The OCC and FDIC Just Redefined What Gets You an MRA. Here's What Your Bank Needs to Do Before November 2.

TL;DR

• The OCC and FDIC finalized a rule redefining “unsafe or unsound practice” — the legal hook examiners use to back up MRAs and enforcement actions. It takes effect November 2, 2026.
• The new standard requires material financial harm or an actual law violation. Process gaps and best-practices misses that don’t affect capital, earnings, liquidity, or asset quality no longer qualify.
• Reputational risk, standing alone, is explicitly excluded from the harm calculus.
• The FDIC says a “large majority” of existing open MRAs don’t meet the new standard and are being closed.
• Banks have roughly four weeks to review outstanding items, update board reporting, and retrain exam teams.

If you’ve ever sat across from an examiner who pointed to a missing policy section and called it an “unsafe or unsound practice,” that conversation just changed — legally, not just in tone.

On September 1, 2026, the OCC and FDIC published a joint final rule in the Federal Register that formally defines the term “unsafe or unsound practice” for the first time in federal banking law and raises the threshold for issuing a Matter Requiring Attention (MRA). The rule takes effect November 2, 2026.

The practical effect is real: the agencies are narrowing the universe of findings that can carry legal weight. The informal “here’s what we’d like to see” era of supervisory communication isn’t going away, but it’s being separated — explicitly, by regulation — from findings that carry corrective-action obligations, board reporting requirements, and enforcement teeth.

Why This Matters Now

For decades, the phrase “unsafe or unsound practice” appeared in the Federal Deposit Insurance Act and the National Bank Act without a statutory definition. Examiners applied it broadly, sometimes to process gaps, documentation shortfalls, or deviation from agency guidance that never touched financial outcomes. The result was an MRA pipeline that ran heavy — boards received long lists of findings, management spent cycles on remediation plans, and exam cycles often looked more like a control checklist than a risk-based review.

The FDIC acknowledged this problem directly. Under the new framework, FDIC examiners will no longer issue Matters Requiring Board Attention (MRBAs) or Supervisory Recommendations (SRs) as separate categories. Examination reports issued after August 31, 2026 use only the new single MRA tier, and the FDIC’s own transition guidance notes that a large majority of existing MRAs are being closed because they don’t satisfy the updated standard.

That’s not a small revision. That’s a structural rewrite of how bank supervision works day to day.

What the New Definition Actually Says

Under the final rule, an unsafe or unsound practice is defined as a practice, act, or failure to act that:

1. Has departed from generally accepted standards of prudential operation, and
2. Has either materially harmed the institution’s financial condition or, if continued, is likely to materially harm the financial condition or present a material risk of loss to the Deposit Insurance Fund.

“Harm to financial condition” means negative impacts on capital, asset quality, earnings, liquidity, or sensitivity to market risk — the CAMELS components. Crucially, the rule explicitly excludes reputational damage from this definition.

The New MRA Standard

The OCC and FDIC may issue an MRA only where the act or failure to act:

• Is an actual violation of a banking or banking-related law or regulation, and that violation is substantive — meaning its nature, duration, frequency, or severity could meaningfully impact the institution or its customers; or
• Is contrary to prudent standards and has already materially harmed the institution’s financial condition, or could materially harm it, or could present material risk to the DIF.

The word “substantive” is doing important work. A technical violation — an isolated paperwork error, a single missed deadline on a low-stakes filing — will not support an MRA. Examiners are explicitly instructed to consider whether a violation is the kind that could meaningfully affect the bank or its customers before reaching for MRA authority.

The Skadden analysis notes that findings falling below this threshold are expected to appear as supervisory observations — exam communications that carry no required action plan, no board-level reporting obligation, and no formal validation process. They’re informational. Management can address them or not. Examiners can note them in the exam report. But they don’t go to the board, and they don’t generate remediation commitments.

What Happens to Existing MRAs

Here’s where banks should focus their attention in the next four weeks.

The FDIC has stated publicly that open MRAs are being evaluated against the new standard and that a large majority will be closed or downgraded to supervisory observations. This doesn’t happen automatically — it flows through the examination process. If you have an open MRA that was issued for a process gap, a documentation deficiency, or a deviation from guidance without demonstrated financial harm, you have a reasonable basis to engage with your examiner-in-charge about reclassification.

