provide quantitative support for the
identification of an unsafe or unsound practice or the issuance of an
MRA.
For the same reasons, the agencies decline to adopt commenter
suggestions for the agencies to codify a burden of proof or burden of
persuasion requirement. Instead, examiners must justify their
determination that a practice, act, or failure to act is unsafe or
unsound or meets the standard for the issuance of an MRA based on
objective facts and sound reasoning. In addition to providing an
institution with information about the basis for an unsafe or unsound
practice or MRA, including a sound justification within a report of
examination or supervisory letter will help inform an institution's
reasoned consideration of whether to appeal an MRA or other material
supervisory determination and assist the agencies in administering
appeals.\39\
---------------------------------------------------------------------------
\39\ The FDIC recently published Guidelines for Appeals of
Material Supervisory Determinations, 91 FR 3184 (Jan. 26, 2026). The
OCC recently published a proposed rule regarding the Bank Appeals
Process, 91 FR 7163 (Feb. 17, 2026).
---------------------------------------------------------------------------
E. Tailoring
Under paragraph (d) of the proposal, the agencies would have
tailored their supervisory and enforcement actions under 12 U.S.C. 1818
and their issuance of MRAs based on the capital structure, riskiness,
complexity, activities, asset size, and any financial risk-related
factor that the agencies deemed appropriate.\40\ This included
tailoring with respect to the requirements or expectations set forth in
such actions as well as whether, and the extent to which, such actions
are taken. The agencies explained that they expected that finding an
unsafe or unsound practice would be a much higher bar for a community
bank than for a larger institution when considered against the overall
operations of the institution.
---------------------------------------------------------------------------
\40\ Paragraph (d) of the proposal will be redesignated as
paragraph (e) in the final rule.
---------------------------------------------------------------------------
Some commenters discussed the proposed tailoring standard, with
many of these commenters generally in favor of the use of tailoring.
For example, one commenter noted that tailoring is essential and
reflects supervisory best practices. Tailoring what is considered
``material harm'' for each institution
[[Page 56015]]
will, in the words of the commenter, improve supervisory effectiveness
and ensure proportionate supervision. Another commenter, however,
opposed the use of tailoring generally, stating that the codification
of a tailoring requirement could be used as a deregulatory lever and
noting that supervision is already risk-based and proportionate in
practice. The tailoring provision in the final rule ensures risk-based
supervision as it relates to unsafe or unsound practices and MRAs.
In addition to general views on tailoring, commenters expressed
concern with certain aspects of the tailoring standard. Specifically,
several commenters expressed concern regarding the statement in the
preamble to the proposal that finding an unsafe or unsound practice or
concluding that an MRA was warranted would be a higher bar for a
community bank than for a larger institution. One of those commenters
believed that statement was counterintuitive and suggested that the
agencies simply state that a risk-based approach would result in
materiality being based on an institution's risk profile. Another
commenter recommended that the agencies clarify that the tailoring
standard would be implemented consistent with risk-based supervision,
that is, tailored to each bank's size, complexity, and business model.
Additionally, in that commenter's view, the rule should consider the
strength of the institution's capital and liquidity levels.\41\ Another
commenter suggested that the agencies provide additional clarity as to
supervisory expectations and requirements that are proportionate to
community banks' lower level of complexity and risk to the banking
system, to ensure consistent and appropriate supervision of community
banks. Alternatively, this commenter stated that the agencies could
revise the tailoring framework by establishing tiers based on asset
size and complexity. Another commenter said that the proposal would
seem to impose higher standards on smaller banks, rather than the lower
standard noted in the proposal, and that the proposal would allow
greater relative risk at smaller institutions. As described in more
detail below, the agencies have added a paragraph to the final rule to
further explain how the tailoring provisions would apply to
institutions of different asset size, complexity, and risk profile.
---------------------------------------------------------------------------
\41\ The agencies note that consideration of the institution's
capital and liquidity levels, as well as other indicators of the
institution's financial condition, is generally already included in
the agencies' determination to identify an unsafe or unsound
practice or issue an MRA based on potential or actual material
financial harm as a result of imprudent practices.
---------------------------------------------------------------------------
A commenter expressed concerns that the proposed tailoring standard
would not require examiners to show how they applied tailoring. The
commenter recommended that the agencies publish tailoring guidance--
such as an illustrative matrix showing asset or complexity bands and
how supervisory expectations change by band--and require examiners to
describe in reports of examinations how the examiners applied
tailoring. Another commenter suggested the agencies establish tiers
based on asset size and complexity to ensure that the concepts of
material harm would be appropriately scaled across community banks,
midsize banks, and large banks. The commenter suggested regulatory text
stating that the agencies shall ensure that supervisory expectations
and requirements are proportionate to community banks' lower level of
complexity and risk to the banking system.
Several commenters suggested that the agencies should tailor what
they consider to be generally accepted standards of prudent operation.
One commenter asserted that practices developed for large, highly
complex, or systemically important institutions should not be treated
as generalized standards applicable across the banking system.
Based on consideration of the comments, the agencies are adopting
in the final rule the proposed tailoring standard with certain
revisions to clarify how tailoring will work. The agencies considered
the commenters' concerns, including that the proposed standard was
counterintuitive and should be revised or clarified through additional
guidance. For the reasons discussed below, the proposal's tailoring
standard would have applied the appropriate level of rigor to community
banks as well as larger institutions. The agencies have determined,
however, that the proposed tailoring standard would benefit from
additional clarity given the potential for confusion reflected in the
comments. The benefits of additional clarity must be balanced with the
need for flexibility inherent in applying the tailoring standard.
To balance these interests, the agencies decided to clarify the
proposed tailoring standard by adding language to the final rule that
effectively codifies the explanation provided in the preamble to the
proposal. That said, the agencies determined not to develop tiers based
on asset size or complexity, a matrix, or other guidance on the
tailoring standard at this time because, in the agencies' view, such
guidance may have an inappropriate limiting effect on the application
of examiner judgment in tailoring of supervisory activities and
enforcement actions under 12 U.S.C. 1818 and issuance of MRAs. In the
agencies' view, these determinations are fact specific assessments.
Accordingly, the agencies determined that clarifying the tailoring
standard in the final rule would provide the needed clarity without
introducing an overly formulaic approach.
