Unsafe or Unsound Practices and Matters Requiring Attention: Final Rule

1 DEPARTMENT OF TREASURY Office of the Comptroller of the Currency 12 CFR Part 4 [Docket ID OCC-2026-0174] RIN 1557-AF35 FEDERAL DEPOSIT INSURANCE CORPORATION 12 CFR Part 305 RIN 3064-AG16 Unsafe or Unsound Practices, Matters Requiring Attention AGENCY: Office of the Comptroller of the Currency, Treasury, and the Federal Deposit Insurance Corporation. ACTION: Final rule. SUMMARY: The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) are adopting a final rule to define the term “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act and to revise the supervisory framework for the issuance of matters requiring attention and other supervisory communications. DATES: The final rule is effective [INSERT DATE 60 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. FOR FURTHER INFORMATION CONTACT: OCC: Eden Gray, Assistant Director, Marjorie Dieter, Special Counsel, Harry Naftalowitz, Attorney, Chief Counsel’s Office, 202-649-5490, Office of the Comptroller of the Currency, 400 7th Street SW, Washington, DC 20219. If you are deaf, hard of

2 hearing, or have a speech disability, please dial 7-1-1 to access telecommunications relay services. FDIC: Brittany Audia, Chief, Exam Support Section, Division of Risk Management Supervision, (703) 254-0801, baudia@fdic.gov; Seth P. Rosebrock, Assistant General Counsel, Legal Division, (202) 898–6609, srosebrock@fdic.gov. SUPPLEMENTARY INFORMATION: I. Introduction The OCC and the FDIC (collectively, the agencies) exercise their enforcement and supervision authority to ensure that supervised institutions1 refrain from engaging in unsafe or unsound practices, operate in compliance with applicable laws and regulations, and address emerging supervisory concerns. To that effect, it is important to promote greater clarity and certainty regarding certain enforcement and supervision standards by defining them through regulation. Moreover, it is critical that examiners and institutions prioritize material financial risks over concerns related to policies, process, documentation, and other nonfinancial risks, and that the agencies’ enforcement and supervision standards further that prioritization. On October 30, 2025, the agencies published in the Federal Register a notice of proposed rulemaking2 to clarify the agencies’ supervisory and enforcement framework and focus on practices, acts, or failures to act, that, if continued, would be likely to materially harm the institution’s financial condition or present a material risk of loss to 1 For purposes of this preamble, the term “institution” refers to national banks, insured State nonmember banks, Federal and State savings associations, Federal branches and agencies of a foreign bank, insured State licensed branches of a foreign bank, and industrial loan corporations subject to supervision or enforcement by the agencies. 2 See Unsafe or Unsound Practices, Matters Requiring Attention, 90 FR 48835 (Oct. 30, 2025).

3 the Deposit Insurance Fund (DIF). Specifically, pursuant to the provisions of section 8 of the Federal Deposit Insurance Act (FDI Act) (12 U.S.C. 1818), the agencies are authorized to take enforcement actions against depository institutions3 and institution￾affiliated parties4 that have engaged in an “unsafe or unsound practice.” The agencies proposed to establish a regulatory definition for the term “unsafe or unsound practice” for purposes of section 8 of the FDI Act. Additionally, the agencies proposed to establish standards for the issuance of Matters Requiring Attention (MRAs) and supervisory observations. After considering the comments received on the proposal and as further described in this preamble, the agencies are adopting a final rule consistent with the objectives of the agencies’ proposal, with certain modifications. The final rule will explicitly limit its scope to institutions the agencies supervise. The final rule will also clarify how the agencies will exercise their enforcement and supervisory authority, including how the agencies will tailor their use of unsafe or unsound practices and matters requiring attention based on risk factors specific to an institution. II. Overview of Proposal and Summary of Comments Received The agencies proposed to issue a rule to define the term “unsafe or unsound practice” for purposes of section 8 of the FDI Act to mean a practice, act, or failure to act, alone or together with other practices, acts, or failures to act, that (1) is contrary to generally accepted standards of prudent operation; and (2)(i) if continued, is likely to (A) 3 A depository institution generally refers to an insured depository institution as defined in 12 U.S.C. 1813(c)(2); any national banking association chartered by the OCC, including an uninsured association; or a branch or agency of a foreign bank. Refer to specific provisions of 12 U.S.C. 1818 regarding their applicability to a specific institution. See 12 U.S.C. 1818(b)(4)–(5). 4 See 12 U.S.C. 1813(u).

4 materially harm the financial condition of an institution; or (B) present a material risk of loss to the DIF; or (ii) materially harmed the financial condition of the institution. The proposed definition would have applied to the agencies’ supervisory and enforcement actions taken against both institutions and institution-affiliated parties. The proposed rule also sought to establish that the agencies may only issue an MRA for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that (1)(i) is contrary to generally accepted standards of prudent operation; and (ii)(A) if continued, could reasonably be expected to, under current or reasonably foreseeable conditions, (1) materially harm the financial condition of the institution; or (2) present a material risk of loss to the DIF; or (B) has already materially harmed the financial condition of the institution; or (2) is an actual violation of a banking or banking-related law or regulation. As proposed, the rule would have required the agencies to tailor their respective supervisory and enforcement actions under 12 U.S.C. 1818 and issuances of MRAs both with regard to the requirements or expectations set forth in such actions as well as whether, and the extent to which, such actions are taken. Tailoring would have been based on the capital structure, riskiness, complexity, activities, asset size and any financial risk-related factor that the agencies deemed appropriate. For matters that would not have met the criteria for the proposed MRA standard, the agencies proposed clarifying that they would be permitted to communicate a suggestion or observation orally or in writing to enhance an institution’s policies, practices, condition, or operations, provided that the communication would not be, and would not be treated by the agencies in a manner similar to, an MRA.

5 The agencies received in total 36 comments on the notice of proposed rulemaking. Many commenters generally supported the proposed rule while others opposed it. Some commenters who supported the proposal highlighted the need for reform of the agencies’ supervisory and enforcement practices. One commenter asserted that a high percentage of supervisory findings, including MRAs, relate to non-financial risks, and that bank employees spend an increasing amount of time complying with examiner mandates. One commenter asserted that limiting examiner discretion and eliminating many non-financial concerns with respect to the type of concerns that could serve as the basis for an MRA will lead to structural supervision reform that will address debanking concerns. Another commenter thought that the proposal would address expansive MRA usage that has shifted regulatory decision making from public rulemaking to private supervision on an institution-by-institution basis. Generally, the agencies agree with these commenters that the final rule will provide important reforms to the agencies’ supervisory and enforcement practices and will help examiners and institutions take appropriate action where action is most warranted to promote safety and soundness. Commenters that supported the proposal also expressed that the proposal’s emphasis on targeted supervision for material financial risks would better focus examiners and institutions on key considerations in furtherance of safety and soundness. For example, one commenter indicated that clarifying unsafe or unsound practices would benefit institutions by allowing them to prioritize issues. Additionally, commenters noted that the proposal would promote the clarity, consistency, and transparency of bank supervision. For example, a commenter asserted that codification of the agencies’ views

6 of unsafe or unsound practices and the standard for issuing MRAs would enhance institutions’ dialogue with examiners and accountability for the agencies in connection with appeals of supervisory determinations. The agencies also agree that the proposed rule generally struck the appropriate balance between proactive identification of material financial risks by examiners and providing each institution’s board of directors and management with clear and transparent supervisory findings and the flexibility to enact day-to-day decisions based on their business judgment and risk tolerance. Other commenters opposed the proposal, and some of these commenters suggested that the agencies withdraw the proposal. Commenters who opposed the proposal argued that the proposed regulatory definition of “unsafe or unsound practice” and standard for the issuance of MRAs would inhibit examiners from proactive identification of risks to institutions. For example, one of these commenters indicated that the 2008 financial crisis demonstrated that regulations could not keep up with rapid changes in institutions’ products and practices. Commenters also indicated that the proposal disregarded the importance of policies, procedures, documentation, and nonfinancial risks in bank supervision, such as operational risks and risks to consumers. Some commenters asserted that bank policies and procedures could serve as leading indicators of financial risk without demonstrating this link. However, these assertions are not consistent with the agencies’ supervisory experience. Rather, the final rule will encourage institutions to focus on the most important risks to an institution’s safety and soundness. Examiners may still provide supervisory observations related to weaknesses in policies and procedures, and, in situations where issues related to an institution’s policies or procedures would meet the criteria to be deemed an unsafe or unsound

7 practice or merit the issuance of an MRA, the agencies could take enforcement or supervisory action accordingly. Furthermore, commenters expressed concern that the proposal’s more targeted focus on material financial risks could create incentives for institutions to improve their financial performance at the expense of controls. The agencies expect that institutions will prudently operate in accordance with generally accepted standards, and that any potential material financial risks would be properly addressed by the agencies. Finally, commenters argued that the proposal and its focus on risks to individual financial institutions failed to consider systemic risk to the financial system. Although macroprudential concerns are not the focus of the agencies’ unsafe or unsound practices enforcement authority or MRA supervisory authority, the proposed standards’ renewed focus on material financial risks will also strengthen the greater financial system by encouraging banks to address the most significant financial risks with the greatest vigilance. III. Final Rule A. Unsafe or Unsound Practices Based on the agencies’ supervisory experience and as a matter of policy, the agencies proposed to implement a definition of “unsafe or unsound practice” for purposes of section 8 of the FDI Act that would have focused on material risks to the financial condition of an institution and would have generally required that an imprudent practice, act, or failure to act, if continued, would be likely to materially harm the institution’s financial condition or present a material risk of loss to the DIF. The proposal explained that, taking into account statutory text, legislative history, and case law, the proposed

8 regulatory definition fit within the authority Congress granted to the agencies to take enforcement actions based on unsafe or unsound practices under section 8 of the FDI Act.5 The term “unsafe or unsound practice” appears in section 8 of the FDI Act for purposes of the agencies’ enforcement authority. The statute does not define the term unsafe or unsound practice. An unsafe or unsound practice may serve as a ground for several types of enforcement actions under provisions of section 8 of the FDI Act. These include involuntary termination of deposit insurance by the FDIC,6 a cease-and-desist order,7 a temporary cease-and-desist order,8 or a Tier 2 or Tier 3 civil money penalty.9 5 See Groos Nat’l Bank v. OCC, 573 F.2d 889, 897 (5th Cir. 1978) (“The phrase ‘unsafe or unsound banking practice’ is widely used in the regulatory statutes and in case law, and one of the purposes of the banking acts is clearly to commit the progressive definition and eradication of such practices to the expertise of the appropriate regulatory agencies.”). 6 12 U.S.C. 1818(a)(2)–(3) (“If the [FDIC] Board of Directors determines that an insured depository institution or the directors or trustees of an insured depository institution have engaged or are engaging in unsafe or unsound practices in conducting the business of the depository institution . . . the [FDIC] Board of Directors may issue an order terminating the insured status of such depository institution effective as of a date subsequent to such finding.”). 7 Id. 1818(b)(1) (“If, in the opinion of the appropriate Federal banking agency, any insured depository institution, depository institution which has insured deposits, or any institution-affiliated party is engaging or has engaged, or the agency has reasonable cause to believe that the depository institution or any institution-affiliated party is about to engage, in an unsafe or unsound practice in conducting the business of such depository institution . . . the agency may issue and serve upon the depository institution or the institution-affiliated party an order to cease and desist from any such . . . practice.”). 8 Id. 1818(c)(1) (“Whenever the appropriate Federal banking agency shall determine that . . . the unsafe or unsound practice or practices . . . or the continuation thereof, is likely to cause insolvency or significant dissipation of assets or earnings of the depository institution, or is likely to weaken the condition of the depository institution or otherwise prejudice the interests of its depositors prior to the completion of the proceedings conducted pursuant to paragraph (1) of subsection (b) of this section, the agency may issue a temporary order requiring the depository institution or such party to cease and desist from any such . . . practice and to take affirmative action to prevent or remedy such insolvency, dissipation, condition, or prejudice pending completion of such proceedings.”). 9 Id. 1818(i) (“[A]ny insured depository institution which, and any institution-affiliated party who . . . recklessly engages in an unsafe or unsound practice in conducting the affairs of such insured depository institution . . . which practice is part of a pattern of misconduct; causes or is likely to cause more than a minimal loss to such depository institution; or results in pecuniary gain or other benefit to such party, shall forfeit and pay a civil penalty of not more than $25,000 for each day during which such . . . practice . . . continues . . . . [A]ny insured depository institution which, and any institution-affiliated party who knowingly . . . engages in any unsafe or unsound practice in conducting the affairs of such depository

9 Most enforcement provisions in section 8 of the FDI Act also include other potential grounds, such as a violation of law or a breach of fiduciary duty, which are not affected by the regulatory definition in the final rule. In determining what may be considered an unsafe or unsound practice under section 8 of the FDI Act, some courts have looked to a standard articulated by John Horne, then Chairman of the Federal Home Loan Bank Board (FHLBB) (Horne Standard), during congressional hearings related to the Financial Institutions Supervisory Act of 1966 (Act of 1966), which is the source of the agencies’ cease-and-desist authority in section 8(b) of the FDI Act.10 Specifically, Chairman Horne stated: Generally speaking, an “unsafe or unsound practice” embraces any action, or lack of action, which is contrary to generally accepted standards of prudent operation, the possible consequences of which, if continued, would be abnormal risk or loss or damage to an institution, its shareholders, or the agencies administering the insurance funds.11 Representative Patman further described the authority added in the Act of 1966 as “aimed specifically at actions impairing the safety or soundness of . . . insured financial institutions” and providing the agencies with “flexible tools [that] relate strictly to the insurance risk and to assure the public of sound banking facilities.”12 institution; . . . and knowingly or recklessly causes a substantial loss to such depository institution or a substantial pecuniary gain or other benefit to such party by reason of such . . . practice . . . shall forfeit and pay a civil penalty in an amount not to exceed the applicable maximum amount determined under subparagraph (D) for each day during which such . . . practice . . . continues.”). 10 See, e.g., Gulf Fed. Sav. & Loan Assoc. of Jefferson Parish v. Fed. Home Loan Bank Bd., 651 F.2d 259, 264 (5th Cir. 1981) (“The authoritative definition of an unsafe or unsound practice, adopted in both Houses, was a memorandum submitted by John Horne . . . .”). Chairman Horne’s articulation of what constitutes an unsafe or unsound practice was read into the record in both chambers of Congress. See 112 Cong. Rec. 25008, 26474 (1966) (remarks of Rep. Thomas W.L. Ashley and Sen. Absalom W. Robertson). 11 112 Cong. Rec. at 26474. 12 112 Cong. Rec. at 24984 (remarks of Rep. Wright Patman).

