Implementation of the Final Rule on Unsafe or Unsound Practices; Matters Requiring Attention

Implementation of the Final Rule on Unsafe or Unsound Practices; Matters Requiring Attention Introduction The Federal Deposit Insurance Corporation (FDIC) is issuing this Financial Institution Letter (FIL) to summarize the agency’s supervisory and enforcement approach for implementing part 305. This FIL summarizes key aspects of the FDIC’s implementation of part 305 and should be reviewed in conjunction with the final rule, revised manuals, and other examination procedures listed below. Part 305 applies to the FDIC’s risk management, including specialty examination areas, and consumer protection examination and enforcement functions. The FDIC encourages financial institutions to confer with FDIC field and regional offices about the FDIC’s implementation of part 305 and how it impacts supervisory expectations and the conduct of examinations. The FDIC is committed to ensuring supervisory consistency across our examination functions. This FIL does not impose new regulatory requirements. Implementation efforts will continue over the coming months, including revisions to other materials, training initiatives, and further communication with supervised institutions. For examination reports issued after August 31, 2026, the FDIC is ending use of the terms Matters Requiring Board Attention (MRBAs) and Supervisory Recommendations (SRs) and will instead use the term Matters Requiring Attention (MRAs) in conformance with part 305 for supervisory criticisms. The forthcoming updates to the FDIC’s Risk Management Manual of Examination Policies and the Consumer Compliance Examination Manual will address changes related to finalization of part 305 and other regulatory changes. The FDIC is planning to issue broader revisions to the Risk Management Manual of Examination Policies and Consumer Compliance Examination Manual next year. Background On August 27, 2026, the FDIC and the Office of the Comptroller of the Currency issued a final rule defining the term “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818) and revising the supervisory framework for the issuance of MRAs and other supervisory communications. The final rule does not apply to enforcement actions brought against institution-affiliated parties (IAPs). The FDIC issued this final rule as part 305 (12 C.F.R. 305) of the FDIC’s rules and regulations, “Enforcement and Supervision Standards.” Under the final rule, an “unsafe or unsound practice” is defined as a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that: (1) Is contrary to generally accepted standards of prudent operation; and (2) (i) If continued, is likely to— (A) Materially harm the financial condition of the institution; or (B) Present a material risk of loss to the Deposit Insurance Fund (DIF); or (ii) Materially harmed the financial condition of the institution.

2 The final rule maintains a rigorous bank supervision program while deemphasizing focus on process and documentation issues that have a limited impact on safety and soundness or conformance with laws and regulations. In accordance with part 305, the FDIC may issue an MRA to an institution for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that: (1) (i) Is contrary to generally accepted standards of prudent operation; and (ii) (A) If continued, could reasonably be expected to, under current or reasonably foreseeable conditions, (1) Materially harm the financial condition of the institution; or (2) Present a material risk of loss to the DIF; or (B) Materially harmed the financial condition of the institution; or (2) Is an actual violation of a banking or banking-related law or regulation. As noted in the preamble to the final rule, the FDIC intends to exercise supervisory discretion when issuing MRAs for violations of banking or banking-related laws or regulations, limiting those MRAs to substantive violations. Violations may warrant an MRA where they demonstrate a pattern or are systemic; have or could reasonably be expected to have a more than minimal adverse impact on the institution’s financial condition, accuracy of books and records, or customers; require or could be reasonably expected to require more than minimal restitution; or involve insider misconduct or self￾dealing. The final rule clarifies that actual violations of banking or banking-related laws or regulations that are not considered MRAs are deemed “other violations.” The FDIC may require remediation of other violations and take other actions as required by applicable Federal or state law. The FDIC continues to emphasize a balanced approach to supervision that fairly and comprehensively assesses financial risk to institutions and the DIF as well as conformance with banking and banking-related laws and regulations. The FDIC will continue to tailor its supervisory activities and corrective programs to each institution’s size and complexity. Lookback Review of Outstanding Recommendations The FDIC has been working to reorient various aspects of bank supervision to focus on the risk of material financial harm, material risk of loss to the DIF, and actual violations of banking and banking￾related laws and regulations. If an institution has had an examination conducted by the FDIC in 2026 (during which examiners have generally been closing out recommendations that are inconsistent with the new approach), any outstanding MRBAs and SRs will be redesignated according to the newly-defined terms contained in the part 305 final rule. For all other FDIC-supervised institutions, the FDIC has completed a retrospective or “lookback” review to assess outstanding MRBAs or SRs to determine if they meet part 305 standards. In certain cases, the FDIC is coordinating with state

