Subscribe free
occfdicenforcementsafety-soundnessbank-supervisioncommunity-banks

Supervision's New Floor: What the OCC-FDIC "Unsafe or Unsound" Rule Actually Changed Before November 2

How the OCC/FDIC final rule (91 FR 56004, 12 CFR 4.92) redefines 'unsafe or unsound' before Nov 2, 2026 — plus tailoring, MRA thresholds, and IAP exposure.

By Lex, LexRegPulse Analyst · ·11 min read
Primary-source research · AI-drafted · human-reviewed. Methodology

By Lex

The trade coverage is leading with "supervision gets a legal definition." That is the least interesting thing in nineteen pages of Federal Register text.

The OCC and FDIC published their joint final rule on September 1, 2026 at 91 FR 56004, codified at 12 CFR 4.92 for national banks and federal savings associations and at a new 12 CFR part 305 for state nonmember banks and state savings associations. It takes effect November 2, 2026. Three provisions do the real work, and two cut against the deregulatory read that has dominated the first week of commentary. The agencies declined to apply the narrowed definition to institution-affiliated parties, so individual officer exposure is now governed by a broader standard than institutional exposure. The codified tailoring rule runs the direction most readers will assume it doesn't: as institutional risk rises, the materiality bar falls and the harm assessment gets more granular. And a "supervisory observation" carries no remediation obligation and no board-presentation requirement — but the agencies expressly reserved the right to use the information underlying it to support assigned ratings.

That last point is the one compliance teams need to plan around, and the one that will not make the trade press. We carried the two-prong test and the November 2 date in the September 1 brief. The reasoning below only exists in the preamble.

How we got here

Section 8 of the FDI Act, 12 U.S.C. 1818, has always authorized enforcement for an "unsafe or unsound practice" without defining it. Courts filled the gap with a statement John Horne, then Chairman of the Federal Home Loan Bank Board, made during hearings on the Financial Institutions Supervisory Act of 1966: an unsafe or unsound practice "embraces any action, or lack of action, which is contrary to generally accepted standards of prudent operation, the possible consequences of which, if continued, would be abnormal risk or loss or damage to an institution, its shareholders, or the agencies administering the insurance funds." The Fifth Circuit called that memorandum "the authoritative definition" in Gulf Federal Savings & Loan Association of Jefferson Parish v. FHLBB, 651 F.2d 259, 264 (5th Cir. 1981). It has governed for six decades.

The agencies proposed to displace it on October 30, 2025 (90 FR 48835), took 36 comments, adopted the final rule August 27, 2026, and published September 1. The two-prong test survived intact: contrary to generally accepted standards of prudent operation, and likely — if continued — to materially harm the institution's financial condition or present a material risk of loss to the DIF, or having already done so. The MRA standard sits one notch lower, at "could reasonably be expected to, under current or reasonably foreseeable conditions," plus a separate prong for actual violations of banking or banking-related law.

This is a significant rewrite of supervisory process, not a change to any substantive prudential requirement. Capital, liquidity, and concentration rules are untouched. What changed is the threshold at which an examiner may write something down and demand you fix it.

The IAP carve-out is the story nobody is telling

The October 2025 proposal would have applied the narrowed definition to institution-affiliated parties as well as institutions. The final rule does not, and the reasoning is worth reading closely.

Because the definition requires likely material harm to the institution's financial condition, the preamble concedes "it would be rare that the actions of an institution-affiliated party could cause such harm to a large institution." The agencies went further: applying the rule to individuals "could result in enforcement actions against institution-affiliated parties being influenced by factors unrelated to the gravity of the misconduct, such as the asset size or staffing numbers of the institution with which a party is affiliated at the time of the misconduct." Their illustration is blunt — an individual could fail to underwrite loans or secure collateral at a large institution "without any remedy or recourse," then move to a smaller institution and do the same thing.

So they dropped it. Footnote 16 is operative: IAP enforcement "will continue to be handled under the agencies' prior standards and procedures and subject to controlling appellate case law."

Read that against what bank GCs are telling boards this month. Institution-level exposure narrows on November 2. Individual exposure does not move — it stays on the Horne Standard and six decades of circuit precedent, unbounded by any materiality-to-the-institution test. For officers at large banks the asymmetry is now formal: the same underwriting failure that cannot support a cease-and-desist order against the bank can still support a Tier 2 civil money penalty or a removal action against the person who committed it. Anyone reading this as across-the-board relief is reading it wrong, and the D&O and indemnification implications deserve attention before the next board cycle.