10 Defining “unsafe or unsound practice” by regulation will provide a clear nationwide standard and increase clarity for institutions. A regulatory definition of the term unsafe or unsound practice is also important to appropriately focus institution and examiner attention on practices that are likely to materially harm an institution’s financial condition or present a material risk of loss to the DIF, providing the institution’s board of directors and management additional flexibility to enact day-to-day decisions based on their business judgment and risk tolerance. The definition reflects the agencies’ judgment and experience that their supervisory resources are best focused on practices that are likely to materially harm an institution’s financial condition, such as risks that are more likely than other risks to lead to material financial losses, bank failures, and instability in the banking system.13 For the same reasons, practices that are likely to materially harm the financial condition of an institution are critical for an institution’s board of directors and management to address. The definition of an unsafe or unsound practice will ensure consistency in identifying practices as unsafe or unsound only where they are likely to materially harm the financial condition of an institution, are likely to present a material risk of loss to the DIF, or have materially harmed the financial condition of the institution. This definition will focus institution and examiner attention on material financial risks facing an institution and otherwise provide the institution’s board of directors and management the flexibility to enact decisions based on their business judgment and risk tolerance. 13 In March 2023, several insured depository institutions with total consolidated assets of $100 billion or more, including Silicon Valley Bank, experienced significant withdrawals of uninsured deposits in response to underlying material weaknesses in their financial position and failed. These failures highlight the need for the agencies to allocate supervisory resources with a focus on material financial risks.

11 Therefore, as explained further below, in the final rule, the agencies define the term unsafe or unsound practice to mean a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that (1) is contrary to generally accepted standards of prudent operation; and (2)(i) if continued, is likely to (A) materially harm the financial condition of the institution; or (B) present a material risk of loss to the DIF; or (ii) materially harmed the financial condition of the institution. This regulatory definition will provide greater consistency for institutions and appropriately focus supervisory and institution resources on the most critical financial risks to institutions and the financial system. As in the proposal, the definition of “unsafe or unsound practice” in the final rule applies to the agencies’ supervisory and enforcement activities prospectively only. Moreover, it does not apply to the agencies’ rulemaking activities or authority. The agencies are making one technical change to the definition of unsafe or unsound practice in the final rule. Specifically, the definition of unsafe or unsound practices in the proposed rule would have applied to the agencies’ supervisory and enforcement activities under 12 U.S.C. 1818. In the final rule, the agencies modified this language to refer separately to the agencies’ “supervisory activities” and the agencies’ “enforcement actions under 12 U.S.C. 1818.” This change reflects that the agencies do not engage in supervisory activities under 12 U.S.C. 1818, and it is not a substantive change from the proposed definition. In addition to enforcement actions under 12 U.S.C. 1818, the agencies identify unsafe or unsound practices as supervisory findings in other communications, including reports of examination, supervisory letters, and informal

12 enforcement actions. These identified unsafe or unsound practices sometimes establish a record for a later enforcement action under 12 U.S.C. 1818.14 Scope. The proposed rule would have applied to the agencies’ enforcement and supervisory actions taken against an institution or an institution-affiliated party. The agencies requested comment on the effect the proposed rule would have on the agencies’ ability to address misconduct by institution-affiliated parties under their enforcement and supervisory authority, and the agencies carefully considered the comments received. 15 A few commenters asserted that the proposed definition of unsafe or unsound practice would impede the agencies’ ability to take appropriate enforcement actions against institution-affiliated parties that are affiliated with large institutions, even when an institution-affiliated party’s actions result in a sizeable loss. Because the definition of unsafe or unsound practice would require that actions be likely to cause material harm to the financial condition of an institution or present a material risk of loss to the DIF, it would be rare that the actions of an institution-affiliated party could cause such harm to a large institution. As proposed, the unsafe or unsound practice definition could result in enforcement actions against institution-affiliated parties being influenced by factors unrelated to the gravity of the misconduct, such as the asset size or staffing numbers of the institution with which a party is affiliated at the time of the misconduct. Given that an institution-affiliated party’s misconduct would be confined to the relative scope of the 14 The agencies’ identification of an unsafe or unsound practice is distinct from standards for safety and soundness that the agencies are required to issue pursuant to 12 U.S.C. 1831p-1. See 12 CFR parts 30, 364. 15 One commenter suggested that the agencies should not deem directors to have engaged in an unsafe or unsound practice because they approved a loan or an institution policy or practice unless said approval violated their fiduciary duties under state law. The agencies decline to adopt this suggestion, as unsafe or unsound practices and breaches of fiduciary duty are two distinct concepts.

13 party’s responsibilities and sphere of influence at the institution, such misconduct may not materially impact the overall financial condition of the institution. Moreover, individuals who are institution-affiliated parties may move between institutions of various sizes. The application of this rule to institution-affiliated parties could allow an individual to engage in misconduct (e.g., failing to appropriately underwrite loans or secure collateral) at a large institution without any remedy or recourse. The individual could then move to a smaller institution and engage in the same conduct. Although the proposed rule attempted to create a single, uniform standard for the phrase “unsafe or unsound practice” that could be used in the context of enforcement actions under 12 U.S.C. 1818 and supervisory activities, the agencies recognize that applying a single uniform definition to both institutions and institution-affiliated parties could fail to account for differences in the agencies’ supervisory objectives. Given this potential to impede, or distort incentives regarding, enforcement actions against institution-affiliated parties and that the primary purpose of this rulemaking was to address the agencies’ supervisory and enforcement activities with respect to their supervised institutions, the agencies are not finalizing the rule’s application to institution￾affiliated parties.16 The agencies are adding a new paragraph to the final rule to codify the refined scope of the rule. Practice. The proposed rule defined an unsafe or unsound practice for purposes of 12 U.S.C. 1818 to apply to a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that meet the other requirements of the 16 Enforcement actions against institution-affiliated parties will continue to be handled under the agencies’ prior standards and procedures and subject to controlling appellate case law.

14 definition. A few commenters asserted that the best reading of section 8 of the FDI Act is that the term “unsafe or unsound practice” applies only to practices, but not individual acts or failures to act, and that the final rule should apply only to practices that meet the criteria of the regulatory definition. Another commenter suggested that the agencies not consider an isolated or technical incident a “practice.” Under the final rule, like the proposal, a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act could be considered an unsafe or unsound practice. An individual act or failure to act may constitute an unsafe or unsound practice. Twelve U.S.C. 1818(b) provides that an agency may issue a cease-and desist order when an institution is engaging or has engaged, or the agency has reasonable cause to believe that the institution is about to engage, in an unsafe or unsound practice in conducting the business of the institution. For example, poor underwriting may constitute an unsafe or unsound practice. By making a loan that is poorly underwritten, an institution would have engaged in an unsafe or unsound practice to the extent it otherwise met the definition of an unsafe or unsound practice. Whether an individual act or omission, as opposed to a pattern of conduct, could result in likely material harm to the financial condition of the institution is generally an academic question. In certain cases, a single event can materially impact the safety and soundness of an institution. But a single event could readily be described as multiple events, making the distinction between a single act or multiple acts that constitute a practice not useful. For example, if an institution agrees to purchase a portfolio of loans and weaknesses in one loan in the portfolio is likely to result in a material financial loss to the institution, the decision and act of purchasing the loan would be considered an

15 outgrowth of the institution’s lending practices. Accordingly, the term “unsafe or unsound practice” in section 8 of the FDI Act, as reflected in the final rule, applies to practices, acts, or failures to act, alone or together with one or more other practices, acts, or failures to act. 17 If an act or failure to act materially harmed the financial condition of an institution and met other requirements of the regulatory definition, such an incident would be considered an unsafe or unsound practice.18 Imprudence. Consistent with the Horne Standard, the agencies proposed that a practice, act, or failure to act would have to be contrary to generally accepted standards of prudent operation to be considered an unsafe or unsound practice.19 A practice, act, or failure to act could only have been considered an unsafe or unsound practice if it deviated from generally accepted standards of prudent operation (and otherwise met the proposed definition).20 Two commenters recommended that the agencies revise the definition of unsafe or unsound practice to not require a finding that an institution acted contrary to generally accepted standards of prudent operation. Removal of the generally accepted standards provision could result in strict liability for assuming a risk of likely material 17 The language of paragraph (b) of the final rule—“together with one or more other practices, acts, or failures to act”—emphasizes the interconnectivity between individual acts or failures to act with other institution practices, acts, and failures to act. 18 The agencies could nonetheless exercise their discretion regarding whether it would be appropriate to take an enforcement action in response to an isolated or technical incident. 19 See, e.g., Frontier State Bank Okla. City, Okla. v. FDIC, 702 F.3d 588, 604 (10th Cir. 2012) (citing Simpson v. OTS, 29 F.3d 1418, 1425 (9th Cir. 1994)). 20 The agencies decline to adopt a commenter’s recommendation to reorder the elements of the definition of unsafe or unsound practice and the standard for the issuance of MRAs to place the generally accepted standards provision after the material harm provision. The action or inaction contrary to generally accepted standards of prudent operation is the source of the relevant risk of or actual material harm to the financial condition of an institution, and accordingly, should be enumerated first. As the agencies implement the final rule, they will provide training for examiners that will, among other things, indicate that a practice cannot be considered unsafe or unsound or support the issuance of an MRA solely on the basis of likely or actual material harm to the financial condition of an institution.

16 harm to the financial condition of the institution. Consistent with the Horne Standard and relevant caselaw, a determination that a practice, act, or failure to act is unsafe or unsound is most appropriately found when the institution acted contrary to generally accepted standards of prudent operation.21 The agencies also acknowledge that an essential role of institutions is to identify, measure, incur, and manage risk. As provided in the proposal, the agencies do not intend to take enforcement actions under section 8 of the FDI Act for prudent operations merely because they result in risk-taking. Under the final rule, a practice, act, or failure to act will only be considered an unsafe or unsound practice if it deviates from generally accepted standards of prudent operation (and otherwise meets the definition). For these reasons, the agencies are adopting the requirement that for a practice, act, or failure to act to be considered unsafe or unsound, it must be contrary to generally accepted standards of prudent operation. Several commenters requested that the agencies clarify what constitutes generally accepted standards of prudent operations. One commenter requested that the agencies codify a list of generally accepted standards of prudent operation and commit to publish any updates to these standards. Some commenters requested clarification specifically regarding emerging risks and novel activities. One commenter requested clarification on what would qualify as a deviation from generally accepted standards of prudent operations. Another commenter requested that the agencies establish a safe harbor or 21 One commenter suggested that the agencies’ adoption of a requirement that unsafe or unsound practices be contrary to generally accepted standards of prudent operation may be inconsistent with the Fifth Circuit’s decision in Gulf Fed. Sav. & Loan Assoc. of Jefferson Parish, 651 F.2d at 264-265. The agencies do not share the commenter’s reading of the case. As described above, the Gulf Fed. court cited the Horne Standard, including the statement that an unsafe or unsound practice is one “which is contrary to generally accepted standards of prudent operation,” as the “authoritative definition.” The Gulf Fed. case otherwise does not focus on this part of the definition. In a later case, MCorp Financial, Inc. v. Board of Governors Federal Reserve System of U.S., 900 F.2d 852, 863 (5th Cir. 1990), the Fifth Circuit explicitly relied on the generally accepted standards of prudent operation requirement in the Horne Standard.