For OCC-supervised institutions, the Arnold & Porter advisory flags a related change: MRAs going forward can close on a shorter timetable. Under the old framework, an MRA often required a “sustainability period” — the bank had to demonstrate the fix held over time before the MRA could be validated and closed. The new rule allows closure once remediation is in place and validated, with no mandatory sustainability window.

This matters for CAMELS ratings. Open MRAs that weigh on a component rating can theoretically close faster once the underlying issue is addressed under documented evidence.

The Enforcement Side

The rule also changes when formal enforcement — civil money penalties, cease-and-desist orders — is on the table. The OCC and FDIC may now use enforcement tools only when a bank has engaged in an unsafe or unsound practice meeting the new materiality standard, or for the same category of substantive legal violations.

Technical violations without meaningful harm are out of scope for formal enforcement. The DWT analysis emphasizes this is not a “free pass” — the agencies retain authority for any substantive violation and are increasing scrutiny on findings that do clear the materiality bar — but it does represent a meaningful narrowing of enforcement exposure for procedural or documentation-only gaps.

This also affects individual accountability. The rule’s materiality filter applies to actions against institution-affiliated parties as well. An officer responsible for a process gap that carried no financial consequence is in a different position than one responsible for conduct that meets the new standard.

What Should Be on Your Desk Right Now

If you’re a chief risk officer, compliance director, or exam management lead, here’s the practical work:

1. Triage your open MRA log

Pull every open MRA and map it against the new two-part test: (a) Is it an actual, substantive violation of law? (b) Did it materially harm or is it reasonably likely to materially harm financial condition (CAMELS)? Items that fail both prongs are candidates for reclassification. Document the analysis.

2. Update your issue management procedures

Your issue tracking system probably has a category called “MRA” that maps to a specific workflow — board reporting, management response, validation schedule. You now need a second lane for supervisory observations: no required action plan, no board reporting obligation, informational only. Update your policy before November 2.

3. Revise your board reporting template

Your current board risk report likely includes a section that lists all open MRAs and their status. That section needs to be rethought. Items that drop to supervisory observations no longer belong in the mandatory-reporting tier. Work with legal to clarify what still goes to the board versus what stays at the management level.

4. Brief your management team

Examiners will apply the new standard starting November 2, but your management team needs to understand it now. The instinct to treat every supervisory communication as requiring a formal action plan doesn’t survive contact with this rule — but neither does the instinct to dismiss any finding below the MRA threshold. Observations still matter; they just carry different obligations.

5. Watch how examiners apply it in practice

The rule sets the legal threshold. How examiners apply it in practice — what they call a “substantive” violation, how they measure materiality for CAMELS purposes — will develop over the next several exam cycles. If you disagree with an MRA designation under the new standard, you now have a clearer legal basis for a challenge through the supervisory appeals process.

So What?

The OCC and FDIC didn’t do this to make banks’ lives easier. They did it to make supervision more credible. A framework where nearly anything can be an MRA is a framework where MRAs mean very little — which makes it harder for examiners to communicate genuine risk, and harder for boards to know what actually needs attention.

The new standard benefits well-run institutions with strong controls and isolated process gaps. It focuses examiner attention on financial condition rather than procedure libraries. And it gives compliance teams a defensible framework for explaining to their board why some findings aren’t being escalated — because the regulation says they don’t have to be.

Four weeks to November 2. Use the time.

Resources used to build this post:

• Federal Register: Unsafe or Unsound Practices, Matters Requiring Attention — OCC and FDIC, effective November 2, 2026
• Skadden: OCC and FDIC Finalize Standards for Unsafe or Unsound Practices and MRAs
• Arnold & Porter: OCC and FDIC Overhaul Bank Supervision, MRAs, and Enforcement Framework
• Cooley FinSights: FDIC, OCC Redefine ‘Unsafe or Unsound Practices’ and Raise Bar for MRAs
• Davis Polk / CLS Blue Sky: OCC and FDIC Changes to Rules for Supervision

Related reading on this site:

• Q4 2026 Compliance Deadlines: MRA, TPRM, GENIUS Act Action Calendar
• Federal Regulators Doubled the Asset Threshold for the 18-Month Exam Cycle
• The Banking Agencies Just Proposed to Throw Out the TPRM Checklist

If your issues management log runs on a spreadsheet that predates this rule, the Issues Management Tracker & Template gives you a structured system for tracking findings by type, severity, and remediation status — with the category structure you’ll need to separate MRAs from supervisory observations under the new framework.