The OCC and FDIC Just Redefined What Gets You an MRA. Here's What Your Bank Needs to Do Before November 2.

TL;DR

• The OCC and FDIC finalized a rule redefining “unsafe or unsound practice” — the legal hook examiners use to back up MRAs and enforcement actions. It takes effect November 2, 2026.
• The new standard requires material financial harm or an actual law violation. Process gaps and best-practices misses that don’t affect capital, earnings, liquidity, or asset quality no longer qualify.
• Reputational risk, standing alone, is explicitly excluded from the harm calculus.
• The FDIC says a “large majority” of outstanding supervisory criticisms don’t meet the new standard and are being closed out.
• Banks have roughly four weeks to review outstanding items, update board reporting, and retrain exam teams.

If you’ve ever sat across from an examiner who pointed to a missing policy section and called it an “unsafe or unsound practice,” that conversation just changed — legally, not just in tone.

On September 1, 2026, the OCC and FDIC published a joint final rule in the Federal Register that formally defines the term “unsafe or unsound practice” for the first time in federal banking law and raises the threshold for issuing a Matter Requiring Attention (MRA). The rule takes effect November 2, 2026.

The practical effect is real: the agencies are narrowing the universe of findings that can carry legal weight. The informal “here’s what we’d like to see” era of supervisory communication isn’t going away, but it’s being separated — explicitly, by regulation — from findings that carry corrective-action obligations, board reporting requirements, and enforcement teeth.

Why This Matters Now

For decades, the phrase “unsafe or unsound practice” appeared in the Federal Deposit Insurance Act and the National Bank Act without a statutory definition. Examiners applied it broadly, sometimes to process gaps, documentation shortfalls, or deviation from agency guidance that never touched financial outcomes. The result was an MRA pipeline that ran heavy — boards received long lists of findings, management spent cycles on remediation plans, and exam cycles often looked more like a control checklist than a risk-based review.

The FDIC acknowledged this problem directly. Under the new framework, FDIC examiners will no longer issue Matters Requiring Board Attention (MRBAs) or Supervisory Recommendations (SRs) as separate categories. Examination reports issued after August 31, 2026 use only the new single MRA tier, per the FDIC’s implementation letter (FIL-53-2026). And Chairman Travis Hill said the FDIC has concluded that a “large majority” of outstanding supervisory criticisms don’t meet the new standard and will be closed out.

That’s not a small revision. That’s a structural rewrite of how bank supervision works day to day.

What the New Definition Actually Says

Under the final rule, an unsafe or unsound practice is defined as a practice, act, or failure to act that:

1. Has departed from generally accepted standards of prudential operation, and
2. Has either materially harmed the institution’s financial condition or, if continued, is likely to materially harm the financial condition or present a material risk of loss to the Deposit Insurance Fund.

“Harm to financial condition” means negative impacts on capital, asset quality, earnings, liquidity, or sensitivity to market risk — the CAMELS components. Crucially, the rule explicitly excludes reputational damage from this definition.

The New MRA Standard

The OCC and FDIC may issue an MRA only where the act or failure to act:

• Is an actual violation of a banking or banking-related law or regulation, and that violation is substantive — meaning its nature, duration, frequency, or severity could meaningfully impact the institution or its customers; or
• Is contrary to prudent standards and has already materially harmed the institution’s financial condition, or could materially harm it, or could present material risk to the DIF.

The word “substantive” is doing important work. A technical violation — an isolated paperwork error, a single missed deadline on a low-stakes filing — will not support an MRA. Examiners are explicitly instructed to consider whether a violation is the kind that could meaningfully affect the bank or its customers before reaching for MRA authority.

The Skadden analysis notes that findings falling below this threshold are expected to appear as supervisory observations — exam communications that carry no required action plan, no board-level reporting obligation, and no formal validation process. They’re informational. Management can address them or not. Examiners can note them in the exam report. But they don’t go to the board, and they don’t generate remediation commitments.

What Happens to Existing MRAs

Here’s where banks should focus their attention in the next four weeks.

The FDIC has run a lookback review of outstanding MRBAs and SRs. Each one will be either redesignated as an MRA or closed out, and the FDIC says it does not plan to convert any existing items into supervisory observations. If a closed item included a violation of law, that violation gets redesignated as an “other violation” that you’re still expected to remediate. Every FDIC-supervised bank is supposed to receive correspondence saying which items survive. This doesn’t happen automatically, so don’t assume it has. If you have an open MRA that was issued for a process gap, a documentation deficiency, or a deviation from guidance without demonstrated financial harm, you have a reasonable basis to engage with your examiner-in-charge about reclassification.

For OCC-supervised institutions, a related change came alongside the rule: MRAs going forward can close on a shorter timetable. Under the old practice, examiners often kept an MRA open to see “demonstrated sustainability” of the fix, which the rule’s preamble flags as inflating MRA counts. The rule itself leaves that to agency policy. The OCC’s revised MRA policy, PPM 5400-11 (August 27, 2026), says examiners “must not delay closing an MRA to assess the sustainability of the corrective action.” Once corrective action is implemented and validated, the MRA closes.