17 include a rebuttable presumption regarding when an institution may be presumed to be acting in accordance with generally accepted standards of prudent operation. Finally, one commenter requested that the agencies clarify that best practices, including those identified through horizontal reviews, should not be the basis for findings of imprudent practices. The agencies decline to codify a list of or adopt a bright line for generally accepted standards of prudent operation, which are concepts the agencies consider to be a matter of examiner judgment, based on objective facts and sound reasoning. Further, as discussed below, the agencies’ expectations for what they consider to be generally accepted standards for prudent operation will be tailored based on the risks associated with an institution’s capital structure, complexity, activities, asset size, and other financial risk-related factors. As the risk associated with these factors for an institution increases, the agencies’ expectations for that institution’s prudent operations would also increase. The agencies agree with commenters that pointed out that generally accepted standards of prudent operation do not require an institution to adopt what the agencies consider to be best practices, including those practices identified in horizontal reviews of peer institutions. The agencies reserve the right to determine whether widespread practices are generally imprudent, taking into account the facts and circumstances, based on objective facts and sound reasoning. For these reasons, the agencies are adopting the requirement that, for practices, acts, or failures to act to be considered unsafe or unsound, they must be contrary to generally accepted standards of prudent operation. The agencies also note that practices,

18 acts, or failures to act that are imprudent, without more, would not be considered unsafe or unsound practices unless they also satisfied the other prong of the definition. Likely. To qualify as an unsafe or unsound practice under the proposed definition, it also would have had to be likely—as opposed to, for example, merely possible—that the practice, act, or failure to act, if continued, would materially harm the financial condition of the institution or present a material risk of loss to the DIF. As explained in the proposal, the agencies believed that including the term “if continued” was important to allow for identification of an unsafe or unsound practice before it impacts an institution’s financial condition. However, conduct would have had to be sufficiently proximate to material harm to an institution’s financial condition to meet the proposed definition.22 Moreover, the agencies invited comment on, but did not propose, more precisely defining the requisite likelihood under the proposed definition, such as through a minimum percentage (e.g., 10 percent, 51 percent). Many commenters opined on “likely” as the proposed probability threshold for unsafe or unsound practices. Some commenters suggested that the agencies specify that “likely” has the same meaning as “more likely than not” or a likelihood of at least 51 percent. 23 One commenter noted that a potential meaning of likely is not just probable but “very probable.” 22 Additionally, under the proposal, practices, acts, or failures to act that have already caused material harm to the financial condition of the institution would not have to meet the “likely” standard, as there would be certainty with respect to the harm. 23 One commenter indicated that defining likely to mean “probably” or “more likely than not” was most in line with certain case law, citing to Michael v. FDIC, 687 F.3d 337, 349 (7th Cir. 2012). The cited case, however, does not use these terms to refer to the standard for what constitutes an unsafe or unsound practice generally and instead refers to the specific requirement in 12 U.S.C. 1818(e)(1) that permits removal and prohibition of an institution-affiliated party when, inter alia, by reason of the party’s conduct an institution “has suffered or will probably suffer financial loss or other damage.”

19 Other commenters suggested that the agencies should not quantify a specific threshold for harm to qualify as “likely.” These commenters suggested that precise quantification as to the likelihood of future events is not possible and would not be credible. Further, a commenter suggested that quantifying a threshold for harm to be considered “likely” could introduce unnecessary complications and legal risk because likelihood is often qualitative and context dependent. One commenter asserted, however, that it should be insufficient for the nexus between an imprudent practice and material financial harm to be conclusory or speculative. Some commenters suggested that the agencies identify a time horizon over which material financial harm must be likely.24 One commenter suggested that harm must be “imminent” or “near imminent,” as opposed to speculative. One commenter suggested that, without a defined time horizon, the likelihood of material financial harm based on a practice differs. Some comments opposed “likely” as the applicable probability threshold for an unsafe or unsound practice. A few commenters indicated that if the supervisory process only stepped in when material harm already is likely, that would often be too late to prevent the material harm, thereby making the process pointless. Other commenters suggested a “likely” standard would prevent the agencies from addressing low￾probability, high-impact risks or preclude reasonable supervisory activities to proactively address risks. 24 One commenter requested the agencies clarify the “if continued” language in the proposed definition of unsafe or unsound practice. Under the final rule, the agencies will use objective facts and sound reasoning to determine whether a practice, act, or failure to act, if continued, is likely to cause the requisite harm. The words “if continued” do not permit the agencies to identify an unsafe or unsound practice based on the mere possibility that the continuation of a practice, act, or failure to act would cause material harm to the financial condition of an institution.

20 Some commenters suggested alternatives to “likely” as the appropriate threshold for the likelihood necessary for an unsafe or unsound practice. A few commenters suggested “reasonably foreseeable” as the appropriate standard. These commenters pointed out that a risk can be excessive, unsafe, and unsound without a likely bad outcome and noted that “reasonably foreseeable” is more frequently used as a standard in legal contexts. Other commenters stated that Chairman Horne used “possible consequences” to refer to the probability of harm necessary for an unsafe or unsound practice. One commenter suggested that the agencies consider “under stress conditions that are plausible” as the appropriate standard, as systemic crises occur suddenly and this would allow the agencies to take proactive action. Another commenter noted that section 8 of the FDI Act provides for different probabilities of harm for different causes of action.25 After consideration of these comments, the agencies are adopting “likely,” as proposed. Under this provision of the final rule, to be considered an unsafe or unsound practice, a practice, act, or failure to act, if continued, must be likely to materially harm the financial condition of the institution or present a material risk of loss to the DIF. The agencies considered commenter suggestions for different standards and ultimately determined that “likely” struck the right balance in terms of probability, clarity, and simplicity. This standard is sufficient to confirm that the agencies do not intend to identify unsafe or unsound practices by extrapolating from deficient conduct that could potentially result in, alone or in combination with other factors or events, material harm 25 See 12 U.S.C. 1818(e) (removal where unsafe or unsound practice “could” prejudice depositors), (i)(B)(ii)(II) (removal where unsafe or unsound practice “will probably” result in financial loss or other damage to an institution). The agencies adoption of the final rule does not affect the fact that any statutory requirements must be met for the agencies to pursue an enforcement action.

21 to the financial condition of an institution but is not likely to do so. The probability that a practice, act, or failure to act, if continued, will materially harm the financial condition of the institution or present a material risk of loss to the DIF must be more than speculative or merely possible. At the same time, a “likely” standard acknowledges that it is impossible to quantify the probability of future events with precision, such as by requiring that a specific result is more likely than not to occur. For the same reasons, the agencies decline to adopt a quantitative threshold for a result to be likely or identify a time horizon on which a result must be likely to occur. The agencies did not specify a time horizon over which the requisite harm could occur, as the appropriate time horizon would be a fact-specific determination based on multiple factors, including the certainty of projected conditions or harm and the magnitude of potential harm. Harm to financial condition. Under the proposal, an unsafe or unsound practice would have included a practice, act, or failure to act that, if continued, was likely to materially harm the financial condition of an institution. In the preamble to the proposal, the agencies explained that they believed that harm to financial condition included practices, acts, or failures to act that are likely to directly, clearly, and predictably impact an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk. One commenter suggested that the agencies add this concept to the regulatory text to prevent reputational or other non-financial impacts from being considered. As described in section III.C of this preamble, the agencies have added paragraph (d) of the final rule to clarify that “[h]arm to financial condition refers to financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.” In addition, described in section III.D of this preamble, the agencies are

22 adding a provision to require that examiner determinations with respect to unsafe or unsound practices, as well as MRAs, are based on objective facts and sound reasoning. Materiality. The proposed standard for unsafe or unsound practices would have applied to practices, acts, or failures to act that, if continued, were likely to materially harm the financial condition of an institution or that had already resulted in actual material harm to the institution. The preamble to the proposal explained that neither actual but non-material financial losses to the institution nor risks of minor harm to an institution’s financial condition, even if imminent, would have been sufficient to meet the proposed standard. Many commenters commented on the concept of materiality. Some of these commenters asserted that the agencies should define material or provide more information regarding when the agencies would consider financial harm to be material. Commenter suggestions for how the agencies should define materiality varied widely.26 A few commenters indicated that the agencies’ consideration of materiality should focus on whether practices, acts, or failures to act are likely to threaten an institution’s financial integrity or financial stability, or call into question the ability of the institution to continue to conduct its business. These commenters indicated that defining materiality in this manner would better align with case law. 27 One commenter suggested that the 26 A few commenters noted that materiality is used as a threshold under securities laws or accounting standards with varying definitions. These commenters were split as to whether it may be helpful for the agencies to refer to these definitions of materiality. In the agencies’ judgment, these situations, which generally refer to the materiality of misstatements or disclosure issues, are sufficiently distinct from the materiality of harm to financial condition so as to not warrant adoption. For purposes of securities laws or accounting standards, materiality standards generally refer to the likelihood that an individual viewing disclosures will be confused. See Basic Inc. v. Levinson, 485 U.S. 224, 232 (1988). Materiality in this case generally refers to information that is not available to the public. 27 See Michael, 687 F.3d at 352 (referring to “abnormal risk to the financial stability of the . . . institution”); Johnson, 81 F.3d at 204 (referring to practices that “threaten the financial integrity” of the institution).

23 agencies define material harm as harm that, in conjunction with the reasonably foreseeable operational and economic conditions that the institution is likely to be subject to, causes an institution to no longer be financially viable or to impose a loss on the DIF. A few commenters suggested the agencies specify concrete, absolute dollar floors or percentages for harm that would be considered material, such as a specified basis point reduction in common equity tier 1 capital or an amount that could endanger the supervised institution’s adequately capitalized status. One the other hand, one commenter suggested that the agencies should not adopt a quantitative threshold for materiality to allow the agencies to consider all aspects of harm, while another commenter suggested that the threshold for material harm should not be defined too narrowly, as it may constrain the agencies’ ability to respond to emerging risks. One commenter recommended clarifying that “material risk” must be tied to objective, demonstrable impacts on solvency, liquidity, capital, operations, or compliance—not reputational theories. Another commenter requested a concrete definition to ensure the definition is not susceptible in the future to regulatory drift that would include immaterial process or documentation issues. Other commenters suggested that any definition of material should consider the systemic impact caused by the bank’s action. One commenter expressed that large banks, specifically, could be causing or distributing a problem but may not be directly financially impacted enough by their actions. These commenters do not cite case law for their argument that conduct would need to be sufficient to call into question the ability of the bank to continue to conduct its business to qualify as an unsafe or unsound practice. Moreover, the agencies do not view the cited case law as necessarily requiring any question about the institution’s viability.

24 Several commenters proposed that the agencies use a term other than material to describe the threshold for potential or actual harm to the financial condition of an institution necessary to constitute an unsafe or unsound practice. One commenter suggested “undue” be used instead of material because it would preclude actions against a wide range of imprudent activities. A few commenters referred to “abnormal” as the threshold for risk or damage referred to by Chairman Horne in his statement. Several commenters expressed disagreement with the materiality threshold. One commenter stated the standard would disproportionally affect smaller institutions while providing few scenarios to apply to larger institutions. Several commenters expressed concern that the new standard would permit banks to take too much risk or would prevent the agencies from intervening to correct bank deficiencies before there is a likelihood of material harm to financial condition. After consideration of these comments, the agencies have determined to adopt materiality as the appropriate threshold for potential or actual harm to the financial condition of an institution for practices, acts, or failures to act to be considered an unsafe or unsound practice. This threshold strikes the right balance between permitting both small and large institutions to take on appropriate risks in line with their business judgment, while focusing supervisory resources on serious financial risks. Some alternative suggestions, such as abnormal or undue risk, would not add clarity as compared to material financial risk and may cause confusion between the concepts of financial risk and practices that are opposed to generally accepted standards of prudent operation. In addition, as described above, systemic risk is a separate concept from safety and soundness and the scope of this rulemaking. The agencies also decline to adopt a

25 quantitative definition for what qualifies as material because assessment of what qualifies as material harm to the financial condition of an institution relies on examiner judgement, based on objective facts and sound reasoning, as described in section III.D of this preamble. Some commenters expressed concern that the proposed definition of unsafe or unsound practices would be insufficient to address imprudent practices by large or complex institutions. As discussed further below, the agencies’ expectations for what they consider to be material harm to the financial condition of an institution will be tailored based on the risks associated with the institution’s capital structure, complexity, activities, asset size, and other financial risk-related factors. Specifically, as the risk associated with the factors identified in the tailoring provision increases, the threshold for materiality of the harm to the financial condition of an institution that constitutes an unsafe or unsound practice or warrants an MRA decreases and the assessment of the harm to the financial condition of institution becomes more granular (e.g., specific business lines, products, or services). As noted in the preamble to the proposal, the agencies acknowledge that, in limited circumstances, other practices, acts, or failures to act may be captured because, if continued, they are likely to result in material harm to an institution’s financial condition. For example, a significant risk of disruption of an institution’s operations through its information technology systems may, in some cases, be likely to cause material financial harm. Whether a cybersecurity vulnerability would meet the definition of an unsafe or unsound practice under this rule depends on the potential severity and likelihood of material harm to the financial condition of the institution. Mitigating factors such as

26 compensating controls associated with a specific gap or weakness would also be considered. As an example, weaknesses surrounding unsupported operating systems and patch management may not be readily mitigated by controls in other areas. Such weaknesses are commonly leveraged by threat actors to interrupt and exploit institutions (via ransomware, data exfiltration, etc.). Such exploits may cause direct financial harm to institutions through the denial of banking services, data exfiltration, or other damaging actions, as well as costs associated with investigating and remediating such incidents. The standard would not include risks to the institution’s reputation unrelated to financial condition.28 Risk of Loss to the Deposit Insurance Fund. Under the proposal, an unsafe or unsound practice also included a practice, act, or failure to act that, if continued, was likely to negatively affect an institution’s ability to avoid FDIC receivership and present a material risk of loss to the DIF as a result of the failure. For example, the failure of an institution to implement appropriate contingency funding arrangements might not pose a risk of material harm to the financial condition of the institution, but could impair the institution’s liquidity under stress and thus present an increased risk to the DIF. In other words, the proposed definition was intended to capture a practice, act, or failure to act that materially increases the probability that an institution would fail and impose a material risk of loss to the DIF. 28 See Gulf Fed. Sav. & Loan Assoc. of Jefferson Parish, 651 F.2d at 264–65 (“Approving intervention under the [FHLBB]’s ‘loss of public confidence’ rationale would result in open-ended supervision. . . . The Board’s rationale would permit it to decide, not that the public has lost confidence in Gulf Federal’s financial soundness, but that the public may lose confidence in the fairness of the association’s contracts with its customers.”).

