Matters Requiring Attention for Violations of Laws and Regulations

1 DEPARTMENT OF THE TREASURY Office of the Comptroller of the Currency 12 CFR Part 4 [Docket ID OCC-2026-0529] RIN 1557-AF56 Violations of Laws or Regulations AGENCY: Office of the Comptroller of the Currency (OCC), Treasury. ACTION: Notice of proposed rulemaking. SUMMARY: The Office of the Comptroller of the Currency (OCC) proposes to revise the supervisory framework for the issuance of matters requiring attention (MRAs) in response to violations of laws or regulations and for addressing violations for which the OCC does not take an enforcement action or issue an MRA. DATES: Comments must be received on or before [INSERT DATE 30 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. ADDRESSES: Commenters are encouraged to submit comments through the Federal eRulemaking Portal. Please use the title “Violations of Laws or Regulations” to facilitate the organization and distribution of the comments. You may submit comments by any of the following methods: • Federal eRulemaking Portal – Regulations.gov: Go to https://regulations.gov/. Enter Docket ID “OCC-2026-0529” in the Search Box and click “Search.” Public comments can be submitted via the “Comment” box below the displayed document information or by clicking on the document title and then clicking the “Comment” box on the top-left side of the screen. For help with submitting

2 effective comments, please click on “Commenter’s Checklist.” For assistance with the Regulations.gov site, please call 1-866-498-2945 (toll free) Monday-Friday, 9 a.m.-5 p.m. ET, or e-mail regulationshelpdesk@gsa.gov. • Mail: Chief Counsel’s Office, Attention: Comment Processing, Office of the Comptroller of the Currency, 400 7th Street, SW, Suite 1E-216, Washington, DC 20219. • Hand Delivery/Courier: 400 7th Street, SW, Suite 1E-216, Washington, DC 20219. Instructions: You must include “OCC” as the agency name and Docket ID “OCC￾2026-0529” in your comment. In general, the OCC will enter all comments received into the docket and publish the comments on the Regulations.gov website without change, including any business or personal information provided such as name and address information, e-mail addresses, or phone numbers. Comments received, including attachments and other supporting materials, are part of the public record and subject to public disclosure. Do not include any information in your comment or supporting materials that you consider confidential or inappropriate for public disclosure. You may review comments and other related materials that pertain to this action by the following method: • Viewing Comments Electronically – Regulations.gov: Go to https://regulations.gov/. Enter Docket ID “OCC-2026-0529” in the Search Box and click “Search.” Click on the “Dockets” tab and then the document’s title. After clicking the document’s title, click the “Browse All Comments” tab. Comments can be viewed and filtered by clicking on the “Sort By” drop-down on the right side of the screen or the “Refine Comments Results” options on the left side of the screen. Supporting materials

3 can be viewed by clicking on the “Browse Documents” tab. Click on the “Sort By” drop￾down on the right side of the screen or the “Refine Results” options on the left side of the screen checking the “Supporting & Related Material” checkbox. For assistance with the Regulations.gov site, please call 1-866-498-2945 (toll free) Monday-Friday, 9 a.m.-5 p.m. ET, or e-mail regulationshelpdesk@gsa.gov. The docket may be viewed after the close of the comment period in the same manner as during the comment period. FOR FURTHER INFORMATION CONTACT: Eden Gray, Assistant Director, Marjorie Dieter, Special Counsel, Anna Mills, Counsel, Harry Naftalowitz, Attorney, Chief Counsel’s Office, 202-649-5490, Office of the Comptroller of the Currency, 400 7th Street SW, Washington, DC 20219. If you are deaf, hard of hearing, or have a speech disability, please dial 7-1-1 to access telecommunications relay services. SUPPLEMENTARY INFORMATION: I. Background The OCC is responsible for assuring that institutions1 under its jurisdiction comply with applicable laws and regulations.2 A violation of law or regulation is an act or failure to act that deviates from, or fails to comply with, a statutory or regulatory requirement. If the OCC determines that an institution violated a law or regulation, the OCC communicates the violation to the institution and may require corrective action.3 On 1 For purposes of this SUPPLEMENTARY INFORMATION, the term “institution” refers to national banks, Federal savings associations, and Federal branches and agencies of foreign banks. See 12 CFR 4.92(a). 2 See, e.g., 12 U.S.C. 1(a), 1818(b)(1). 3 Through various statutory examination and reporting authorities, Congress has conferred upon the OCC the authority to exercise visitorial powers and examination authorities with respect to supervised institutions. Id. 481, 1463, 1464, 5412(b)(2)(B). The Supreme Court has indicated support for a broad reading of certain visitorial powers. The examination and visitorial powers authorize the OCC to issue

