OCC and FDIC Adopt Final Rule Defining ‘Unsafe or Unsound Practice’ and Limiting Issuance of Matters Requiring Attention

Summary

On August 27, 2026, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation (the “agencies”) jointly adopted a Final Rule that codifies in regulation a definition of “unsafe or unsound practice” for purposes of Section 8 of the Federal Deposit Insurance Act (the “FDIA”) and revises the supervisory and regulatory framework for the agencies’ issuance of matters requiring attention (“MRAs”) and other supervisory communications.[1] The Final Rule will become effective on November 2, 2026.

Concurrently, the OCC issued a related notice of proposed rulemaking (the “OCC Proposal”) that would further refine, by regulation, the OCC’s standard for issuing MRAs based on violations of law.[2] The OCC Proposal would differentiate “substantive violations” from “technical violations.” Under the OCC Proposal, the OCC would be permitted to issue an MRA only for a “substantive” violation of law but would retain the ability to direct the institution to correct a “technical” violation. Comments on the OCC Proposal are due on October 1, 2026.

The OCC released related revisions to two sections of its internal Policies and Procedures Manual to provide updated guidance to OCC staff on the issuance of enforcement actions (the “Enforcement Action PPM”) and MRAs (the “MRA PPM”). The revisions are intended to ensure that the OCC’s supervisory and enforcement actions are consistent with the policies articulated in the Final Rule.[3]

Background

On October 7, 2025, the OCC and FDIC issued a joint proposal (the “Proposed Rule”) to define “unsafe or unsound practice” for purposes of Section 8 of the FDIA and to establish minimum criteria that must be met for the agencies to issue MRAs to supervised institutions.[4] The Final Rule largely adopts the Proposed Rule’s substance, with certain key changes in response to commenters’ suggestions.

The term “unsafe or unsound practice” serves as a crucial statutory basis for the exercise of enforcement authority by the federal banking agencies under Section 8 of the FDIA. The federal banking agencies have previously refrained from defining the term in regulation, but courts have crafted their own, at times conflicting, definitions of the term.[5] Generally, courts have held that to establish the existence of an unsafe or unsound practice under Section 8, there must be a finding of: (1) an imprudent act (i.e., an act or inaction that is contrary to generally accepted standards of prudent operation) that (2) places a banking institution at an abnormal risk of financial loss or damage.[6]

An MRA is a written communication from bank examiners to a bank’s management or board requiring a change in practice.[7] The purpose of an MRA is to bring a deficient practice to the attention of the institution’s management and board of directors to ensure that the institution addresses the deficiency. MRAs are significant because their remediation status must be comprehensively tracked by both the supervised institution and the issuing agency, and unresolved MRAs have historically frequently been the basis for a downgrade of a bank’s CAMELS rating. Such a downgrade may result in significant adverse regulatory consequences, including enforcement actions.

For more information on the Proposed Rule, Section 8 of the FDIA and MRAs and other supervisory communications, please refer to our Memorandum to Clients, published October 14, 2025.

Implications for Supervision and Enforcement

As underscored by both agency heads, the Final Rule represents an important milestone that codifies the policy shift toward risk-based supervision focused on the most significant financial risks at supervised institutions. Comptroller of the Currency Jonathan Gould stated that it is “critical that examiners and institutions prioritize material financial risks and substantive violations of law over concerns related to policies, process, documentation, and other nonfinancial risks, and that the agencies’ supervision and enforcement standards further that prioritization.”[8] FDIC Chairman Travis Hill emphasized his expectation that the Final Rule will shift the attention of bank examiners “towards underlying financial risks and away from banks’ processes for managing those risks,” with the result that “examiners will focus only on issues that can have a material impact on the financial condition of an institution and on actual violations of relevant laws or regulations.”[9]