27 The agencies received several comments relating to the agencies’ proposed treatment of the risk of loss to the DIF. Two commenters asserted that the provision on material risk of loss to the DIF is superfluous, given that a loss to the DIF necessarily entails the failure of an institution, which in turn would have experienced material harm to its financial condition. As noted in the preamble to the proposal, inadequate contingency funding arrangements could impair an institution’s liquidity under stress and present a material risk to the DIF without posing a risk of material harm to the financial condition of the institution. The agencies therefore decline to remove the DIF provision. One commenter recommended that the agencies, when analyzing whether a practice presents “a material risk of loss to the DIF,” account for factors impacting the difficulty of resolving a particular institution. The agencies decline to adopt this suggestion. Specifically, the agencies’ unsafe or unsound authority under section 8 of the FDI Act and the purpose of MRAs applies to the safety and soundness of institutions that are a going concern. The agencies will not consider a material risk of loss to the DIF as a means to consider an institution’s resolution planning for their wind-down as a gone concern. The agencies’ consideration under this prong will generally be limited to the likelihood that an institution’s going-concern practices would cause it to fail in a manner that poses a material risk of loss to the DIF. Another commenter asserted that a small institution is incapable of presenting a material risk of loss to the DIF. The materiality threshold is based on the risk of loss, not the potential amount of loss, so a small institution could still present a material risk of loss.

28 Taken together, the proposed provisions related to actual or potential material harm to the financial condition of the institution and a material risk of loss to the DIF provide the agencies with sufficient latitude to address imprudent practices, acts or failures to act that pose material financial risks. Accordingly, the agencies are adopting the DIF provision as proposed. For these reasons, the agencies are defining the term unsafe or unsound practice, for purposes of the agencies’ enforcement activities under 12 U.S.C. 1818, to mean a practice, act, or failure to act, alone or together with other practices, acts, or failures to act, that (1) is contrary to generally accepted standards of prudent operation; and (2)(i) if continued, is likely to (A) materially harm the financial condition of an institution; or (B) present a material risk of loss to the DIF; or (ii) materially harmed the financial condition of the institution. B. Matters Requiring Attention The agencies also proposed to establish uniform standards for examiners’ issuance and communication of MRAs. Specifically, the proposed rule provided that the agencies would only be permitted to issue an MRA for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that (1)(i) is contrary to generally accepted standards of prudent operation; and (ii)(A) if continued, could reasonably be expected to, under current or reasonably foreseeable conditions, (1) materially harm the financial condition of the institution; or (2) present a material risk of loss to the DIF; or (B) has already material harmed the financial condition of the institution; or (2) is an actual violation of a banking or banking-related law or regulation.

29 The proposed standard for MRAs differed from the proposed standard for unsafe or unsound practices in two significant respects. First, for the agencies to issue an MRA if imprudent practices, acts, or failures to act continued, material harm to the financial condition of an institution would have needed to be reasonably expected to under current or reasonably foreseeable conditions result in material financial harm, which is a lower bar than the likeliness requirement for unsafe or unsound practices. Second, the agencies could have issued an MRA for an actual violation of a banking or banking-related law or regulation. With respect to common terms between the proposed MRA standard and the proposed unsafe or unsound practices standard, the agencies are adopting those portions of the proposed MRA standard for the reasons discussed in section III.A of this preamble. Many commenters supported the agencies’ proposed standard for the issuance of an MRA. One commenter suggested that the agencies clarify that MRAs are not binding orders but are a warning of a potential enforcement action if the practice or violation is not corrected within a reasonable amount of time and that failure to remediate an MRA, in and of itself is not an unsafe or unsound practice.29 Under the final rule, mere failure to remediate an MRA does not constitute an unsafe or unsound practice. The agencies characterize MRAs as concerns that, in the agencies’ judgment, rise to the level of requiring presentation to the board of directors and for which an institution must take corrective action.30 29 Another commenter recommended that the FDIC continue to refer to matters requiring correction as “Matters Requiring Board Attention,” because communications that the OCC labels “matters requiring attention” are unenforceable guidance. Under the final rule, institutions will be required to take action in response to an MRA, so the FDIC declines to adopt the commenter’s recommendation. 30 The commenter further suggested that the agencies’ respective authority to issue MRAs is based on their authority to take enforcement actions pursuant to section 8 of the FDI Act and the agencies should revise the statutory authority section of the proposal accordingly. The agencies do not believe that any change is

30 Reasonable Expectation of Harm Under the proposal, for the agencies to issue an MRA if imprudent practices, acts, or failures to act continued, material harm to the financial condition of an institution would have needed to be reasonably expected to, under current or reasonably foreseeable conditions, result in material financial harm. Some commenters suggested that the agencies lower the required probability of material harm to the financial condition of the institution to promote proactive identification of risks. A few commenters indicated that the proposed MRA standard would only permit the agencies to issue an MRA in response to an unsafe or unsound practice. One commenter suggested that the agencies broaden the types of harm cognizable under the proposed MRA standard to include emerging risks that could eventually cause material financial harm to consumers. Some commenters opined that the agencies should issue MRAs to address institutions that are highly vulnerable to reasonably foreseeable economic shocks, including when institutions adopt a niche business model or have high concentrations in certain types of customers, market interest rates rise, or credit quality erodes. One commenter referred to the FDIC’s post￾failure review report for Signature Bank and identified scenarios in which MRAs could necessary. Through statutory examination and reporting authorities, Congress has conferred upon the agencies the authority to exercise visitorial powers with respect to supervised institutions. 12 U.S.C. 481, 1463, 1464, 1820, 3105(c), 5412(b). The Supreme Court has indicated support for a broad reading of the agencies’ visitorial powers. See, e.g., Cuomo v. Clearing House Ass’n, L.L.C., 557 U.S. 519 (2009); United States v. Gaubert, 499 U.S. 315 (1991); United States v. Phila. Nat’l Bank, 374 U.S. 321 (1963). The visitorial powers facilitate early identification and communication of supervisory concerns that may not rise to a violation of law, unsafe or unsound banking practice, or breach of fiduciary duty under section 8 of the FDI Act. The agencies’ use of MRAs to identify material financial risks, as proposed and finalized, fits squarely within the agencies’ visitorial powers. Indeed, the agencies issued MRAs or their equivalent long before Congress provided the agencies with plenary enforcement authority. See, e.g., Comptroller of the Currency: Treasury Department, Instructions to National Bank Examiners 17–18 (1951) (“The ‘Examiners Comments on Matters Requiring Attention’ is one of the most important sections of the report [of examination].”).

31 be issued to institutions before institutions’ financial condition and performance ratios decline. The agencies reiterate that the MRA standard of the final rule requires a lower probability of material harm to the financial condition of an institution than does the final rule’s definition of unsafe or unsound practice. Accordingly, examiners may issue an MRA before an unsafe or unsound practice is present. With that framing in mind, the agencies are of the opinion that the MRA standard would have been capable of proactively addressing the risks that precipitated the failure of Silicon Valley Bank. As described in the preamble to the proposal, “reasonably foreseeable” does not necessarily mean the most likely future outcome and could include a range of possible outcomes. For example, throughout 2022, the agencies could have considered it “reasonably foreseeable” that the federal funds rate and other market interest rates would rise considerably, and an institution’s vulnerability to a significant rise in interest rates could have been grounds for an MRA. As described in section III.D of this preamble, examiners’ determination that a significant increase in interest rates was reasonably foreseeable would need to be based on objective facts and sound reasoning. The MRA standard of the final rule is broad enough to proactively capture priority supervisory issues and the identification of material financial risks without overbroad issuances of MRAs. The breadth of the MRA standard will allow the agencies to, as commenters suggested, address reasonably foreseeable economic shocks before they materialize and affect the financial condition of an institution. Speculative concerns about future harm, however, should not support the issuance of an MRA. Thus, whether an MRA in a

32 specific situation would be tailored to the unique facts and circumstances at a given institution and time. Violations of Law The agencies proposed that examiners could issue an MRA for an actual violation of a banking or banking-related law or regulation. Many commenters offered recommendations and requests for clarification on which types of violations should support the issuance of an MRA. Some commenters recommended that the use of violations of law to support the issuance of an MRA be limited to only “substantive” violations of law. These commenters also made suggestions for what should be considered a substantive violation of law, such as those that are systemic, recurring, or repetitive or that represent a failure of an institution to meet a key purpose of the underlying regulation or statute or have resulted in significant harm to consumers or members of a community. The agencies find that judicious use of MRAs to address violations will best position the agencies and institutions to address institution and customer harm. Consistent with these commenters’ recommendations and as described below, the agencies intend to exercise their supervisory discretion to issue MRAs for violations only in response to substantive violations, as described below. The following four categories of violations would support the issuance of an MRA.31 The first category of substantive violations are violations that demonstrate a pattern or are systemic. For these purposes, a violation demonstrates a pattern if there are 31 Under the agencies’ substantive violation policies, examiners must review objective facts and apply sound reasoning to determine whether a violation is substantive and, in turn, supports the issuance of an MRA.

33 repeated or ongoing violations, considering the number of violations and the length of time in which the violations occurred. Systemic violations of laws or regulations are violations that are widespread or prevalent within an institution or business line. The second category of substantive violations are violations that have, or could be reasonably expected to have, a more than minimal adverse impact on an institution’s financial condition, the accuracy of the institution’s books and records, or its customers. The “more than minimal” threshold for impacts or restitution is a lower threshold than “material” but excludes trivial or de minimis impacts or restitution. A violation that results in a more than minimal adverse impact on an institution’s financial condition must have a direct, clear, and predictable connection between the violation and the impact on an institution. Violations that have a more than minimal impact on the books and records of an institution include the filing of inaccurate Consolidated Reports of Condition and Income, depending on the relative and absolute impact of the inaccuracy, as well as other qualitative and quantitative factors the agencies deem appropriate. A more than minimal adverse impact to customers includes both financial and nonfinancial adverse impacts to customers, with “customers” referring to applicants, current customers, and former customers protected by applicable laws or regulations. The third category of substantive violations are violations that require, or could be reasonably expected to require, more than minimal restitution to make the recipients whole. Whether restitution is considered more than minimal is based on the reasonably expected size of the restitution payments, the degree of the adverse impact, and the number of persons affected by the violation.

34 Finally, the fourth category of substantive violations are violations that involve insider misconduct or self-dealing. Examples of violations involving insider misconduct or self-dealing would include violations of any law or regulation perpetrated by an insider knowingly or for the benefit of the insider or the insider’s associate. One commenter recommended that all violations should require correction. While not every violation may be correctable, and while some de minimis violations may not warrant corrections, the agencies believe that they should retain the discretion to require institutions to correct violations of law or regulation through means other than the issuance of an MRA, when appropriate. Additionally, the agencies recognize that Federal law expressly requires the agencies to take certain actions in the event of violations (e.g., the imposition of civil money penalties for violations of the National Flood Insurance Act of 1968 and the Flood Disaster Protection Act of 1973 (Flood Act)).32 Therefore, the agencies are adding a new paragraph to the rule to provide additional clarification regarding violations of banking or banking-related laws or regulations for which the agencies do not issue an MRA or take an enforcement action, which are referred to as “other violations.” Under paragraph (h), as added to the final rule, the agencies may direct an institution to remediate “other violations” and take other actions as required by applicable state or Federal law in connection with the violation. The agencies will not direct an institution to take any action other than to remediate the violation, unless such other actions are required by applicable state or Federal law. 32 Depending on the facts and circumstances, a violation of the Flood Act, like any violation of a banking or banking-related law or regulation, could meet the criteria of a substantive violation.

35 Violations for which the agencies do not issue an MRA can be considered in ratings determinations. Additionally, for purposes of FDIC-supervised institutions, if the FDIC determines at a subsequent examination or visitation that a supervised institution has failed to remediate any “other violations” after the FDIC has directed the institution to remediate the violation, the FDIC would be permitted to cite such an uncorrected violation as an MRA as part of the follow-up examination or visitation. Under the proposed rule, examiners could use the violation of law prong of the MRA standard only to issue MRAs for actual violations of law and not for violations of law that may occur in the future. One commenter expressed concern that the proposed MRA standard would not permit the agencies to cite an MRA in response to imminent violations of consumer financial protection laws. The agencies note that the final rule permits examiners to offer supervisory observations to improve an institution’s policies, practices, condition, or operations, as discussed in section III.F of this preamble. 33 Some commenters recommended that only federal banking or banking-related laws, and only those that the agencies are specifically or solely authorized to enforce, should support the issuance of an MRA. Commenters also recommended that the agencies exclude principles-based requirements, such as the Interagency Guidelines Establishing Standards for Safety and Soundness, from being used to support the issuance of an MRA.34 One commenter recommended that the agencies publish a list of categories of laws the agencies would generally consider to constitute “banking or banking-related 33 An act, practice, or failure to act that is not an actual violation of a banking or banking-related law may nonetheless support the issuance of an MRA if the act, practice, or failure to act meets the criteria of the safety and soundness prong of the MRA. 34 See 12 CFR part 30, appendix A (OCC); 12 CFR part 364, appendix A (FDIC).