To provide additional clarity, the final rule explains that as the
risk associated with the factors identified in the tailoring provision
increases: the threshold for materiality of the harm to the financial
condition of an institution that constitutes an unsafe or unsound
practice or warrants an MRA decreases; the assessment of the harm to
the financial condition of an institution becomes more granular (e.g.,
specific business lines, products, or services); and the requirements
under an enforcement action or MRA relating to remediation, and the
expectations regarding prudent operation, increase. Similarly, the
inverse is true. As the risk associated with the factors identified in
the tailoring provision decreases, the threshold for materiality of the
harm to financial condition increases; the agencies will consider harm
to financial condition with less granularity; and the requirements
related to remediation, and expectations regarding prudent operation,
decrease.
This added clarification will codify the explanation that the
agencies provided in the preamble to the proposal and is responsive to
many commenter suggestions. For example, as explained in the proposal,
as applied to the threshold for material harm, the agencies would not
expect that a particular projected percentage decrease in capital or
liquidity that rises to the level of materiality for the largest
institutions would necessarily also be material for community banks.
Similarly, while the agencies may consider increased classified assets
in a particular business line as a result of the institution's
imprudent practices to warrant an MRA at the largest institutions, the
agencies may consider a community bank's asset quality less granularly
and consider the overall asset portfolio at the institution level. For
all institutions, the agencies would not expect the assessment of the
harm to the financial condition of institution to be so granular that
the agencies would consider the harm to financial condition to narrow
products or services that were immaterial to the institution overall.
As suggested by several commenters, the added clarification explicitly
confirms
[[Page 56016]]
that the agencies will tailor their expectations regarding prudent
operations based on an institution's asset size and other financial
risk-related factors. In all, added paragraph (e)(3) provides clarity
regarding how the agencies will tailor their supervisory activities and
enforcement actions based on unsafe or unsound practices for community
banks with a lower level of complexity and large and complex
institutions.
The final rule also includes technical revisions to the tailoring
provision to clarify its scope. First, as discussed above regarding
paragraph (b)(1), the tailoring provision in the final rule applies to
the agencies' supervisory activities and enforcement actions under 12
U.S.C. 1818. Second, the final rule would clarify that the tailoring
provisions only apply to enforcement actions based on unsafe or unsound
practices. Enforcement actions based on other conduct are beyond the
scope of the final rule.
F. Supervisory Observations
For concerns that do not rise to the level of an MRA, the agencies
proposed to continue to permit examiners to provide informal
supervisory observations to enhance an institution's policies,
practices, condition, or operations without a requirement for
corrective action.\42\ With certain clarifications, the agencies are
adopting the proposed supervisory observations standard. Supervisory
observations are informal observations of objective facts identifying
weaknesses in an institution's policies, practices, condition, or
operations that do not rise to the level of an MRA. Unlike MRAs, there
is no requirement that an institution will take corrective action in
response to a supervisory observation.\43\
---------------------------------------------------------------------------
\42\ Consistent with the proposal, supervisory observations are
separate and distinct from requirements that the agencies impose in
connection with an application, notice, or other request, including
through a condition imposed in writing under 12 U.S.C. 1818.
\43\ To the extent a supervisory observation would refer to a
violation of a banking or banking-related law or regulation for
which the agencies do not take an enforcement action or issue an
MRA, paragraph (h) of the final rule would allow the agencies to
require the institution to remediate the violation.
---------------------------------------------------------------------------
With respect to the proposed supervisory observation standard, one
commenter supported the proposed standard because it would reduce
conflation of MRAs and other informal supervisory communications.
Another commenter argued that, because the proposed rule would only
result in MRAs for unsafe or unsound practices, the agencies would
relegate important observations to nonbinding examiner communications.
As previously discussed, the MRA standard expands beyond conduct that
is considered an unsafe or unsound practice. Supervisory concerns that
do not meet the MRA standard are best addressed through the use of
supervisory observations. To clarify that supervisory observations are
intended to address examiner findings that do not meet the standard for
the issuance of an MRA, a specific reference to the MRA standard was
added to more clearly define a supervisory observation. To clarify that
the weaknesses described in supervisory observations do not meet the
criteria of an unsafe or unsound practice, the agencies have added
paragraph (g)(1) to the final rule, which explicitly states that the
paragraph defining ``unsafe or unsound practices'' does not apply to
the supervisory observation standard.
As proposed, the agencies would not have been permitted to
criticize an institution for declining to remediate a concern or
weakness identified in a supervisory communication or to escalate the
communication into an MRA on the sole basis of an institution's lack of
adoption of an examiner's suggestion offered in multiple examination
cycles. One commenter disagreed with the agencies and suggested that
the agencies permit examiners to escalate supervisory observations into
MRAs when an institution repeatedly declines to adopt an examiner
recommendation. It is critical that institutions, and not the agencies,
exercise their own judgment on whether, when, and how to enhance their
policies, practices, condition, or operations, unless otherwise
required by an MRA or an enforcement action.
Accordingly, supervisory observations do not warrant escalation
into an MRA absent a change in the institution or its operating
environment that would support the issuance of an MRA, in accordance
with the final rule's standard for issuing MRAs. To the extent there is
an actual or increased probability of deterioration to an institution's
condition following the communication of a supervisory observation, the
circumstances underlying the observation could later be the basis for
an MRA or enforcement action, but only if the criteria for an MRA or
enforcement action are satisfied.
The agencies indicated in the preamble to the proposed rule several
limitations on how the agencies would use supervisory observations. The
agencies would not be permitted to require an institution to submit an
action plan to incorporate examiners' supervisory observations.
Examiners would not be permitted, and the institution would not be
required, to track the institution's implementation of changes in
response to supervisory observations. Although examiners would be
permitted to informally make such supervisory observations to the
institution's board of directors, the institution's management would
not be required to present the supervisory observations to the
institution's board of directors. Some commenters recommended that the
agencies codify these limitations in the final rule. Codification of
some of these limitations will promote transparency and clarity.\44\
Accordingly, the final rule explicitly states that a supervisory
observation does not create a requirement or supervisory expectation
that a supervisory observation will be presented to an institution's
board of directors. The agencies note that this would not prohibit an
examiner from informally providing feedback regarding how an
institution could address weaknesses identified in a supervisory
observation. Each institution's board of directors and management,
informed by supervisory observations and independent judgment, can
determine whether to implement changes to enhance the institution's
policies, practices, condition, or operations. Examiners could not
require or suggest any expectation that the institution take any
corrective action in response to a supervisory observation.\45\
However, consistent with the proposal, the agencies can use the
information underlying supervisory observations to support assigned
ratings.
