Revised Policies and Procedures Manuals for Bank Enforcement Actions and Related Matters and Matters Requiring Attention

August 27, 2026 Page 1 of 30
PPM 5310-3
Section: Bank Supervision Subject: Bank Enforcement Actions
and Related Matters
To: Deputy Comptrollers, Department and Division Heads, District Counsel, and All Examining Personnel Purpose and Scope This Policies and Procedures Manual (PPM) issuance revises PPM 5310-3, “Bank Enforcement Actions and Related Matters,” dated May 25, 2023, which establishes general policies and procedures for Office of the Comptroller of the Currency (OCC) staff when the OCC takes enforcement actions against banks in response to violations of laws, regulations, final agency orders, conditions imposed in writing, or written agreements (collectively, violations); unsafe or unsound practices; and noncompliance with safety and soundness guidelines. This PPM uses the term “deficiencies” to refer to violations and unsafe or unsound practices; “deficiencies” does not refer to noncompliance with safety and soundness guidelines under 12 CFR 30. This PPM provides guidance on selecting the enforcement actions best suited to resolve a bank’s deficiencies or noncompliance with safety and soundness guidelines and promotes consistency while preserving flexibility for individual circumstances. This PPM applies to the supervision of all banks examined by the OCC. National banks, federal savings associations, and federal branches and agencies are collectively referred to as “banks” in this PPM. When necessary, types of banks are specifically distinguished or excepted. 1 This PPM does not address enforcement actions against institution-affiliated parties or other individuals, civil money penalty (CMP) actions, or actions to enforce securities laws. 2 This PPM also does not address conditions imposed in writing or operating agreements issued in the context of a bank’s licensing filing. 3 “Enforcement actions” as used in this PPM do not include restrictions 1 The principles in this PPM may be considered in taking an enforcement action against a third-party service provider. Examiners should consult with Chief Counsel’s Office staff in Enforcement (Enforcement) on these matters. 2 Refer to PPM 5310-13, “Institution-Affiliated Party Enforcement Actions and Related Matters”; PPM 5310-8, “Fast Track Enforcement Program”; PPM 5000-7, “Civil Money Penalties”; and PPM 5310-5, “Securities Activities Enforcement Policy.” 3 For the purposes of this PPM, a “licensing filing” means an application, notice, or other request submitted to the OCC under 12 CFR 5.

PPM 5310-3
August 27, 2026 Page 2 of 30 imposed by the OCC in response to a bank’s licensing filing or by operation of law (for example, mandatory restrictions pursuant to prompt corrective action or consequences of being in “troubled condition” under 12 CFR 5). This PPM provides internal OCC guidance and does not create substantive or procedural rights enforceable at law or in any administrative proceeding. This PPM also does not supersede or limit the applicability of any other OCC policy that may provide more explicit guidance or establish supplemental procedures applicable to bank enforcement actions or treatment of supervisory or licensing issues arising from the various specialty areas (for example, consumer protection, Bank Secrecy Act (BSA)/anti-money laundering (AML), asset management, or information technology). This PPM is subject to future revision based on any changes in applicable law or regulation.

PPM 5400-11
August 27, 2026 Page 3 of 30
Contents
I. Introduction .......................................................................................................................... 4
II. Types of Bank Enforcement Actions ................................................................................... 4
III. Escalation and Tailoring Framework ................................................................................... 5
A. Informal Enforcement Actions ........................................................................................... 6
1. Memorandum of Understanding..................................................................................... 6
2. Individual Minimum Capital Ratios ............................................................................... 7
B. Formal Enforcement Actions.............................................................................................. 8
1. Cease-and-Desist Order .................................................................................................. 8
2. Capital Directives............................................................................................................ 8
C. Resolution ........................................................................................................................... 8
IV. Content of Bank Enforcement Actions ................................................................................ 9
V. Follow-Up Activities ............................................................................................................ 9
VI. Assessing and Communicating Compliance With Bank Enforcement Actions................... 10
A. Assessing Compliance ...................................................................................................... 10
B. Communicating Compliance ............................................................................................ 11
VII. Terminating or De-Escalating an Enforcement Action...................................................... 12
VIII. Noncompliance With Formal Enforcement Actions.......................................................... 12
IX. 12 CFR 30 Notices of Deficiency and Safety and Soundness Orders................................ 12
X. Formal Investigations......................................................................................................... 13
XI. Timeliness of Bank Enforcement Actions.......................................................................... 14
XII. Documentation in OCC Supervisory Information Systems............................................... 14
XIII. Public Disclosure of Bank Enforcement Actions............................................................... 15
XIV. Disclosure by Banks........................................................................................................... 16
XV. Further Information ............................................................................................................ 16
Appendix A: Informal Enforcement Actions Against Banks....................................................... 17
Appendix B: Formal Enforcement Actions Against Banks.......................................................... 19
Appendix C: Bank Enforcement Action Processes and Time Frames ......................................... 23
Appendix D: Mandatory and Discretionary Provisions Under PCA............................................ 26
Appendix E: Abbreviations........................................................................................................... 28
Appendix F: References................................................................................................................ 29

PPM 5310-3
August 27, 2026 Page 4 of 30
I. Introduction
The OCC primarily uses enforcement actions against banks to require banks to take timely actions to correct deficiencies and, in certain instances, noncompliance with safety and soundness guidelines. Bank enforcement actions can also enhance the OCC’s position for timely and orderly resolution or receivership to protect the Deposit Insurance Fund. The OCC follows three guiding principles when considering a bank enforcement action:
escalation, tailoring, and focus on the actions essential to correcting specific deficiencies. First, the OCC’s response is generally escalatory 4 and provides banks an opportunity to remediate deficiencies, both before escalation to an enforcement action and before escalation to a more severe action. Further, the appropriate supervisory or enforcement response to a deficiency should focus on requiring the bank to take corrective action with the least degree of OCC intervention that is reasonably necessary for the bank to remediate the deficiency. Second, the OCC tailors the type of enforcement action, the speed of escalation, and the contents of the accompanying corrective actions to the specific bank’s financial risk-related factors, including the risks associated with the bank’s capital structure, complexity, activities, asset size, and any other financial risk-related factors. The OCC’s enforcement approach reflects the increased regulatory and supervisory expectations for large or complex banks. For example, the OCC may escalate to an enforcement action against a large or complex bank based on practices that would not trigger a similar response against a community bank. Further, the OCC may escalate to an enforcement action more quickly with respect to larger or more complex banks. Third, the OCC issues focused bank enforcement actions with corrective actions targeted to correct specific deficiencies. A bank enforcement action should contain only those corrective actions necessary to remediate the deficiencies. Corrective actions should not elevate the bank’s process and procedure over substance or impose requirements on the bank unrelated to the core purpose of the enforcement action. Overall, examiners should use objective facts and sound reasoning when considering an enforcement action, including when determining whether to take an action, the appropriate type of enforcement action, and the corrective actions required. Regardless of the general approach outlined in this framework, however, the OCC may take any legally supportable enforcement action, at any time, as circumstances warrant. Examiners must consult Enforcement in the Chief Counsel’s Office when considering recommending an enforcement action against a bank and Enforcement must ensure the action has sufficient legal and factual support.
II. Types of Bank Enforcement Actions
Enforcement actions against banks can be informal or formal.
4
In exigent circumstances, such as where bank failure may occur, an escalatory approach may not be appropriate.

