OCC and FDIC adopt new “unsafe or unsound practice” definition: Key takeaways for consumer protection reviews

The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) recently adopted a joint final rule that, for the first time, defines “unsafe or unsound practice” by regulation. The final rule is effective November 2, 2026.

In general, the rule requires that:

• Before either agency uses the unsafe-or-unsound-practice framework to support a supervisory or enforcement action, the conduct must be contrary to generally accepted standards of prudent operation and connected to material financial harm to the institution or risk of loss to the Deposit Insurance Fund (DIF)
  
  
• For either agency to issue a Matter Requiring Attention (MRA), the conduct must meet a similar but somewhat lower materiality threshold, or constitute an actual violation of a banking or banking-related law or regulation

The Federal Reserve System did not join in the final rule.

The OCC and FDIC retain independent authority to bring enforcement actions on grounds such as violations of law, regardless of the new materiality standard. The OCC separately proposed a framework distinguishing “substantive” from “technical” violations of law for purposes of MRAs. Together, these changes raise the threshold for formal supervisory action and have direct implications for consumer compliance examinations.

This alert explains what changed, what did not, and what institutions may wish to consider.

Background

The authority at issue traces back to Section 8 of the Federal Deposit Insurance (FDI) Act (12 U.S.C. § 1818), enacted as part of the Financial Institutions Supervisory Act of 1966. Congress designed Section 8 to give federal banking agencies flexible, intermediate tools to address unsafe or unsound practices and violations of law that could harm financial institutions and the broader economy.

Although Section 8 did not define what constitutes unsafe or unsound practices, its legislative history has long been understood to serve a broad safety-and-soundness purpose. Section 8 is intended to protect institutions, depositors, and the insurance funds from practices that pose real financial risk. Historically, however, many MRAs focused on Compliance Management System (CMS) weaknesses, such as policy gaps, incomplete documentation, and process weaknesses, without a clear link to material financial harm or risk to the DIF. A bank could be criticized for an outdated monitoring procedure, even when the record did not show a material effect on its capital, asset quality, earnings, liquidity, or sensitivity to market risk. The new rule, along with the proposed rule from the OCC, recenter Section 8 and the MRA framework on material financial risk.

The joint final rule: A new definition of “unsafe or unsound practice”

The rule uses a two-part test. Both conditions must be met for conduct to qualify as an “unsafe or unsound practice,” but the second condition may be satisfied on either a forward-looking or backward-looking basis:

• First: Contrary to generally accepted standards of prudent operation of a depository institution; and
  
  
• Second, either:
  • Forward-looking: Likely, if continued, to cause material harm to the institution’s financial condition or present a material risk of loss to the FDIC’s DIF; or
    
    
  • Backward-looking: Has already materially harmed the financial condition of the institution.

The new definition applies to both enforcement actions under 12 U.S.C. 1818 and supervisory activities. It does not, however, determine what the agencies consider unsafe or unsound practices in rulemaking activities. The rule also sets a separate standard for MRAs. While higher than prior practice, the MRA threshold uses a somewhat lower probability standard than the unsafe-or-unsound-practice definition itself. An MRA may be issued when conduct is contrary to generally accepted standards of prudent operation and, if continued, could reasonably be expected, under current or reasonably foreseeable conditions, to materially harm the institution’s financial condition or present a material risk of loss to the DIF, or when the conduct has already materially harmed the institution’s financial condition.

MRAs may also be issued for actual violations of banking or banking-related laws or regulations, independent of the materiality test. Matters that do not meet either standard may still be communicated as supervisory observations, which do not create a requirement for corrective action. The final rule provides that an institution’s failure to remediate an MRA does not, by itself, constitute an unsafe or unsound practice.

The joint final rule also created a new “other violations” category. When an examiner identifies an actual violation of a banking-related law or regulation, but the agency does not issue an MRA or take an enforcement action, the violation falls into this category. The agency may still direct the institution to remediate the violation, and any other legal requirements continue to apply. This category applies to both OCC- and FDIC-supervised institutions.

The FDIC has reported that a “large majority” of existing MRAs do not meet the new MRA standard and are being closed.

OCC’s proposed rule: Substantive versus technical violations

In a parallel action, the OCC proposed to codify this policy into a binding regulation that would further refine when MRAs may be issued for violations of law. Under the proposal, only “substantive” violations, whose nature, duration, frequency, or severity could meaningfully impact a bank or its customers, would trigger an MRA.

A violation would be classified as substantive if it relates to one of five categories:

• Systemic or pattern violations (e.g., recurring Truth in Lending Act (TILA) disclosure errors across multiple branches)
  
  
• Violations with a direct, clear, predictable, and more than minimal impact on the institution’s financial condition (e.g., losses from improperly structured loans that have a predictable and more than minimal effect on asset quality)
  
  
• Violations affecting the accuracy of books and records (e.g., systematic misclassification of loan categories)
  
  
• Violations requiring more-than-minimal restitution or causing more-than-minimal adverse customer impact (e.g., overcharges affecting hundreds of accounts)
  
  
• Insider misconduct (e.g., officer self-dealing)

“Technical” violations, which are isolated, minor, and without meaningful impact, would still be cited and corrected as appropriate, but could not trigger an MRA under the OCC proposal. The OCC has also published revised staff manuals for MRAs and enforcement actions. The OCC’s proposed rule would also replace the joint rule’s “other violations” category, as applied to OCC-supervised institutions, with this “technical violations” framework.