The Federal Reserve Board did not join the OCC and FDIC in proposing or issuing the Final Rule. However, under the leadership of Vice Chair for Supervision Michelle Bowman, the Federal Reserve has pursued a similar framework through internal policy changes. In an April 2026 update to its Statement of Supervisory Operating Principles, the Federal Reserve Board’s Division of Supervision and Regulation set forth new criteria to govern the issuance of MRAs and “matters requiring immediate attention” (“MRIAs”): “supervisory staff may issue an MRA or MRIA based on a threat to the safety and soundness of a Board-supervised banking organization only if they determine in good faith that a deficiency exists that, if not remediated in a timely manner, would create a significant probability of significant harm to the financial condition of the banking organization or has resulted in significant actual harm to the financial condition of the banking organization.”[10] Similarly, Federal Reserve supervisory staff may issue an enforcement action based on an unsafe or unsound practice “only if they determine that an act or failure to act by the banking organization would, if not remediated in a timely manner, create an abnormal probability of abnormal harm to the financial condition of the banking organization or has resulted in abnormal actual harm to the financial condition of the banking organization.”[11] To date the FRB has not defined “unsafe or unsound practice” either in regulation or guidance. For more information about the FRB’s update to its Statement of Supervisory Operating Principles, please refer to our Memorandum to Clients, published May 1, 2026.

The Final Rule should enhance the durability of the consequential policy shift, under current banking agency leadership, toward supervision on the basis of material financial risk. Even prior to the Final Rule being adopted, publicly available data on supervisory ratings and the number of outstanding MRAs and new enforcement actions indicated a marked shift over the past eighteen months toward a more focused supervisory criticism.[12]

In recent months, all three federal banking agencies indicated that they have been conducting a comprehensive review of outstanding MRAs and similar supervisory recommendations, with the goal of eliminating MRAs that do not align with current standards for issuance.[13] Because of the higher standard for the issuance of MRAs, banking organizations should evaluate their public disclosures in light of the circumstances cited as the basis for an MRA under the new standard.

Although the intention of the Final Rule is to narrow in a durable fashion the scope of circumstances that may give rise to MRAs and enforcement actions, many of the key operative terms are subject to a range of interpretation, as described below. As Chairman Hill observed in his remarks accompanying the Final Rule’s adoption, “the final rule does not prevent examiners from proactively identifying issues” and “does not require examiners to wait until a financial harm actually occurs to issue a supervisory criticism.”[14] The significant degree of discretion that remains inherent to the supervisory process, even under the Final Rule’s clarifying framework, underscores that the policy views and implementation approach of banking agency leadership over time will remain central to shaping the actual experience of supervised firms.

The Final Rule and Related OCC Policy Revisions

Unsafe or Unsound Practice

For purposes of the issuance of enforcement actions under Section 8 of the FDIA and the agencies’ “supervisory activities,” the Final Rule codifies the definition of “unsafe or unsound practice” as:

a practice, act, or failure to act, alone or together with one or more other practices, acts, or failures to act, that:

(1) is contrary to generally accepted standards of prudent operation; and

(2)(i) if continued, is likely to—

(A) materially harm the financial condition of the institution; or

(B) present a material risk of loss to the Deposit Insurance Fund (“DIF”); or

   (ii) materially harmed the financial condition of the institution.[15]

In adopting the definition as proposed, the agencies added clarification by codifying certain terms in regulation and addressing others in the preamble to the Final Rule:

• Harm to Financial Condition. The Final Rule codifies the definition of “harm to financial condition” as “financial losses or other negative impacts to an institution’s capital, asset quality, earnings, liquidity, or sensitivity to market risk.”[16]
• Materiality. Consistent with the Proposed Rule, the agencies adopted “material” harm as the appropriate threshold for potential or actual harm to the financial condition of an institution. In doing so, the agencies declined to adopt several commenter recommendations, including that the standard should refer to “abnormal” rather than “material” harm.[17] The agencies explained that their expectations for what constitutes “material” harm “will be tailored based on the risks associated with the institution’s capital structure, complexity, activities, asset size, and other financial risk-related factors.”[18]

Some commenters on the Proposed Rule had “suggested the agencies specify concrete, absolute dollar floors or percentages for harm that would be considered material, such as a specified basis point reduction in common equity tier 1 capital or an amount that could endanger the supervised institution’s adequately capitalized status.”[19] However, the agencies declined to adopt a quantitative definition for what qualifies as material “because assessment of what qualifies as material harm to the financial condition of an institution relies on examiner judgment, based on objective facts and sound reasoning.”[20]