---------------------------------------------------------------------------
\44\ The agencies will oversee the implementation of the
supervisory observation framework to promote effective use of
supervisory observations by examiners, consistent with the
requirements of the final rule.
\45\ As a corollary of there being no requirement or supervisory
expectation that an institution will take corrective action in
response to a supervisory observation, the institution will not be
required to submit an action plan to address a supervisory
observation or track the implementation of a voluntary decision to
address a supervisory observation. Examiners will also be prohibited
from tracking the institution's voluntary implementation of changes
in response to a supervisory observation, outside of normal
recordkeeping related to examinations.
---------------------------------------------------------------------------
G. Other Comments Received
The agencies received various other comments on the proposed
rulemaking. Many of these commenters suggested other reforms to the
agencies' supervisory and enforcement action processes. Some commenters
addressed the agencies' suggestion in the preamble to the proposal that
the agencies require any downgrade to a CAMELS composite rating under
the Uniform Interagency
[[Page 56017]]
Rating System of 3 or below to be accompanied by an MRA or enforcement
action. Upon further consideration, the agencies have determined this
proposal, as well as other reforms to the agencies' supervisory and
enforcement action processes beyond the identification of unsafe or
unsound practices and issuance of MRAs, is beyond the scope of this
rulemaking.\46\ The agencies will consider these comments, as
appropriate, when considering other changes to their supervisory and
enforcement action processes.
---------------------------------------------------------------------------
\46\ On May 19, 2026, the Federal Financial Institutions
Examination Council (FFIEC) published a proposed notice to request
comment on proposed revisions to the CAMELS rating system. The
proposed FFIEC notice would recommend strengthening the link between
CAMELS ratings and a financial institution's safety and soundness by
focusing component and composite ratings on factors that materially
affect an institution's financial condition and risk profile, and by
improving the transparency of CAMELS ratings. The agencies have
determined that any changes to their rating processes would be
premature while the FFIEC proposal is pending.
---------------------------------------------------------------------------
IV. Impact Analysis
OCC Expected Effects
A. Introduction
The OCC is issuing a final rule to establish certain definitions
and standards for certain OCC supervisory activities and enforcement
actions against an institution that is a national bank, Federal savings
association, or Federal branch or agency of a foreign bank
(collectively, institutions). The rule will establish a regulatory
definition for the term ``unsafe or unsound practice,'' a revised
standard for the issuance of MRAs, and other supervisory tools to
ensure that institutions prioritize material financial risks.
B. Regulatory Baseline
The OCC assumes that the various courts' definitions of the term
``unsafe or unsound practice'' and the OCC supervisory standards,
including its MRA standard, in effect immediately before the OCC
proposed this rule are the relevant regulatory baselines.
C. Background
As previously discussed, the OCC is issuing this final rule to
promote greater clarity and certainty regarding certain enforcement and
supervision standards and to ensure that examiners and institutions
prioritize material financial risks. The final rule establishes for
OCC-supervised institutions a uniform definition for the term ``unsafe
or unsound practice'' for purposes of enforcement actions under 12
U.S.C. 1818 and supervisory activities. Additionally, the final rule
establishes uniform standards for when and how the agencies may
communicate MRAs and ``other violations'' as part of the examination
process. Furthermore, the final rule also clarifies how the OCC will
tailor its supervisory activities and enforcement actions based on
unsafe or unsound practices and its issuance of MRAs. Finally, the
final rule permits the OCC examiners to offer informal observations,
referred to as ``supervisory observations,'' to institutions.
D. Parties Affected by the Final Rule
The OCC currently supervises 986 institutions.\47\ Because all OCC-
supervised institutions were subject to the supervisory and enforcement
standards in effect immediately before the OCC proposed this rule, the
rule would affect all 986 institutions the OCC supervises.
---------------------------------------------------------------------------
\47\ Based on data accessed using the Financial Institution Data
Retrieval System (FINDRS) on July 29, 2026.
---------------------------------------------------------------------------
E. Costs and Benefits
i. Cost Savings From Decreased Regulatory Compliance Burden
The final rule would result in several direct benefits to
institutions, namely, significant cost and time savings to
institutions. Additionally, the final rule does not impose new mandates
or costs related thereto on institutions.
Under the final rule, the OCC expects that it will issue fewer MRAs
and take fewer enforcement actions under 12 U.S.C. 1818 on the basis of
an unsafe or unsound practice. As a result, institutions would have
fewer MRAs and enforcement actions to address and remediate.
Institutions can incur significant direct costs arising from MRAs and
enforcement actions. For example, in response to an MRA or an
enforcement action, some institutions hire external consultants, for
which hourly rates can range from between $300 to $1,200 an hour for
top-tier firms or $150 to $300 an hour for lower-tier firms, or
financial advisory firms that charge institutions $250 to $550 per
hour.\48\ To the extent that there may be less need for consultants,
institutions will directly benefit from consultant cost savings.
---------------------------------------------------------------------------
\48\ See Clancy Fossum, Embark, What are the Fees & Hourly Rates
of Accounting Consulting Firms? (Nov. 13, 2019), https://
blog.embarkwithus.com/what-are-the-fees-hourly-rates-of-accounting-
consulting-firms#:~:text=in%20each%20category.-
,Big%204%20Firms,global%20footprints%2C%20and%20charge%20accordingly.
&text=Although%20Big%204%20fees%20in,be%20aware%20of%20before%20proce
eding; Consulting Mavericks, Average Consulting Rates by Industry,
<a href="https://consultingmavericks.com/start/other/average-consulting-rates-by-industry/">https://consultingmavericks.com/start/other/average-consulting-rates-by-industry/</a> (last visited Sept. 26, 2025).
---------------------------------------------------------------------------
In addition to consultant fees, institutions incur other direct
costs to successfully address MRAs and enforcement actions, including
the payment of civil money penalties. These costs may include increased
hiring and retention of appropriately qualified employees, training for
existing employees, time expenditure of employees (which may include
time spent addressing MRAs and enforcement actions, time by management
and the board to review and approve changes made, time spent working
with external consultants, time conducting internal audit verification,
and time spent in partnership with the OCC in ongoing follow up
communications and examinations specific to the issue), updating
processes and procedures, and addressing the supervisory concern that
is the basis of the MRA or the enforcement action. If the MRA or
enforcement action has to do with institution systems or
infrastructure, these costs could include technology costs, which could
be very costly expenditures. If institutions do not appropriately
address MRAs and enforcement actions in a timely fashion, they may also
incur additional fines and penalties \49\ on top of the costs to
remediate the issue itself.\50\
---------------------------------------------------------------------------
\49\ To reiterate, under the final rule, an institution's mere
failure to remediate an MRA does not constitute an unsafe or unsound
practice.
