For decades, federal bank examiners could criticize an institution for an "unsafe or unsound practice" without anyone being able to point to a regulatory definition of the phrase. The statute that gives them the power uses the term but never defines it. On August 27, the FDIC and the OCC finalized a joint rule that finally writes the definition down, and the line they drew says as much about what they left out as what they put in.
The rule was published in the Federal Register on September 1 and takes effect November 2. It codifies the agencies' approach to two everyday supervisory tools: the "unsafe or unsound practice" finding that can support enforcement action, and the "Matters Requiring Attention" letter, known inside the industry as an MRA, that orders a bank to fix a problem. The stated purpose is to refocus supervision on material financial risks and away from what the agencies call less consequential policy, procedural, documentation, and reputational concerns.
The two-part test
Under the final rule, an unsafe or unsound practice is a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation, and that either is likely, if continued, to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund, or that has already materially harmed the institution's financial condition.
The definition of harm is deliberately financial. It includes losses or negative impacts on capital, asset quality, earnings, liquidity, or sensitivity to market risk. It expressly excludes reputation risk, which had been a recurring complaint from banks that examiners were elevating public-relations criticisms into supervisory findings. The agencies declined to set numerical thresholds for "likely" or "material," instead requiring examiners to support determinations with objective facts and sound reasoning. The definition applies to institutions, not to enforcement actions against individuals.
The significance of the two-part structure is that a practice must clear both bars. A bank can be criticized for conduct contrary to prudent standards, but without a plausible path to material financial harm, the conduct cannot support the "unsafe or unsound" label. The rule moves the most serious supervisory charge onto firmer, more financial footing.
What changes for MRAs
The rule sets a somewhat lower threshold for issuing an MRA than for an unsafe-or-unsound finding. An MRA may be issued when a practice is contrary to generally accepted standards of prudent operation and could reasonably be expected, under current or reasonably foreseeable conditions, to materially harm the institution or present a material risk to the Deposit Insurance Fund. An MRA can also rest on an actual violation of a banking or banking-related law or regulation.
Several changes flow from that standard. Not every technical violation warrants an MRA; agencies may require remediation of an actual violation without issuing one or taking enforcement action. Less significant weaknesses can be communicated as "supervisory observations," which do not require corrective action or board presentation. And the FDIC is eliminating two of its older instruments altogether: Matters Requiring Board Attention and Supervisory Recommendations. Outstanding items under those labels will be reviewed and redesignated as MRAs where appropriate or closed out.
The rule also directs that supervisory and enforcement actions be tailored to an institution's capital structure, complexity, activities, asset size, and other financial risk factors. Higher-risk institutions face lower materiality thresholds and more extensive remediation requirements. The tailoring provision is the rule's quiet compromise: it constrains examiners at the low end while preserving their reach at the high end.
The reaction split along familiar lines
The agencies received 36 comments on the proposal. Supporters, largely from the industry side, argued the rule curbs expansive MRA usage and refocuses supervision on risks that actually threaten banks. Opponents argued the rule could inhibit proactive risk identification by making examiners hesitant to flag problems that have not yet shown up in the numbers.
The Federal Reserve did not join the rulemaking, and its absence is a structural feature of the outcome. The rule binds OCC-supervised national banks and FDIC-supervised state-chartered banks, but not Fed-supervised institutions, where the Fed has said it is pursuing a similar approach through guidance rather than regulation. The Fed began reviewing its outstanding MRAs and related items in February 2026. Banks that operate across charters will therefore live under a written standard from two agencies and a guidance-based approach from the third.
For bank management, the practical work begins before November 2. The judgment-based terms that survived the rulemaking, "generally accepted standards of prudent operation," "likely," and "material," will be defined in application, and examination-response procedures are the place where the new standards will first be tested. The rule gives banks firmer ground to push back on findings that cannot be tied to financial harm, and it gives examiners a clearer script for the findings that can.
What the rule does not do is settle the debate about how much discretion examiners should have. It moves the battleground from whether the term has a definition to how the definition applies case by case, which is where banking supervision has always lived.
Primary sources
- Federal Register notice 91 FR 56004, "Unsafe or Unsound Practices, Matters Requiring Attention."
- FDIC Financial Institution Letter 53-2026 for the redesignation and closure of existing MRBAs and supervisory recommendations.
- OCC and FDIC statements as summarized by the National Law Review and the Consumer Finance Monitor.