4 October 30, 2025, the OCC and FDIC (collectively, the agencies) proposed to issue a rule to, among other things, revise the supervisory framework for the issuance of MRAs (MRA proposal).4 The final rule related to the MRA proposal (MRA final rule) is published elsewhere in this issue of the Federal Register.5 The MRA proposal would have permitted the OCC to issue an MRA in response to a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that is an actual violation of a banking or banking-related law or regulation.6 The OCC solicited comment on various aspects of the MRA proposal, including the scope of the “banking and banking-related” standard and whether violations of laws or regulations must also present a reasonably foreseeable risk of or actual material harm to the financial condition of the institution. The OCC is issuing this proposed rulemaking that would, if finalized, further refine the standard for the issuance of MRAs for legal violations. As described below, the proposed rule would establish and define two categories of violations of laws or regulations: “substantive violations” and “technical violations.”7 The OCC would be permitted to issue an MRA in response to a substantive violation. For technical violations, the proposed rule would provide a mechanism other than MRAs to address MRAs. See, e.g., Cuomo v. Clearing House Ass’n, 557 U.S. 519 (2009); United States v. Gaubert, 499 U.S. 315 (1991); United States v. Phila. Nat’l Bank, 374 U.S. 321 (1963). 4 Unsafe or Unsound Practices, Matters Requiring Attention, 90 FR 48835 (Oct. 30, 2025). 5 See the interagency final rule titled Unsafe or Unsound Practices, Matters Requiring Attention published elsewhere in this issue of the Federal Register. 6 Unsafe or Unsound Practices, Matters Requiring Attention, 90 FR at 48849. The MRA proposal addressed and the MRA final rule addresses the issuance of MRAs in response to a practice, act, or failure to act, that is contrary to generally accepted standards of prudent operation and presents certain risks of material harm to the financial condition of the institution (including if the financial condition of the institution has already been materially harmed) or loss to the Deposit Insurance Fund. These aspects of the MRA standard are not proposed to be amended by this notice of proposed rulemaking. 7 The MRA final rule incorporates aspects of the substantive violation standard as a matter of policy. This proposal would establish a legally binding limit on the OCC’s ability to issue an MRA in response to a violation of a law or regulation.

5 these violations. The proposed distinction between substantive violations and technical violations would prioritize examiners’ and institutions’ attention on substantive violations, i.e., those violations that have a greater likelihood to impact the institution or its customers.8 The proposal would provide an effective mechanism to ensure that institutions comply with applicable laws and regulations, including substantive and technical violations. II. Description of the Proposed Rule To properly focus institution and examiner attention on the violations of law or regulation that are most critical to the prudent operation of a financial institution, the proposed rule would limit the issuance of MRAs addressing banking or banking-related violations of laws or regulations to substantive violations.9 The OCC expects that, generally, substantive violations would be limited to violations of banking or banking￾related laws, as opposed to laws that are unrelated to banking, like employment laws or zoning laws. The term “substantive violation” would replace the term “actual violation” in the OCC’s MRA standard. This substitution of terms would not permit the OCC to issue an MRA based on mere speculation that an institution violated a law or regulation or to prevent the potential violation of a law or regulation. Rather, the “substantive violation” qualification in the proposed rule would reserve the issuance of MRAs to violations that meet certain criteria. The OCC would still be required to explain the factual basis underlying the cited violation. 8 This prioritization of substantive violations is consistent with the OCC’s current practices. 9 The OCC requests comment on whether it should remove the term “banking or banking-related” from the MRA standard set forth in 12 CFR 4.92(c).

6 A new paragraph would be added to provide a general definition of a substantive violation. The paragraph would deem a violation of law or regulation to be substantive “if its nature, duration, frequency, or severity could meaningfully impact the institution or its customers.” The general definition of the term “substantive violation” would be followed by five categories to provide more concrete parameters as to what qualifies as a substantive violation.10 If a violation of law or regulation meets the criteria of any one of these five categories, the violation would support the issuance of an MRA. The violation must meet the criteria of at least one of the five categories to qualify as a substantive violation. The OCC believes that judicious use of MRAs will best position institutions to prevent harm to institutions and their customers, and the proposal would accordingly limit the scope of violations that would support the issuance of an MRA. The proposal would also preserve examiners’ discretion to use less formal supervisory mechanisms to address the violation of a law or regulation, if examiners believe such a mechanism would be effective in ensuring the violation ceases and is appropriately corrected. Systemic or Patterns of Violations First, violations that are systemic or constitute a pattern of violations would meet the definition of a substantive violation. Systemic violations of laws or regulations are violations that are widespread or prevalent within an institution or business line. Bank Secrecy Act (BSA) compliance program violations or pillar violations, such as a failure to designate an individual responsible for coordinating and monitoring day-to-day BSA compliance, would generally meet this criterion.11 A pattern of violations refers to 10 The MRA final rule grouped substantive violations into four categories. The criteria for a substantive violation would be unchanged by this proposal’s regrouping of substantive violations into five categories. 11 See 12 CFR 21.21.