36 laws.” Another commenter argued that the exclusion of violations other than banking or banking-related laws is both inconsistent with the scope of the agencies’ enforcement authority under section 8 of the FDI Act and imprudent.35 For purposes of the final rule, after consideration of the comments, the agencies are retaining the words “banking or banking-related” in the final rule.36 The agencies continue to believe that bank supervision, including the issuance of MRAs, should be focused on banking-related issues. While the agencies recognize that greater clarity may be beneficial regarding what was intended by this phrase, the agencies believe that providing an enumerated list of all such banking or banking-related laws and regulations could be overly restrictive and could prevent the agencies from effectively implementing and examining compliance with newly-adopted laws and regulations (e.g., the Guiding and Establishing National Innovation for U.S. Stablecoins Act). Therefore, the agencies are providing a general, non-exhaustive overview of how they interpret the terms “banking or banking-related laws or regulations.” Such laws or regulations involve both Federal or applicable state laws or regulations that are inherently associated with the conduct of banking or financial operations and related activities. 37 35 As previously discussed, the agencies’ authority to take an enforcement action under section 8 of the FDI Act based on violations of law is unaffected by this rulemaking, which only addresses the agencies’ issuance of MRAs based on violations of law. 36 Consistent with the proposal, the agencies will not issue MRAs in response to violations of Federal consumer financial laws, as defined by 12 U.S.C. 5481(14), for insured depository institution with total assets of more than $10 billion and any affiliate thereof. See 12 U.S.C. 5515–5516. Commenter’s concerns regarding the potential for increased consumer harm resulting from the focused scope of the agencies’ MRA authority does not allow for the agencies to exceed their statutory authority. See Patel v. Garland, 596 U.S. 328, 346 (2022) (citing Niz-Chavez v. Garland, 593 U. S. 155, 171 (2021) and Jay v. Boyd, 351 U.S. 345, 357 (1956)). 37 A State law that purports to apply to national banks, Federal savings associations, or Federal branches or agencies of a foreign bank may be preempted, for example when it prevents or significantly interferes with their exercise of Federal powers. See Cantero v. Bank of Am., N. A., 602 U.S. 205 (2024); Barnett Bank of Marion Cnty., N.A. v. Nelson, 517 U.S. 25, 33 (1996); 12 U.S.C. 25b(b)(1)(B), 1465(a), 3102(b).

37 Certain state laws, like state legal lending limits, are relevant to the safety and soundness of state-chartered institutions and are accordingly considered banking or banking related laws or regulations. Various categories of laws or regulations are properly classified as banking or banking-related. For example, laws or regulations that establish prudential requirements for institutions, such as the FDI Act or Regulation W, are banking or banking-related. Consumer protection laws or regulations applicable to bank products or services, like the Electronic Fund Transfer Act and the Equal Credit Opportunity Act, are also considered banking or banking-related. Anti-money laundering, counter-terrorist financing, and sanctions laws or regulations, including regulations issued by the Office of Foreign Assets Control to enforce economic and trade sanctions, are banking or banking-related as well. By contrast, laws that are wholly unrelated to the business of banking, including zoning or environmental laws and regulations would not be considered banking or banking-related, even though such laws and regulations apply to banks. The nature of other laws and regulations may be dependent on the context in which they are being applied. For example, an Internal Revenue Service (IRS) regulation requiring the delivery of tax forms to depositors or borrowers would be considered a banking or banking-related regulation, whereas an IRS regulation requiring employers to deliver tax forms to their employees would not be considered a banking or banking-related regulation. Nonconformance with guidelines, such as the Interagency Guidelines Establishing Standards for Safety and Soundness, is not considered a violation of banking or banking￾related law or regulation. Other comments about MRAs

38 In the proposal, the agencies noted that the agencies have often kept MRAs outstanding for a prolonged period of time after an institution has fully completed its remediation of the underlying practice, act, or failure to act because examiners seek to see demonstrated sustainability of the remediation before an MRA is closed. The agencies’ practice of keeping MRAs open past the point of full remediation has the potential to distract an institution’s board of directors and management, as well as examiners, by inflating the number of MRAs based on practices, acts, or failures to act that have already been remediated. The agencies received many comments relating to the timeframe for remediation and closure of MRAs, the information the agencies should consider when determining whether to close an outstanding an MRA, and various ways in which the agencies can further enhance their respective supervisory frameworks. The agencies have determined that these suggestions, where warranted, would be best incorporated outside of the context of this rulemaking. Moreover, experience with administering the supervisory and enforcement framework described in the final rule will inform future agency deliberations on whether revisions to the framework, consistent with these comments, are advisable.38 C. Harm to Financial Condition As described above, the agencies have added paragraph (d) of the final rule to clarify that “[h]arm to financial condition refers to financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to 38 One commenter requested that the agencies issue a request for information (RFI) in approximately 36 months of implementing the final rule to determine whether additional revisions to the agencies’ supervisory or enforcement standards are needed to effectuate the goals of the rulemaking. The agencies cannot at this time commit to issuing such an RFI but will consider institutions’ feedback on the final rule, once implemented.

39 market risk.” This codifies language included in the preamble to the proposal and defines harm to financial condition for purposes of the agencies’ definition of unsafe or unsound practices definition and MRA standard. A commenter suggested that the agencies codify this definition of harm to financial condition. Some commenters recommended that the agencies make revisions in the final rule to capture consumer harm, other than consumer harm that results from a violation of law or regulation, which may be covered by the violation of law prong of the MRA standard. The agencies decline to adopt this suggestion, as it is beyond the scope of the agencies’ statutory authorities underlying the rulemaking. Consumer harm will be captured under the final rule to the extent the underlying issues result in safety and soundness concerns or violations of law or regulation that meet the requisite standards described above. D. Basis for Agency Determinations The preamble to the proposed rule explained that the agencies proposed to rely on examiner judgment, based on objective facts and sound reasoning, to determine whether a practice, act, or failure to act met the criteria for the issuance of an MRA. Many commenters supported the agencies’ proposed reliance on objective facts and sound reasoning to determine not only whether the criteria for the issuance of an MRA are met but also whether the criteria for the definition of unsafe or unsound practice are met. The agencies agree with these commenters and have added at paragraph (f) in the final rule a statement that the agencies will use objective facts and sound reasoning to determine whether, in accordance with the requirements of the rule, the agencies may take an enforcement action based on an unsafe or unsound practice under 12 U.S.C. 1818 or issue a matter requiring attention.

40 To further promote objectivity and consistency, several commenters suggested that the agencies require examiners to provide demonstrable and quantifiable evidence to determine whether the criteria for the definition of unsafe or unsound practice or the issuance of an MRA are met. Other commenters, however, objected to requiring examiners to quantify the probability and materiality of harm, as the difficulty in making such predictions would make a quantification requirement difficult to administer and speculative in nature. The agencies agree with commenters that examiners must share with an institution the basis for their identification of an unsafe or unsound practice or the issuance of an MRA. However, the agencies also agree that a quantification requirement would give a false sense of precision due to its reliance on subjective assumptions rather than empirical evidence. Essentially, a quantification requirement would not solve for the inherent uncertainty regarding whether an institution will suffer material harm in the future. Accordingly, the agencies decline to require examiners to provide quantitative support for the identification of an unsafe or unsound practice or the issuance of an MRA. For the same reasons, the agencies decline to adopt commenter suggestions for the agencies to codify a burden of proof or burden of persuasion requirement. Instead, examiners must justify their determination that a practice, act, or failure to act is unsafe or unsound or meets the standard for the issuance of an MRA based on objective facts and sound reasoning. In addition to providing an institution with information about the basis for an unsafe or unsound practice or MRA, including a sound justification within a report of examination or supervisory letter will help inform an institution’s reasoned

41 consideration of whether to appeal an MRA or other material supervisory determination and assist the agencies in administering appeals.39 E. Tailoring Under paragraph (d) of the proposal, the agencies would have tailored their supervisory and enforcement actions under 12 U.S.C. 1818 and their issuance of MRAs based on the capital structure, riskiness, complexity, activities, asset size, and any financial risk-related factor that the agencies deemed appropriate.40 This included tailoring with respect to the requirements or expectations set forth in such actions as well as whether, and the extent to which, such actions are taken. The agencies explained that they expected that finding an unsafe or unsound practice would be a much higher bar for a community bank than for a larger institution when considered against the overall operations of the institution. Some commenters discussed the proposed tailoring standard, with many of these commenters generally in favor of the use of tailoring. For example, one commenter noted that tailoring is essential and reflects supervisory best practices. Tailoring what is considered “material harm” for each institution will, in the words of the commenter, improve supervisory effectiveness and ensure proportionate supervision. Another commenter, however, opposed the use of tailoring generally, stating that the codification of a tailoring requirement could be used as a deregulatory lever and noting that supervision is already risk-based and proportionate in practice. The tailoring provision in 39 The FDIC recently published Guidelines for Appeals of Material Supervisory Determinations, 91 FR 3184 (Jan. 26, 2026). The OCC recently published a proposed rule regarding the Bank Appeals Process, 91 FR 7163 (Feb. 17, 2026). 40 Paragraph (d) of the proposal will be redesignated as paragraph (e) in the final rule.

42 the final rule ensures risk-based supervision as it relates to unsafe or unsound practices and MRAs. In addition to general views on tailoring, commenters expressed concern with certain aspects of the tailoring standard. Specifically, several commenters expressed concern regarding the statement in the preamble to the proposal that finding an unsafe or unsound practice or concluding that an MRA was warranted would be a higher bar for a community bank than for a larger institution. One of those commenters believed that statement was counterintuitive and suggested that the agencies simply state that a risk￾based approach would result in materiality being based on an institution’s risk profile. Another commenter recommended that the agencies clarify that the tailoring standard would be implemented consistent with risk-based supervision, that is, tailored to each bank’s size, complexity, and business model. Additionally, in that commenter’s view, the rule should consider the strength of the institution’s capital and liquidity levels.41 Another commenter suggested that the agencies provide additional clarity as to supervisory expectations and requirements that are proportionate to community banks’ lower level of complexity and risk to the banking system, to ensure consistent and appropriate supervision of community banks. Alternatively, this commenter stated that the agencies could revise the tailoring framework by establishing tiers based on asset size and complexity. Another commenter said that the proposal would seem to impose higher standards on smaller banks, rather than the lower standard noted in the proposal, and that the proposal would allow greater relative risk at smaller institutions. As described in 41 The agencies note that consideration of the institution’s capital and liquidity levels, as well as other indicators of the institution’s financial condition, is generally already included in the agencies’ determination to identify an unsafe or unsound practice or issue an MRA based on potential or actual material financial harm as a result of imprudent practices.

