The OCC Just Made Recovery Planning Optional for $100 Billion Banks. Here's What Still Exists Under Safety and Soundness.

If you run operational risk at a bank with $100 billion or more in assets, you may have spent part of 2026 watching your recovery planning requirements disappear one by one. The OCC’s Appendix E recovery planning guidelines — including the 2024 amendments that added operational risk, annual testing requirements, and extended coverage to the $100B tier — became effective May 1, 2026. Gone.

Comptroller Jonathan Gould said prescriptive recovery planning guidelines “do little to improve [banks’] ability to manage through stress and distract from the real work of running a safe and sound institution.” The Federal Register entry described the 2024 documentation requirements as “scenario-dependent or otherwise conjectural.” The OCC estimated $20 million in annual cost savings for covered banks.

That sounds like deregulation. It is not the same as deregulation of operational risk itself.

TL;DR

• OCC rescinded Appendix E recovery planning guidelines for $100B+ national banks, effective May 1, 2026 — annual testing requirements, operational risk documentation, and specific governance mandates are gone.
• General safety and soundness authority at 12 CFR Part 30 Appendix A remains intact, and OCC examiners can still cite operational risk deficiencies under those standards.
• Federal Reserve requirements for BHC parents — capital planning, DFAST, liquidity — were not affected by the OCC action.
• The practical guidance: keep the substance of your recovery planning program, restructure the format, and document your program scope decisions before your next examination.

What the OCC Actually Rescinded

The rescission covers everything in Appendix E to 12 CFR Part 30 plus the supporting infrastructure: the “Recovery Planning” booklet of the Comptroller’s Handbook, and four OCC Bulletins that provided examination expectations and guidance around the guidelines.

The 2024 amendments that were removed had three main components banks had been building toward:

Expanded coverage. The 2024 rule extended the guidelines to national banks with $100B+ in average total consolidated assets — not just the largest systemically important institutions. Banks in the $100B–$250B range had been planning their first compliance cycles.

Operational and strategic risk. The 2024 amendments specifically required that recovery plans address operational challenges, not just financial stress. That language — the explicit hook for operational risk teams — is what made Appendix E relevant beyond treasury and capital planning functions.

Annual testing. The 2024 guidelines required covered banks to test recovery plans annually, with documentation of results. That testing cycle drove significant program investment: tabletop exercises, playbook validation, cross-functional engagement.

All three components are rescinded. What remains is the base safety and soundness framework — which was there before Appendix E existed and doesn’t disappear because Appendix E is gone.

What the OCC Did Not Rescind

The Interagency Guidelines Establishing Standards for Safety and Soundness — Appendix A to 12 CFR Part 30 — remain in full force. These guidelines require national banks to maintain:

• Internal controls and information systems sufficient to identify and manage material risks across all risk categories
• An internal audit system to test those controls
• Management and board oversight of risk management

“All risk categories” includes operational risk. An examiner reviewing a $100B+ bank that has dismantled its operational resilience program can still cite Appendix A for inadequate risk management infrastructure — there is no requirement to reference Appendix E.

The OCC also said explicitly that it still expects covered institutions to “be well managed and have appropriate risk management processes in place to prepare for and respond to stress events, including through appropriate contingency funding plans.” That language is not in the rescission rule as a new requirement. It is the OCC describing what it already expects under safety and soundness authority.

Comptroller Gould did not say large banks don’t need to plan for stress. He said the mandatory documentation format was counterproductive.

The Federal Reserve Piece

OCC authority applies to the national bank subsidiary. For a bank holding company or financial holding company with $100B+ in assets, the Federal Reserve has separate supervisory authority and its own expectations around operational resilience.

Federal Reserve supervisory letters, capital planning requirements, and the DFAST framework create a distinct layer of operational risk expectations for BHC parents. None of those were touched by the OCC’s April 2026 action.

A $100B+ bank embedded in a BHC cannot restructure its recovery planning program based solely on the OCC rescission without also checking whether the program changes affect Federal Reserve exam compliance for the holding company. In many cases, the bank’s recovery planning function feeds the BHC’s broader capital and liquidity stress programs — programs the Federal Reserve still examines.

The FDIC Parallel

Banks with $100B+ in total assets are also FDIC-insured, which means resolution planning under Title I of Dodd-Frank (for the largest institutions designated as covered companies) applies regardless of OCC recovery planning status. The FDIC’s Title I resolution planning requirements — living wills — are a separate regulatory process with separate documentation and testing requirements.