7 repeated or ongoing violations, considering the number of violations and the length of time in which the violations occurred. For example, repeated failures to obtain an appraisal on properties securing higher-risk mortgages could support a finding of a pattern of violations, depending on the particular facts and circumstances, like the annual number of higher-risk mortgages the institution originates.12 Likewise, ongoing violations of the reporting requirements set forth in the Office of Foreign Assets Control’s regulations could support a finding of a pattern of violations, depending on the particular facts and circumstances, like the volume of transactions at the institution that trigger the reporting requirements.13 Isolated violations generally do not create a reasonable expectation of future violations and would accordingly be excluded from this category of substantive violations.14 Violations Impacting an Institution’s Financial Condition Second, a violation would be considered substantive if it has or could reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the institution’s financial condition. Whether the requisite impact could reasonably be expected, for this and other categories of substantive violations, requires more than a remote possibility that the impact will manifest. For example, the OCC expects that an institution’s purchase of low-quality assets from an affiliate, resulting in a violation of Regulation W, would generally meet this part of the definition.15 Hindsight may be informative, but it is not determinative of whether an impact to the financial condition of 12 See 15 U.S.C. 1639h. 13 See 31 CFR part 501 et seq. 14 Nonetheless, an isolated violation of a law or regulation could meet the criteria of other categories of substantive violations. 15 See 12 CFR part 223.

8 the institution could reasonably have been expected to materialize. Accordingly, where an institution has already experienced the requisite impact to its financial condition, the violation would be considered under this second category only if the impact was predictable. For example, if an institution suffered more than minimal deposit outflow after depositors discovered that the institution originated a small quantity of loans in violation of the Flood Disaster Protection Act, such an impact to the financial condition of the institution generally would not be considered predictable, and the violation would not be considered substantive under this second category. The second category of substantive violations would also require that the violation has a direct and clear impact to the financial condition of the institution.16 Mere correlations or attenuated connections between a violation of law and impact to the financial condition of an institution would not support the issuance of an MRA. As with all aspects of the OCC’s MRA standard, the OCC would use objective facts and sound reasoning to determine whether a violation of law had a direct and clear impact on an institution’s financial condition.17 Lastly, the requisite expected or actual impact under this second category of substantive violations would be a more than minimal impact on the institution’s financial condition. The OCC intends for the phrase “more than minimal impact” to include impact that would not be considered “material” under the material harm to the financial 16 Included in the requirement that a violation have a “direct” impact on the financial condition of the institution would be that the violation itself, as opposed to the regulatory response to the violation, must create the impact on the institution’s financial condition. Accordingly, a civil money penalty assessed in response to a violation of law would not provide the requisite impact to the financial condition of the institution to meet the criteria of this second category of substantive violations. 17 See 12 CFR 4.92(f). The proposal would redesignate the current paragraph (f) as paragraph (g).

9 condition of the institution prong of the MRA standard.18 However, de minimis impacts to the financial condition of an institution would not give rise to a substantive violation under this second category. The OCC would consider financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk as the relevant indicators of impact to an institution’s financial condition.19 Violations Impacting Institution Books and Records The third category of substantive violations would be violations that have had or could reasonably be expected to have a more than minimal impact on the accuracy of the institution’s books and records. As in the second category, a more than minimal impact is less than material but more than de minimis. For example, an inaccurate Consolidated Report of Condition and Income (Call Report) need not result in a change to an institution’s Prompt Corrective Action category for such a violation to be considered a substantive violation under this category.20 At the same time, Call Report inaccuracies are not per se substantive violations; whether the violation is substantive would be assessed by considering the relative and absolute impact of the inaccuracy, as well as other qualitative and quantitative factors the OCC deems appropriate. If an inaccuracy in a Call Report would be considered a “material misstatement or omission” under the Federal Financial Institutions Examination Council (FFIEC) guidance on whether an institution 18 See id. § 4.92(c)(1)(ii). Material harm to the financial condition of an institution is an otherwise sufficient basis for the issuance of an MRA. Considering the importance of compliance with applicable laws and regulations, the proposal would decrease the requisite harm to the financial condition of an institution needed for a violation to be deemed substantive and, in turn, support the issuance of an MRA. 19 See id. § 4.92(d). The proposal would redesignate paragraph (d) as paragraph (e), to clarify that the OCC’s definition of financial condition also applies to the second category of substantive violations. 20 See 12 U.S.C. 161.

10 must amend one or more Call Reports, such an inaccuracy would generally be considered a substantive violation.21 Violations Requiring Restitution or Impacting Customers The fourth category of substantive violations would be violations that require more than minimal restitution or could reasonably be expected to have a more than minimal adverse impact to customers. Whether an adverse impact or restitution is “more than minimal” would be determined in terms of the reasonably expected size of the restitution payments, degree of the adverse impact, and number of persons affected by the violation. Accordingly, under the proposal, restitution would be considered “more than minimal” both where a few customers are entitled to a large amount of restitution and where many customers are each entitled to a small amount of restitution. In the more than minimal restitution subcategory, the term “required” does not refer to the OCC’s authority to require restitution or a statutory mandate that restitution be paid. Rather, that term is intended to indicate that restitution is necessary to make the recipients whole. Whereas the more than minimal restitution subcategory focuses on financial harm to persons, the subcategory that covers violations reasonably expected to have a more than minimal adverse impact on customers includes both financial and nonfinancial impacts.22 For example, if an institution fails to establish or administer an adequate identity theft program in violation of the Fair Credit Reporting Act and its 21 See generally, Federal Financial Institutions Examination Council, Instructions for Preparation of Consolidated Reports of Condition and Income: FFIEC 031 and FFIEC 041 at A-1 to A-3 (Dec. 2025). However, the OCC expects that a Call Report inaccuracy would not meet the criteria of the third category of substantive violations unless the inaccuracy would be considered a “material misstatement or omission” under the FFIEC’s guidance. 22 For purposes of the proposal, the term “customer” refers to applicants, current customers, and former customers protected by applicable laws or regulations.

