FDIC and OCC Issue Proposal to Define ‘Unsafe or Unsound Practice’ and Constrain Issuance of Matters Requiring Attention

Summary

On October 7, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency (the “agencies”) jointly issued a notice of proposed rulemaking (the “NPR”) that proposes to define the term “unsafe or unsound practice” for purposes of the enforcement powers provided under section 8 of the Federal Deposit Insurance Act (the “FDIA”) (12 U.S.C. § 1818 (“Section 8”)) and to establish minimum criteria that must be met for the agencies to issue matters requiring attention (“MRAs”) to supervised institutions.  Although not included in the proposed rule text, the NPR additionally indicates an intention by the agencies to narrow the circumstances in which the composite supervisory rating of a bank may be lowered to a “less-than-satisfactory” rating (i.e., a composite CAMELS rating of 3 or below).

• The NPR’s proposed definition of an unsafe or unsound practice would require a practice, act or failure to act that is contrary to generally accepted standards of prudent bank operation and that, if continued, is likely to materially harm the financial condition of the institution or present a material risk of loss to the Deposit Insurance Fund or that has already materially harmed the financial condition of the institution.  Notably, the agencies considered, but did not propose, adding more specific definitional parameters to the materiality standard for the underlying harm contemplated by the proposed definition.  The NPR seeks comment on whether any quantitative or other supplemental definition should be supplied in this regard.
• Under the NPR, the agencies propose certain minimum predicate findings in order for supervisors to issue an MRA.  These standards would not require the actual current existence of an unsafe or unsound practice in order for an MRA to be issued, but would condition an agency’s ability to issue an MRA on the reasonable expectation that an unsafe or unsound condition could arise as a consequence of the practice subject to the MRA.  The proposal would specify that an MRA may only be issued with respect to a practice, act or failure to act that (1) could reasonably be expected to become an unsafe or unsound practice (as defined under the NPR) under current or reasonably foreseeable conditions, or (2) is an actual violation of a banking or banking-related law or regulation.
• The NPR preamble indicates that going forward the agencies expect that any downgrade of a bank’s composite CAMELS rating to a less-than-satisfactory rating would only occur in circumstances where an MRA that satisfies the proposed standards described above has been issued to the bank, or where an enforcement action has been brought against the bank, including an enforcement action on the basis of the proposed definition of unsafe or unsound practice.

Taken as a whole, the stance toward supervisory and enforcement policy reflected by the NPR can be expected to result in fewer instances of banks becoming subject to the negative consequences that accompany an “less-than-satisfactory” CAMELS rating, perhaps most importantly for M&A and other deal-related activity.  The proposal is also intended to diminish the proportion of resources and management attention banks have been called upon to devote to what FDIC Acting Chairman Hill described in his statement as “a litany of process-related items that are unrelated to a bank’s current or future financial condition.”[1]  The agencies intend the proposal to instead “focus examiners’ attention on supervisory issues that are material to a bank’s safety and soundness.”[2]

Although the Federal Reserve Board did not join in the proposal, the underlying policy focus on reorienting supervision toward material supervisory risks is one that is publicly shared by Vice Chair for Supervision Michelle Bowman and that has animated other Federal Reserve actions, such as its July proposal to revise its Large Financial Institution rating system.[3]

In his statement, FDIC Acting Chairman Hill stated that the NPR is just one of several steps the FDIC and other banking agencies are contemplating to “execute on the goal of reforming supervision.”[4]  He went on to say that “[w]e are also working hard on potential reforms to the CAMELS rating system, and we are reevaluating many aspects of our existing manuals, rules, guidance, and internal supervisory procedures.”[5]

In a speech shortly following the release of the NPR, Treasury Secretary Bessent stated with regard to the proposal to define unsafe or unsound practice that “[t]he past failure to define this term led to supervisory criticisms focused on processes or documentation related to governance, model management, and third-party risk management.  In other words, topics that often had little or nothing to do with a bank’s actual financial condition.  This regulatory myopia was the driving force behind the spring 2023 bank failures.”[6]

Comments on the NPR will be due 60 days following its publication in the Federal Register, which will likely be delayed due to the federal government shutdown that began on October 1, 2025.