43 more detail below, the agencies have added a paragraph to the final rule to further explain how the tailoring provisions would apply to institutions of different asset size, complexity, and risk profile. A commenter expressed concerns that the proposed tailoring standard would not require examiners to show how they applied tailoring. The commenter recommended that the agencies publish tailoring guidance—such as an illustrative matrix showing asset or complexity bands and how supervisory expectations change by band—and require examiners to describe in reports of examinations how the examiners applied tailoring. Another commenter suggested the agencies establish tiers based on asset size and complexity to ensure that the concepts of material harm would be appropriately scaled across community banks, midsize banks, and large banks. The commenter suggested regulatory text stating that the agencies shall ensure that supervisory expectations and requirements are proportionate to community banks’ lower level of complexity and risk to the banking system. Several commenters suggested that the agencies should tailor what they consider to be generally accepted standards of prudent operation. One commenter asserted that practices developed for large, highly complex, or systemically important institutions should not be treated as generalized standards applicable across the banking system. Based on consideration of the comments, the agencies are adopting in the final rule the proposed tailoring standard with certain revisions to clarify how tailoring will work. The agencies considered the commenters’ concerns, including that the proposed standard was counterintuitive and should be revised or clarified through additional guidance. For the reasons discussed below, the proposal’s tailoring standard would have

44 applied the appropriate level of rigor to community banks as well as larger institutions. The agencies have determined, however, that the proposed tailoring standard would benefit from additional clarity given the potential for confusion reflected in the comments. The benefits of additional clarity must be balanced with the need for flexibility inherent in applying the tailoring standard. To balance these interests, the agencies decided to clarify the proposed tailoring standard by adding language to the final rule that effectively codifies the explanation provided in the preamble to the proposal. That said, the agencies determined not to develop tiers based on asset size or complexity, a matrix, or other guidance on the tailoring standard at this time because, in the agencies’ view, such guidance may have an inappropriate limiting effect on the application of examiner judgment in tailoring of supervisory activities and enforcement actions under 12 U.S.C. 1818 and issuance of MRAs. In the agencies’ view, these determinations are fact specific assessments. Accordingly, the agencies determined that clarifying the tailoring standard in the final rule would provide the needed clarity without introducing an overly formulaic approach. To provide additional clarity, the final rule explains that as the risk associated with the factors identified in the tailoring provision increases: the threshold for materiality of the harm to the financial condition of an institution that constitutes an unsafe or unsound practice or warrants an MRA decreases; the assessment of the harm to the financial condition of an institution becomes more granular (e.g., specific business lines, products, or services); and the requirements under an enforcement action or MRA relating to remediation, and the expectations regarding prudent operation, increase. Similarly, the inverse is true. As the risk associated with the factors identified in the

45 tailoring provision decreases, the threshold for materiality of the harm to financial condition increases; the agencies will consider harm to financial condition with less granularity; and the requirements related to remediation, and expectations regarding prudent operation, decrease. This added clarification will codify the explanation that the agencies provided in the preamble to the proposal and is responsive to many commenter suggestions. For example, as explained in the proposal, as applied to the threshold for material harm, the agencies would not expect that a particular projected percentage decrease in capital or liquidity that rises to the level of materiality for the largest institutions would necessarily also be material for community banks. Similarly, while the agencies may consider increased classified assets in a particular business line as a result of the institution’s imprudent practices to warrant an MRA at the largest institutions, the agencies may consider a community bank’s asset quality less granularly and consider the overall asset portfolio at the institution level. For all institutions, the agencies would not expect the assessment of the harm to the financial condition of institution to be so granular that the agencies would consider the harm to financial condition to narrow products or services that were immaterial to the institution overall. As suggested by several commenters, the added clarification explicitly confirms that the agencies will tailor their expectations regarding prudent operations based on an institution’s asset size and other financial risk￾related factors. In all, added paragraph (e)(3) provides clarity regarding how the agencies will tailor their supervisory activities and enforcement actions based on unsafe or unsound practices for community banks with a lower level of complexity and large and complex institutions.

46 The final rule also includes technical revisions to the tailoring provision to clarify its scope. First, as discussed above regarding paragraph (b)(1), the tailoring provision in the final rule applies to the agencies’ supervisory activities and enforcement actions under 12 U.S.C. 1818. Second, the final rule would clarify that the tailoring provisions only apply to enforcement actions based on unsafe or unsound practices. Enforcement actions based on other conduct are beyond the scope of the final rule. F. Supervisory Observations For concerns that do not rise to the level of an MRA, the agencies proposed to continue to permit examiners to provide informal supervisory observations to enhance an institution’s policies, practices, condition, or operations without a requirement for corrective action. 42 With certain clarifications, the agencies are adopting the proposed supervisory observations standard. Supervisory observations are informal observations of objective facts identifying weaknesses in an institution’s policies, practices, condition, or operations that do not rise to the level of an MRA. Unlike MRAs, there is no requirement that an institution will take corrective action in response to a supervisory observation. 43 With respect to the proposed supervisory observation standard, one commenter supported the proposed standard because it would reduce conflation of MRAs and other informal supervisory communications. Another commenter argued that, because the proposed rule would only result in MRAs for unsafe or unsound practices, the agencies would relegate important observations to nonbinding examiner communications. As 42 Consistent with the proposal, supervisory observations are separate and distinct from requirements that the agencies impose in connection with an application, notice, or other request, including through a condition imposed in writing under 12 U.S.C. 1818. 43 To the extent a supervisory observation would refer to a violation of a banking or banking-related law or regulation for which the agencies do not take an enforcement action or issue an MRA, paragraph (h) of the final rule would allow the agencies to require the institution to remediate the violation.

47 previously discussed, the MRA standard expands beyond conduct that is considered an unsafe or unsound practice. Supervisory concerns that do not meet the MRA standard are best addressed through the use of supervisory observations. To clarify that supervisory observations are intended to address examiner findings that do not meet the standard for the issuance of an MRA, a specific reference to the MRA standard was added to more clearly define a supervisory observation. To clarify that the weaknesses described in supervisory observations do not meet the criteria of an unsafe or unsound practice, the agencies have added paragraph (g)(1) to the final rule, which explicitly states that the paragraph defining “unsafe or unsound practices” does not apply to the supervisory observation standard. As proposed, the agencies would not have been permitted to criticize an institution for declining to remediate a concern or weakness identified in a supervisory communication or to escalate the communication into an MRA on the sole basis of an institution’s lack of adoption of an examiner’s suggestion offered in multiple examination cycles. One commenter disagreed with the agencies and suggested that the agencies permit examiners to escalate supervisory observations into MRAs when an institution repeatedly declines to adopt an examiner recommendation. It is critical that institutions, and not the agencies, exercise their own judgment on whether, when, and how to enhance their policies, practices, condition, or operations, unless otherwise required by an MRA or an enforcement action. Accordingly, supervisory observations do not warrant escalation into an MRA absent a change in the institution or its operating environment that would support the issuance of an MRA, in accordance with the final rule’s standard for issuing MRAs. To

48 the extent there is an actual or increased probability of deterioration to an institution’s condition following the communication of a supervisory observation, the circumstances underlying the observation could later be the basis for an MRA or enforcement action, but only if the criteria for an MRA or enforcement action are satisfied. The agencies indicated in the preamble to the proposed rule several limitations on how the agencies would use supervisory observations. The agencies would not be permitted to require an institution to submit an action plan to incorporate examiners’ supervisory observations. Examiners would not be permitted, and the institution would not be required, to track the institution’s implementation of changes in response to supervisory observations. Although examiners would be permitted to informally make such supervisory observations to the institution’s board of directors, the institution’s management would not be required to present the supervisory observations to the institution’s board of directors. Some commenters recommended that the agencies codify these limitations in the final rule. Codification of some of these limitations will promote transparency and clarity. 44 Accordingly, the final rule explicitly states that a supervisory observation does not create a requirement or supervisory expectation that a supervisory observation will be presented to an institution’s board of directors. The agencies note that this would not prohibit an examiner from informally providing feedback regarding how an institution could address weaknesses identified in a supervisory observation. Each institution’s board of directors and management, informed by supervisory observations and independent judgment, can determine whether to implement changes to enhance the 44 The agencies will oversee the implementation of the supervisory observation framework to promote effective use of supervisory observations by examiners, consistent with the requirements of the final rule.

49 institution’s policies, practices, condition, or operations. Examiners could not require or suggest any expectation that the institution take any corrective action in response to a supervisory observation.45 However, consistent with the proposal, the agencies can use the information underlying supervisory observations to support assigned ratings. G. Other Comments Received The agencies received various other comments on the proposed rulemaking. Many of these commenters suggested other reforms to the agencies’ supervisory and enforcement action processes. Some commenters addressed the agencies’ suggestion in the preamble to the proposal that the agencies require any downgrade to a CAMELS composite rating under the Uniform Interagency Rating System of 3 or below to be accompanied by an MRA or enforcement action. Upon further consideration, the agencies have determined this proposal, as well as other reforms to the agencies’ supervisory and enforcement action processes beyond the identification of unsafe or unsound practices and issuance of MRAs, is beyond the scope of this rulemaking.46 The agencies will consider these comments, as appropriate, when considering other changes to their supervisory and enforcement action processes. IV. Impact Analysis 45 As a corollary of there being no requirement or supervisory expectation that an institution will take corrective action in response to a supervisory observation, the institution will not be required to submit an action plan to address a supervisory observation or track the implementation of a voluntary decision to address a supervisory observation. Examiners will also be prohibited from tracking the institution’s voluntary implementation of changes in response to a supervisory observation, outside of normal recordkeeping related to examinations. 46 On May 19, 2026, the Federal Financial Institutions Examination Council (FFIEC) published a proposed notice to request comment on proposed revisions to the CAMELS rating system. The proposed FFIEC notice would recommend strengthening the link between CAMELS ratings and a financial institution’s safety and soundness by focusing component and composite ratings on factors that materially affect an institution’s financial condition and risk profile, and by improving the transparency of CAMELS ratings. The agencies have determined that any changes to their rating processes would be premature while the FFIEC proposal is pending.

50 OCC Expected Effects A. Introduction The OCC is issuing a final rule to establish certain definitions and standards for certain OCC supervisory activities and enforcement actions against an institution that is a national bank, Federal savings association, or Federal branch or agency of a foreign bank (collectively, institutions). The rule will establish a regulatory definition for the term “unsafe or unsound practice,” a revised standard for the issuance of MRAs, and other supervisory tools to ensure that institutions prioritize material financial risks. B. Regulatory Baseline The OCC assumes that the various courts’ definitions of the term “unsafe or unsound practice” and the OCC supervisory standards, including its MRA standard, in effect immediately before the OCC proposed this rule are the relevant regulatory baselines. C. Background As previously discussed, the OCC is issuing this final rule to promote greater clarity and certainty regarding certain enforcement and supervision standards and to ensure that examiners and institutions prioritize material financial risks. The final rule establishes for OCC-supervised institutions a uniform definition for the term “unsafe or unsound practice” for purposes of enforcement actions under 12 U.S.C. 1818 and supervisory activities. Additionally, the final rule establishes uniform standards for when and how the agencies may communicate MRAs and “other violations” as part of the examination process. Furthermore, the final rule also clarifies how the OCC will tailor its supervisory activities and enforcement actions based on unsafe or unsound practices and

51 its issuance of MRAs. Finally, the final rule permits the OCC examiners to offer informal observations, referred to as “supervisory observations,” to institutions. D. Parties Affected by the Final Rule The OCC currently supervises 986 institutions.47 Because all OCC-supervised institutions were subject to the supervisory and enforcement standards in effect immediately before the OCC proposed this rule, the rule would affect all 986 institutions the OCC supervises. E. Costs and Benefits i. Cost Savings from Decreased Regulatory Compliance Burden The final rule would result in several direct benefits to institutions, namely, significant cost and time savings to institutions. Additionally, the final rule does not impose new mandates or costs related thereto on institutions. Under the final rule, the OCC expects that it will issue fewer MRAs and take fewer enforcement actions under 12 U.S.C. 1818 on the basis of an unsafe or unsound practice. As a result, institutions would have fewer MRAs and enforcement actions to address and remediate. Institutions can incur significant direct costs arising from MRAs and enforcement actions. For example, in response to an MRA or an enforcement action, some institutions hire external consultants, for which hourly rates can range from between $300 to $1,200 an hour for top-tier firms or $150 to $300 an hour for lower-tier firms, or financial advisory firms that charge institutions $250 to $550 per hour.48 To the 47 Based on data accessed using the Financial Institution Data Retrieval System (FINDRS) on July 29, 2026. 48 See Clancy Fossum, Embark, What are the Fees & Hourly Rates of Accounting Consulting Firms? (Nov. 13, 2019), https://blog.embarkwithus.com/what-are-the-fees-hourly-rates-of-accounting-consulting￾firms#:~:text=in%20each%20category.-

52 extent that there may be less need for consultants, institutions will directly benefit from consultant cost savings. In addition to consultant fees, institutions incur other direct costs to successfully address MRAs and enforcement actions, including the payment of civil money penalties. These costs may include increased hiring and retention of appropriately qualified employees, training for existing employees, time expenditure of employees (which may include time spent addressing MRAs and enforcement actions, time by management and the board to review and approve changes made, time spent working with external consultants, time conducting internal audit verification, and time spent in partnership with the OCC in ongoing follow up communications and examinations specific to the issue), updating processes and procedures, and addressing the supervisory concern that is the basis of the MRA or the enforcement action. If the MRA or enforcement action has to do with institution systems or infrastructure, these costs could include technology costs, which could be very costly expenditures. If institutions do not appropriately address MRAs and enforcement actions in a timely fashion, they may also incur additional fines and penalties49 on top of the costs to remediate the issue itself.50 ,Big%204%20Firms,global%20footprints%2C%20and%20charge%20accordingly.&text=Although%20Bi g%204%20fees%20in,be%20aware%20of%20before%20proceeding; Consulting Mavericks, Average Consulting Rates by Industry, https://consultingmavericks.com/start/other/average-consulting-rates-by￾industry/ (last visited Sept. 26, 2025). 49 To reiterate, under the final rule, an institution’s mere failure to remediate an MRA does not constitute an unsafe or unsound practice. 50 See Perry Menezes et al., CSO, How Financial Institutions Can Reduce Security and Other Risks from MRAs (Aug. 29, 2023), https://www.csoonline.com/article/650386/how-financial-institutions-can-reduce￾security-and-other-risks-from￾mras.html#:~:text=MRAs%20are%20expensive,has%20not%20done%20its%20job; See also Monticello Consulting Group, Building Regulatory Resilience: A Deeper Look into Consent Orders & MRAs (Apr. 20, 2021), https://www.monticellocg.com/blog/2021/04/20/building-regulatory-resilience-a-deeper-look-into￾consent-orders-mras#_ftn2 (stating that the largest banks in the United States have incurred almost $200 billion in aggregate fines and penalties during a 20-year period ending around early 2021).