11 implementing regulations, the violation could have a more than minimal adverse impact on customers regardless of whether any financial impacts actually materialize.23 Insider Violations The fifth and final category of substantive violations are violations that involve insider misconduct or self-dealing. The prevention of such abuses is integral to safe and sound banking. Studies have found that insider abuses often contribute to an institution’s failure.24 Moreover, insider abuses corrode the public’s trust in the banking system.25 Accordingly, such violations would support the issuance of an MRA regardless of the size or prevalence of such violations at an institution. Examples of violations involving insider misconduct would include violations of any law or regulation perpetrated by an insider knowingly or for the benefit of the insider or the insider’s associate. Violations of laws or regulations that involve self-dealing include violations of Regulation O26 and, in some instances, section 22(e) of the Federal Reserve Act.27 Tailoring As with all aspects of the OCC’s MRA standard, the OCC would tailor the issuance of MRAs for substantive violations of laws or regulations based on the risks associated with an institution’s capital structure, complexity, activities, asset size, and any other financial risk-related factor that the OCC deems appropriate.28 The tailoring provision would not modify institutions’ compliance requirements for applicable laws or 23 See 12 CFR 41.90. 24 See GAO 94-88, Bank Insider Activities: Insider Problems and Violations Indicate Broader Management Deficiencies (insider abuses occurred in 175 institutions that failed in 1990 and 1991, 61 percent of all institutions that failed during that period); See also OCC, Comptroller’s Handbook: Insider Activities at 1 (Nov. 2013) (“Studies of bank failures have found that insider abuse—such as poor￾quality loans made and unjustified fees paid to directors and officers—often contributes to the failures.”). 25 See OCC, Comptroller’s Handbook: Problem Bank Supervision at 8 (Sept. 2021). 26 12 CFR 31.2 (OCC); 12 CFR part 215 (Federal Reserve Board). 27 12 U.S.C. 376. 28 12 CFR 4.92(e). The proposal would redesignate the current paragraph (e) as paragraph (f).

12 regulations, or permit any institutions to violate the law. Rather, the tailoring provision would enhance the OCC’s ability to provide the appropriate supervisory response to each violation, considering all relevant factors. For example, regarding substantive violations that constitute a pattern, the number of violations needed to establish a pattern would be assessed relative to the frequency of an institution’s activities that implicate compliance with a particular set of laws or regulations. A higher number of violations would generally be required to establish a pattern at a large institution than at a small institution. At the same time, the error rate threshold to establish a pattern of violations would be lower at a large institution than at a small institution. Additionally, regarding substantive violations that had a more than minimal impact on the financial condition of an institution, the tailoring provision would allow the OCC to undertake a more granular assessment of the impact to the financial condition of a large institution (e.g., the impact to a business line) and a less granular assessment of the impact to the financial condition of a small institution. The granularity of that assessment, among other tailoring factors, could affect whether the OCC would determine that an MRA is the appropriate supervisory mechanism to address that violation. Technical Violations The proposal also includes a new paragraph that establishes the OCC’s approach to violations for which the OCC does not take an enforcement action or issue a matter requiring attention.29 The OCC would refer to these violations as “technical violations.” 29 Under this proposal, the OCC could respond to a violation of a law or regulation with the issuance of a technical violation instead of an MRA, even if the violation would meet the criteria of a substantive violation.

13 This new paragraph would replace the OCC’s “other violations” paragraph in 12 CFR 4.92.30 The proposed rule would consider a violation of a law or regulation to be technical if the nature, duration, frequency, and severity of the violation could not meaningfully impact the institution and its customers. In other words, if a violation would not meet the criteria for a substantive violation, the OCC would deem the violation a technical violation. The proposed rule would permit the OCC to direct an institution to correct a technical violation, provided that the OCC would not specify the corrective action the institution must take or include other corrective actions unrelated to the violation. The proposed rule would also clarify that the OCC may direct an institution to take such other actions as are required by law, if any. To illustrate, if an institution, in violation of Regulation B, fails to provide a notice of incompleteness or notice of taking adverse action on an incomplete application to a credit applicant, the proposal would allow the OCC to require the institution to correct the violation without prescribing how to correct the violation. 31 However, the OCC would not require the institution to notify the OCC that it has corrected the Regulation B violation or provide to the OCC an action plan to track corrective actions taken by the institution. Generally, the OCC would document its finding of a technical violation but would not track whether an institution has corrected the violation. The institution would not be required to inform the OCC when the technical violation has been corrected. If one or 30 12 CFR 4.92(h) 31 See 12 CFR 1002.9(c).