PPM 5310-3
August 27, 2026 Page 5 of 30
Informal enforcement actions are typically not published or made available to the public.
Appendix A of this PPM contains a complete list of informal bank actions with descriptions of
the types of informal actions the OCC may issue. Primary examples of informal bank enforcement actions include memorandums of understanding (MOU) and individual minimum capital ratios (IMCR), which are discussed within the escalation and tailoring framework in
Section III of this PPM, and notices of deficiency under 12 CFR Part 30, which are discussed in
Section IX of this PPM.
Formal bank enforcement actions are more severe than informal bank enforcement actions. Formal bank enforcement actions generally are published or made available to the public and many are enforceable through the federal court system. 5 In addition, violation of a formal bank enforcement action can provide the legal basis for CMP assessments. 6 Appendix B of this PPM contains a complete list with descriptions of the types of formal bank enforcement actions the OCC may issue. Primary examples of formal enforcement actions include cease-and-desist (C&D) orders 7 and capital directives, which are discussed within the escalation and tailoring framework in Section III of this PPM, and safety and soundness orders, which are discussed in
Section IX of this PPM.
III. Escalation and Tailoring Framework
The OCC generally provides banks an opportunity to resolve supervisory issues through the supervisory process before considering an enforcement action. Examiners may issue matters requiring attention (MRA) when they identify a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that 8

• is contrary to generally accepted standards of prudent operation; and
  − if continued, could reasonably be expected to, under current or reasonably foreseeable conditions,
• materially harm the financial condition of the bank; or
• present a material risk of loss to the Deposit Insurance Fund; or
  − materially harmed the financial condition of the bank; or
• is a substantive violation of a banking or banking-related law or regulation.
  Additional information on violations of law and matters requiring attention can be found in PPM 5400-11, “Matters Requiring Attention.” Examiners may communicate supervisory observations to enhance a bank’s policies, practices, condition, or operations, but the communication should clearly state that the observations do not require corrective action by the bank. 5 Refer to Appendix B of this PPM for more information. 6 See, e.g., 12 USC 1818(i)(2)(A)(ii). 7 A C&D order secured by the consent of the subject bank’s board is generally referred to as a consent order. 8 PPM 5400-11, “Matters Requiring Attention.”

PPM 5310-3
August 27, 2026 Page 6 of 30
An unsafe or unsound practice may support the OCC initiating a C&D action against a bank. An unsafe or unsound practice is a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that

• is contrary to generally accepted standards of prudent operation; and
  – if continued, is likely to
• materially harm the financial condition of the bank; or
• present a material risk of loss to the Deposit Insurance Fund; or
  – materially harmed the financial condition of the bank.
  The OCC’s bank enforcement response generally follows an escalatory path, providing banks an opportunity to remediate deficiencies before escalation to an enforcement action or to a more severe enforcement action. Notwithstanding this general approach, the OCC may take any legally supportable enforcement action, at any time, as circumstances warrant. When the OCC escalates to a bank enforcement action, the OCC tailors the enforcement action to correct identified deficiencies at the specific bank. When making escalation and tailoring decisions, the OCC considers the following:
• Management’s willingness and ability to correct the deficiencies. When bank
  management has a demonstrable history of correcting identified deficiencies, or when management has already commenced reasonable and prompt remediation efforts, escalation to an enforcement action or a more severe enforcement action may be unnecessary.
• Risk associated with the bank’s asset size, capital structure, complexity, activities, and
  any other financial risk-related factor. The OCC tailors its enforcement approach, including the form of the enforcement action, the corrective actions required in it, and the speed of escalation to reflect the increased regulatory and supervisory expectations for large or complex banks.
• Objective facts and sound reasoning. Examiners should use objective facts and sound
  reasoning to determine not only whether to escalate to an enforcement action, but also the appropriate type of enforcement action. A. Informal Enforcement Actions This section of the PPM discusses informal enforcement actions. If a bank fails to remediate the deficiencies in response to an informal enforcement action, the OCC may determine escalation to a formal enforcement action is warranted.

1. Memorandum of Understanding
   Escalation to an informal enforcement action may be appropriate when a bank has failed to correct, in a timely manner, an MRA based on actual or reasonably expected material harm to the financial condition of the bank or a material risk of loss to the Deposit Insurance Fund.

PPM 5310-3
August 27, 2026 Page 7 of 30
When escalating to an informal enforcement action, the OCC generally seeks to enter into an MOU with the bank, unless requiring individual minimum capital ratios through an IMCR is more appropriate. As discussed in the “Individual Minimum Capital Ratios” section of this PPM, an IMCR may also be used in conjunction with an MOU. An MOU generally is not appropriate if the bank has engaged in an unsafe or unsound practice or a substantive violation of law. In addition, the OCC considers risks associated with the bank’s capital structure, complexity, activities, asset size, and any other financial risk-related factors of the bank that the OCC deems appropriate (e.g., escalation to a formal enforcement action may be appropriate to address an issue at a larger or more complex bank whereas a similar practice at a smaller or less complex bank might be appropriately addressed through an informal action).
2. Individual Minimum Capital Ratios
An IMCR may be appropriate when the OCC’s primary concern is a bank’s capital relative to its risk profile. The OCC may issue an IMCR in one or more of the following situations:

• The bank’s leverage ratio, as calculated in accordance with 12 CFR 3, subpart B, is less than
  8 percent or the bank’s Capital component rating is 3 or worse.
• The bank’s composite rating is 4 or worse or at least two of the bank’s Asset Quality,
  Liquidity, Earnings, or Sensitivity to Market Risk component ratings are 4 or worse.
• There are specific reasons for the OCC to believe that the bank’s capital is misstated and
  likely to significantly decrease (e.g., a severely understated allowances for credit losses due to risk rating downgrades, initial discovery of significant fraud, or other significant books and records concerns).
• The OCC has concerns, based on objective facts, that a specific risk will begin to materialize
  in the near future and significantly decrease the bank’s capital to below an 8 percent leverage ratio, and the OCC has issued a related MRA. To begin the IMCR process, the OCC sends a bank a notice of intent to establish higher minimum capital ratios, which includes the proposed capital ratios, the date they must be reached, and an explanation of why the OCC considers the proposed ratios necessary or appropriate for the bank. After an opportunity for the bank to respond to the notice, the OCC implements the IMCR through a notification of establishment of higher capital ratios. At each follow-up activity, examiners must assess whether maintaining the IMCR is necessary in light of the bank’s present circumstances. IMCRs are intended to correct a capital shortfall but are not intended to remain in perpetuity on a bank. Supervision must clearly articulate the specific concerns that warrant maintaining an IMCR that exceeds 18 months in duration and must obtain approval to maintain the IMCR from the appropriate decision maker. If a bank is unable to maintain sufficient capital after issuance of an IMCR, the OCC considers escalating to a Capital Directive or other formal enforcement action. If a bank exhibits deficiencies in areas other than capital, another type of enforcement action may be more appropriate than issuing an IMCR, or another type of enforcement action may be issued in addition to an IMCR.

PPM 5310-3
August 27, 2026 Page 8 of 30
B. Formal Enforcement Actions
This section of the PPM discusses formal enforcement actions.

1. Cease-and-Desist Order
   When escalating to a formal bank enforcement action, the OCC generally seeks a C&D order. A C&D order is enforceable in federal district court, and violations of a C&D order can provide the legal basis for additional enforcement actions, including CMPs. A willful violation of a C&D order is grounds for receivership. A C&D order may be appropriate when a bank has engaged in an unsafe or unsound practice; a substantive violation, 9 as defined in PPM 5400-11; or a violation of a condition imposed in writing, final agency order, or written agreement. 10 Although the OCC generally seeks a C&D order when escalating to a formal enforcement action, in some instances the OCC may decide to pursue other enforcement actions. Additionally, the OCC is legally required to initiate a formal enforcement action in certain circumstances. 11
2. Capital Directives
   Escalation to a capital directive 12 may be appropriate when a bank fails to achieve the capital ratios required by an IMCR within a reasonable time. There may be limited circumstances when immediate escalation to a capital directive (without issuing an IMCR first) is appropriate. In addition, if a bank exhibits deficiencies in areas other than capital, another type of enforcement action may be more appropriate than a capital directive. Finally, the OCC may issue a prompt corrective action directive when a bank is undercapitalized and must issue such a directive when a bank is significantly undercapitalized, or critically undercapitalized, as defined in applicable law. 13
   C. Resolution
   The OCC has the authority to place a bank into conservatorship or receivership on any one of several grounds, including, for Federal Deposit Insurance Corporation (FDIC)-insured banks, when the bank has tangible equity capital of two percent or less. Under certain circumstances, the OCC may initiate resolution by placing a bank into receivership or conservatorship, or requiring 9 12 USC 1818 does not limit the OCC’s authority to initiate enforcement actions based on a violation of a law, a rule, or a regulation by subject matter or severity. By focusing bank enforcement actions on substantive violations, the OCC exercises its discretion to prioritize among supervisory objectives. 10 For purposes of 12 USC 1818, an MOU is not considered a “condition imposed in writing, final agency order, or written agreement.” 11 See e.g., 12 USC 1818(s) (mandatory C&D order for certain BSA cases); 12 USC 24a(e)(2) and (3) (Gramm￾Leach-Bliley Act). 12 12 USC 3907(b)(2); 12 USC 1464(s); 12 CFR 3, Subpart J. 13 12 USC 1831o.