Background

Unsafe or Unsound

The term “unsafe or unsound practice” serves as a crucial statutory basis for the exercise of enforcement authority by the banking agencies under Section 8.[7]  Section 8 does not, however, define the term unsafe or unsound practice.  Given the lack of a statutory and, until now, regulatory definition, courts have crafted their own, at times conflicting, definitions of the term since it was first introduced into Section 8 by the Financial Institutions Supervisory Act of 1966.[8]  Generally, courts have held that to establish the existence of an unsafe or unsound practice under Section 8, there must be a finding of:  (1) an imprudent act (i.e., an act or inaction that is contrary to generally accepted standards of prudent operation) that (2) places a banking institution at an abnormal risk of financial loss or damage.[9]

MRAs

An MRA is a written communication from bank examiners to a bank’s management or board requiring a change in practice.[10]  The purpose of an MRA is to bring a deficient practice to the attention of the institution’s management and board of directors to ensure that the institution addresses the deficiency.  MRAs are significant because their remediation status must be comprehensively tracked by both the supervised institution and the issuing agency, and unresolved MRAs are frequently the basis for a downgrade of a bank’s CAMELS rating.  Such a downgrade may result in significant adverse regulatory consequences.  For example, a less-than-satisfactory composite rating limits a bank’s ability to engage in interstate mergers, to establish a de novo interstate branch, or to control or hold an interest in certain subsidiaries.[11]  A less-than-satisfactory composite rating at a subsidiary depository institution also renders a parent financial holding company (“FHC”) unable to rely on its FHC status to engage in new activities or make acquisitions and investments.[12]

The NPR

Defining Unsafe or Unsound Practice

The proposed rule would adopt a legal interpretation that would establish the following standard for citing unsafe or unsound practices as the basis for an enforcement action under 12 U.S.C. § 1818:

An “unsafe or unsound practice” is a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that:

1.   Is contrary to generally accepted standards of prudent operation; and

2.   Either

a.   If continued, is likely to—

i.    Materially harm the financial condition of the institution; or

ii.    Present a material risk of loss to the DIF; or

b.   Materially harmed the financial condition of the institution.

Although certain key components of this definition are themselves open to a range of potential interpretation, the NPR provides useful illumination on the intended functioning of certain key terms and concepts.

• Imprudent act.  The proposed definition provides that a practice, act, or failure to act would have to be contrary to generally accepted standards of prudent operation to be considered an unsafe or unsound practice.[13]  The preamble specifically notes that the agencies do not intend to take enforcement action under Section 8 with respect to prudent operations that result in risk-taking given that prudent risk-taking is inherent to the business of banking.
• Likely.  To qualify as an unsafe or unsound practice under the proposed definition, it must be likely—as opposed to merely possible—that the practice, act, or failure to act, if continued, would materially harm the financial condition of the institution or present a material risk of loss to the DIF.  The preamble notes that the agencies view inclusion of the phrase “if continued” as important to allow for identification of an unsafe or unsound act or failure to act before it definitively impacts an institution’s financial condition. The agencies highlight that they considered, but did not ultimately propose, more precisely defining the degree of requisite likelihood contemplated by the use of the term “likely” within the proposed definition, such as by specifying a minimum probability threshold (e.g., 10%, 51%) and invited comment on this topic.
• Financial condition.  An unsafe or unsound practice would include a practice, act, or failure to act that, if continued, is likely to materially harm the financial condition of an institution.  The agencies noted that they believe that harm to financial condition includes practices, acts, or failures to act that are likely to directly, clearly, and predictably affect an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.
• Risk of Loss to the Deposit Insurance Fund.  An unsafe or unsound practice would also include a practice, act, or failure to act that, if continued, is likely to negatively affect an institution’s ability to avoid FDIC receivership and therefore present a material risk of loss to the DIF.  For example, the NPR states that a failure of an institution to implement appropriate contingency funding arrangements might not pose a risk of material harm to the financial condition of the institution, but could impair the institution’s liquidity under stress and thus present an increased risk to the DIF.
• Harm. The proposed standard focuses on material harm to financial condition, and the NPR states that the agencies generally interpret harm to refer to financial loss.  Therefore, to constitute an unsafe or unsound practice, a practice, act, or failure to act generally must have either caused actual material losses to the institution or must be likely to cause material loss or other negative financial impact to the institution.  Conversely, the fact that a practice, act, or failure to act has caused actual but non-material financial losses to the institution is insufficient to meet the proposed standard.
• Nonfinancial risks impacting financial condition.  The agencies also acknowledged that, in limited circumstances, practices, acts, or failures to act that relate to risks that are in the first instance nonfinancial may be captured because, if continued, they are likely to cause material harm to an institution’s financial condition.  For example, the NPR acknowledges that the term unsafe or unsound practice could include deficiencies related to cybersecurity or critical operational infrastructure that are so severe that, if continued, they would be likely to result in a material disruption to the institution’s core operations and consequently prevent the institution, its counterparties, and its customers from conducting business operations.  The fact that this would in turn be likely to cause material harm to the financial condition of the institution is stressed as the basis on which the unsafe or unsound definitional standard could be met in the case of a risk that presents itself initially as nonfinancial.