\50\ See Perry Menezes et al., CSO, How Financial Institutions
Can Reduce Security and Other Risks from MRAs (Aug. 29, 2023),
https://www.csoonline.com/article/650386/how-financial-institutions-
can-reduce-security-and-other-risks-from-
mras.html#:~:text=MRAs%20are%20expensive,has%20not%20done%20its%20job
; See also Monticello Consulting Group, Building Regulatory
Resilience: A Deeper Look into Consent Orders & MRAs (Apr. 20,
2021), <a href="https://www.monticellocg.com/blog/2021/04/20/building-regulatory-resilience-a-deeper-look-into-consent-orders-mras#_ftn2">https://www.monticellocg.com/blog/2021/04/20/building-regulatory-resilience-a-deeper-look-into-consent-orders-mras#_ftn2</a>
(stating that the largest banks in the United States have incurred
almost $200 billion in aggregate fines and penalties during a 20-
year period ending around early 2021).
---------------------------------------------------------------------------
While it would be difficult to precisely quantify the overall
aggregate annual direct cost savings to institutions, the OCC expects
that cost savings will likely exceed $100 million due to the decrease
in the number of MRAs issued to institutions. In addition to the
significant direct cost savings described above, institutions could
potentially experience several indirect benefits, including clarity
regarding, and consistent application of MRA or enforcement concerns,
as well as less staffing turnover.
[[Page 56018]]
ii. Costs and Benefits Relating to the Safety and Soundness of
Institutions
The final rule imposes no new mandates, and thus no direct costs,
on institutions, and has a low probability of causing indirect costs to
institutions. Regarding indirect costs, the narrowed MRA standard of
the final rule could delay the identification of supervisory risks.
This delayed identification could result in higher costs to resolve
supervisory concerns, associated losses, and in extreme cases, failure.
Nevertheless, the OCC determined it is unlikely that the final rule
will result in the delayed identification of supervisory risks because
the definition of unsafe or unsound practice and standard for the
issuance of MRAs endeavor to more effectively prioritize the
identification of material financial risks (i.e., those most likely to
cause significant stress) and therefore to lower the risk of
institution failure. Accordingly, it is also possible that under the
final rule, risks to institutions, including the risk of failure, could
decrease significantly; under the final rule, examiners and
institutions would prioritize the identification and remediation of
supervisory concerns that could result in material financial loss to
institutions. Ultimately, the net effect will be dependent upon OCC's
policies and oversight, as well as how institutions' management respond
to this rule.
FDIC Expected Effects
As previously discussed, the agencies are amending their
regulations to define the term ``unsafe or unsound practice'' for
purposes of section 8 of the Federal Deposit Insurance Act and revise
the framework for communicating MRAs to supervised insured depository
institutions (IDIs) \51\ to focus on practices, acts, or failures to
act that, if continued, could reasonably be expected to, under current
or reasonably foreseeable conditions, (A) materially harm the financial
condition of an institution or (B) present a material risk of loss to
the DIF, or violations of a banking or banking-related law or
regulation. The final rule will provide a consistent nationwide
standard for the issuance of MRAs to promote greater clarity for IDIs.
---------------------------------------------------------------------------
\51\ The FDIC's rule applies to an institution that is an
insured State nonmember bank, insured State licensed branch of a
foreign bank, or an insured State savings association.
---------------------------------------------------------------------------
This analysis utilizes all regulations and guidance applicable to
IDIs supervised by the agencies, as well as information on the
financial condition of supervised IDIs as of the quarter ending March
31, 2026, as the baseline to which the effects of the final rule are
considered.
The final rule is substantially similar to the proposal, with two
primary modifications: (1) the final rule would remove institution-
affiliated parties from its scope; and (2) the final rule would create
a newer category of ``other'' violations of laws and regulations that
the agencies may cite and which may not rise to the level of an MRA.
As noted in section III of this preamble, enforcement actions
against institution-affiliated parties under the final rule will
continue to be handled under the agencies' prior standards and
procedures. As such, institution-affiliated parties are not expected to
be impacted by the final rule, relative to the baseline. Similarly, the
agencies currently cite other violations of banking and banking-related
laws and regulations. The final rule would maintain this practice, but
it would limit the remedies that the agencies could seek for such other
violations (i.e., the agencies will only be permitted to direct IDIs to
remediate other violations and take such other actions as may be
required by law). As such, IDIs are not expected to be adversely
impacted by the final rule, relative to the baseline.
A. Scope
The final rule does not impose any obligations on supervised IDIs,
and supervised IDIs do not need to take any action in response to this
rule. The final rule requires the FDIC to revise its current practices
regarding the identification and communication of examination findings.
Therefore, the FDIC is the only entity directly affected by the final
rule.
The final rule affects supervised IDIs through examinations and
reports of examination conducted by the agencies. All 2,700 FDIC-
supervised IDIs subject to examinations as of March 31, 2026, could be
affected by the final rule.\52\
---------------------------------------------------------------------------
\52\ See Consolidated Reports of Condition and Income (Call
Reports), March 31, 2026.
---------------------------------------------------------------------------
B. Benefits and Costs
The following subsections discuss qualitatively the benefits and
costs of the final rule.
Benefits to IDIs
The final rule poses two types of benefits to supervised IDIs: (1)
reductions in, or more efficient use of, resources to comply with
findings from reports of examinations; and (2) possible increases in
proceeds from the provision of banking products and services. By
raising the standard against which an IDI's action, or inaction, is
assessed to be eligible for an MRA, IDIs may experience lower volumes
of examination findings, particularly MRAs. Further, by potentially
reducing the number of examination findings not related to material
risks to the financial condition of the IDI, the final rule may enable
IDIs that do receive MRAs to more effectively address those risks.
Finally, by enacting a consistent definition of conditions that merit
the use of MRAs by the FDIC, the final rule improves clarity and
reduces uncertainty of findings in reports of examinations, relative to
the baseline. Such reductions in findings and increases in clarity may
reduce compliance costs or increase the efficiency with which
compliance costs are expended by IDIs to respond to ROE findings. The
FDIC does not have the information necessary to quantify such potential
benefits.