PPM 5310-3
August 27, 2026 Page 9 of 30 its sale, merger, or liquidation before the bank becomes insolvent or has tangible equity capital of 2 percent or less. 14
IV. Content of Bank Enforcement Actions
The OCC develops focused bank enforcement actions targeted at correcting specific deficiencies. Bank enforcement actions must address deficiencies documented in a related formal written communication or otherwise uncovered during an examination or investigation. MRAs may be escalated into a bank enforcement action. Once the OCC determines the deficiencies that must be addressed in the bank enforcement action, the enforcement action must

• include a description of the facts and legal basis for action (for public enforcement actions).
• specifically state any requirements placed on the bank and list any restrictions or limitations
  on the bank’s activities.
• contain only those requirements necessary to remediate the deficiency.
• assign deadlines by which the bank must act, complete any corrective actions, or be subject
  to restrictions or limitations on activities.
  Corrective actions in a bank enforcement action should not elevate the bank’s process and procedure over substance or include requirements unrelated to the core purpose of the enforcement action. Bank enforcement actions must be appropriately tailored to address the specific deficiencies at the bank. While a bank enforcement action is designed to prompt the bank to correct a deficiency, bank management and the board have the discretion and the responsibility to determine how best to achieve compliance with required corrective actions. Bank enforcement actions should generally be drafted using standard introduction, closing, and other language provided by the OCC’s Director for Enforcement, but they must be tailored to address the specific deficiencies of the bank. Bank enforcement actions must be drafted by or in consultation with Enforcement.
  V. Follow-Up Activities
  The OCC’s timely assessment and written feedback on a bank’s progress toward compliance with a bank enforcement action is critical to helping the board and management understand the requirements of the enforcement action and achieve timely compliance. The bank’s success or failure in complying with an enforcement action and the impact on the bank from continuation of the deficiencies should be thoroughly documented in the OCC’s supervisory information systems. Some enforcement actions include requirements for the submission of corrective action plans to the OCC for prior written determination of no supervisory objection (NSO). When assessing a required corrective action plan, examiners should consider the specific enforcement action requirements and the bank’s asset size and complexity. Banks have discretion to tailor corrective 14 See 12 USC 1821(c)(5); 12 USC 1831o (FDIC-insured banks only).

PPM 5310-3
August 27, 2026 Page 10 of 30 action plans appropriately. Examiners should not use requirements for corrective action plans to expand the scope of corrective actions beyond what is necessary to remediate the deficiencies addressed by the enforcement action. A determination of NSO should generally be reached within 30 days of submission of the corrective action plan. The OCC’s supervisory strategies for banks with enforcement actions must include plans for examiner follow-up. The plans must include activities to monitor progress and validate the effectiveness of the board’s and management’s corrective actions. Plans must include the timing, expertise, and resource requirements. If the enforcement action requires an action plan, examiners must perform the first assessment of a bank’s compliance with an enforcement action within 90 days of the action plan receiving a determination of NSO. If the enforcement action does not require an action plan, examiners must perform the first assessment of a bank’s compliance with an enforcement action within 120 days of execution. While the enforcement action remains outstanding, examiners must assess compliance with the enforcement action at least once within the bank’s supervisory cycle. Examiners should work with banks to determine when the bank expects to complete corrective actions and subsequently determine the earliest point at which corrective actions can be validated. The timing of follow-up activities should be aligned to corrective action due dates and the bank’s action plans. When a bank’s corrective actions are ready to be assessed, the OCC determines whether the corrective actions can be validated. When examiners validate a corrective action, they must determine that the bank has implemented the expected corrective action and that it is effective. When performing validation activities to confirm effectiveness of corrective actions in a bank enforcement action, examiners must substantially rely on applicable work performed by a bank’s internal audit when that function is rated satisfactory. Examiners cannot require a bank to add corrective action validation to an audit scope solely for the purpose of OCC reliance on audit’s work. If the OCC has specific audit concerns with a risk area despite a satisfactory overall rating for audit, examiners may request limited additional information outside of audit workpapers to confirm the effectiveness of the corrective action and assess if audit has improved coverage for that risk area. When corrective actions have been implemented and their effectiveness validated, articles will be considered and labeled “in compliance.”
VI. Assessing and Communicating Compliance With Bank Enforcement Actions
This section discusses assessing compliance with enforcement actions and providing written communications to banks regarding enforcement action compliance. A. Assessing Compliance Upon completing follow-up activities, examiners must determine whether the bank has met the requirements of each article of an outstanding enforcement action and designate the article as “in compliance” or “not in compliance.”

PPM 5310-3
August 27, 2026 Page 11 of 30
When an article is designated “in compliance,” the bank has adopted and implemented the corrective actions necessary to remediate the specific deficiencies addressed by the article, and the OCC has validated, with substantial reliance on a bank’s internal audit or otherwise, the corrective actions. Articles that are “in compliance” may fall out of compliance and be designated “not in compliance” at any time the bank enforcement action remains outstanding. When an article is designated “not in compliance,” the board and management have failed to cease activities prohibited by the article or adopt or implement the corrective actions required by the article. B. Communicating Compliance Examiners must provide written communication to the bank after completing follow-up activities, or in response to a bank’s submission or request, as described in this section. Reports of examination and supervisory letters, as applicable, that discuss compliance with a bank enforcement action must include a “Compliance with Enforcement Actions” section. This section should be tailored to the scope of the follow-up activity and must include the following:

• A table that states the status (that is, in compliance or not in compliance) of each actionable
  article, as appropriate.
• A write-up for each actionable article that includes
  − a summary of the article’s requirements. 15
  − status of the actions required.
  − commitment, if applicable.
  Write-ups for articles that are in compliance are optional when the article was also communicated as being “in compliance” in a previous written communication, unless material information regarding the article or management or the board’s actions have changed since the prior communication. The annual report of examination for banks under continuous supervision 16 may summarize the status of bank enforcement action articles and reference relevant formal written communications that occurred throughout the supervisory cycle. Write-ups for articles should be included if the
  article’s status has changed since the prior formal written communication.
  15 A summary of the article’s requirements must be included in the first formal communication that discusses compliance with the enforcement action. Thereafter, reference to the communication with the summary can be made in subsequent communications and must be included in the annual report of examination. 16 Banks under continuous supervision include Regional and Midsize Financial Institutions, Large and Global Financial Institutions, and some large community banks. Banks under continuous supervision receive supervisory letters communicating the results of targeted examinations throughout the supervisory cycle and an annual report of examination that aggregates the results of all supervisory activities and conveys the bank’s CAMELS or ROCA ratings.