• Consistent with the agencies’ simultaneously issued joint proposal to eliminate the supervisory consideration of reputation risk, the agencies underscore in the NPR that although risks of a nonfinancial nature might in certain circumstances satisfy the unsafe or unsound definitional standard if there is close nexus to financial impact, the standard does not encompass risks to the institution’s reputation that are unrelated to its financial condition.[14]
• Material harm.  Under the proposed definition, to be considered an unsafe or unsound practice the likely harm to an institution’s financial condition or risk of loss to the DIF must be material.  Risks of minor harm to an institution’s financial condition, even if imminent, would not rise to the level of an unsafe or unsound practice.  Instead, the agencies “will consider the likely harm to an institution’s financial condition to be material if it would materially impact the institution’s capital, asset quality, liquidity, earnings, or sensitivity to market risk, or would materially impact the risk that an institution fails and causes a loss to the DIF.”  Going forward, the agencies state that they:

expect that it would be rare for an institution to exhibit unsafe or unsound practices, as defined in the proposed rule, based solely on the institution’s policies, procedures, documentation or internal controls, without significant weaknesses in the institution’s financial condition (i.e., weaknesses that caused material harm to the financial condition of the institution, or were likely to materially harm the financial condition of the institution or likely to present material risk of loss to the DIF).[15]

• Tailoring required.  The NPR explains that the agencies intend to tailor their exercise of enforcement powers under Section 8, as well as their issuance of MRAs, based on the capital structure, riskiness, complexity, activities, and asset size of the supervised bank in question, as well as any factor related to financial risk that the agencies deem appropriate.  This includes tailoring with respect to the requirements or expectations set forth in such actions as well as whether, and the extent to which, such actions are taken.  With respect to how such tailoring would be applied in practice, the NPR preamble states that:

[T]he agencies expect that finding an unsafe or unsound practice would be a much higher bar for a community bank than for a larger institution when considered against the overall operations of the institution.  For example, as applied to the threshold for material harm, the agencies would not expect that a particular projected percentage decrease in capital or liquidity that rises to the level of materiality for the largest institutions would necessarily also be material for community banks.[16]

Establishing Limitations on the Ability of the Agencies to Issue MRAs

The proposal would, for the first time, establish by rule a set of minimum requirements that must be met in order for an agency to issue an MRA.  Under the proposed rule, the agencies “may only” issue an MRA for a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that (1) could reasonably be expected to become an unsafe or unsound practice (as defined under the NPR) under current or reasonably foreseeable conditions, or (2) is an actual violation of a banking or banking-related law or regulation.[17]

As noted, the proposed standard for issuance of an MRA would not require the actual existence of an unsafe or unsound practice in order for an MRA to be issued, and therefore, the proposed standard for issuance of an MRA represents a lower threshold than the threshold necessary for the issuance of a formal enforcement action under Section 8.

The NPR justifies the ability of the agencies to issue MRAs and, implicitly, the agencies’ authority to issue MRAs before a given practice rises to the unsafe or unsound level required for an enforcement action under Section 8 on the grounds that “Congress has conferred upon the agencies the authority to exercise visitorial powers and examination authorities with respect to supervised institutions” and that such powers are intended to “facilitate early identification of supervisory concerns that may not rise to a violation of law, unsafe or unsound practice, or breach of fiduciary duty under section 8 of the FDI Act.”[18]

The agencies further assert that “[s]imilar to the proposed definition of unsafe or unsound practice,” conduct that is captured by the proposed MRA standard “would, in the vast majority of cases, relate directly to risks of material harm to the financial condition of an institution or violations of certain laws and regulations.”[19]  The NPR stresses that such risks “will, in the vast majority of cases, relate directly, clearly and predictably to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.”[20]

Commenting further on the limitations on the flexibility of the proposed MRA standard, the agencies state that “[t]he proposal would not permit examiners to issue MRAs based on potential conditions that are possible but not reasonably foreseeable.”[21]  As a concrete example, the NPR observes that “in late 2022 the agencies could have considered it ‘reasonably foreseeable’ that the federal funds rate and other market interest rates would rise considerably, and an institution’s vulnerability to a significant rise in interest rates could have been grounds for an MRA.”[22]  Such latitude cannot, however, be used “as a pretext to force an institution to comply with an examiner’s managerial judgment instead of the judgment of the institution’s own management, in the absence of a reasonable expectation of material harm to the financial condition of the institution.”[23] 

