On September 1, 2026, the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC) published in the Federal Register a joint final rule that defines an “unsafe or unsound practice” under Section 8 of the Federal Deposit Insurance Act and modifies the agencies’ standards for issuing matters requiring attention (MRAs). The rule follows a notice of proposed rulemaking published in October 2025 and marks the first time that “unsafe or unsound practice” has been defined by regulation.
The final rule establishes a more stringent standard for bringing an MRA that requires examiners to prioritize material financial risks over other nonfinancial risks related to policies, process and documentation. As a result, the rule is expected to reduce the number of MRAs issued by the OCC and FDIC and, relatedly, the number of MRAs escalated to enforcement actions.
New definitions and standards for issuing MRAs
In the final rule, the OCC and FDIC define “unsafe or unsound practice” and establish updated standards for bringing MRAs and supervisory observations. In a notable change from the proposed rule, the final rule does not apply to individual bankers – referred to as institution-affiliated parties – but only to institutions the agencies supervise. Enforcement actions against institution-affiliated parties will continue under the agencies’ existing standards.
Unsafe or unsound practices
Under the final rule, the agencies define the term “unsafe or unsound practice” as a:
“practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that (1) is contrary to generally accepted standards of prudent operation; and (2)(i) if continued, is likely to (A) materially harm the financial condition of the institution; or (B) present a material risk of loss to the [FDIC’s] Deposit Insurance Fund; or (ii) materially harmed the financial condition of the institution.”[1]
The definition of “unsafe or unsound practice” applies to the agencies’ supervisory and enforcement activities prospectively only – and not to their rulemaking activities.
Note that the agencies did not define “generally accepted standards of prudent operation,” and that such standards will be based instead on the “risks associated with an institution’s capital structure, complexity, activities, asset size, and other financial risk-related factors.” The agencies also declined to define “material,” noting it will be assessed through examiner judgment.
MRAs
Following from this definition, the agencies may only issue an MRA to an institution based on an act, practice or failure to act that:
“(1)(i) is contrary to generally accepted standards of prudent operation; and (ii)(A) if continued, could reasonably be expected to, under current or reasonably foreseeable conditions (1) materially harm the financial condition of the institution; (2) present a material risk of loss to the [FDIC’s] Deposit Insurance Fund]; or (B) materially harmed the financial condition of the institution; or (2) is an actual violation of a banking or banking-related law or regulation.”
Note that one difference between the definition of “unsafe or unsound practice” and the standard for issuing an MRA is whether a continued act, practice or failure to act is “likely to” or “could reasonably be expected to” cause harm. As a result, examiners may issue an MRA before an unsafe or unsound practice is present.
Tailoring
The agencies will tailor supervisory activities, enforcement actions and MRA issuance based on the risks posed by an institution’s capital structure, complexity, activities, asset size and other financial risk-related factors. As institutional risk increases:
- The materiality threshold for harm decreases.
- The harm assessment becomes more granular (e.g., by business line, product or service).
- Remediation requirements and prudent-operation expectations increase.
Basis for determinations
Examiners must use “objective facts and sound reasoning” to determine whether an unsafe or unsound practice exists or an MRA is warranted. The agencies declined to require quantitative thresholds or a formal burden of proof, but examiners must be able to justify their determinations to the institution.
Supervisory observations and other violations
Supervisory observations are “informal observations of objective facts identifying weaknesses in an institution’s policies, practices, condition or operations that do not rise to the level of an MRA.” The final rule permits examiners to provide informal supervisory observations related to weaknesses in an institution’s policies or procedures, without an associated requirement for the institution to take corrective action or present the matter to its board of directors.
The rule also defines “other violations,” meaning an actual violation of a banking or banking-related statute or regulation for which the agency does not take an enforcement action or issue an MRA, but may require remediation. The agencies note that “banking or banking-related” extends to federal and/or applicable state laws or regulations inherently associated with the conduct of banking or financial operations and related activities, including consumer protection (i.e., the Equal Credit Opportunity Act) and anti-money laundering laws.
Subsequent actions taken by the FDIC and OCC
In a document discussing implementation of the final rule, the FDIC stated it has completed a lookback review of outstanding matters requiring board attention and supervisory recommendations to determine which meet the new standards. After coordinating with state counterparts, it will notify each institution which items will be redesignated as MRAs, closed out or redesignated as an “other violation,” which the FDIC expects the institution to remediate.
In addition to the final rule, the OCC released a notice of proposed rulemaking to “further refine the standard for the issuance of MRAs for legal violations” by creating a formal distinction between “substantive” and “technical” violations of law. Substantive violations could still qualify for an MRA, while technical violations would be addressed through other supervisory tools. The OCC also published two revised Policies and Procedures Manuals for OCC staff covering its policies for issuing MRAs and taking enforcement actions, updated to align with the new definitions in the rule. The MRA manual was not previously made public.
Looking ahead
The rule will take effect on November 2. As noted, moving forward, we expect banks to see fewer MRAs issued, along with a resultant decrease in the annual number of MRAs escalated to enforcement actions. Institutions with open MRAs may see some downgraded to supervisory observations or closed outright. However, since the new definition applies prospectively only, clients should not expect the FDIC or OCC to revisit closed historical enforcement matters or supervisory findings under the new standard (separate from the FDIC’s own lookback review of currently outstanding items). Finally, institutions should monitor the OCC’s proposed rulemaking on the substantive-versus-technical violation distinction and consider submitting comments by September 26, 2026.
[1] “Harm to a bank’s financial condition” is a newly defined phrase, which means “financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.”