PPM 5310-3
August 27, 2026 Page 12 of 30
VII. Terminating or De-Escalating an Enforcement Action
The OCC terminates a bank enforcement action once the bank has achieved substantial compliance with an enforcement action. “Substantial compliance” means the bank has satisfied the essential requirements of the order even if minor, isolated requirements have not been fully satisfied. In other words, an enforcement action can be terminated when, in the examiner’s judgment, the deficiency has substantively been cured, even if the bank has not satisfied all technical requirements of the action. Additionally, the OCC can terminate a bank enforcement action if it determines the enforcement action is no longer necessary to achieve agency objectives or the action has become outdated or irrelevant to the bank’s circumstances. The OCC can also modify or de-escalate a bank enforcement action when a portion of the action is no longer necessary or has become outdated or irrelevant, or the bank has substantially remediated portions of the enforcement action. These options to terminate, modify, or de-escalate an enforcement action may be appropriate when the bank’s condition and risk profile have significantly improved and the form of the existing enforcement action is inconsistent with the nature and extent of the bank’s condition, risk profile, and deficiencies or the facts that led to escalation are no longer present.
VIII. Noncompliance With Formal Enforcement Actions
When a bank fails to comply with a formal bank enforcement action, the OCC considers whether additional actions are appropriate. Such actions could include CMPs, enforcement actions against the board or management, or a more severe formal enforcement action against the bank. The OCC also considers CMPs, as appropriate, in conjunction with other types of enforcement actions described in this PPM. If a bank does not comply with a C&D order, the OCC may initiate a proceeding in district court. The determination as to whether and how to enforce a C&D order should be made on a case-by￾case basis, following consultation with the applicable decision makers.
IX. 12 CFR 30 Notices of Deficiency and Safety and Soundness Orders
Pursuant to 12 USC 1831p-1 and 12 CFR 30, the OCC has authority to determine that a bank has failed to comply with the safety and soundness standards in 12 CFR 30. This authority is separate from the authority to issue informal and formal enforcement actions that address unsafe or unsound practices, violations, or failure to comply with a written condition or agreement as discussed throughout this PPM. The OCC does not consider noncompliance with safety and soundness standards established in 12 CFR 30 a violation of law for purposes of this PPM or 12 USC 1818. When a bank fails to comply with applicable safety and soundness standards, the OCC may require the submission of a safety and soundness plan by issuing an enforcement action in the form of a notice of deficiency. For example, a notice of deficiency may be appropriate where a bank exhibits serious, systemic, or repeat information technology or information security deficiencies that must be addressed but are not likely to result in material financial harm to the

PPM 5310-3
August 27, 2026 Page 13 of 30 bank. The OCC may also issue a notice of deficiency to a bank to resolve deficiencies in certain discrete areas, such as BSA/AML deficiencies at a bank that do not require initiation of a C&D action pursuant to 12 USC 1818(s). A notice of deficiency also may be appropriate for a large or complex bank where serious internal control deficiencies or risk management deficiencies exist, but those deficiencies may not otherwise constitute unsafe or unsound practices or meet the MRA standard. If a bank has not submitted a safety and soundness plan in response to a notice of deficiency or has failed to adhere to its safety and soundness plan, the OCC may unilaterally escalate to a safety and soundness order, pursuant to 12 USC 1831p-1 and 12 CFR 30. When considering the path to escalation to a notice of deficiency under 12 CFR 30, examiners should keep in mind the general preference to resolve issues through the supervisory process where appropriate prior to initiating an enforcement action. In addition, the principles in Sections IV through VII of this PPM related to the content of an enforcement action, follow-up activities, assessing and communicating compliance, and terminating enforcement actions also apply to enforcement actions taken pursuant to 12 CFR 30.
X. Formal Investigations
In most cases, documents and information may be obtained from the bank by the OCC pursuant to its examination authority. A formal investigation, initiated pursuant to an order of investigation (OOI), however, may be appropriate when the OCC’s examination authority is not sufficient to obtain documents or other information needed to accomplish OCC objectives, including determining whether (or to what extent) there has been misconduct by or at a bank. 17 For example, a formal investigation is generally appropriate when sworn testimony is needed, or when subpoenas are needed to obtain documents from sources outside the bank. The formal investigation is a supplement to, and not a replacement for, the OCC’s examination process. Under an OOI, the OCC may issue subpoenas to obtain documents and sworn testimony. The OCC may issue document subpoenas to institution-affiliated parties and to third parties (i.e., individuals and entities not directly affiliated with the bank). The OCC may also issue subpoenas to obtain sworn testimony (under oath, transcribed by a court reporter) from institution-affiliated parties or other individuals, who may be subject to criminal penalties if they do not testify accurately and honestly. Pursuant to 12 CFR 19.181, information and documents obtained or used in the formal investigation are confidential (i.e., non-public OCC information). If the supervisory office determines that a formal investigation may be appropriate, it must consult with Enforcement. The supervisory office and Enforcement should consider the need for, scope of, and resource requirements for any investigation. If the supervisory office and Enforcement determine that there is a basis for initiating a formal investigation, the supervisory 17 Orders of investigation are conducted pursuant to 12 USC 481 (national banks), 12 USC 1464(d) (federal savings associations), 12 USC 1817(j), 12 USC 1818(n), 12 USC 1820(c), 12 USC 3102(b) (federal branches and agencies), 12 USC 3108(a) and (b) (federal branches and agencies), 12 USC 3110 (federal branches and agencies), and 12 CFR 19.180–184.

PPM 5310-3
August 27, 2026 Page 14 of 30 office (together with Enforcement) must obtain the necessary approval from the appropriate decision maker. Upon the initiation of a formal investigation, Enforcement and the supervisory office should prepare an investigative plan. Formal investigations should be conducted with a clear supervisory objective and a realistic strategy for achieving that objective. Accordingly, investigative plans must focus on specific issues, describe investigatory steps, include time frames and anticipated resources for completion, and be updated periodically as necessary. Formal investigations are often resource-intensive and require ongoing supervisory and legal attention. While the goal of investigations is to gain a complete understanding of the relevant conduct or transactions, investigations should nonetheless be conducted efficiently. Upon completion of an investigation, the supervisory office together with Enforcement must determine whether to recommend any enforcement action based on the findings to the appropriate decision maker and proceed accordingly. Finally, upon completion of a formal investigation, the supervisory office together with Enforcement must seek approval from the appropriate decision maker to terminate the order of investigation.
XI. Timeliness of Bank Enforcement Actions
When the OCC decides to escalate to an enforcement action or a more severe enforcement action, the OCC’s policy is to take an enforcement action as soon as practical. Whenever possible, the proposed enforcement action should be presented to the bank within 180 days of the start of a supervisory activity that results in any formal written communication that indicates, based on the escalation and tailoring framework described above, an enforcement action or a more severe enforcement action is warranted. The OCC escalates more rapidly to enforcement actions against large or complex banks. Bank enforcement action recommendations based on facts gathered pursuant to a formal investigation should be presented to the appropriate decision maker expeditiously upon completion of the investigative work. The investigative work is typically considered to be complete when the assigned Enforcement and supervisory team has determined that it has accomplished the tasks needed to complete the investigation (e.g., completion of the last sworn statement, interview, or document review). Cases involving unique circumstances, including those that entail coordination with other agencies, may add to the time needed to process a case or present a bank enforcement action recommendation to the authorizing official. The Enforcement and supervisory team should account for and describe these unique circumstances in the investigative plan or enforcement action recommendation.
XII. Documentation in OCC Supervisory Information Systems
The consistent administration of the OCC’s enforcement action documentation is important. The supervisory office must maintain accurate records of OCC enforcement actions against banks. This includes recording and maintaining actions, status, financial payment information (if applicable), relevant tracking dates, and supporting documents in the appropriate supervisory information systems. Supervisory offices must follow established procedures for entering, tracking,

PPM 5310-3
August 27, 2026 Page 15 of 30 and closing bank enforcement actions and documenting supervisory activities related to bank enforcement action follow-up in the OCC’s supervisory information systems. The OCC’s supervisory records must accurately reflect the efforts of the board and management to resolve deficiencies or noncompliance with safety and soundness guidelines and the OCC’s supervisory activities or actions to ensure resolution. The OCC’s supervisory information systems must include the following relevant supporting documentation:

• The executed enforcement action document(s).
• The decision to initiate, modify, or terminate the enforcement action, including any
  supporting memoranda and other supporting decision documents.
• Relevant internal correspondence, correspondence with the bank (and, if applicable,
  documentation of the bank’s receipt of correspondence), and correspondence with other agencies (if applicable).
• The nature and extent of corrective actions, including who completed them and when they
  were completed.
• A conclusion about the effectiveness of the board and management’s corrective actions.
• Documentation supporting examiner follow-up and validation activities.
• Details (for example, description, completion time frames, and names of responsible parties)
  of any additional corrective actions the board or management must complete.
• Supervisory actions resulting from the OCC’s follow-up activities (e.g., proposed changes to
  or termination of enforcement actions; strategy changes; CAMELS, ROCA, or specialty area rating changes; risk assessment system changes; and written communications to the bank).
  XIII. Public Disclosure of Bank Enforcement Actions
  The OCC is required to publish and make available to the public certain final enforcement actions and other agreements against banks, including but not limited to C&D orders (including consent orders) and any termination and modification of C&D orders. Appendixes A and B to this PPM contain full details about which actions must be publicly disclosed. In addition, notices of charges are typically posted on the OCC’s website. The OCC may, at its discretion, choose not to publish a particular action or to delay publication under exceptional circumstances. 18 The OCC’s Public Affairs office issues a monthly news release listing recent public enforcement actions and terminations, including public bank enforcement actions. The listing includes the name of the bank, the type of action (including notices of charges), the date of the action, and the subject matters covered in the enforcement action. The monthly news releases are available on the “Newsroom” page of the OCC’s website. Published bank enforcement actions, including published notices of charges, are also posted and available via a searchable “Enforcement Actions” page on the OCC website. Disclosures related to enforceable operating agreements and conditions imposed in writing are not included in the monthly enforcement actions news release but can be found on the “Interpretations and Decisions” page of the OCC’s website. 18 See 12 USC 1818(u).

