OCC and FDIC’s Revised Standards for Unsafe Banking Practices Take Effect

New standards governing how two major U.S. banking regulators identify unsafe or unsound practices and issue supervisory findings take effect on November 2. The Office of the Comptroller of the Currency (OCC) and Federal Deposit Insurance Corporation (FDIC) are putting greater emphasis on financial risks that could materially damage a bank or threaten the Deposit Insurance Fund.

The joint rule establishes a regulatory definition of an unsafe or unsound practice and sets standards for matters requiring attention, known as MRAs. It also distinguishes those findings from informal supervisory observations and other violations of banking law. The change affects how examiners evaluate and communicate problems at institutions supervised by the two agencies, rather than creating a new set of capital requirements for banks.

Issued on August 27 and published in the Federal Register on September 1, the measure follows a proposal made in October 2025. Its final regulatory text lists November 2, 2026, as the effective date. The underlying distinction is between a weakness that warrants a formal supervisory response and a less serious concern that examiners may still identify without requiring a bank to correct it.

A financial-harm test for unsafe or unsound conduct

Under the new definition, a practice, act or failure to act must first be contrary to generally accepted standards of prudent operation. It must also have materially harmed the institution’s financial condition, or be likely to cause that harm or present a material risk of loss to the Deposit Insurance Fund if continued. Both parts of the test matter: an imperfect procedure by itself does not automatically qualify as unsafe or unsound conduct.

The word “likely” is an important threshold. In explaining the rule, the agencies distinguish a likelihood of material harm from a mere possibility. Their assessment must be grounded in objective facts and sound reasoning, not speculative scenarios. A single act or omission can still meet the definition if it satisfies the stated criteria; repeated misconduct is not a prerequisite.

Financial condition has a specific meaning in the regulation. It covers losses or other negative effects on a bank’s capital, asset quality, earnings, liquidity or sensitivity to market risk. The Deposit Insurance Fund is also explicitly protected through the separate test for material risk of loss. That means supervisors can consider danger to the insurance system even where the precise damage to the bank has not yet occurred.

The regulators say this approach is meant to direct examination resources toward financial exposures instead of treating shortcomings in internal processes, policies or documentation as equivalent to material threats to a bank. It does not mean operational or governance weaknesses are irrelevant. A weakness that creates sufficiently serious financial exposure can still meet the standard, even if it initially appears to be a process problem.

There is no fixed numerical percentage defining “material” harm. The agencies declined to set one, arguing that financial consequences depend on the institution and its circumstances. For a bank, that leaves the practical assessment dependent on how examiners connect a particular practice to the institution’s balance sheet, earnings or other financial risks.

Different standards for MRAs, observations and violations

The rule separately defines when an examiner may issue an MRA, a finding that requires attention from a bank’s board and corrective action. The MRA threshold is not identical to the test for an unsafe or unsound practice. Examiners may issue one when imprudent conduct could reasonably be expected, under current or reasonably foreseeable conditions, to cause material financial harm or pose a material risk to the Deposit Insurance Fund. That is a more forward-looking standard than the requirement that harm be “likely” for an unsafe or unsound practice.

An actual violation of a banking or banking-related law or regulation also can justify an MRA. The final rule therefore does not make every examination finding depend on a showing of material financial loss. In explaining how the violation standard will be used, the agencies identify substantive problems such as systemic or repeated violations, more-than-minimal effects on customers or financial records, significant restitution issues, and insider misconduct or self-dealing.

The distinction is particularly relevant to consumer protection. A banking-law violation affecting customers can warrant formal attention even if the bank itself has not suffered a substantial balance-sheet loss. The final rule also preserves the agencies’ ability to require correction of actual legal violations that do not rise to the level of an MRA, rather than treating smaller violations as permissible.

Those lower-level legal findings are classified as “other violations.” Where an examiner does not issue an MRA or pursue enforcement, the regulator may still direct the institution to remediate an actual violation and take further action required by applicable law. The regulatory text specifically creates a place for these findings instead of forcing every violation into the same supervisory category.

Supervisory observations serve a different purpose. They allow examiners to point out weaknesses in policies, practices, condition or operations that fall below the MRA threshold. An observation alone does not create a requirement or supervisory expectation that the matter be presented to the board or that the bank take corrective action. A bank may nevertheless choose to address such a weakness as part of its own risk management.

This classification is intended to make the weight of an examiner’s criticism clearer. An MRA calls for action; an observation does not carry the same obligation. An actual violation remains a legal compliance issue even if it is handled outside an MRA. The agencies also state that simply failing to remediate an MRA does not, by itself, establish a separate unsafe or unsound practice under the new definition.

How supervision changes for banks and examiners

Application of the standards must be tailored to the institution. The rule directs examiners to consider factors including capital structure, complexity, business activities, asset size and other financial risks. For larger or more complex banks, the assessment of financial harm may need to reach individual business lines, products or services. A smaller institution with simpler operations may require a different degree of scrutiny or remediation.

The OCC’s supervisory bulletin describes the objective as making enforcement and examinations more consistent while prioritizing material financial risks. The rule applies to institutions supervised by the OCC and FDIC, including the respective banks and foreign-bank branches within their authority. It does not set a new standard for enforcement against individual institution-affiliated parties, such as certain officers or directors. Those matters remain subject to existing procedures.

The agencies expect the narrower framework to reduce unnecessary examination findings and the time banks spend responding to them. The OCC anticipates fewer MRAs, although that is an expectation rather than a measured result of the new rule. In their published analysis, the regulators also acknowledge a possible downside: a narrower threshold could delay identification of some emerging problems. Their position is that the defined standards still allow early intervention when a serious risk is reasonably foreseeable.

The measure does not repeal the agencies’ authority to enforce applicable banking laws, nor does it mean that financial institutions can disregard an examiner’s finding simply because no loss has yet occurred. The category and seriousness of a problem determine whether it warrants formal correction, informal communication or enforcement under the relevant law. Banks will have to apply those distinctions as examinations and supervisory reviews proceed under the revised standards.

There is also a timing footnote to the rollout. In a September 24 review, the U.S. Government Accountability Office noted that November 2, the effective date stated in the rule, falls less than 60 days after the Senate’s September 4 receipt of the measure, a period relevant under the Congressional Review Act. The GAO report recorded that discrepancy but did not itself announce a replacement effective date. The published rule continues to specify November 2.