Negative feedback from regulators during the examination process
may discourage IDIs from taking part in activities and could result in
reduced provision of banking products and services. To the extent that
matters requiring the attention of an institution's board of directors
and management are currently identified and used in a way that raises
potential chilling effects, the final rule could result in fewer such
effects relative to the baseline. A reduction in chilling effects could
enable IDIs to provide financial products and services to entities that
they would not have otherwise. The FDIC does not have the data
necessary to quantify this potential benefit.
Costs to IDIs
The final rule may reduce the volume of examination findings
communicated to IDIs, and this could pose certain costs. To the extent
that the final rule results in delays in the identification of material
risks to the financial condition of an IDI, such entities could incur
higher costs to resolve such issues, associated losses, and in extreme
cases, failure. However, as previously discussed, the FDIC expects that
the final rule's definition of unsafe or unsound practice better
prioritizes the identification and communication of such risks.
Therefore, the FDIC anticipates that delayed identification of such
risks is unlikely, because risks that are likely to lead to losses or
failure will still be in scope under the final rule. Moreover, it is
also possible that under the final rule, risks to IDIs and risks of IDI
failures could decrease because, under the final rule, IDI management
and examiners will prioritize the
[[Page 56019]]
identification and remediation of issues that could result in material
financial loss to IDIs.
Effects on Households and Small Businesses
A comment letter on the proposed rule requested a discussion of the
expected effects of the rule on households and small businesses. As
mentioned, the final rule imposes no direct requirements on the IDIs
supervised by the FDIC, so any effects would be a consequence of the
effects on the IDIs. The reduction of regulatory burden and chilling
effects for supervised IDIs, as discussed above, may result in lower
prices of their financial products and services, or an increase in
credit or other product offerings. Potentially lower prices or
increasing credit availability would benefit the customers of IDIs and
may be particularly valuable to price-sensitive customers or customers
with more limited access to credit, including many households and small
businesses. The FDIC lacks the data needed to estimate this potential
impact.
Alternatives Considered
The agencies considered adopting the proposed rule without changes.
As discussed earlier, the agencies made several revisions in the final
rule that the agencies determined to be an improvement over the
proposal. The agencies determined not to finalize the rule's
application to institution affiliated parties to avoid impeding or
distorting incentives regarding enforcement actions against
institution-affiliated parties. The final rule clarifies the proposed
tailoring provision by describing how the agencies will apply the
provision as the risks associated with various financial risk-related
factors increase. Additionally, the final rule clarifies the
supervisory observation standard, adds a definition of ``harm to
financial condition,'' and establishes the ``other violations''
mechanism to require the correction of actual violations of banking or
banking-related laws for which the agencies do not take an enforcement
action or issue an MRA.
The agencies also considered the suggestions made by commenters
that included alternatives to the final rule, such as establishing a
broader MRA standard than that adopted by this rule and eliminating the
issuance of MRAs based on an institution's internal audit findings. The
agencies also considered, but did not adopt, an alternative rule
framework that would use a quantified definition of likelihood or
material. For example, some commenters suggested a minimum percentage
(e.g., 10 percent, 51 percent) as part of the final rule's definition
of ``unsafe or unsound practice'' for a harm to be considered
``likely.'' Other commenters suggested clarifications or
quantifications of what risks would be consistent with ``material''
harm and to consider including specific absolute dollar floors or
percentage impacts on metrics, such as tier-1 capital, in defining
``material.'' As discussed in section II of this preamble, after
careful consideration, the agencies determined the definitions adopted
in the final rule best meet the rule's objectives to promote greater
clarity and certainty regarding enforcement and supervision standards
so that examiners and institutions may prioritize material financial
risks to institutions and avoid unnecessary regulatory burden. For a
complete discussion of the comments considered, see section III of this
preamble. For the reasons articulated above, the agencies believe the
final rule is preferred over the alternatives.
V. Administrative Law Matters
A. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 \53\ (PRA) states that no
agency may conduct or sponsor, nor is the respondent required to
respond to, an information collection unless it displays a currently
valid Office of Management and Budget (OMB) control number. The
agencies have reviewed this rule and determined that it does not create
any information collection or revise any existing collection of
information. One commenter asserted that the MRA standard that the
agencies are adopting creates information collection, recordkeeping,
and disclosure requirements for institutions, and that the rule thus
failed to comply with the procedural requirements of the PRA. The
commenter misunderstands the nature of this rulemaking, as this
rulemaking is not the source of the agencies' authority to issue MRAs.
The agencies' visitorial authority provides the agencies with the
authority to issue MRAs, and the rule does not impose any requirements
on institutions. Furthermore, each MRA is tailored to the specific
issues examiners identify at an institution, so the final rule does not
require the same information from 10 or more entities. Accordingly, no
PRA submissions to OMB will be made with respect to this rule.
---------------------------------------------------------------------------
\53\ 44 U.S.C. 3501-3521.
---------------------------------------------------------------------------
B. Regulatory Flexibility Act Analysis
OCC
In general, the Regulatory Flexibility Act (RFA) \54\ requires an
agency, in connection with a final rule, to prepare a final regulatory
flexibility analysis describing the impact of the rule on small
entities (defined by the U.S. Small Business Administration (SBA) for
purposes of the RFA to include commercial banks and savings
institutions with total assets of $850 million or less and trust
companies with total assets of $47 million or less). However, under
section 605(b) of the RFA, this analysis is not required if an agency
certifies that the rule would not have a significant economic impact on
a substantial number of small entities and publishes its certification
and a short explanatory statement in the Federal Register along with
its final rule.
---------------------------------------------------------------------------
\54\ 5 U.S.C. 601 et seq.
---------------------------------------------------------------------------
The OCC currently supervises approximately 602 small entities, all
of which may be impacted by the rule.\55\ In general, the OCC
classifies the economic impact on an individual small entity as
significant if the total estimated impact in one year is greater than 5
percent of the small entity's total annual salaries and benefits or
greater than 2.5 percent of the small entity's total non-interest
expense. Furthermore, the OCC considers 5 percent or more of OCC-
supervised small entities to be a substantial number. Thus, at present,
30 OCC-supervised small entities would constitute a substantial number.
---------------------------------------------------------------------------
\55\ The OCC bases its estimate of the number of small entities
on the SBA's size thresholds for commercial banks and savings
institutions, and trust companies, which are $850 million and $47
million, respectively. Consistent with the General Principles of
Affiliation, 13 CFR 121.103(a), the OCC counts the assets of
affiliated financial institutions when determining if it should
classify an OCC-supervised institution as a small entity. The OCC
uses December 31, 2025, to determine size because a ``financial
institution's assets are determined by averaging the assets reported
on its four quarterly financial statements for the preceding year.''
