On August 27, the OCC and the FDIC finalized a joint rule, effective November 2, defining the term “unsafe or unsound practice” for purposes of Section 8 of the FDI Act and establishing uniform standards for the issuance of Matters Requiring Attention (MRAs). Consistent with the October 2025 proposal (previously covered by InfoBytes here), the final rule defines an unsafe or unsound practice as one that is contrary to generally accepted standards of prudent operation and that, if continued, is likely to materially harm the financial condition of an institution or present a material risk of loss to the Deposit Insurance Fund — or that has already caused such material harm to the institution — and permits agencies to issue an MRA only for practices that meet this standard or that constitute an actual violation of a banking or banking-related law or regulation. The rule requires agencies to tailor supervisory and enforcement actions based on any financial risk-related factor the agencies deem appropriate, including capital structure, complexity, activities, and asset size, and states that examiners must prioritize material financial risks over concerns related to policies, process, documentation, and other nonfinancial risks. The final rule also establishes categories below MRAs, including supervisory observations and “other violations,” for concerns that do not meet the MRA threshold.

Among the modifications agencies adopted (i.e., changes from the proposal), the final rule explicitly limits its scope to institutions the agencies supervise — dropping its application to institution-affiliated parties, which the agencies noted could have created unintended obstacles for addressing individual misconduct at larger institutions. It also clarifies that an institution’s mere failure to remediate an MRA does not itself constitute an unsafe or unsound practice. In connection with the final rule, the OCC also released PPM 5400-11, “Matters Requiring Attention,” which replaces PPM 5400-14, “Violations of Laws and Regulations,” and released a substantially revised PPM 5310-3, “Bank Enforcement Actions and Related Matters,” anchoring the agencies’ enforcement framework to three guiding principles: escalation, tailoring, and focus.

Separately, the OCC issued a companion notice of proposed rulemaking that would clarify when a violation of law or regulation would support an MRA. The proposed rule would establish two categories: “substantive violations” and “technical violations.” Only substantive violations would support the issuance of an MRA. These violations would cover five categories: (i) violations that demonstrate a pattern; (ii) violations that directly impact the financial condition of the institution; (iii) violations that involve reporting inaccuracies requiring amendment; (iv) violations that affect consumers or the public; and (v) violations that implicate specific statutory requirements such as the BSA/AML . Violations that do not meet the substantive threshold would be classified as technical violations and addressed outside of the MRA process. The OCC stated the proposed distinction intends to focus supervisory attention on violations that have the greatest impact on an institution or its customers. Comments on the proposed rule must be submitted by October 1.