Tailoring runs the direction you don't expect

New paragraph (e)(3) — identical in 12 CFR 4.92 and 12 CFR 305.1 — codifies that as risk associated with capital structure, complexity, activities, and asset size increases: the materiality threshold decreases; the harm assessment becomes more granular, expressly down to "specific business lines, products, or services"; and remediation requirements and prudent-operation expectations increase. The inverse applies as risk falls.

Several commenters flagged this as counterintuitive; one argued it would impose higher standards on smaller banks. The agencies disagreed but conceded the drafting needed work, and their examples make the design explicit: increased classified assets in a single business line may warrant an MRA at the largest institutions, while a community bank's asset quality gets assessed "less granularly" against the overall portfolio at the institution level.

Two things follow. A large complex bank faces a lower effective materiality bar and line-of-business scrutiny — the relief there is thinner than the headlines suggest. A community bank gets a genuinely higher bar assessed against the whole balance sheet, which is the real prize in this rulemaking. The awkward part is that the agencies declined to publish tiers, an illustrative matrix, or any examiner documentation requirement for how tailoring was applied, reasoning that such guidance "may have an inappropriate limiting effect on the application of examiner judgment." A commenter asked for exactly that and was turned down. Tailoring is now mandatory and unverifiable in the same paragraph.

Observations are free of remediation, not free of consequence

Paragraph (g) is a real grant of protection. A supervisory observation creates no requirement or supervisory expectation that it be presented to the board or that the institution take corrective action. Footnote 45 adds that no action plan may be required and that examiners "will also be prohibited from tracking the institution's voluntary implementation of changes in response to a supervisory observation, outside of normal recordkeeping related to examinations." The agencies also refused a commenter's request to permit escalation when an institution repeatedly declines a suggestion: observations "do not warrant escalation into an MRA absent a change in the institution or its operating environment."

Then, closing section III.F: "consistent with the proposal, the agencies can use the information underlying supervisory observations to support assigned ratings."

The same reservation reappears for "other violations" under paragraph (h) — violations the agencies decline to cite as MRAs "can be considered in ratings determinations." Note an asymmetry practitioners will hit fast: for FDIC-supervised institutions, an uncorrected other violation can be cited as an MRA at the follow-up examination. The OCC's paragraph (h) contains no parallel escalation.

Put the pieces together and you get a category of finding that carries no corrective-action duty, no tracking, no board obligation, no formal record to appeal — and that can still move a CAMELS component. That is not a loophole; it is the express design. The practical response is to treat observations as a ratings-evidence file rather than a remediation file: document the board's reasoned decision not to act, memorialize the business judgment, and preserve it, because it will resurface in the ratings conversation.

The dropped CAMELS linkage, and why

The proposal floated requiring that any CAMELS composite downgrade to 3 or below be accompanied by an MRA or enforcement action. The final rule drops it as beyond scope — but footnote 46 supplies the reason coverage has missed. On May 19, 2026, the FFIEC published a proposed notice seeking comment on revisions to the CAMELS rating system, aimed at focusing ratings on factors that materially affect financial condition and at improving transparency. The agencies concluded that "any changes to their rating processes would be premature while the FFIEC proposal is pending."

Fair enough as sequencing. But combined with the observations reservation, the interim state is a framework in which ratings pressure can accumulate without a documented, appealable finding attached to it. That is the opposite of the transparency this rule is marketed on, and it is why the FFIEC docket now matters more than the one that just closed.

To be fair, the counterargument has force. OMB designated the final rule a major rule under the Congressional Review Act, and the OCC estimates aggregate savings "will likely exceed $100 million" from fewer MRAs across the 986 institutions it supervises; the FDIC's 2,700 supervised IDIs get a consistent nationwide standard for the first time. Those are genuine gains. None of it resolves the appealability gap — it just situates the gap inside an otherwise favorable framework.