3 counterparts to determine the appropriate approach for FDIC-supervised institutions. At a minimum, the FDIC intends to provide each FDIC-supervised institution with a sense of what can be expected at its next FDIC examination or engagement with respect to previously issued MRBAs and SRs. After coordinating with state supervisors, all FDIC-supervised institutions will receive correspondence indicating which, if any, MRBAs or SRs will be redesignated as MRAs or closed out. If an MRBA or SR does not satisfy the “MRA” criteria under the final rule but includes a violation of banking-related law or regulation, the MRBA or SR will be closed out, and the violation of law or regulation will be redesignated as an “other violation” under the rule, which the institution would still be expected to remediate. MRA Implementation for FDIC Reports of Examination (ROEs) FDIC examinations and ROEs will adhere to part 305. Formal examination communications under which practices or conditions require remedial action will generally be presented as enforcement actions or MRAs, although institutions will still be required to remediate violations of law that do not rise to the level of an MRA. 1 Examiners will focus on evidence of risk of material financial harm, material risk of loss to the DIF, and substantive violations of banking and banking-related laws and regulations. Examiners will exercise judgement to determine what constitutes material harm to an institution’s financial condition or risk of loss to the DIF based on objective facts regarding the institution’s business model, activities, and other factors. Under part 305, harm to financial condition refers to financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk. The term “reasonably foreseeable,” under part 305, encompasses material financial harm that is not yet evident but is more than speculative based on current facts and circumstances. For example, poorly underwritten loans may not immediately default, as borrowers may make payments for some time before ceasing to pay. Therefore, it is important for the FDIC to continue identifying problems and require remediation before conditions deteriorate. Generally, ROE comments will be more concise going forward. MRAs will be presented in a standard ROE format with: a description of the issue; rationale for why material harm, risk of loss to the DIF, or an actual violation is present and requires remedial action; and the FDIC’s expectations for addressing each MRA. In addition to MRAs, ROE comments may also include compliance or conformance with enforcement actions or other directives/regulatory matters (e.g. Prompt Corrective Action directives, brokered deposit waivers). Supervisory Observations 1 The FDIC may also require remedial action under other statutory authorities, such as issuing Prompt Corrective Action directives.

4 Examiners can provide supervisory observations in an ROE to support ratings and examination conclusions. A supervisory observation is an informal observation that does not rise to the level of an MRA and that identifies weaknesses in an institution’s policies, practices, condition, or operations. Supervisory observations do not create a requirement or supervisory expectation that the supervisory observation will be presented to the institution’s board of directors or that the institution will take corrective action in response to the supervisory observation. Accordingly, examiners will present supervisory observations as fact-based statements supporting supervisory assessments and, potentially, supervisory ratings. As part of its initial lookback described above, the FDIC does not plan to convert any existing MRBAs or SRs into supervisory observations. The FDIC will use supervisory observations as a communication tool going forward. “Substantive Violations” As noted above and in the preamble to the final rule, the FDIC intends to exercise its supervisory discretion to issue MRAs for violations only in response to substantive violations of banking or banking-related laws and regulations. The FDIC can impose specific remediation requirements, including restitution, for such violations. “Substantive violations” will be included in the ROE’s Violations page. “Other Violations” An actual violation of a banking or banking-related laws or regulation for which the FDIC does not take an enforcement action or issue an MRA is considered an “other violation”. While MRAs will not be issued in response to other violations, there may be supervisory observations that reference the “other violation”, if warranted. The FDIC may require remediation of “other violations,” including restitution, and take any actions required by applicable Federal and state law. “Other violations” may be included in the ROE’s Violations page. Section 39 of the Federal Deposit Insurance Act Non-conformance with guidelines, such as the Interagency Guidelines Establishing Standards for Safety and Soundness (Appendix A to part 364), is not considered a violation of banking or banking￾related law or regulation, and non-conformance with Appendix A to part 364 will not, in and of itself, be used to require institutions to provide a Section 39 plan. The FDIC expects to require Section 39 plans only in rare cases, and only when a practice meets the MRA standard under part 305 and an MRA is issued (which could occur between examinations if necessary). Enforcement Actions Against Institutions The FDIC will only bring an enforcement action against an institution (for example, a cease-and￾desist order) based in whole or in part on alleged unsafe or unsound practices if the legal basis for

5 that action meets the standards concerning unsafe or unsound practices under part 305. The FDIC intends to limit enforcement actions against institutions for violations of banking and banking￾related laws and regulations to substantive violations. Enforcement actions against institution￾affiliated parties are not impacted by part 305. FDIC Examination Manuals and Other Documents With the finalization of part 305, the FDIC is issuing or revising the following: • Risk Management Manual of Examination Policies: o Chapter 1.1 - Basic Examination Concepts and Guidelines o Chapter 4.5 - Violations of Laws and Regulations o Chapter 16.1 - Report of Examination Instructions o Chapter 21.1 - Examination Planning • Example Risk Management ROE Pages: o Matters Requiring Attention o Examination Conclusions and Comments o Violations of Laws and Regulations • Consumer Compliance Examination Manual: o Chapter II-7 - Documenting the Examination o Chapter II-8 - Investigations and Visitations o Chapter II-11 - Appeals o Chapter V-9 - Home Mortgage Disclosure Act o Chapter V-17 - Small-Dollar Loans Additionally, the FDIC is rescinding the following: • Risk Management Manual of Examination Policies: o 17.1a Bank of Anytown – Current Expected Credit Losses o 17.1b Bank of Anytown – Non-Current Expected Credit Losses o 20.1 Risk-Focused, Forward-Looking Safety and Soundness Supervision • Consumer Compliance Examination Manual: o Chapter III-2 Bank of Anytown Examination Templates The FDIC will continue to rescind or revise outstanding agency issuances in the coming weeks, and work with state counterparts and the other federal banking agencies to ensure that interagency materials are consistent with part 305.