PPM 5310-3
August 27, 2026 Page 16 of 30
In certain cases, the OCC may issue a news release for an enforcement action when appropriate. Examiners should consult with Public Affairs and OCC legal staff in these instances.
XIV. Disclosure by Banks
Disclosures described in the preceding paragraphs refer only to the OCC’s required or discretionary disclosures. Banks are not permitted to disclose the existence of any non-public informal action, any potential (non-final) enforcement action (including any 15-day letter or proposed, unexecuted consent order), or any information obtained in the course of a formal investigation (including subpoenas) to a party, other than as permitted in 12 CFR Part 4. Nothing in this paragraph, however, is intended to relieve any bank, or, when applicable, its holding company, of independent obligations to make required disclosures under the law. A bank seeking to make a required disclosure pursuant to an independent obligation must ensure disclosure is made pursuant to the requirements in 12 CFR 4. All public bank enforcement actions, operating agreements, and conditions imposed in writing are considered to be public at the time they are executed (i.e., signed by all parties, including the appropriate OCC official), unless the OCC otherwise notifies the banks. Banks may, therefore, disclose executed documents described in this paragraph without further action by the OCC (i.e., prior to publication by the OCC).
XV. Further Information
For further information regarding OCC enforcement actions against banks, please contact Enforcement at (202) 649-6200 or Special Supervision at (202) 649-6450. Jennifer Crosthwaite Acting Senior Deputy Comptroller for Large and Global Financial Institutions Benjamin Eddy Senior Deputy Comptroller for Regional and Midsize Financial Institutions Stephen A. Lybarger Acting Senior Deputy Comptroller for Community Bank Supervision Adam J. Cohen Senior Deputy Comptroller and Chief Counsel

PPM 5310-3
August 27, 2026 Page 17 of 30
Appendix A: Informal Enforcement Actions Against Banks
Conditions imposed in writing (public if enforceable under 12 USC 1818): A “condition imposed in writing” within the meaning of 12 USC 1818 is imposed on a bank by the supervisory office in connection with an action on an application, notice, or other request. Examples of conditions imposed in writing include conditions imposed by the OCC when communicating a written determination of no supervisory objection. Conditions imposed in writing may be imposed to protect the safety and soundness of the bank or to ensure that the OCC’s approval is consistent with law. Conditions imposed in writing remain in effect until the OCC removes them. Any violations of conditions imposed in writing can provide the legal basis for additional enforcement actions, including a CMP assessment. The OCC refers to conditions imposed by supervision as “supervisory conditions imposed in writing.” Conditions imposed by the OCC’s Chartering, Organization and Structure Division (CO&S) in association with or resulting from a bank’s licensing filing, although typically enforceable under 12 USC 1818, are not bank enforcement actions and are not within the scope of this PPM. The OCC refers to conditions imposed by CO&S as “regulatory conditions imposed in writing.” Individual minimum capital ratios (not public): The OCC is authorized under 12 USC 1464(s)(2), 12 USC 3907, and 12 CFR 3, subpart H, to establish higher IMCRs for a bank in light of its particular circumstances. When the OCC determines that higher capital ratios are necessary, it sends the bank a notice of intent to establish higher minimum capital ratios (IMCR notice). The IMCR notice includes the proposed capital ratios, the date they must be reached, and an explanation of why the OCC considers the proposed ratios necessary or appropriate for the bank. The bank may provide a written response within 30 days of the IMCR notice, unless the OCC specifies a shorter time frame. The bank’s response should include any matters the board and management believe the OCC should consider in deciding whether to establish an IMCR, what management or the board believe the IMCR should be, and when the bank should achieve the ratios. The bank’s failure to respond within the required time frame is considered a waiver to any objection to the proposed IMCR. The OCC makes its decision after the close of the response period and notifies the bank of its decision in writing using a notification of establishment of higher capital ratios (IMCR decision notification). The IMCR decision notification includes an explanation of the OCC’s decision and may require the bank to develop and submit to the OCC an acceptable plan to reach the higher minimum capital ratios. The establishment of an IMCR does not affect a bank’s PCA capital category. If a bank fails to maintain its capital ratios above the higher minimums established in the IMCR, the OCC may issue a capital directive requiring the bank to submit and adhere to an acceptable plan to achieve or
maintain its required capital levels. Additionally, the OCC may deem a bank’s failure to maintain capital ratios above the IMCR an unsafe or unsound practice within the meaning of 12 USC 1818. 19 Memorandum of understanding (not public): A bilateral document between a bank and the OCC that looks similar to a formal OCC enforcement action in form and content. An MOU is 19 See 12 USC 3907(b)(1), 1464(s)(3).

PPM 5310-3
August 27, 2026 Page 18 of 30 drafted by the OCC. An MOU is not a binding legal document, but a board’s failure to honor an MOU may provide strong evidence of the need for a formal bank enforcement action. Operating agreement (public if made explicitly enforceable under 12 USC 1818): A bilateral document signed by the board on behalf of a bank and an authorized OCC official. Operating agreements typically specify that they are “written agreements” within the meaning of 12 USC 1818 (that is, enforceable operating agreements). In such cases, violations of an operating agreement can provide the legal basis for additional enforcement actions, including CMP assessments. Unlike a C&D or consent order, operating agreements are not enforceable through the federal court system. Operating agreements executed by CO&S in association with or resulting from a bank’s licensing filing are not bank enforcement actions and are not within the scope of this PPM. Notice of deficiency issued under 12 CFR 30 (not public): Pursuant to 12 USC 1831p-1 and 12 CFR 30, the OCC may issue a notice of deficiency when a bank fails to comply with an established safety and soundness standard in 12 CFR 30. The notice of deficiency requires the bank to submit to the OCC a safety and soundness plan describing the steps the bank will take to correct the deficiency, including the time frame within which the bank will take those steps. The bank generally has 30 days to provide its safety and soundness plan; under certain circumstances, the OCC may shorten the time frame for the bank’s response. If the bank fails to submit an acceptable plan or fails in any material respect to implement an approved plan, the OCC must, by order, require the bank to correct the deficiencies, and the OCC may, by order, require the bank to take any other action provided in 12 USC 1831p-1(e)(2)(B). Refer to Appendix B of this PPM for more information regarding safety and soundness orders.

