OCC and FDIC define "unsafe or unsound practice" and set limits on MRAs
A joint final rule, effective 2 November 2026, defines "unsafe or unsound practice" around material harm to a bank's financial condition and sets standards for when examiners may issue matters requiring attention. A companion OCC proposal deals with violations of law.
"Unsafe or unsound practice" carries a lot of weight. It's a basis for enforcement action under section 8 of the Federal Deposit Insurance Act, and yet nobody had written down what it means in a regulation. On 1 September 2026 the OCC and the FDIC published a final rule that gives it one (91 FR 56004). It takes effect on 2 November 2026.
What the final rule does
The agencies are "adopting a final rule to define the term 'unsafe or unsound practice' for purposes of section 8." The definition is built around harm. The rule sets "the threshold for materiality of the harm to the financial condition of an institution," and explains that "harm to financial condition refers to financial losses or other negative impacts to an institution's capital."
It also covers matters requiring attention, the formal findings examiners use to say "fix this." There are now standards for when an MRA can be issued, and a lighter category below it. In the agencies' words, "supervisory observations are informal observations of objective facts identifying weaknesses."
The rule amends 12 CFR part 4 for the OCC and part 305 for the FDIC, and the agencies say it "will explicitly limit its scope to institutions the agencies supervise." A correction to the rule was published on 22 September 2026.
The OCC companion on violations of law
On the same day the OCC proposed a related rule on violations of laws or regulations (91 FR 56074). It would treat a violation as substantive "if its nature, duration, frequency, or severity could meaningfully impact the institution or its customers," and lists examples such as violations that "require more than minimal restitution" or "involve insider misconduct or self-dealing." Comments on that proposal closed on 1 October 2026.
Who it reaches
The final rule applies to banks and savings associations supervised by the OCC and the FDIC. State member banks supervised by the Federal Reserve and credit unions are outside it.
What it could mean
In our opinion this changes the tone of exams more than what gets looked at. Once "unsafe or unsound" is tied to material financial harm, a bank has firmer ground to push back on an MRA that's really an examiner's process preference. We'd guess a lot of what used to be MRAs will show up as supervisory observations instead.
Don't relax too much. An observation is informal, but it's written down and the next exam team will read it. Ignore one about stale vendor reviews and there's a fair chance it comes back as an MRA. We'd track observations exactly like MRAs: an owner, a due date, and a closing note.
Consumer compliance is the exception we'd flag. A violation can hurt customers badly while costing the bank almost nothing, and the OCC's violations proposal is all about customer impact and restitution. A tighter definition of unsafe or unsound doesn't soften any of that.