The OCC rescission and the FDIC resolution planning framework are parallel, not redundant. Recovery planning (OCC’s former Appendix E focus) addressed how a bank would restore operations under stress. Resolution planning (FDIC/Federal Reserve living wills) addresses how a bank would be wound down or resolved under failure scenarios. A bank whose assets trigger both frameworks needs both programs, regardless of what happened to Appendix E.

The Reputation Risk Carve-Out

In June 2026, the OCC and FDIC finalized a joint rule prohibiting the use of “reputation risk” in bank supervision. That rule eliminated one category of supervisory pressure — examiners cannot now issue adverse actions based on reputational grounds.

But the rule explicitly carved out operational risk. Regulators retained authority to cite operational risk factors, including cyberattacks, natural disasters, and operational failures — even when those factors also affect public confidence. That carve-out was deliberate and signals that the agencies understood banks might otherwise argue that operational resilience issues are merely reputational.

The practical effect: eliminating reputation risk as a supervisory category did not reduce the OCC’s ability to examine and act on operational risk deficiencies. It just removed one avenue for what critics called pretextual examinations.

What a Responsible Large Bank Does Now

The OCC’s action created a specific compliance planning decision: your program was built around a rule that no longer exists. Here is a structured approach to that decision.

Keep the Substance

The annual testing, governance structures, scenario library, and playbooks you built under Appendix E are sound risk management infrastructure. They were good practice before they were mandatory. They remain good practice now.

The risk of dismantling these programs to capture the cost savings isn’t just examiner displeasure. It’s that a real stress event — a cyber incident, a market disruption, a liquidity squeeze — happens before you’ve rebuilt what you tore down. Recovery planning programs that exist only because of a rule tend to disappear when the rule does, and the bank that got caught without one in 2018 or 2023 wasn’t protected by the absence of a mandate.

Restructure the Format

What you can safely change is the documentation format. Appendix E required specific plan structures, sign-off processes, and test documentation formats that were tied to the guideline. Those requirements are gone.

Build the format that works for your institution’s governance structure and examination approach. That might mean collapsing what was a standalone “recovery plan” document into your broader operational risk management framework. It might mean integrating recovery scenarios into your annual RCSA process rather than running a separate exercise. It might mean shorter, scenario-specific playbooks rather than a comprehensive plan document.

Document Your Scope Decisions

Before your next OCC examination, document the deliberate decisions you made about program scope. If you tested annually under the guidelines and now test biennially, write down why and what risk governance process approved that change. If you eliminated the formal operational risk section that the 2024 amendments required, explain the alternative framework you use to address those risks.

Examiners who examine large banks understand that the guidelines were rescinded. They also understand that banks make deliberate, risk-based decisions about their programs. The exam finding you want to avoid is one that says your program decisions look ad hoc or cost-driven rather than deliberately risk-managed.

Contingency Funding Plans Are Non-Negotiable

The OCC specifically mentioned contingency funding plans as an expectation that survives the rescission. This is the treasury and liquidity team’s domain — but if your operational risk program had any hooks into CFP scenarios, those connections should remain intact.

The 2023 regional bank failures were a vivid reminder that liquidity risk and operational risk are not separate. SVB and Signature failed operationally — deposit runoff that stressed systems and personnel before the formal failure occurred. A recovery planning program that didn’t integrate operational failure scenarios with liquidity stress scenarios would have been deficient under Appendix E. It’s still deficient without the guideline.

So What?

The OCC’s recovery planning rescission is a real regulatory change. The documentation burden is lighter. The mandatory annual testing cycle is gone. The specific Appendix E governance requirements no longer apply.

But the OCC has not told large banks they don’t need to be prepared for stress. It has told them it trusts them to build that preparation in a way that fits their institution — rather than following a mandatory template that generated documentation without necessarily improving resilience.

Treat that as the latitude it is. The banks that use it well will have strong, flexible programs that hold up under examination and under actual stress. The banks that use it to cut program investment will find that examiners have other tools.

The RCSA template at RiskTemplate includes operational risk scenario frameworks and control self-assessment processes that support an integrated approach to operational resilience — the kind of substance-forward program that survives both the rescission and the next examination cycle.

Related reading:

• Cloud Concentration Risk and BCP: When Your Core Vendor Goes Down
• Operational Resilience vs. Business Continuity: Building the US Bank Framework
• BCP Change Management: Mid-Cycle Review and Vendor Triggers

Sources:

• OCC News Release NR 2026-21: OCC Issues Final Rule to Rescind Recovery Planning Guidelines
• Federal Register: Rescission of OCC Guidelines — 2026-06281
• OCC Bulletin 2026-10
• US Banking Regulators Finalize Rule Eliminating Use of Reputation Risk
• ABA Banking Journal: OCC Rescinds Recovery Standards for Larger Banks