See footnote 8 of the SBA's Table of Size Standards.
---------------------------------------------------------------------------
The final rule will affect all covered institutions, including
national banks, Federal savings associations, and Federal branches or
agencies of foreign banks. Therefore, the final rule will apply to a
substantial number of small entities. The OCC expects that the final
rule will reduce the aggregate annual number of MRA issuances across
OCC-supervised institutions. This reduction in the number of MRAs
issued will, in turn, reduce the burden for institutions relating to
MRA remediation. Additionally, the OCC expects that the final rule will
result in a decrease in the
[[Page 56020]]
annual number of MRAs escalated to enforcement actions, which will
provide de minimis cost savings. Therefore, the Comptroller of the
Currency certifies that this final rule will not have a significant
economic impact on a substantial number of small entities. A final
regulatory flexibility analysis is thus not required.
One commenter argued that the MRA standard that the OCC is adopting
imposes new costs on institutions, including small entities. The
codified MRA standard does not impose any new obligations, and thus no
direct costs, on institutions.
FDIC
The RFA generally requires that an agency, in connection with a
final rule, prepare and make available for public comment a final
regulatory flexibility analysis that describes the impact of the final
rule on small entities.\56\ However, a final regulatory flexibility
analysis is not required if the agency certifies that the final rule
will not have a significant economic impact on a substantial number of
small entities. The SBA has defined small entities to include banking
organizations with total assets of less than or equal to $850
million.\57\ Generally, the FDIC considers a significant economic
impact to be a quantified effect in excess of 5 percent of total annual
salaries and benefits or 2.5 percent of total noninterest expenses of
the regulated small entity. As detailed in the following statement of
factual basis, the FDIC certifies that the final rule will not have a
significant economic impact on a substantial number of small entities.
---------------------------------------------------------------------------
\56\ See 5 U.S.C. 601 et seq.
\57\ The SBA defines a small banking organization as having $850
million or less in assets, where an organization's ``assets are
determined by averaging the assets reported on its four quarterly
financial statements for the preceding year.'' See 13 CFR 121.201
(as amended by 87 FR 69118, effective December 19, 2022). In its
determination, the ``SBA counts the receipts, employees, or other
measure of size of the concern whose size is at issue and all of its
domestic and foreign affiliates.'' See 13 CFR 121.103. Following
these regulations, the FDIC uses an insured depository institution's
affiliated and acquired assets, averaged over the preceding four
quarters, to determine whether the insured depository institution is
``small'' for the purposes of RFA.
---------------------------------------------------------------------------
To evaluate the impact of the final rule on small entities
regulated by the FDIC, this analysis considers all relevant regulations
and guidance applicable to these institutions, together with financial
data for all IDIs, as the baseline to which the effects of the final
rule are considered. As of the quarter ending March 31, 2026, the FDIC
supervised 2,700 IDIs, of which 1,978 are small entities for the
purposes of the RFA.\58\ Only a subset of small, FDIC-supervised IDIs
are examined in a given year.\59\
---------------------------------------------------------------------------
\58\ See Call Reports, March 31, 2026.
\59\ Based on 1,978 small FDIC-supervised IDIs, the FDIC
estimates a range of 1,319 examinations to 1,978 examinations per
year. The estimate assumes qualifying IDIs are examined once every
18 months (1,978/1.5 = 1,319) and non-qualifying IDIs are examined
every 12 months.
---------------------------------------------------------------------------
As noted in the RFA section of the proposal, the FDIC believed that
the proposal would not impose any obligations on small, FDIC-supervised
entities, and supervised entities would not need to take any action in
response.\60\ The FDIC did not receive any comments in response to its
RFA analysis of the proposal.
---------------------------------------------------------------------------
\60\ See 90 FR 48835 at 48845.
---------------------------------------------------------------------------
Like the proposed rule, the final rule will not directly impose any
obligations on small, FDIC-supervised entities, and such supervised
entities will not need to take any action in response. The final rule
requires the FDIC to revise its current practices regarding the
communication of IDI examination findings. Therefore, the FDIC will be
the only entity directly affected by the rule.
In light of the foregoing statement of factual bases, the FDIC
certifies that the final rule will not have a significant economic
impact on a substantial number of small entities and, therefore, a
final regulatory flexibility analysis is not required.
C. Unfunded Mandates Reform Act of 1995
Consistent with the Unfunded Mandates Reform Act (UMRA), the review
considers whether the mandates imposed by the rule may result in an
expenditure of $100 million or more by State, local, and tribal
governments, or by the private sector, in any one year, adjusted
annually for inflation (currently $193 million). One commenter argued
that the MRA standard that the agencies are adopting imposes new costs
on institutions, potentially in excess of $193 million, and requested
that the agencies either provide data and reasoning why total costs
impose are less than $193 million or publish the UMRA-required written
statement. The codified MRA standard does not impose any new
obligations on institutions. Accordingly, the OCC estimates that the
final rule would not require additional expenditure from OCC-regulated
entities, nor will it require expenditures of $193 million or more by
State, local, and tribal governments, or by other segments of the
private sector. Thus, the OCC believes the rule is not a significant
rule for the purposes of the UMRA. Accordingly, the OCC has not
prepared the written statement described in section 202 of the
UMRA.\61\
---------------------------------------------------------------------------
\61\ The FDIC also notes that independent regulatory agencies,
like the FDIC, are not subject to UMRA. See 2 U.S.C. 658(1),
1502(1).
---------------------------------------------------------------------------
D. Riegle Community Development and Regulatory Improvement Act of 1994
Pursuant to section 302(a) of the Riegle Community Development and
Regulatory Improvement Act (RCDRIA) of 1994,\62\ in determining the
effective date and administrative compliance requirements for new
regulations that impose additional reporting, disclosure, or other
requirements on insured depository institutions, the OCC and FDIC must
consider, consistent with principles of safety and soundness and the
public interest (1) any administrative burdens that the final rule
would place on depository institutions, including small depository
institutions and customers of depository institutions and (2) the
benefits of the final rule. This rulemaking would not impose any
reporting, disclosure, or other requirements on insured depository
institutions. Therefore, section 302(a) does not apply to this final
rule.