53 While it would be difficult to precisely quantify the overall aggregate annual direct cost savings to institutions, the OCC expects that cost savings will likely exceed $100 million due to the decrease in the number of MRAs issued to institutions. In addition to the significant direct cost savings described above, institutions could potentially experience several indirect benefits, including clarity regarding, and consistent application of MRA or enforcement concerns, as well as less staffing turnover. ii. Costs and Benefits Relating to the Safety and Soundness of Institutions The final rule imposes no new mandates, and thus no direct costs, on institutions, and has a low probability of causing indirect costs to institutions. Regarding indirect costs, the narrowed MRA standard of the final rule could delay the identification of supervisory risks. This delayed identification could result in higher costs to resolve supervisory concerns, associated losses, and in extreme cases, failure. Nevertheless, the OCC determined it is unlikely that the final rule will result in the delayed identification of supervisory risks because the definition of unsafe or unsound practice and standard for the issuance of MRAs endeavor to more effectively prioritize the identification of material financial risks (i.e., those most likely to cause significant stress) and therefore to lower the risk of institution failure. Accordingly, it is also possible that under the final rule, risks to institutions, including the risk of failure, could decrease significantly; under the final rule, examiners and institutions would prioritize the identification and remediation of supervisory concerns that could result in material financial loss to institutions. Ultimately, the net effect will be dependent upon OCC’s policies and oversight, as well as how institutions’ management respond to this rule. FDIC Expected Effects

54 As previously discussed, the agencies are amending their regulations to define the term “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act and revise the framework for communicating MRAs to supervised insured depository institutions (IDIs)51 to focus on practices, acts, or failures to act that, if continued, could reasonably be expected to, under current or reasonably foreseeable conditions, (A) materially harm the financial condition of an institution or (B) present a material risk of loss to the DIF, or violations of a banking or banking-related law or regulation. The final rule will provide a consistent nationwide standard for the issuance of MRAs to promote greater clarity for IDIs. This analysis utilizes all regulations and guidance applicable to IDIs supervised by the agencies, as well as information on the financial condition of supervised IDIs as of the quarter ending March 31, 2026, as the baseline to which the effects of the final rule are considered. The final rule is substantially similar to the proposal, with two primary modifications: (1) the final rule would remove institution-affiliated parties from its scope; and (2) the final rule would create a newer category of “other” violations of laws and regulations that the agencies may cite and which may not rise to the level of an MRA. As noted in section III of this preamble, enforcement actions against institution￾affiliated parties under the final rule will continue to be handled under the agencies’ prior standards and procedures. As such, institution-affiliated parties are not expected to be impacted by the final rule, relative to the baseline. Similarly, the agencies currently cite 51 The FDIC’s rule applies to an institution that is an insured State nonmember bank, insured State licensed branch of a foreign bank, or an insured State savings association.

55 other violations of banking and banking-related laws and regulations. The final rule would maintain this practice, but it would limit the remedies that the agencies could seek for such other violations (i.e., the agencies will only be permitted to direct IDIs to remediate other violations and take such other actions as may be required by law). As such, IDIs are not expected to be adversely impacted by the final rule, relative to the baseline. A. Scope The final rule does not impose any obligations on supervised IDIs, and supervised IDIs do not need to take any action in response to this rule. The final rule requires the FDIC to revise its current practices regarding the identification and communication of examination findings. Therefore, the FDIC is the only entity directly affected by the final rule. The final rule affects supervised IDIs through examinations and reports of examination conducted by the agencies. All 2,700 FDIC-supervised IDIs subject to examinations as of March 31, 2026, could be affected by the final rule.52 B. Benefits and Costs The following subsections discuss qualitatively the benefits and costs of the final rule. Benefits to IDIs The final rule poses two types of benefits to supervised IDIs: (1) reductions in, or more efficient use of, resources to comply with findings from reports of examinations; and (2) possible increases in proceeds from the provision of banking products and 52 See Consolidated Reports of Condition and Income (Call Reports), March 31, 2026.

56 services. By raising the standard against which an IDI’s action, or inaction, is assessed to be eligible for an MRA, IDIs may experience lower volumes of examination findings, particularly MRAs. Further, by potentially reducing the number of examination findings not related to material risks to the financial condition of the IDI, the final rule may enable IDIs that do receive MRAs to more effectively address those risks. Finally, by enacting a consistent definition of conditions that merit the use of MRAs by the FDIC, the final rule improves clarity and reduces uncertainty of findings in reports of examinations, relative to the baseline. Such reductions in findings and increases in clarity may reduce compliance costs or increase the efficiency with which compliance costs are expended by IDIs to respond to ROE findings. The FDIC does not have the information necessary to quantify such potential benefits. Negative feedback from regulators during the examination process may discourage IDIs from taking part in activities and could result in reduced provision of banking products and services. To the extent that matters requiring the attention of an institution’s board of directors and management are currently identified and used in a way that raises potential chilling effects, the final rule could result in fewer such effects relative to the baseline. A reduction in chilling effects could enable IDIs to provide financial products and services to entities that they would not have otherwise. The FDIC does not have the data necessary to quantify this potential benefit. Costs to IDIs The final rule may reduce the volume of examination findings communicated to IDIs, and this could pose certain costs. To the extent that the final rule results in delays in the identification of material risks to the financial condition of an IDI, such entities could

57 incur higher costs to resolve such issues, associated losses, and in extreme cases, failure. However, as previously discussed, the FDIC expects that the final rule’s definition of unsafe or unsound practice better prioritizes the identification and communication of such risks. Therefore, the FDIC anticipates that delayed identification of such risks is unlikely, because risks that are likely to lead to losses or failure will still be in scope under the final rule. Moreover, it is also possible that under the final rule, risks to IDIs and risks of IDI failures could decrease because, under the final rule, IDI management and examiners will prioritize the identification and remediation of issues that could result in material financial loss to IDIs. Effects on Households and Small Businesses A comment letter on the proposed rule requested a discussion of the expected effects of the rule on households and small businesses. As mentioned, the final rule imposes no direct requirements on the IDIs supervised by the FDIC, so any effects would be a consequence of the effects on the IDIs. The reduction of regulatory burden and chilling effects for supervised IDIs, as discussed above, may result in lower prices of their financial products and services, or an increase in credit or other product offerings. Potentially lower prices or increasing credit availability would benefit the customers of IDIs and may be particularly valuable to price-sensitive customers or customers with more limited access to credit, including many households and small businesses. The FDIC lacks the data needed to estimate this potential impact. Alternatives Considered The agencies considered adopting the proposed rule without changes. As discussed earlier, the agencies made several revisions in the final rule that the agencies

58 determined to be an improvement over the proposal. The agencies determined not to finalize the rule’s application to institution affiliated parties to avoid impeding or distorting incentives regarding enforcement actions against institution-affiliated parties. The final rule clarifies the proposed tailoring provision by describing how the agencies will apply the provision as the risks associated with various financial risk-related factors increase. Additionally, the final rule clarifies the supervisory observation standard, adds a definition of “harm to financial condition,” and establishes the “other violations” mechanism to require the correction of actual violations of banking or banking-related laws for which the agencies do not take an enforcement action or issue an MRA. The agencies also considered the suggestions made by commenters that included alternatives to the final rule, such as establishing a broader MRA standard than that adopted by this rule and eliminating the issuance of MRAs based on an institution’s internal audit findings. The agencies also considered, but did not adopt, an alternative rule framework that would use a quantified definition of likelihood or material. For example, some commenters suggested a minimum percentage (e.g., 10 percent, 51 percent) as part of the final rule’s definition of “unsafe or unsound practice” for a harm to be considered “likely.” Other commenters suggested clarifications or quantifications of what risks would be consistent with “material” harm and to consider including specific absolute dollar floors or percentage impacts on metrics, such as tier-1 capital, in defining “material.” As discussed in section II of this preamble, after careful consideration, the agencies determined the definitions adopted in the final rule best meet the rule’s objectives to promote greater clarity and certainty regarding enforcement and supervision standards so that examiners and institutions may prioritize material financial risks to

59 institutions and avoid unnecessary regulatory burden. For a complete discussion of the comments considered, see section III of this preamble. For the reasons articulated above, the agencies believe the final rule is preferred over the alternatives. V. Administrative Law Matters A. Paperwork Reduction Act The Paperwork Reduction Act of 199553 (PRA) states that no agency may conduct or sponsor, nor is the respondent required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. The agencies have reviewed this rule and determined that it does not create any information collection or revise any existing collection of information. One commenter asserted that the MRA standard that the agencies are adopting creates information collection, recordkeeping, and disclosure requirements for institutions, and that the rule thus failed to comply with the procedural requirements of the PRA. The commenter misunderstands the nature of this rulemaking, as this rulemaking is not the source of the agencies’ authority to issue MRAs. The agencies’ visitorial authority provides the agencies with the authority to issue MRAs, and the rule does not impose any requirements on institutions. Furthermore, each MRA is tailored to the specific issues examiners identify at an institution, so the final rule does not require the same information from 10 or more entities. Accordingly, no PRA submissions to OMB will be made with respect to this rule. B. Regulatory Flexibility Act Analysis OCC 53 44 U.S.C. 3501–3521.

60 In general, the Regulatory Flexibility Act (RFA)54 requires an agency, in connection with a final rule, to prepare a final regulatory flexibility analysis describing the impact of the rule on small entities (defined by the U.S. Small Business Administration (SBA) for purposes of the RFA to include commercial banks and savings institutions with total assets of $850 million or less and trust companies with total assets of $47 million or less). However, under section 605(b) of the RFA, this analysis is not required if an agency certifies that the rule would not have a significant economic impact on a substantial number of small entities and publishes its certification and a short explanatory statement in the Federal Register along with its final rule. The OCC currently supervises approximately 602 small entities, all of which may be impacted by the rule.55 In general, the OCC classifies the economic impact on an individual small entity as significant if the total estimated impact in one year is greater than 5 percent of the small entity’s total annual salaries and benefits or greater than 2.5 percent of the small entity’s total non-interest expense. Furthermore, the OCC considers 5 percent or more of OCC-supervised small entities to be a substantial number. Thus, at present, 30 OCC-supervised small entities would constitute a substantial number. The final rule will affect all covered institutions, including national banks, Federal savings associations, and Federal branches or agencies of foreign banks. Therefore, the final rule will apply to a substantial number of small entities. The OCC expects that the 54 5 U.S.C. 601 et seq. 55 The OCC bases its estimate of the number of small entities on the SBA’s size thresholds for commercial banks and savings institutions, and trust companies, which are $850 million and $47 million, respectively. Consistent with the General Principles of Affiliation, 13 CFR 121.103(a), the OCC counts the assets of affiliated financial institutions when determining if it should classify an OCC-supervised institution as a small entity. The OCC uses December 31, 2025, to determine size because a “financial institution’s assets are determined by averaging the assets reported on its four quarterly financial statements for the preceding year.” See footnote 8 of the SBA’s Table of Size Standards.

61 final rule will reduce the aggregate annual number of MRA issuances across OCC￾supervised institutions. This reduction in the number of MRAs issued will, in turn, reduce the burden for institutions relating to MRA remediation. Additionally, the OCC expects that the final rule will result in a decrease in the annual number of MRAs escalated to enforcement actions, which will provide de minimis cost savings. Therefore, the Comptroller of the Currency certifies that this final rule will not have a significant economic impact on a substantial number of small entities. A final regulatory flexibility analysis is thus not required. One commenter argued that the MRA standard that the OCC is adopting imposes new costs on institutions, including small entities. The codified MRA standard does not impose any new obligations, and thus no direct costs, on institutions. FDIC The RFA generally requires that an agency, in connection with a final rule, prepare and make available for public comment a final regulatory flexibility analysis that describes the impact of the final rule on small entities.56 However, a final regulatory flexibility analysis is not required if the agency certifies that the final rule will not have a significant economic impact on a substantial number of small entities. The SBA has defined small entities to include banking organizations with total assets of less than or equal to $850 million.57 Generally, the FDIC considers a significant economic impact to 56 See 5 U.S.C. 601 et seq. 57 The SBA defines a small banking organization as having $850 million or less in assets, where an organization’s “assets are determined by averaging the assets reported on its four quarterly financial statements for the preceding year.” See 13 CFR 121.201 (as amended by 87 FR 69118, effective December 19, 2022). In its determination, the “SBA counts the receipts, employees, or other measure of size of the concern whose size is at issue and all of its domestic and foreign affiliates.” See 13 CFR 121.103. Following these regulations, the FDIC uses an insured depository institution’s affiliated and acquired

62 be a quantified effect in excess of 5 percent of total annual salaries and benefits or 2.5 percent of total noninterest expenses of the regulated small entity. As detailed in the following statement of factual basis, the FDIC certifies that the final rule will not have a significant economic impact on a substantial number of small entities. To evaluate the impact of the final rule on small entities regulated by the FDIC, this analysis considers all relevant regulations and guidance applicable to these institutions, together with financial data for all IDIs, as the baseline to which the effects of the final rule are considered. As of the quarter ending March 31, 2026, the FDIC supervised 2,700 IDIs, of which 1,978 are small entities for the purposes of the RFA.58 Only a subset of small, FDIC-supervised IDIs are examined in a given year.59 As noted in the RFA section of the proposal, the FDIC believed that the proposal would not impose any obligations on small, FDIC-supervised entities, and supervised entities would not need to take any action in response.60 The FDIC did not receive any comments in response to its RFA analysis of the proposal. Like the proposed rule, the final rule will not directly impose any obligations on small, FDIC-supervised entities, and such supervised entities will not need to take any action in response. The final rule requires the FDIC to revise its current practices regarding the communication of IDI examination findings. Therefore, the FDIC will be the only entity directly affected by the rule. assets, averaged over the preceding four quarters, to determine whether the insured depository institution is “small” for the purposes of RFA. 58 See Call Reports, March 31, 2026. 59 Based on 1,978 small FDIC-supervised IDIs, the FDIC estimates a range of 1,319 examinations to 1,978 examinations per year. The estimate assumes qualifying IDIs are examined once every 18 months (1,978 / 1.5 = 1,319) and non-qualifying IDIs are examined every 12 months. 60 See 90 FR 48835 at 48845.