14 more technical violations would later meet the criteria of a substantive violation, the OCC would then be permitted to issue an MRA. Noncompliance with Guidelines The proposal focuses on violations of laws and regulations. For noncompliance with guidelines set forth in the OCC’s Safety and Soundness Standards,32 the OCC believes that existing supervisory mechanisms provide the appropriate degree of examiner and institution focus on addressing such noncompliance.33 Accordingly, the OCC proposes to explicitly exclude noncompliance with the guidelines set forth in the OCC’s Safety and Soundness Standards from the definitions of substantive and technical violations. If noncompliance with the guidelines would later meet the criteria for the issuance of an MRA in response to a practice, act, or failure to act, that is contrary to generally accepted standards of prudent operation and presents certain risks of material harm to the financial condition of the institution, the OCC would then be permitted to issue an MRA. The OCC invites comment on whether there are other illustrative examples of guidelines the OCC should specify as being excluded from the definitions of substantive and technical violations. III. Request for Comments The agencies request feedback on all aspects of the proposed rule, including: Question 1: Are substantive violations of laws or regulations the appropriate scope of violations to support the issuance of an MRA? If so, should the OCC include any other categories of substantive violations of laws or regulations? 32 12 CFR part 30. 33 See, e.g., § 30.3.

15 Question 2: Should violations of applicable state laws or regulations support the issuance of an MRA? Question 3: Should the OCC revise the prefatory language to the definition of “substantive violation” to reflect both future impacts and impacts that have already materialized? Question 4: For the first category of substantive violations, what other factors should the OCC consider when determining whether violations of laws or regulations are systemic or constitute a pattern? Question 5: Is “more than minimal impact on the institution’s financial condition” the appropriate standard for substantive violations that could meaningfully impact the finances of an institution? If not, what standard would be appropriate, and why? Should the OCC use the words “harm to” instead of the words “impact on”? Should a greater degree of harm to the financial condition of an institution be required for a violation of law to be considered substantive under the second category of substantive violations? Question 6: For the third category of substantive violations, is “more than minimal impact on the accuracy of the institution’s books and records” the correct standard? If not, what standard would be appropriate, and why? Should the standards promulgated by the Financial Accounting Standards Board guide the OCC’s determination on whether a violation caused a more than minimal impact on the accuracy of an institution’s books and records, and if so, how? Question 7: Is “more than minimal restitution” the appropriate measure for the requisite restitution to find a substantive violation under the fourth category of substantive violations? If not, what standard would be appropriate, and why?

16 Question 8: Is “more than minimal adverse impact to customers” the appropriate standard to find a substantive violation under the fourth category of substantive violations? If not, what standard would be appropriate, and why? Should substantive violations include a violation that had or could reasonably be expected to have a “more than minimal adverse impact to the public”? If so, are there any limiting principles the OCC should incorporate into a “more than minimal adverse impact to the public” standard to ensure the OCC applies the standard appropriately? For example, should the OCC require that a violation had or be reasonably expected to have a “direct, clear, and predictable” more than minimal adverse impact to the public? Question 9: Should the OCC revise its tailoring provision codified at 12 CFR 4.92 to reflect or enhance this proposal? For example, should the OCC clarify the tailoring standard to explicitly state that the “more than minimal impact to the financial condition” standard or its alternative would be tailored to the risk factors of each institution? Should the OCC tailor the issuance of MRAs in response to insider violations? Question 10: Are there guidelines other than the safety and soundness standards set forth in the appendices to 12 CFR part 30 that have an existing supervisory mechanism to provide the appropriate degree of focus on addressing such noncompliance, and that the OCC should accordingly exclude from the substantive violation and technical violation standards? For example, should the OCC exclude the Interagency Guidelines for Real Estate Lending from the substantive violation and technical violation standards? Question 11: How, if at all, should the substantive violation or technical violation standards address credit write-ups and other related issues? Should examiners be

17 permitted to require an institution to assign a different credit risk rating to loans? Should examiners be permitted to require an institution to place a loan into nonaccrual status? Question 12: Is the proposed “technical violations” supervisory mechanism more appropriate than the OCC’s current “other violations” mechanism? Is the technical violations mechanism broader or narrower than the other violations mechanism, and if so, how? Question 13: Should the OCC remove the term “banking or banking-related” from the OCC’s MRA standard, codified at 12 CFR 4.92(c)? Does the proposed substantive violation standard appropriately define the scope of violations that would support the issuance of an MRA? Would removal of the term “banking or banking-related” better align with the proposed technical violations supervisory mechanism? Question 14: Should the OCC further clarify the actions the OCC may take in response to a technical violation to specify that the OCC may take any action required by law? Is the proposed clarification that the OCC may direct an institution that commits a technical violation to take such other actions required by law necessary? IV. Impact Analysis A. Introduction & Background The OCC is proposing a rule to revise the supervisory framework for the issuance of MRAs in response to violations of laws or regulations and for addressing violations for which the OCC does not take an enforcement action or issue an MRA. As discussed above, consistent with a policy adopted in the MRA final rule, the proposed rule would establish and define two categories of violations of laws or regulations: “substantive violations” and “technical violations.” The OCC would be permitted to issue an MRA in