---------------------------------------------------------------------------
\62\ 12 U.S.C. 4802(a).
---------------------------------------------------------------------------
E. Congressional Review Act
Subtitle E of the Small Business Regulatory Enforcement Fairness
Act of 1996 (also known as the Congressional Review Act) defines a
``major rule'' as a rule that the Administrator of OMB's Office of
Information and Regulatory Affairs (OIRA) finds has resulted in or is
likely to result in:
1. An annual effect on the economy of $100 million or more;
2. A major increase in costs or prices for consumers, individual
industries, Federal, State, or local government agencies, or geographic
regions; or
3. Significant adverse effects on competition, employment,
investment, productivity, innovation or on the ability of U.S.-based
enterprises to compete with foreign-based enterprises in domestic and
export markets.\63\
---------------------------------------------------------------------------
\63\ 5 U.S.C. 804(2).
---------------------------------------------------------------------------
OMB has determined that the final rule is a major rule for purposes
of the Congressional Review Act. As required, the agencies will submit
the final rule and other appropriate reports to Congress and the
Government Accountability Office for review.
F. Executive Orders 12866 and 14192
1. Executive Order 12866
Section 3(f) of Executive Order 12866 defines a ``significant
regulatory action''
[[Page 56021]]
as a regulatory action that is likely to result in a rule that may:
(1) Have an annual effect on the economy of $100 million or more or
adversely affects in a material way the economy, a sector of the
economy, productivity, competition, jobs, the environment, public
health or safety, or State, local, or tribal governments or
communities;
(2) Create a serious inconsistency or otherwise interfere with an
action taken or planned by another agency;
(3) Materially alter the budgetary impact of entitlements, grants,
user fees, or loan programs or the rights and obligations of recipients
thereof; or
(4) Raise novel legal or policy issues arising out of legal
mandates, the President's priorities, or the principles set forth in
Executive Order 12866.
OIRA has determined that this final rule is a significant
regulatory action under section 3(f)(1) of Executive Order 12866 and,
therefore, is subject to review under Executive Order 12866.
2. Executive Order 14192
Executive Order 14192, titled ``Unleashing Prosperity Through
Deregulation,'' was issued on January 31, 2025. Section 3(a) of
Executive Order 14192 requires an agency, unless prohibited by law, to
identify at least ten existing regulations to be repealed when the
agency publicly proposes for notice and comment or otherwise
promulgates a new regulation. In furtherance of this standard, section
3(c) of Executive Order 14192 requires that the new incremental costs
associated with new regulations shall, to the extent permitted by law,
be offset by the elimination of existing costs associated with at least
ten prior regulations. This rule is considered a deregulatory action
under Executive Order 14192.
List of Subjects
12 CFR Part 4
Administrative practice and procedure, Freedom of information,
Individuals with disabilities, Minority businesses, Organization and
functions (Government agencies), Reporting and recordkeeping
requirements, Women.
12 CFR Part 305
Banks, Banking, Organization and functions (Government agencies).
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the Currency
12 CFR Chapter I
Authority and Issuance
For the reasons set forth in the preamble, and under the authority
of 12 U.S.C. 93a, chapter I of title 12 of the Code of Federal
Regulations is amended as follows:
PART 4--ORGANIZATION AND FUNCTIONS, AVAILABILITY AND RELEASE OF
INFORMATION, CONTRACTING OUTREACH PROGRAM, POST-EMPLOYMENT
RESTRICTIONS FOR SENIOR EXAMINERS
0
1. The authority citation for part 4 is revised to read as follows:
Authority: 5 U.S.C. 301, 552; 12 U.S.C. 1, 93a, 161, 481, 482,
484(a), 1442, 1462a, 1463, 1464, 1467a, 1817(a), 1818, 1820, 1821,
1831m, 1831p-1, 1831o, 1833e, 1867, 1951 et seq., 2601 et seq., 2801
et seq., 2901 et seq., 3101 et seq., 3102(b), 3401 et seq.,
3501(c)(1)(C), 5321, 5412, 5414; 15 U.S.C. 77uu(b), 78q(c)(3); 18
U.S.C. 641, 1905, 1906; 29 U.S.C. 1204; 31 U.S.C. 5318(g)(2), 9701;
42 U.S.C. 3601; 44 U.S.C. 3506, 3510; E.O. 12600, 52 FR 23781, 3
CFR, 1987 Comp., p. 235.
0
2. Add Sec. 4.92 to read as follows:
Sec. 4.92 Enforcement and supervisory standards.
(a) Scope. This section prescribes the definitions and standards
for certain OCC supervisory activities and enforcement actions against
an institution that is a national bank, Federal savings association, or
Federal branch or agency of a foreign bank.
(b) Unsafe or unsound practices. For purposes of the OCC's
enforcement actions under 12 U.S.C. 1818 and supervisory activities, an
``unsafe or unsound practice'' is a practice, act, or failure to act,
alone or together with one or more other practices, acts, or failures
to act, that:
(1) Is contrary to generally accepted standards of prudent
operation; and
(2) (i) If continued, is likely to--
(A) Materially harm the financial condition of the institution; or
(B) Present a material risk of loss to the Deposit Insurance Fund;
or
(ii) Materially harmed the financial condition of the institution.
(c) Matters requiring attention. The OCC may only issue a matter
requiring attention to an institution for a practice, act, or failure
to act, alone or together with one or more other practices, acts, or
failures to act, that:
(1) (i) Is contrary to generally accepted standards of prudent
operation; and
(ii) (A) If continued, could reasonably be expected to, under
current or reasonably foreseeable conditions:
(1) Materially harm the financial condition of the institution; or
(2) Present a material risk of loss to the Deposit Insurance Fund;
or
(B) Materially harmed the financial condition of the institution;
or
(2) Is an actual violation of a banking or banking-related law or
regulation.
(d) Harm to financial condition. Harm to financial condition refers
to financial losses or other negative impacts to an institution's
capital, asset quality, earnings, liquidity, or sensitivity to market
risk.
(e) Tailored application required. (1) The OCC will tailor its
supervisory activities and enforcement actions based on unsafe or
unsound practices under 12 U.S.C. 1818 and its issuance of matters
requiring attention based on the risks associated with the
institution's capital structure, complexity, activities, asset size,
and any other financial risk-related factor that the OCC deems
appropriate.