What else moved

Reputational harm untethered to financial condition is out, with the preamble citing Gulf Federal on the open-ended supervision a "loss of public confidence" rationale would license. Nonconformance with the Interagency Guidelines Establishing Standards for Safety and Soundness — 12 CFR part 30, appendix A for the OCC and 12 CFR part 364, appendix A for the FDIC — is not a violation of law. Consumer harm untethered to a violation or safety-and-soundness concern was declined as beyond statutory scope, and footnote 36 confirms no MRAs for violations of Federal consumer financial laws at IDIs above $10 billion. Operational, third-party, and consumer-facing findings that used to arrive as MRAs will now arrive as observations or other violations — which routes them into the ratings channel described above.

One doctrinal note. The agencies ground MRA authority not in section 8 but in visitorial powers, citing Cuomo v. Clearing House Ass'n, L.L.C., 557 U.S. 519 (2009) for "a broad reading of the agencies' visitorial powers" — a load-bearing citation for a case better known for limiting the OCC's reach against state law enforcement. The preamble also leans on Groos National Bank v. OCC, 573 F.2d 889, 897 (5th Cir. 1978), for the proposition that Congress committed "the progressive definition and eradication of such practices to the expertise of the appropriate regulatory agencies." That is a deference proposition from a different era. After Loper Bright Enterprises v. Raimondo (2024), a court reviewing a contested section 8 action will read the statutory term independently. The rule's practical force is therefore as a self-binding constraint reviewable for arbitrary departure — which is the theory an institution should build its appeal record around.

What to watch

The companion OCC proposal published the same day at 91 FR 56074 (Docket ID OCC-2026-0529, RIN 1557-AF56) closes for comment October 1, 2026. It regroups the final rule's four categories of substantive violations into five without changing the criteria, and replaces the "other violations" mechanism at 12 CFR 4.92(h) with "technical violations" at a new paragraph (i). Two provisions deserve comment letters: footnote 29 states the OCC could respond with a technical violation "even if the violation would meet the criteria of a substantive violation" — unreviewable downward discretion — and Question 13 asks whether to strike "banking or banking-related" from the MRA standard entirely. The proposal's own tailoring discussion confirms the inversion: a higher raw number of violations establishes a pattern at a large bank, but a lower error rate does.

Then the gap. Findings issued between now and November 2 are made under the current standard while remediation on them will be judged under the new one. The rule applies prospectively only and says nothing about closure of open findings. Run the inventory now and identify which outstanding MRAs would not clear the new bar; the argument for closure is strongest while the transition is fresh. Pair that with OCC Bulletin 2026-41 (August 27, 2026), which revised PPM 5310-3 and made PPM 5400-11 public for the first time. Two changes matter operationally: the OCC will terminate enforcement actions at "substantial compliance" rather than perfect compliance, and it deleted former Appendix C, "Actions Against Banks With Persistent Weaknesses," the large-bank escalation framework in place since 2023. Both are covered in our August 28 and August 29 briefs.

Watch the appeals track too. The preamble points to the FDIC's Guidelines for Appeals of Material Supervisory Determinations, 91 FR 3184 (January 26, 2026), and the OCC's proposed Bank Appeals Process rule, 91 FR 7163 (February 17, 2026), as where "objective facts and sound reasoning" gets tested. The agencies declined to require quantification and declined to codify any burden of proof or persuasion. What institutions got instead is a written justification obligation in the report of examination — thin, but more than existed before.

Bottom line

This is the most consequential supervisory-process change of the quarter for OCC- and FDIC-supervised institutions, and it delivers real relief that is distributed unevenly and paired with two unadvertised costs. Individual officer exposure did not narrow at all. And findings that fall below the new MRA line do not disappear — they migrate into a category with no remediation duty, no appeal, and an express reservation that they can still move your ratings. Institutions that spend the next sixty days re-papering their MRA inventory while ignoring how their examiner will handle observations will have optimized the wrong half of the rule.

Sources

Citations to 90 FR 48835 (Oct. 30, 2025), 91 FR 3184 (Jan. 26, 2026), 91 FR 7163 (Feb. 17, 2026), and the FFIEC's May 19, 2026 CAMELS proposed notice are as stated in the final rule's preamble and its footnotes 2, 39, and 46, and each has been independently confirmed against Federal Register records: the October 2025 proposal at FR Doc. 2025-19711, the FDIC appeals guidelines at FR Doc. 2026-01433, the OCC Bank Appeals Process proposal at FR Doc. 2026-03086, and the FFIEC notice, "Uniform Financial Institutions Rating System," at FR Doc. 2026-09944.