63 In light of the foregoing statement of factual bases, the FDIC certifies that the final rule will not have a significant economic impact on a substantial number of small entities and, therefore, a final regulatory flexibility analysis is not required. C. Unfunded Mandates Reform Act of 1995 Consistent with the Unfunded Mandates Reform Act (UMRA), the review considers whether the mandates imposed by the rule may result in an expenditure of $100 million or more by State, local, and tribal governments, or by the private sector, in any one year, adjusted annually for inflation (currently $193 million). One commenter argued that the MRA standard that the agencies are adopting imposes new costs on institutions, potentially in excess of $193 million, and requested that the agencies either provide data and reasoning why total costs impose are less than $193 million or publish the UMRA￾required written statement. The codified MRA standard does not impose any new obligations on institutions. Accordingly, the OCC estimates that the final rule would not require additional expenditure from OCC-regulated entities, nor will it require expenditures of $193 million or more by State, local, and tribal governments, or by other segments of the private sector. Thus, the OCC believes the rule is not a significant rule for the purposes of the UMRA. Accordingly, the OCC has not prepared the written statement described in section 202 of the UMRA. 61 D. Riegle Community Development and Regulatory Improvement Act of 1994 Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act (RCDRIA) of 1994,62 in determining the effective date and 61 The FDIC also notes that independent regulatory agencies, like the FDIC, are not subject to UMRA. See 2 U.S.C. 658(1), 1502(1). 62 12 U.S.C. 4802(a).

64 administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, the OCC and FDIC must consider, consistent with principles of safety and soundness and the public interest (1) any administrative burdens that the final rule would place on depository institutions, including small depository institutions and customers of depository institutions and (2) the benefits of the final rule. This rulemaking would not impose any reporting, disclosure, or other requirements on insured depository institutions. Therefore, section 302(a) does not apply to this final rule. E. Congressional Review Act Subtitle E of the Small Business Regulatory Enforcement Fairness Act of 1996 (also known as the Congressional Review Act) defines a “major rule” as a rule that the Administrator of OMB’s Office of Information and Regulatory Affairs (OIRA) finds has resulted in or is likely to result in:

1. An annual effect on the economy of $100 million or more;
2. A major increase in costs or prices for consumers, individual industries, Federal, State, or local government agencies, or geographic regions; or
3. Significant adverse effects on competition, employment, investment, productivity, innovation or on the ability of U.S.-based enterprises to compete with foreign-based enterprises in domestic and export markets.63 OMB has determined that the final rule is a major rule for purposes of the Congressional Review Act. As required, the agencies will submit the final rule and other appropriate reports to Congress and the Government Accountability Office for review. 63 5 U.S.C. 804(2).

65 F. Executive Orders 12866 and 14192

1. Executive Order 12866 Section 3(f) of Executive Order 12866 defines a “significant regulatory action” as a regulatory action that is likely to result in a rule that may: (1) Have an annual effect on the economy of $100 million or more or adversely affects in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities; (2) Create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) Materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) Raise novel legal or policy issues arising out of legal mandates, the President’s priorities, or the principles set forth in Executive Order 12866. OIRA has determined that this final rule is a significant regulatory action under section 3(f)(1) of Executive Order 12866 and, therefore, is subject to review under Executive Order 12866.
2. Executive Order 14192 Executive Order 14192, titled “Unleashing Prosperity Through Deregulation,” was issued on January 31, 2025. Section 3(a) of Executive Order 14192 requires an agency, unless prohibited by law, to identify at least ten existing regulations to be repealed when the agency publicly proposes for notice and comment or otherwise promulgates a new regulation. In furtherance of this standard, section 3(c) of Executive

66 Order 14192 requires that the new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least ten prior regulations. This rule is considered a deregulatory action under Executive Order 14192. List of Subjects 12 CFR Part 4 Administrative practice and procedure, Freedom of information, Individuals with disabilities, Minority businesses, Organization and functions (Government agencies), Reporting and recordkeeping requirements, Women. 12 CFR Part 305 Banks, Banking, Organization and functions (Government agencies). DEPARTMENT OF THE TREASURY Office of the Comptroller of the Currency 12 CFR Chapter I Authority and Issuance For the reasons set forth in the preamble, and under the authority of 12 U.S.C. 93a, chapter I of title 12 of the Code of Federal Regulations is amended as follows: PART 4—ORGANIZATION AND FUNCTIONS, AVAILABILITY AND RELEASE OF INFORMATION, CONTRACTING OUTREACH PROGRAM, POST-EMPLOYMENT RESTRICTIONS FOR SENIOR EXAMINERS

1. The authority citation for part 4 is revised to read as follows: Authority: 5 U.S.C. 301, 552; 12 U.S.C. 1, 93a, 161, 481, 482, 484(a), 1442, 1462a, 1463, 1464, 1467a, 1817(a), 1818, 1820, 1821, 1831m, 1831p-1, 1831o, 1833e, 1867, 1951 et seq., 2601 et seq., 2801 et seq., 2901 et seq., 3101 et seq., 3102(b), 3401 et seq., 3501(c)(1)(C), 5321, 5412, 5414; 15 U.S.C. 77uu(b), 78q(c)(3); 18 U.S.C. 641, 1905, 1906; 29 U.S.C. 1204; 31 U.S.C. 5318(g)(2), 9701; 42 U.S.C. 3601; 44 U.S.C. 3506, 3510; E.O. 12600, 52 FR 23781, 3 CFR, 1987 Comp., p. 235.

67 2. Add § 4.92 to read as follows: § 4.92 Enforcement and supervisory standards. (a) Scope. This section prescribes the definitions and standards for certain OCC supervisory activities and enforcement actions against an institution that is a national bank, Federal savings association, or Federal branch or agency of a foreign bank. (b) Unsafe or unsound practices. For purposes of the OCC’s enforcement actions under 12 U.S.C. 1818 and supervisory activities, an “unsafe or unsound practice” is a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that: (1) Is contrary to generally accepted standards of prudent operation; and (2) (i) If continued, is likely to— (A) Materially harm the financial condition of the institution; or (B) Present a material risk of loss to the Deposit Insurance Fund; or (ii) Materially harmed the financial condition of the institution. (c) Matters requiring attention. The OCC may only issue a matter requiring attention to an institution for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that: (1) (i) Is contrary to generally accepted standards of prudent operation; and (ii) (A) If continued, could reasonably be expected to, under current or reasonably foreseeable conditions: (1) Materially harm the financial condition of the institution; or (2) Present a material risk of loss to the Deposit Insurance Fund; or (B) Materially harmed the financial condition of the institution; or

68 (2) Is an actual violation of a banking or banking-related law or regulation. (d) Harm to financial condition. Harm to financial condition refers to financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk. (e) Tailored application required. (1) The OCC will tailor its supervisory activities and enforcement actions based on unsafe or unsound practices under 12 U.S.C. 1818 and its issuance of matters requiring attention based on the risks associated with the institution’s capital structure, complexity, activities, asset size, and any other financial risk-related factor that the OCC deems appropriate. (2) Tailoring required by this paragraph (e)(1) of this section includes tailoring with respect to the requirements or expectations set forth in enforcement actions based on unsafe or unsound practices under 12 U.S.C. 1818 and in matters requiring attention, as well as whether, and the extent to which, such actions and matters are taken or issued. (3) As the risk associated with the factors identified in paragraph (e)(1) of this section increases: (i) The threshold for materiality of the harm to the financial condition of an institution to take or issue an action or matter decreases; (ii) The assessment of the harm to the financial condition of institution becomes more granular (e.g., specific business lines, products, or services); and (iii) The requirements under the action or matter relating to remediation, and the expectations regarding prudent operation, increase. (f) Basis for OCC determinations. The OCC will use objective facts and sound reasoning to determine whether, in accordance with paragraphs (b) through (e) of this

69 section, the OCC may take an enforcement action based on an unsafe or unsound practice under 12 U.S.C. 1818 or issue a matter requiring attention. (g) Clarification regarding supervisory observations. (1) Paragraph (b) of this section does not apply to supervisory observations. (2) A supervisory observation is an informal observation that does not rise to the level of a matter requiring attention, as described in paragraph (c) of this section, that identifies weaknesses in an institution’s policies, practices, condition, or operations. (3) A supervisory observation does not create a requirement or supervisory expectation that the supervisory observation will be presented to the institution’s board of directors or that the institution will take corrective action in response to the supervisory observation. (h) Other violations. An actual violation of a banking or banking-related law or regulation for which the OCC does not take an enforcement action or issue a matter requiring attention is an other violation. (1) The OCC may require an institution to remediate an other violation. (2) The OCC may take such other actions as are required by law in connection with an other violation. FEDERAL DEPOSIT INSURANCE CORPORATION 12 CFR Chapter III Authority and Issuance For the reasons set out in the preamble, title 12 of the Code of Federal Regulations is amended as follows: 3. Add part 305, consisting of § 305.1, to read as follows:

70 PART 305—ENFORCEMENT AND SUPERVISION STANDARDS Sec. 305.1 Enforcement and supervisory standards. Authority: 12 U.S.C. 1818, 1819(a) (Seventh, Eighth, and Tenth), 1831p–1. § 305.1 Enforcement and supervisory standards. (a) Scope. This section prescribes the definitions and standards for certain FDIC supervisory activities and enforcement actions against an institution that is an insured State nonmember bank, insured State licensed branch of a foreign bank, or an insured State savings association. (b) Unsafe or unsound practices. For purposes of the FDIC’s enforcement actions under 12 U.S.C. 1818 and supervisory activities, an “unsafe or unsound practice” is a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that: (1) Is contrary to generally accepted standards of prudent operation; and (2) (i) If continued, is likely to— (A) Materially harm the financial condition of the institution; or (B) Present a material risk of loss to the Deposit Insurance Fund; or (ii) Materially harmed the financial condition of the institution. (c) Matters requiring attention. The FDIC may only issue a matter requiring attention to an institution for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that: (1) (i) Is contrary to generally accepted standards of prudent operation; and (ii) (A) If continued, could reasonably be expected to, under current or reasonably foreseeable conditions:

71 (1) Materially harm the financial condition of the institution; or (2) Present a material risk of loss to the Deposit Insurance Fund; or (B) Materially harmed the financial condition of the institution; or (2) Is an actual violation of a banking or banking-related law or regulation. (d) Harm to financial condition. Harm to financial condition refers to financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk. (e) Tailored application required. (1) The FDIC will tailor its supervisory activities and enforcement actions based on unsafe or unsound practices under 12 U.S.C. 1818 and its issuance of matters requiring attention based on the risks associated with the institution’s capital structure, complexity, activities, asset size, and any other financial risk-related factor that the FDIC deems appropriate. (2) Tailoring required by this paragraph (e)(1) of this section includes tailoring with respect to the requirements or expectations set forth in enforcement actions based on unsafe or unsound practices under 12 U.S.C. 1818 and in matters requiring attention, as well as whether, and the extent to which, such actions and matters are taken or issued. (3) As the risk associated with the factors identified in paragraph (e)(1) of this section increases: (i) The threshold for materiality of the harm to the financial condition of an institution to take or issue an action or matter decreases; (ii) The assessment of the harm to the financial condition of institution becomes more granular (e.g., specific business lines, products, or services); and

72 (iii) The requirements under the action or matter relating to remediation, and the expectations regarding prudent operation, increase. (f) Basis for FDIC determinations. The FDIC will use objective facts and sound reasoning to determine whether, in accordance with paragraphs (b) through (e) of this section, the FDIC may take an enforcement action based on an unsafe or unsound practice under 12 U.S.C. 1818 or issue a matter requiring attention. (g) Clarification regarding supervisory observations. (1) Paragraph (b) of this section does not apply to supervisory observations. (2) A supervisory observation is an informal observation that does not rise to the level of a matter requiring attention, as described in paragraph (c) of this section, that identifies weaknesses in an institution’s policies, practices, condition, or operations. (3) A supervisory observation does not create a requirement or supervisory expectation that the supervisory observation will be presented to the institution’s board of directors or that the institution will take corrective action in response to the supervisory observation. (h) Other violations. An actual violation of a banking or banking-related law or regulation for which the FDIC does not take an enforcement action or issue a matter requiring attention is an other violation. (1) The FDIC may require an institution to remediate an other violation. (2) The FDIC may take such other actions as are required by law in connection with an other violation. Jonathan V. Gould, Comptroller of the Currency.

73 Federal Deposit Insurance Corporation. By order of the Board of Directors. Dated at Washington, DC on August 27, 2026. Jennifer M. Jones, Deputy Executive Secretary.