18 response to a substantive violation, and the proposed rule would provide a mechanism other than MRAs to address technical violations. The proposed rule would prioritize examiners’ and institutions’ attention on substantive violations, i.e., those violations that have a greater likelihood to impact the institution or its customers. B. Parties Affected by the Proposed Rule The OCC currently supervises 986 institutions.34 Because all OCC-supervised institutions were subject to the supervisory and enforcement standards in effect immediately before the OCC proposed this rule, the rule would affect all 986 institutions the OCC supervises. C. Costs and Benefits i. Cost Savings from Decreased Regulatory Compliance Burden The proposed rule would, consistent with the OCC’s policy in the MRA final rule, result in several direct benefits to institutions, namely, cost and time savings. Additionally, the proposed rule does not impose new mandates or costs related thereto on institutions. Under the proposed rule, the OCC expects that it would cite fewer violations of laws or regulations as substantive, as defined under the proposed rule, resulting in the issuance of fewer MRAs. As a result, institutions would have fewer MRAs to address and remediate. Generally, the OCC expects that the costs and time required to remediate a violation can range from de minimis to significant. Although institutions must address and remediate all violations of laws or regulations, including technical violations, substantive violations cited in an MRA may have more significant remediation costs and 34 Based on data accessed using the Financial Institution Data Retrieval System (FINDRS) on July 29, 2026.

19 burden. For example, in response to an MRA, some institutions hire external consultants, for which hourly rates can range from between $300 to $1,200 an hour for top-tier firms  or $150 to $300 an hour for lower-tier firms, or financial advisory firms that charge institutions $250 to $550 per hour.35 To the extent that there may be less need for consultants, institutions may directly benefit from consultant cost savings. Institutions may incur other direct costs to successfully address MRAs, including increased hiring and retention of appropriately qualified employees, training for existing employees, time expenditure of employees (which may include time spent addressing MRAs, time by management and the board to review and approve changes made, time spent working with external consultants, time conducting internal audit verification, and time spent in partnership with the OCC in ongoing follow up communications and examinations specific to the issue), updating processes and procedures, and addressing the root cause of the substantive violation that is the basis of the MRA. Although institutions would also incur direct costs associated with addressing and remediating technical violations, the OCC expects these direct costs to be less than those necessary to address substantive violations because examiners would be limited to directing the institution to correct the technical violation and could not specify the corrective action the institution must take or include other corrective actions unrelated to the violation. While it would be difficult to precisely quantify the overall aggregate annual direct cost savings to institutions, the OCC expects that cost savings would be de 35 See Clancy Fossum, Embark, What are the Fees & Hourly Rates of Accounting Consulting Firms? (Nov. 13, 2019), https://blog.embarkwithus.com/what-are-the-fees-hourly-rates-of-accounting-consulting￾firms#:~:text=in%20each%20category.- ,Big%204%20Firms,global%20footprints%2C%20and%20charge%20accordingly.&text=Although%20Bi g%204%20fees%20in,be%20aware%20of%20before%20proceeding; Consulting Mavericks, Average Consulting Rates by Industry, https://consultingmavericks.com/start/other/average-consulting-rates-by￾industry/ (last visited Sept. 26, 2025).

20 minimis. In addition to the direct cost savings described above, institutions could potentially experience several indirect benefits, including clarity regarding, and consistent application of, MRA standards. ii. Costs and Benefits Relating to the Safety and Soundness of Institutions The proposed rule imposes no new mandates, and thus no direct costs, on institutions, and has a low probability of causing indirect costs to institutions. Regarding indirect costs, the narrowed MRA standard for violations of laws or regulations in the proposal could delay the identification of the root cause of technical violations of law or regulations. This delayed identification could result in higher costs to resolve certain issues or the occurrence of similar violations, although, in the OCC’s supervisory experience, most technical violations are not costly to remediate. Further, the OCC determined it is unlikely that the proposed rule will result in the delayed identification of violations that are likely to significantly impact the institution or its customers, which would be substantive violations. The OCC expects that the proposed rule would benefit safety and soundness as it would prioritize examiners’ and institutions’ attention on substantive violations, i.e., those violations that have a greater likelihood to impact the institution or its customers. Therefore, the OCC expects that the proposed rule would benefit safety and soundness and does not expect that the indirect costs of the narrowed MRA standard for violations of laws or regulations in the proposal to be more than de minimis. V. Regulatory Analyses A. Paperwork Reduction Act