The proposed MRA standard also limits the types of violations of law that can support valid issuance of an MRA to “actual violations of a discrete set of federal and state law or regulation—those related to banking.”[24]  This “would generally include banking and consumer financial protection laws, but would not include laws and regulations outside of the banking and consumer finance context, such as tax laws.”[25]  The NPR stresses that “the agencies would not issue an MRA solely to address an institution’s policies, procedures, or internal controls, unless those policies, procedures, or internal controls otherwise satisfied the regulatory standard for an MRA, even if those policies, procedures, or internal controls could lead to a violation of law or regulation.”[26]

Informal Supervisory Communications

The proposal would allow agency examiners to continue to provide informal, non-binding suggestions “to enhance an institution’s policies, practices, condition or operations.”[27]  Importantly, however, the proposed rule would provide that such communications may not be treated in a manner similar to an MRA.

The NPR preamble provides significant additional detail on the limits the agencies intend to place on the nature and attendant consequences of these informal forms of supervisory communication to avoid these communications being treated in a fashion similar to an MRA:

• the agencies would not be permitted to require an institution to submit an action plan to address the informal supervisory communication; and
• examiners would not be permitted, and supervised institutions would not be required, to track the institution’s adoption or implementation of examiner suggestions.

Although examiners would be permitted to make informal supervisory communications to the institution’s board of directors, the institution’s management would not be required to present the supervisory communications to the institution’s board of directors.

The agencies would not be permitted to criticize an institution for declining to remediate a concern or weakness identified by an informal supervisory communication or to escalate the communication into an MRA on the sole basis of an institution’s lack of adoption of an examiner’s suggestion, even where offered in multiple examination cycles.

The circumstances underlying an informal supervisory communication could, in the event of further deterioration, later be the basis for an MRA or enforcement action, but only if the criteria for an MRA or enforcement action under the proposal are satisfied at that time and not solely on the basis of any past failure to respond to or address the informal supervisory communication.

This element of the proposal creates the potential that supervised institutions will see an uptick in informal supervisory communications as the agencies shift a portion of supervisory communications toward informal channels.

Limitations on Downgrades of Composite CAMELS Rating to Less-Than-Satisfactory

The NPR preamble states that “[i]n furtherance of the agencies’ goal to prioritize attention on material financial risks and legal compliance, the agencies also expect that any downgrade in an institution’s composite supervisory rating to less-than-satisfactory would only occur in circumstances in which the institution receives an MRA that meets the standard outlined in the proposed rule or an enforcement action pursuant to the agencies’ enforcement authority.”[28]

By connecting the assignment of a less-than-satisfactory composite rating to the issuance of MRAs and enforcement actions, the agencies believe they would “generally ensure a less-than-satisfactory composite rating is tied to a potential material harm to the institution’s financial condition, potential material risk of loss to the DIF, actual material harm to the institution’s financial condition, or actual violations of certain laws and regulations.”[29]  The NPR preamble states that although Section 8 provides for grounds for an enforcement action based on a violation of law, “the agencies expect that they would not downgrade an institution’s composite rating to less-than-satisfactory based only on a violation of law, unless such practice, act, or failure to act that results in the violation of law also is likely to cause material harm to the financial condition of the institution, is likely to present a material risk of loss to the DIF, or has caused material harm to the institution’s financial condition, as the agencies propose under the unsafe or unsound practice definition.”[30]

Next Steps

It remains to be seen what refinements will be adopted to the proposal following the comment process, or if the Federal Reserve will undertake an analogous rulemaking.  Interestingly, the NPR signaled a possible future focus on “complementary changes to the agencies’ MRA verification and validation procedures to ensure MRAs are lifted as soon as practicable after the institution completes corrective actions.”[31]  The agencies note that, under current practices, MRAs are often kept outstanding for a prolonged period of time after an institution has fully completed its remediation of the underlying issue “because examiners seek to see demonstrated sustainability of the remediation before an MRA is closed.”[32]  The agencies note that this practice “has the potential to distract an institution’s board of directors and management, as well as examiners, by inflating the number of MRAs based on practices, acts, or failures to act that have already been remediated.”[33]  Focus on this sort of measure that would operate in a complementary fashion with the proposal itself is indicative of the continued multi-faceted focus by the agencies on enhancing the efficiency of the supervisory process.