PPM 5310-3
August 27, 2026 Page 19 of 30
Appendix B: Formal Enforcement Actions Against Banks
Many formal bank enforcement actions below are designated as “public” because they are generally required to be published or made available to the public. 12 USC 1818(u), however, provides the OCC with the authority to delay or withhold publication under certain exceptional circumstances. Capital directive (public): Pursuant to 12 USC 3907 and 12 CFR 3, the OCC may issue a capital directive when a bank fails to achieve or maintain capital at or above the minimum ratios required by 12 CFR 3, subparts B or H; a written agreement; or a condition for approval of an application. A capital directive may require the bank to achieve its minimum capital requirement by a specified date, submit and adhere to an acceptable capital plan, and take other actions to achieve the required capital ratios. The OCC sends the bank a notice of intent to issue a directive, which includes reasons for the proposed directive and proposed contents. The bank generally has 30 days to provide a written response to the notice, though the OCC can shorten the time period for the bank’s response under certain circumstances. The bank’s response should state any reasons the bank believes a directive should not be issued, propose alternative contents for the directive, and include any other matters that the bank would like the OCC to consider in deciding whether to issue a directive or revise the directive’s contents. The bank’s failure to respond within the required time frame is considered a waiver of any objection to the proposed capital directive. The OCC makes its decision after receiving a response or after the close of the response period. A capital directive has essentially the same force and effect as a C&D order. Violations of a capital directive can provide the legal basis for assessing CMPs against the bank and its institution-affiliated parties under 12 USC 1818(i) or 12 USC 3909(d). A capital directive may also be enforced through application to a federal district court. Unlike C&D orders, a failure to meet or a willful violation of a capital directive is not itself grounds for receivership. Capital directives are rarely used because most banks with deficient capital have other deficiencies that also need to be addressed, and they are addressed through other formal bank enforcement actions. When capital adequacy is the overriding concern and other deficiencies do not need to be addressed through a formal bank enforcement action, capital directives can be useful. C&D order (public): A final order issued pursuant to 12 USC 1818(b) that may be issued when a bank engages in an unsafe or unsound practice or violates a law, condition imposed in writing, 20 or written agreement (for example, an operating agreement made enforceable under 12 USC 1818 or a formal agreement). In addition to requiring a bank to cease and desist from the unsafe or unsound practice or violation and to take affirmative action to correct or remedy any conditions resulting from any violation or
practice, a C&D order may require a bank to make restitution or provide reimbursement (i.e., restitution orders), restrict asset growth, dispose of a 20 A “condition imposed in writing” under 12 USC 1818 is defined as any condition imposed in writing by a federal banking agency in connection with any action on any application, notice, or other request by the depository institution or institution-affiliated party. This definition includes conditions imposed on a bank by the supervisory office as well as conditions imposed by CO&S.

PPM 5310-3
August 27, 2026 Page 20 of 30 loan or other asset, rescind an agreement or contract, employ qualified officers or employees, or take other actions the OCC determines to be appropriate. A C&D order may also place limitations on a bank’s activities or functions. A C&D order is imposed on an involuntary basis after the issuance of a notice of charges, a hearing, a recommended decision by an administrative law judge, and a final decision and order by the Comptroller. The Comptroller’s decision to issue a C&D order in this manner is appealable to a U.S. Court of Appeals (either the D.C. Circuit or the circuit in which the home office of the bank is located). The OCC may enforce a C&D order through application to a federal district court. Violations of a C&D order can provide the legal basis for additional enforcement actions, including CMPs. A willful violation of a final C&D order is itself grounds for receivership. 21 Restitution order (public): A restitution order is a type of C&D order, authorized under 12 USC 1818(b)(6), that can be used to require a bank to take affirmative action to correct or remedy any conditions resulting from any violation or unsafe or unsound practice, including a requirement to make restitution (or provide reimbursement, indemnification, or guarantee against loss) if the bank was unjustly enriched in connection with the violation or practice, or the violation or practice involved a reckless disregard for the law or prior order. Civil money penalties (public): Refer to PPM 5000-7. Consent order (public): Aside from its title, a consent order is identical in form and legal effect to a C&D order. A consent order, however, is issued with the consent of the bank’s board. Temporary C&D order (not public except for the related notice of charges): A temporary C&D order is issued by the OCC pursuant to 12 USC 1818(c) following the filing of a notice of charges seeking a C&D order. The OCC may issue a temporary C&D order to a bank when the violation or unsafe or unsound practice described in the notice of charges, or the continuation of the violation or practice, is likely to cause the bank’s insolvency, cause significant dissipation of the bank’s assets or earnings, weaken the bank’s condition, or otherwise prejudice the interests of the bank’s depositors before the completion of the proceedings resulting from the notice of charges. A temporary C&D order may also be imposed if the notice of charges specifies that a bank’s books and records are so incomplete or inaccurate that the OCC is unable, through the normal supervisory process, to determine the financial condition of the bank or the details or purpose of any transaction(s) that may have a material effect on the financial condition of the bank, or if the notice of charges specifies that any person has engaged in certain false advertising, misuse of FDIC names, or misrepresentations to indicate insured status as described in 12 USC 1828(a)(4). Although a temporary C&D order
may be challenged in district court within 10 days of issuance, it is effective upon issuance and remains effective and enforceable, unless set aside, limited, or suspended by the court, until a final C&D order is in place or the OCC dismisses the charges in the notice. Violations of a temporary C&D order can provide the legal basis for the assessment of CMPs. Formal agreement (public): A formal agreement, a “written agreement” within the meaning of 12 USC 1818, is a bilateral document signed by an authorized OCC official and the board on 21 12 USC 1821(c)(5)(D).

PPM 5310-3
August 27, 2026 Page 21 of 30 behalf of a bank. Violations of a formal agreement can provide the legal basis for additional enforcement actions, including CMP assessments. Formal agreements are not enforceable through the federal court system. Gramm–Leach–Bliley Act (GLBA) agreements (national banks only, public): An agreement between a national bank and the OCC pursuant to 12 USC 24a(e)(2) and (3) and 12 CFR 5.39(j)(1)(ii) and (iii). A national bank that controls or holds an interest in a financial subsidiary must execute a GLBA agreement with the OCC within 45 days after receiving notice that

• the national bank or any of its depository institution affiliates are not well capitalized or well
  managed, 22
• the aggregate consolidated financial subsidiary assets exceed the limits of 12 CFR 5.39(g)(2),
• the national bank’s accounting treatment for any financial subsidiary does not comply with
  the standards set forth in 12 CFR 5.39(h)(1) and (2),
• the national bank’s procedures for identifying and managing financial and operational risks
  within the bank and the financial subsidiary do not adequately protect the bank from such risks, or
• the national bank’s policies and procedures to preserve the separate corporate identity and
  limited liability of the bank and the financial subsidiaries are not reasonable. A GLBA agreement requires the national bank to comply with certain prudential requirements and may include limitations on the conduct or activities of the national bank or any subsidiary of the national bank as the OCC determines to be appropriate. If the national bank fails to correct the conditions giving rise to the notice within 180 days after receipt, the OCC may require the national bank to divest control of any financial subsidiary. Prompt corrective action (PCA) directive (FDIC-insured banks only, public): FDIC-insured banks are subject to mandatory and discretionary restrictions and actions depending upon the bank’s PCA capital category. 23 Mandatory restrictions and actions are effective when the bank is notified or is deemed to have notice of its PCA capital category. The OCC imposes discretionary restrictions and actions on the bank through the issuance of a PCA directive. Discretionary restrictions include requiring recapitalization, restricting affiliate transactions, restricting interest rates, requiring sale of voting shares, further restricting asset growth, restricting activities, requiring election of new board members, requiring dismissal of directors or officers, requiring new senior executive officers, prohibiting deposits from correspondent banks, requiring divestiture of subsidiaries, or taking any other action that the OCC determines will resolve the bank’s problems at the least possible long-term cost to the Deposit Insurance Fund. The OCC first issues a notice of intent to issue a PCA directive to the bank, unless the OCC finds it necessary to issue a PCA directive, which is immediately effective, without providing such notice. The bank is given an opportunity to respond to the notice and explain why the proposed PCA directive is not necessary, suggest any modifications to the proposed PCA directive, or 22 “Well capitalized” and “well managed” are defined in 12 CFR 5.3. For purposes of 12 CFR 5.3, “well managed” generally means that the bank has composite and management ratings of 1 or 2. 23 See 12 USC 1831o; 12 CFR 6; and the “Problem Bank Supervision” booklet of the Comptroller’s Handbook.