21 The Paperwork Reduction Act of 199536 (PRA) states that no agency may conduct or sponsor, nor is the respondent required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. The OCC has reviewed this proposed rule and determined that it does not create any information collection or revise any existing collection of information. Accordingly, no PRA submissions to OMB will be made with respect to this proposed rule. B. Regulatory Flexibility Act Analysis The Regulatory Flexibility Act37 (RFA) requires an agency to consider the impact of its proposed rules on small entities. In connection with a proposed rule, the RFA generally requires an agency to prepare an Initial Regulatory Flexibility Analysis (IRFA) describing the impact of the rule on small entities, unless the head of the agency certifies that the proposed rule will not have a significant economic impact on a substantial number of small entities and publishes such certification along with a statement providing the factual basis for such certification in the Federal Register. An IRFA must contain: (1) a description of the reasons why action by the agency is being considered; (2) a succinct statement of the objectives of, and legal basis for, the proposed rule; (3) a description of and, where feasible, an estimate of the number of small entities to which the proposed rule will apply; (4) a description of the projected reporting, recordkeeping, and other compliance requirements of the proposed rule, including an estimate of the classes of small entities that will be subject to the requirements and the type of professional skills necessary for preparation of the report or record; (5) an identification, to the extent practicable, of all relevant Federal rules that may duplicate, overlap with, or conflict with 36 44 U.S.C. 3501–3521. 37 5 U.S.C. 601–612.

22 the proposed rule; and (6) a description of any significant alternatives to the proposed rule that accomplish its stated objectives. The OCC currently supervises 986 institutions (commercial banks, trust companies, Federal savings associations, and branches or OCC of foreign banks),38 of which approximately 602 are small entities under the RFA.39 In general, the OCC classifies the economic impact on an individual small entity as significant if the total estimated impact in one year is greater than 5 percent of the small entity’s total annual salaries and benefits or greater than 2.5 percent of the small entity’s total non-interest expense. Furthermore, the OCC considers 5 percent or more of OCC-supervised small entities to be a substantial number, and at present, 30 OCC￾supervised small entities would constitute a substantial number. Therefore, since the proposed rule would affect all OCC-supervised institutions, a substantial number of OCC-supervised small entities would be impacted. This proposed rulemaking imposes no new mandates, and thus no direct costs, on affected OCC-supervised institutions. Therefore, the Comptroller of the Currency certifies that the proposed rule would not have a significant economic impact on a substantial number of small entities. C. Unfunded Mandates Reform Act of 1995 38 Based on data accessed using the OCC’s Financial Institutions Data Retrieval System on July 29, 2026. 39 The OCC bases its estimate of the number of small entities on the Small Business Administration’s size thresholds for commercial banks and savings institutions, and trust companies, which are $850 million and $47 million, respectively. Consistent with the General Principles of Affiliation, 13 CFR 121.103(a), the OCC counted the assets of affiliated financial institutions when determining if it should classify an OCC￾supervised institution as a small entity. The OCC used average quarterly assets in December 31, 2025, to determine size because a “financial institution’s assets are determined by averaging the assets reported on its four quarterly financial statements for the preceding year.” See footnote 8 of the U.S. Small Business Administration’s Table of Size Standards.

23 The OCC has analyzed the proposed rule under the factors in the Unfunded Mandates Reform Act of 1995 (UMRA).40 Under this analysis, the OCC considered whether the proposed rule includes a Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year ($193 million as adjusted annually for inflation). Pursuant to section 202 of the UMRA,41 if a proposed rule meets this UMRA threshold, the OCC would need to prepare a written statement that includes, among other things, a cost-benefit analysis of the proposal. The UMRA does not apply to regulations that incorporate requirements specifically set forth in law. This proposed rulemaking imposes no new mandates—and thus no direct costs— on affected OCC-supervised institutions. The OCC, therefore, concludes that the proposed rule would not result in an expenditure of $193 million or more annually by State, local, and tribal governments, or by the private sector. Accordingly, the OCC has not prepared the written statement described in section 202 of the UMRA. D. Riegle Community Development and Regulatory Improvement Act of 1994 Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act of 1994, 12 U.S.C. 4802(a), in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, the OCC will consider, consistent with principles of safety and soundness and the public interest: (1) any administrative burdens that the proposed rule would place on depository institutions, including small depository institutions and customers of depository 40 2 U.S.C. 1531 et seq. 41 Id. 1532.