(2) Tailoring required by this paragraph (e)(1) of this section
includes tailoring with respect to the requirements or expectations set
forth in enforcement actions based on unsafe or unsound practices under
12 U.S.C. 1818 and in matters requiring attention, as well as whether,
and the extent to which, such actions and matters are taken or issued.
(3) As the risk associated with the factors identified in paragraph
(e)(1) of this section increases:
(i) The threshold for materiality of the harm to the financial
condition of an institution to take or issue an action or matter
decreases;
(ii) The assessment of the harm to the financial condition of
institution becomes more granular (e.g., specific business lines,
products, or services); and
(iii) The requirements under the action or matter relating to
remediation, and the expectations regarding prudent operation,
increase.
(f) Basis for OCC determinations. The OCC will use objective facts
and sound reasoning to determine whether, in accordance with paragraphs
(b) through (e) of this section, the OCC may take an enforcement action
based on an unsafe or unsound practice under 12 U.S.C. 1818 or issue a
matter requiring attention.
(g) Clarification regarding supervisory observations. (1) Paragraph
(b) of this section does not apply to supervisory observations.
(2) A supervisory observation is an informal observation that does
not rise to the level of a matter requiring attention, as described in
paragraph (c) of this section, that identifies weaknesses in an
institution's policies, practices, condition, or operations.
(3) A supervisory observation does not create a requirement or
supervisory expectation that the supervisory observation will be
presented to the
[[Page 56022]]
institution's board of directors or that the institution will take
corrective action in response to the supervisory observation.
(h) Other violations. An actual violation of a banking or banking-
related law or regulation for which the OCC does not take an
enforcement action or issue a matter requiring attention is an other
violation.
(1) The OCC may require an institution to remediate an other
violation.
(2) The OCC may take such other actions as are required by law in
connection with an other violation.
FEDERAL DEPOSIT INSURANCE CORPORATION
12 CFR Chapter III
Authority and Issuance
For the reasons set out in the preamble, title 12 of the Code of
Federal Regulations is amended as follows:
0
3. Add part 305, consisting of Sec. 305.1, to read as follows:
PART 305--ENFORCEMENT AND SUPERVISION STANDARDS
Sec.
305.1 Enforcement and supervisory standards.
Authority: 12 U.S.C. 1818, 1819(a) (Seventh, Eighth, and Tenth),
1831p-1.
Sec. 305.1 Enforcement and supervisory standards.
(a) Scope. This section prescribes the definitions and standards
for certain FDIC supervisory activities and enforcement actions against
an institution that is an insured State nonmember bank, insured State
licensed branch of a foreign bank, or an insured State savings
association.
(b) Unsafe or unsound practices. For purposes of the FDIC's
enforcement actions under 12 U.S.C. 1818 and supervisory activities, an
``unsafe or unsound practice'' is a practice, act, or failure to act,
alone or together with one or more other practices, acts, or failures
to act, that:
(1) Is contrary to generally accepted standards of prudent
operation; and
(2) (i) If continued, is likely to--
(A) Materially harm the financial condition of the institution; or
(B) Present a material risk of loss to the Deposit Insurance Fund;
or
(ii) Materially harmed the financial condition of the institution.
(c) Matters requiring attention. The FDIC may only issue a matter
requiring attention to an institution for a practice, act, or failure
to act, alone or together with one or more other practices, acts, or
failures to act, that:
(1) (i) Is contrary to generally accepted standards of prudent
operation; and
(ii) (A) If continued, could reasonably be expected to, under
current or reasonably foreseeable conditions:
(1) Materially harm the financial condition of the institution; or
(2) Present a material risk of loss to the Deposit Insurance Fund;
or
(B) Materially harmed the financial condition of the institution;
or
(2) Is an actual violation of a banking or banking-related law or
regulation.
(d) Harm to financial condition. Harm to financial condition refers
to financial losses or other negative impacts to an institution's
capital, asset quality, earnings, liquidity, or sensitivity to market
risk.
(e) Tailored application required. (1) The FDIC will tailor its
supervisory activities and enforcement actions based on unsafe or
unsound practices under 12 U.S.C. 1818 and its issuance of matters
requiring attention based on the risks associated with the
institution's capital structure, complexity, activities, asset size,
and any other financial risk-related factor that the FDIC deems
appropriate.
(2) Tailoring required by this paragraph (e)(1) of this section
includes tailoring with respect to the requirements or expectations set
forth in enforcement actions based on unsafe or unsound practices under
12 U.S.C. 1818 and in matters requiring attention, as well as whether,
and the extent to which, such actions and matters are taken or issued.
(3) As the risk associated with the factors identified in paragraph
(e)(1) of this section increases:
(i) The threshold for materiality of the harm to the financial
condition of an institution to take or issue an action or matter
decreases;
(ii) The assessment of the harm to the financial condition of
institution becomes more granular (e.g., specific business lines,
products, or services); and
(iii) The requirements under the action or matter relating to
remediation, and the expectations regarding prudent operation,
increase.
(f) Basis for FDIC determinations. The FDIC will use objective
facts and sound reasoning to determine whether, in accordance with
paragraphs (b) through (e) of this section, the FDIC may take an
enforcement action based on an unsafe or unsound practice under 12
U.S.C. 1818 or issue a matter requiring attention.
(g) Clarification regarding supervisory observations. (1) Paragraph
(b) of this section does not apply to supervisory observations.
(2) A supervisory observation is an informal observation that does
not rise to the level of a matter requiring attention, as described in
paragraph (c) of this section, that identifies weaknesses in an
institution's policies, practices, condition, or operations.
(3) A supervisory observation does not create a requirement or
supervisory expectation that the supervisory observation will be
presented to the institution's board of directors or that the
institution will take corrective action in response to the supervisory
observation.
(h) Other violations. An actual violation of a banking or banking-
related law or regulation for which the FDIC does not take an
enforcement action or issue a matter requiring attention is an other
violation.
(1) The FDIC may require an institution to remediate an other
violation.
(2) The FDIC may take such other actions as are required by law in
connection with an other violation.
Jonathan V. Gould,
Comptroller of the Currency.
Federal Deposit Insurance Corporation.
By order of the Board of Directors.
Dated at Washington, DC, on August 27, 2026.
Jennifer M. Jones,
Deputy Executive Secretary.
[FR Doc. 2026-17823 Filed 8-31-26; 8:45 am]
BILLING CODE 4810-33-6714-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 1, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.