This matters for CAMELS ratings. Open MRAs that weigh on a component rating can theoretically close faster once the underlying issue is addressed under documented evidence.

The Enforcement Side

The rule also changes when formal enforcement — civil money penalties, cease-and-desist orders — is on the table, but only on one ground. When an action rests on an “unsafe or unsound practice,” that practice now has to meet the new materiality standard. Section 8 of the FDI Act has other grounds too, like a violation of law or a breach of fiduciary duty, and the preamble says those are “not affected” by the new definition.

So a process or documentation gap with no financial impact can no longer be called an unsafe or unsound practice to support an order. The DWT analysis emphasizes this is not a “free pass”: banks can still face enforcement for any predicate violation of law, and individuals sit outside the rule entirely. But it does represent a meaningful narrowing of enforcement exposure for procedural or documentation-only gaps.

One thing that did not change: individual accountability. The proposal would have applied the new definition to institution-affiliated parties (officers, directors and others), but the final rule dropped them from its scope. Actions against individuals “will continue to be handled under the agencies’ prior standards and procedures.” Don’t tell your executives the materiality bar protects them personally.

What Should Be on Your Desk Right Now

If you’re a chief risk officer, compliance director, or exam management lead, here’s the practical work:

1. Triage your open MRA log

Pull every open MRA and map it against the new two-part test: (a) Is it an actual, substantive violation of law? (b) Did it materially harm or is it reasonably likely to materially harm financial condition (CAMELS)? Items that fail both prongs are candidates for reclassification. Document the analysis.

2. Update your issue management procedures

Your issue tracking system probably has a category called “MRA” that maps to a specific workflow — board reporting, management response, validation schedule. You now need a second lane for supervisory observations: no required action plan, no board reporting obligation, informational only. Update your policy before November 2.

3. Revise your board reporting template

Your current board risk report likely includes a section that lists all open MRAs and their status. That section needs to be rethought. Items that get closed out, or new findings that land as supervisory observations, no longer belong in the mandatory-reporting tier. Closed items that were redesignated as “other violations” still need remediation tracking. Work with legal to clarify what still goes to the board versus what stays at the management level.

4. Brief your management team

Examiners will apply the new standard starting November 2, but your management team needs to understand it now. The instinct to treat every supervisory communication as requiring a formal action plan doesn’t survive contact with this rule — but neither does the instinct to dismiss any finding below the MRA threshold. Observations still matter; they just carry different obligations.

5. Watch how examiners apply it in practice

The rule sets the legal threshold. How examiners apply it in practice — what they call a “substantive” violation, how they measure materiality for CAMELS purposes — will develop over the next several exam cycles. If you disagree with an MRA designation under the new standard, you now have a clearer legal basis for a challenge through the supervisory appeals process.

So What?

The OCC and FDIC didn’t do this to make banks’ lives easier. They did it to make supervision more credible. A framework where nearly anything can be an MRA is a framework where MRAs mean very little — which makes it harder for examiners to communicate genuine risk, and harder for boards to know what actually needs attention.

The new standard benefits well-run institutions with strong controls and isolated process gaps. It focuses examiner attention on financial condition rather than procedure libraries. And it gives compliance teams a defensible framework for explaining to their board why some findings aren’t being escalated — because the regulation says they don’t have to be.

Four weeks to November 2. Use the time.

Resources used to build this post:

• Federal Register: Unsafe or Unsound Practices, Matters Requiring Attention — OCC and FDIC, effective November 2, 2026
• FDIC FIL-53-2026: Implementation of the Final Rule on Unsafe or Unsound Practices; Matters Requiring Attention
• OCC PPM 5400-11: Matters Requiring Attention
• Skadden: OCC and FDIC Finalize Standards for Unsafe or Unsound Practices and MRAs
• Arnold & Porter: OCC and FDIC Overhaul Bank Supervision, MRAs, and Enforcement Framework
• Cooley FinSights: FDIC, OCC Redefine ‘Unsafe or Unsound Practices’ and Raise Bar for MRAs
• Davis Polk / CLS Blue Sky: OCC and FDIC Changes to Rules for Supervision

Related reading on this site:

• Q4 2026 Compliance Deadlines: MRA, TPRM, GENIUS Act Action Calendar
• Federal Regulators Doubled the Asset Threshold for the 18-Month Exam Cycle
• The Banking Agencies Just Proposed to Throw Out the TPRM Checklist

If your issues management log runs on a spreadsheet that predates this rule, the Issues Management Tracker & Template gives you a structured system for tracking findings by type, severity, and remediation status — with the category structure you’ll need to separate MRAs from supervisory observations under the new framework.