PPM 5310-3
August 27, 2026 Page 22 of 30 provide any other relevant information to support its position. After considering the bank’s response, the OCC may issue the PCA directive as proposed or in modified form, determine that no action is necessary, or seek more information from the bank. A PCA directive essentially has the same force and effect as a C&D order. A PCA directive may also be enforced through application to a district court. For banks that are in the undercapitalized, significantly undercapitalized, or critically undercapitalized categories, the supervisory office should consider using a PCA directive. A PCA directive can enhance the OCC’s use of resolution options later because failure to become adequately capitalized when subject to a PCA directive is a ground for receivership. 24 Similarly, PCA directives may be appropriate when the need for prompt action is present. Refer to
Appendix D for more information on mandatory and discretionary actions under PCA.
Safety and soundness order (public): If a bank fails to submit or implement an acceptable safety and soundness plan pursuant to 12 CFR 30, the OCC must require the bank to correct the deficiencies and may require the bank to take other actions under 12 USC 1831p-1(e)(2)(B) until the deficiency has been corrected. The OCC requires the correction of deficiencies using a safety and soundness order. The OCC must also take certain additional actions against a bank that has not corrected a deficiency if the bank has experienced extraordinary growth over the past 18 months, has commenced operations within the past 24 months, or has undergone a change in control. If circumstances warrant, the OCC may issue a safety and soundness order that is immediately effective. Otherwise, the process for issuing a safety and soundness order under 12 CFR 30.5 begins with the issuance of a notice of intent to issue a safety and soundness order. The notice identifies the safety and soundness deficiencies and describes the proposed actions that would be included in the order and the time frame for complying with the proposed actions. The bank is given an opportunity to respond to the notice by explaining why the proposed order is not necessary or offering suggested modifications to the proposed order. After considering the response, the OCC may issue a safety and soundness order or determine that no action is necessary. A safety and soundness order has essentially the same force and effect as a C&D order. A safety and soundness order may also be enforced through application to a district court. Unlike C&D orders, a willful violation of a safety and soundness order is not itself grounds for receivership. Unlike PCA directives and capital directives, a safety and soundness order allows the OCC to require a bank to address deficiencies in its operations regardless of the bank’s capital levels. Use of a safety and soundness order may be considered when a bank has serious systemic weaknesses resulting in the failure to meet one or more of the safety and soundness standards set forth in 12 CFR 30 but is not undercapitalized for PCA purposes and is not subject to an existing formal enforcement action that addresses the deficiency. 24 12 USC 1821(c)(5)(K)(ii).

PPM 5310-3
August 27, 2026 Page 23 of 30
Appendix C: Bank Enforcement Action Processes and Time Frames
This appendix outlines the general process and timelines by type of enforcement action. Refer to the “Decision Authority and OCC Legal Staff Responsibilities” and “Timeliness of Bank Enforcement Actions” sections of this PPM for more information. Time frames marked with an asterisk (*) in this appendix are set forth in statute or regulation. Enforcement action type Process and time frames Capital directive • The supervisory office should provide a notice of intent to issue a capital directive to the bank within 30 days of the OCC’s final decision to issue the notice.

• The bank has 30 days* after receiving the notice to respond to the OCC,
  unless the OCC specifies a shorter time frame.
• The OCC should consider any response from the bank, make a final decision
  whether to issue the directive, and provide any directive to the bank within 30 days of the expiration of the response period. If the OCC decides not to issue a directive, the OCC will notify the bank in writing. C&D order or consent order
• The supervisory office should provide the proposed enforcement action to the
  board within 30 days of the OCC’s final decision to take the enforcement action.
• The OCC should obtain signatures from the board and execute the document
  within 30 days following delivery of the copy of the enforcement action to the board.
• If the board does not execute the proposed enforcement action within 30 days
  following delivery, the OCC should expeditiously prepare and serve on the bank a notice of charges for a C&D order. Conditions imposed in writing • The bank provides an application, notice, or other request to the supervisory office that is not a licensing filing under 12 CFR 5.
• The supervisory office should provide the conditions imposed in writing to the
  bank within 30 days after the OCC makes a final decision to impose a condition in writing in connection with its action on the bank’s application, notice, or other request. Formal agreement • The supervisory office should provide the proposed enforcement action to the board within 30 days of the OCC’s final decision to take the enforcement action.
• The OCC should obtain signatures from the board and execute the document
  within 30 days following delivery of the copy of the enforcement action to the board.
• If the board does not execute the proposed enforcement action within 30 days
  following delivery, the OCC should expeditiously prepare and serve on the bank a notice of charges for a C&D order. GLBA agreement (national banks only)
• The OCC must notify a national bank that it does not continue to meet the
  relevant qualifications in 12 CFR 5.39(g) and safeguards in 12 CFR 5.39(h).
• Pursuant to 12 CFR 5.39(j), the bank must execute the agreement within 45
  days* of the OCC’s notice that the bank does not meet the relevant qualifications and safeguards, unless the OCC extends the time frame. The following are guidelines for meeting this time frame:
  − The supervisory office should provide the proposed agreement to the bank within 30 days after the OCC’s decision to take the enforcement action. − The OCC should obtain signatures from the board and execute the document within 15 days following delivery of the copy of the agreement to the bank, unless the OCC permits additional time.

PPM 5310-3
August 27, 2026 Page 24 of 30
Enforcement action type Process and time frames IMCR • The supervisory office should provide a notice of intent to establish an IMCR to the bank within 30 days of the OCC’s final decision to issue the notice of intent.

• The bank has 30 days* after receiving the notice of intent to respond to the
  OCC, unless the OCC specifies a different time frame.
• The OCC should make its decision whether to establish an IMCR and notify
  the bank in writing of its decision within 30 days after expiration of the response period. MOU • The supervisory office should provide the proposed enforcement action to the board within 30 days of the OCC’s final decision to take the enforcement action.
• The OCC should obtain signatures from the board and execute the document
  within 30 days following delivery of the copy of the enforcement action to the board. Operating agreement • The supervisory office should provide the proposed enforcement action to the board within 30 days of the OCC’s final decision to take the enforcement action.
• The OCC should obtain signatures from the board and execute the document
  within 30 days following delivery of the copy of the enforcement action to the board. PCA directive • The OCC may immediately issue a PCA directive or issue a notice of intent to issue a PCA directive. − If the supervisory office finds it necessary to immediately issue a directive, the supervisory office should provide the PCA directive to the bank within 14 days of the OCC’s final decision to immediately issue the directive. − If the OCC issues a notice of intent, the supervisory office should provide the notice to the bank within 30 days of the OCC’s final decision to issue a notice of intent.
• The bank may file a written response to the notice within the time period set by
  the OCC. The date must be at least 14 calendar days* from the date of the notice unless the OCC determines that a shorter time frame is appropriate.
• The OCC should consider any response from the bank, make a final decision
  whether to issue the directive, and provide any directive to the bank within 30 days of the expiration of the response period. If the OCC decides not to issue a directive, the OCC will notify the bank in writing. Notice of deficiency issued under 12 CFR 30
• The supervisory office should provide a notice of deficiency to the bank within
  30 days of the OCC’s final decision to issue the notice.
• The bank must submit a safety and soundness plan to the OCC within 30
  days* after receiving the notice of deficiency, unless the OCC specifies a different time frame.
• The supervisory office must notify the bank whether the plan has been
  approved or seek more information regarding the plan within 30 days* after receiving the plan, unless the OCC extends the approval time frame. Safety and soundness order • The OCC may immediately issue a safety and soundness order or issue a notice of intent to issue a safety and soundness order. − If the supervisory office finds it necessary to immediately issue a safety and soundness order, the supervisory office should provide the order to the bank within 30 days of the OCC’s final decision to issue the order. − If the OCC issues a notice of intent, the supervisory office should provide the notice to the bank within 30 days of the OCC’s final decision to issue a notice of intent.
• The bank may file a written response to the notice within the time period set by
  the OCC. Such a response must be received by the OCC within 14 calendar

PPM 5310-3
August 27, 2026 Page 25 of 30
Enforcement action type Process and time frames days* from the date of the notice, unless the OCC specifies a different time frame is appropriate.