Under the OCC’s proposed framework, if an OCC examiner finds a minor, isolated TILA violation that does not qualify as “substantive,” the examiner may note it and ask the bank to correct it, but it should not appear as an MRA in the examination report, and the bank should not be expected to present it to the board as a formal remediation item. The FDIC did not issue its own substantive-versus-technical framework. Rather, it relies on the joint final rule’s “other violations” category, described above, and its examination manual to address violations that fall below the MRA threshold.

Impact on consumer protection reviews

The new framework changes how examiners classify and escalate findings. It does not eliminate consumer compliance supervision.

What changed:

• CMS-based findings: Examiners’ ability to label a consumer compliance issue an “unsafe or unsound practice” or issue a safety-and-soundness MRA based solely on nonfinancial control weaknesses, such as deficiencies in an institution’s CMS, documentation gaps, or process failures, is now constrained unless the issue meets the materiality standard or involves an actual violation of law. In practice, if an examiner identifies a CMS weakness (such as an outdated fair lending monitoring program), the examiner may raise it as a supervisory observation, but cannot escalate it to an MRA unless the weakness has caused or could cause material financial harm.
  
  
• Unfair or deceptive acts or practices (UDAP), fair lending, and Community Reinvestment Act (CRA): The joint final rule contains no subject-matter carveout for consumer protection laws. Consumer compliance issues, including those arising under the prohibition against UDAP, the Equal Credit Opportunity Act (ECOA), and the CRA, cannot be characterized as unsafe or unsound practices unless they meet the rule’s materiality threshold; this applies to both OCC- and FDIC-supervised institutions. Under the OCC’s proposed violations framework, which remains at the proposed stage, consumer law violations would trigger MRAs only if they qualify as “substantive” (e.g., systemic or pattern violations, violations requiring more-than-minimal restitution, or those causing more-than-minimal adverse customer impact).
  
  
• Supervisory observations: Lower-level concerns may be conveyed through supervisory observations, and examiners may revisit unresolved observations in future examinations. A pattern of unaddressed observations could eventually support a finding that rises to MRA level.

While the new rule changes the threshold for certain MRAs, it does not remove the agencies’ core enforcement tools.

What has not changed:

• Actual violations remain enforceable: Violation citations, consumer compliance ratings, restitution orders, referrals, and enforcement actions based on actual violations of consumer protection statutes remain available on independent statutory grounds.
  
  
• Section 8 authority remains broad: Section 8 of the FDI Act continues to give the OCC and FDIC authority to cite violations, order restitution, assess civil money penalties, issue cease-and-desist orders, and terminate deposit insurance. These authorities are independent of the unsafe-or-unsound-practice definition. If a bank violates consumer compliance laws, the agencies may act regardless of whether the conduct meets the new materiality threshold.

What about the Federal Reserve System?

For Federal Reserve System-supervised institutions, the joint final rule does not directly apply. However, on April 21, 2026, the Federal Reserve System’s Division of Supervision and Regulation issued an Updated Statement of Supervisory Operating Principles directing examiners to prioritize material financial risks and setting a tiered approach.

In this approach, MRAs and matters requiring immediate attention (MRIAs) for safety-and-soundness concerns require a significant probability of significant harm to the institution’s financial condition (or significant actual harm), while enforcement actions based on unsafe or unsound practices require an abnormal probability of abnormal harm (or abnormal actual harm), with “abnormal” meaning substantially higher than normal or significant.

The statement also provides that an institution that self-identifies a safety-and-soundness deficiency that would otherwise meet the MRA or MRIA standard and promptly begins reasonable remediation will presumptively be treated as giving rise to a supervisory observation, rather than an MRA or MRIA.

Key takeaways

Institutions may wish to consider the following steps:

• Reassess open MRAs. Create an internal inventory of all outstanding MRAs. For any that do not meet the new materiality threshold, consider making a written request to the examination team for review and potential closure. Document the basis for the assessment, including the facts supporting or undermining material financial risk.
  
  
• Maintain consumer compliance programs. The rule narrows when the OCC and FDIC can use their supervisory tools, but it does not limit the ability to cite violations, downgrade compliance ratings, order restitution, or refer matters for enforcement. An institution that scales back its compliance program may increase its exposure to enforcement action, rather than an MRA, for the resulting violations.
  
  
• Monitor the OCC’s proposed violations rule. The proposal is open for a 30-day comment period, offering an opportunity to comment on how the five-category test applies in practice. Institutions may wish to consider submitting comments, particularly on how the “more-than-minimal adverse customer impact” standard would apply to common consumer compliance issues. The FDIC did not issue a separate parallel proposal; it relies on the final rule’s other-violations category.
  
  
• Watch for revised examination manuals. Both agencies are updating examination guidance. Changes to the FDIC Consumer Compliance Examination Manual and the OCC MRA staff manuals are expected to detail how the new standards are translated into examination practice.
  
  
• Monitor the Federal Reserve System’s separate reforms. Federal Reserve System-supervised institutions may wish to track the Board’s MRA and MRIA review, evolving examination standards, and the self-identification approach. Institutions that self-identify a safety-and-soundness deficiency and promptly begin reasonable remediation may receive presumptive treatment as a supervisory observation rather than an MRA or MRIA.

Learn more

For more information, please contact the authors.