24 institutions; and (2) the benefits of the proposed rule. The OCC requests comment on any administrative burdens that the proposed rule would place on depository institutions, including small depository institutions, and their customers, and the benefits of the proposed rule that the OCC should consider in determining the effective date and administrative compliance requirements for a final rule. E. Providing Accountability Through Transparency Act of 2023 The Providing Accountability Through Transparency Act of 2023, 5 U.S.C. 553(b)(4), requires that a notice of proposed rulemaking include the internet address of a summary of not more than 100 words in length of a proposed rule, in plain language, that shall be posted on the internet website www.regulations.gov. The Office of the Comptroller of the Currency proposes to revise the supervisory framework for the issuance of matters requiring attention (MRAs) in response to violations of laws or regulations and for addressing violations for which the OCC does not take an enforcement action or issue an MRA. The proposal and the required summary can be found at https://www.regulations.gov by searching for Docket ID OCC-2026-0529 and https://occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/index￾proposed-issuances.html. F. Executive Orders 12866 and 14192 Executive Order 12866, titled “Regulatory Planning and Review,” as amended, requires the Office of Information and Regulatory Affairs (OIRA), Office of Management and Budget to determine whether a proposed rule is a “significant regulatory action” prior to the disclosure of the proposed rule to the public. If OIRA finds

25 the proposed rule to be a “significant regulatory action,” Executive Order 12866 requires the OCC to conduct a cost-benefit analysis of the proposed rule and for OIRA to conduct a review of the proposed rule prior to publication in the Federal Register. Executive Order 12866 defines “significant regulatory action” to mean a regulatory action that is likely to (1) have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, the President’s priorities, or the principles set forth in Executive Order 12866. OIRA has determined that this rulemaking is a “significant regulatory action” for purposes of Executive Order 12866. Section 3(a) of Executive Order 14192 requires an agency, unless prohibited by law, to identify at least ten existing regulations to be repealed when the agency publicly proposes for notice and comment or otherwise promulgates a new regulation. In furtherance of this standard, section 3(c) of Executive Order 14192 requires that the new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least ten prior regulations. This proposed rule, if finalized as proposed, is expected to be an E.O. 14192 deregulatory action. List of Subjects in 12 CFR Part 4

26 Administrative practice and procedure, Freedom of information, Individuals with disabilities, Minority businesses, Organization and functions (Government agencies), Reporting and recordkeeping requirements, Women. Authority and Issuance For the reasons set forth in the preamble, and under the authority of 12 U.S.C. 93a, chapter I of title 12 of the Code of Federal Regulations is proposed to be amended as follows: PART 4—ORGANIZATION AND FUNCTIONS, AVAILABILITY AND RELEASE OF INFORMATION, CONTRACTING OUTREACH PROGRAM, POST-EMPLOYMENT RESTRICTIONS FOR SENIOR EXAMINERS

1. The authority citation for part 4 continues to read as follows: Authority: 5 U.S.C. 301, 552; 12 U.S.C. 1, 93a, 161, 481, 482, 484(a), 1442, 1462a, 1463, 1464, 1467a, 1817(a), 1818, 1820, 1821, 1831m, 1831p-1, 1831o, 1833e, 1867, 1951 et seq., 2601 et seq., 2801 et seq., 2901 et seq., 3101 et seq., 3102(b), 3401 et seq., 3501(c)(1)(C), 5321, 5412, 5414; 15 U.S.C. 77uu(b), 78q(c)(3); 18 U.S.C. 641, 1905, 1906; 29 U.S.C. 1204; 31 U.S.C. 5318(g)(2), 9701; 42 U.S.C. 3601; 44 U.S.C. 3506, 3510; E.O. 12600, 52 FR 23781, 3 CFR, 1987 Comp., p. 235.
2. Amend § 4.92 by: a. In paragraph (c)(2), removing the words “an actual” and adding the words “a substantive” in their place; b. Removing paragraph (h); c. Redesignating paragraphs (d) through (g) as paragraphs (e) through (h); d. Adding a new paragraph (d);

27 e. In newly redesignated paragraph (f)(2) and paragraph (f)(3) introductory text, removing “(e)(1)” and adding in its place “(f)(1)”; f. In newly redesignated paragraph (g), removing “(e)” and adding in its place “(f)”; and g. Adding paragraphs (i) and (j). The additions read as follows: § 4.92 Enforcement and supervisory standards.

---

(d) Substantive violation of a law or regulation. A violation of a law or regulation is substantive if its nature, duration, frequency, or severity could meaningfully impact the institution or its customers. Substantive violations of a law or regulation must: (1) Be systemic, or constitute a pattern; (2) Have had or reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the institution’s financial condition; (3) Have had or reasonably be expected to have a more than minimal impact on the accuracy of the institution’s books and records; (4) Require more than minimal restitution or reasonably be expected to have a more than minimal adverse impact to customers; or (5) Involve insider misconduct or self-dealing.

---

(i) Clarification regarding technical violations. (1) Paragraphs (b) through (h) of this section do not apply to technical violations. (2) A technical violation is a violation of a law or regulation for which the OCC does not take an enforcement action or issue a matter requiring attention.

28 (3) The OCC may not direct an institution that commits a technical violation to take any action other than to correct the technical violation or such other actions as are required by law. (j) Clarification regarding noncompliance with guidelines. Noncompliance with the guidelines set forth in the appendices to 12 CFR part 30 is not a substantive violation under paragraph (d) of this section or a technical violation under paragraph (i) of this section. Jonathan V. Gould, Comptroller of the Currency.