• The OCC should consider any response from the bank, make a final decision
  whether to issue the order, and provide any order to the bank within 30 days of the expiration of the response period. If the OCC decides not to issue an order, the OCC will notify the bank in writing. Temporary C&D order • The OCC should serve a notice of charges and temporary C&D order on a bank within 21 days of the OCC’s final decision to issue a temporary C&D order to the bank.
• Within 10 days* after the OCC serves the temporary C&D on the bank, the
  bank may apply for an injunction in a federal district court to set aside, limit, or suspend the temporary C&D.

PPM 5310-3
August 27, 2026 Page 26 of 30
Appendix D: Mandatory and Discretionary Provisions Under PCA
This appendix only applies to insured depository institutions as defined in 12 USC 1813(c)(2). This appendix summarizes the mandatory and discretionary actions under PCA, which are triggered by a bank’s PCA capital category. This appendix is not an exhaustive list of supervisory actions under PCA. For more information on PCA and its mandatory and discretionary supervisory actions, refer to 12 USC 1831o, 12 CFR 6, and the “Problem Bank Supervision” booklet of the Comptroller’s Handbook. PCA category Applicable PCA provisions Well capitalized If the bank would be undercapitalized after making the payment, then

• capital distributions (cash or certain other distributions) restricted.
• management fees restricted.
  Adequately capitalized
  Same as well capitalized banks, plus
• brokered deposits restricted. 25
  Undercapitalized Same as adequately capitalized banks, plus
• restrictions on asset growth, acquisitions, new branches, and new lines of business.
• bank must submit an acceptable Capital Restoration Plan (CRP) to the OCC within 45 days of the
  date the bank was notified of its undercapitalized status.
• discretionary application of certain restrictions otherwise applicable only to significantly
  undercapitalized banks.
  Significantly undercapitalized banks and undercapitalized banks that have failed to submit an acceptable CRP Same as undercapitalized banks, plus
• restrictions on senior executive officer compensation.
  The OCC shall also take one or more of the following actions:
• Require recapitalization.*
• Restrict affiliate transactions.*
• Restrict interest rates on deposits. *
• Further restrict asset growth or require the bank to reduce assets.
• Require the bank to alter, reduce, or terminate activities.
• Require the bank to improve management by electing new directors, dismissing directors or senior
  executive officers, or requiring qualified senior executive officers.
• Prohibit the bank’s acceptance of deposits from correspondent banks.
• Require certain divestitures of subsidiaries.
• Require the bank to take any other action the OCC determines will resolve the bank’s problems at
  the least possible long-term cost to the Deposit Insurance Fund better than any of the actions described here.

• There is the presumption that the OCC will take these actions.
  25 Refer to 12 USC 1831f, 12 CFR 303.243, 12 CFR 337.6, and 12 CFR 337.7. Deposit rate restrictions prevent a bank that is not well capitalized from circumventing the prohibition on brokered deposits by offering rates significantly above market in order to attract a large volume of deposits quickly. As a general rule, a bank that is not well capitalized may not offer deposit rates more than 75 basis points above average national rates for deposits of similar size and maturity. Refer to FDIC-FIL-30-2022, “FDIC Updates on Brokered Deposits,” for more information.

PPM 5310-3
August 27, 2026 Page 27 of 30
Critically undercapitalized
Same as significantly undercapitalized banks and undercapitalized banks that have failed to submit and implement an acceptable CRP, plus 26

• receivership or conservatorship within 90 days (extensions permitted under certain circumstances
  with OCC approval and FDIC concurrence), or such other action that the OCC determines, with the concurrence of the FDIC, will resolve the bank’s problems at the least possible long-term cost to the Deposit Insurance Fund better than receivership or conservatorship.
• restrictions on payments of principal or interest on the bank’s subordinated debt.
  26 The FDIC shall also prescribe certain further restrictions on the activities of the bank.

August 27, 2026 Page 28 of 30
Appendix E: Abbreviations
AML anti-money laundering
BSA Bank Secrecy Act
CAMELS capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk C&D cease-and-desist CMP civil money penalty FDIC Federal Deposit Insurance Corporation GLBA Gramm–Leach–Bliley Act IMCR individual minimum capital ratios MOU memorandum of understanding MRA matters requiring attention OCC Office of the Comptroller of the Currency OOI order of investigation PCA prompt corrective action PPM Policies and Procedures Manual ROCA risk management, operational controls, compliance, asset quality ROE report of examination SRC supervision review committee

August 27, 2026 Page 29 of 30
Appendix F: References
References are generally applicable to national banks and federal savings associations unless otherwise noted. Laws

• 12 USC 24a(e)(2) and (3), “Provisions Applicable to National Banks That Fail to Continue to
  Meet Certain Requirements”
• 12 USC 1464, “Federal Savings Associations” (federal savings associations)
• 12 USC 1813(c)(2), “Definitions Relating to Depository Institutions”
• 12 USC 1818, “Termination of Status as Insured Depository Institution”
• 12 USC 1818(b), “C&D Proceedings”
• 12 USC 1818(c), “Temporary C&D Orders”
• 12 USC 1818(i), “Jurisdiction and Enforcement; Penalty”
• 12 USC 1818(s), “Compliance With Monetary Transaction Recordkeeping and Reporting
  Requirements”
• 12 USC 1818(u), “Public Disclosures of Final Orders and Agreements”
• 12 USC 1821(c)(5), “Insurance Funds, Appointment of Corporation as Conservator or
  Receiver”
• 12 USC 1831f, “Brokered Deposits”
• 12 USC 1831o, “Prompt Corrective Action”
• 12 USC 1831p-l, “Standards for Safety and Soundness”
• 12 USC 3102, “Establishment of Federal Branches and Agencies by Foreign Bank” (federal
  branches and agencies)
• 12 USC 3108, “Regulation and Enforcement” (federal branches and agencies)
• 12 USC 3110, “Penalties” (federal branches and agencies)
• 12 USC 3907, “Capital Adequacy”
• 12 USC 3909(d), “Civil Penalties; Assessment and Collection”
  Regulations
• 12 CFR 3, “Capital Adequacy Standards”
• 12 CFR 4, “Release of Non-Public OCC Information”
• 12 CFR 4, “Enforcement and Supervisory Standards”
• 12 CFR 5, “Rules, Policies, and Procedures for Corporate Activities”
• 12 CFR 5.39, “Financial Subsidiaries of a National Bank”
• 12 CFR 5.51, “Changes in Directors and Senior Executive Officers of a National Bank or
  Federal Savings Association”
• 12 CFR 6, “Prompt Corrective Action” (national banks and federal savings associations)
• 12 CFR 19, “Rules of Practice and Procedure”
• 12 CFR 19.181, “Confidentiality of Formal Investigations”
• 12 CFR 28.19, “Enforcement” (federal branches and agencies)
• 12 CFR 30, “Safety and Soundness Standards”
• 12 CFR 303.243, “Brokered Deposit Waivers”

August 27, 2026 Page 30 of 30

• 12 CFR 337.6, “Brokered Deposits”
• 12 CFR 337.7, “Interest Rate Restrictions”
• 12 CFR 359, “Golden Parachute and Indemnification Payments”
  Policies and Procedures Manuals
• PPM 5000-7, “Civil Money Penalties”
• PPM 5310-5, “Securities Activities Enforcement Policy”
• PPM 5310-8, “Fast Track Enforcement Program”
• PPM 5310-13, “Institution-Affiliated Party Enforcement Actions and Related Matters”
• PPM 5400-11, “Matters Requiring Attention”
  Other Publications
• “Bank Supervision Process,” Comptroller’s Handbook
• “Problem Bank Supervision,” Comptroller’s Handbook
• “Changes in Directors and Senior Executive Officers,” Comptroller’s Licensing Manual
• OCC Bulletin 2016-6, “Bank Secrecy Act/Anti-Money Laundering: Process for
  Administrative Enforcement Actions Based on Noncompliance With BSA Compliance Program Requirements or Repeat or Uncorrected BSA Compliance Problems”
• OCC Bulletin 2020-75, “Bank Secrecy Act/Anti-Money Laundering: Joint Statement on
  Enforcement of BSA/AML Requirements”
• FDIC-FIL-30-2022, “FDIC Updates on Brokered Deposits”