With regard to operational and non-financial forms of risk, “the agencies acknowledge that, in limited circumstances, other [non-financial] practices, acts, or failures to act may be captured because, if continued, they are likely to result in material harm to an institution’s financial condition.” For example, “a significant risk of disruption of an institution’s operations through its information technology systems may, in some cases, be likely to cause material financial harm.”[21] Whether a cybersecurity vulnerability would meet the definition of an unsafe or unsound practice under the Final Rule “depends on the potential severity and likelihood of material harm to the financial condition of the institution.”[22] The agencies underscore that the materiality standard “would not include risks to the institution’s reputation unrelated to financial condition.”[23]

• Practice. The agencies reiterated their view that a single “act” could be considered an unsafe or unsound “practice” for purposes of the enforcement authorities in Section 8 of the FDIA and declined to adopt commenter recommendations to exclude isolated or technical incidents.[24] The preamble to the Final Rule stressed, however, that failure to remediate an MRA does not by itself constitute an unsafe or unsound practice.[25]
• Imprudence. Consistent with the Horne Standard and caselaw, the agencies affirmed that a practice, act or failure to act must be “contrary to generally accepted standards of prudent operation” to be considered unsafe or unsound, explaining that “the agencies do not intend to take enforcement actions under Section 8 of the FDI Act for prudent operations merely because they result in risk-taking.”[26] The agencies importantly confirmed that standards of prudent operation “do not require an institution to adopt what the agencies consider to be best practices, including those practices identified in horizontal reviews of peer institutions.”[27] The agencies also noted that what they consider to be standards of prudent operation in relation to a particular firm will be tailored based on firm size and other financial risk-related factors.[28]
• Likely. The agencies declined to provide a bright line regarding when an outcome is “likely” to materially harm the financial condition of an institution or present a material risk of loss to the DIF, or to identify a time horizon over which the requisite harm must be likely to occur. The agencies expressly declined to specify, for instance, that “likely” has the same meaning as “more likely than not” or a likelihood of at least 51 percent.[29] However, the agencies affirmed that the probability of harm must be “more than speculative or merely possible.”[30]
• Risk of Loss to the DIF. The agencies explained that they will not employ the element of the definition that deals with material risk of loss to the DIF “as a means to consider an institution’s resolution planning for their wind-down as a gone concern,” and that consideration of this element “will generally be limited to the likelihood that an institution’s going-concern practices would cause it to fail in a manner that poses a material risk of loss to the DIF.”[31] The agencies note, for example, that “the failure of an institution to implement appropriate contingency funding arrangements might not pose a risk of material harm to the financial condition of the institution, but could impair the institution’s liquidity under stress and thus present an increased risk to the DIF.”[32]
• Institution-Affiliated Parties. In a departure from the Proposed Rule, the agencies expressly provided that the definition of “unsafe or unsound practice” adopted by the Final Rule does not apply with regard to enforcement actions against directors, employees and other institution-affiliated parties (“IAPs”).[33] The agencies explain that applying the same definition to both institutions and IAPs “could fail to account for differences in the agencies’ supervisory objectives” in those two distinct contexts.[34] Accordingly, enforcement actions against IAPs will continue to be handled under the agencies’ prior standards and procedures.[35]

In tandem with the release of the Final Rule, the OCC also announced revisions to its Enforcement Action PPM that are intended to ensure that the OCC’s internal procedures are consistent with the new regulatory standards adopted.[36] In addition to incorporating the Final Rule’s definition of “unsafe or unsound practice,” the revised PPM sets out three new guiding principles underlying the OCC’s approach to enforcement:

• Escalation Prior to Initiation of Enforcement. The OCC will generally provide an institution an opportunity to remediate deficiencies before escalation to an enforcement action. In prescribing corrective action, the OCC will focus on minimizing the degree of OCC intervention.
• Tailoring. The OCC will tailor the type of enforcement action, the content of the required corrective actions, and the speed of escalation to enforcement proceedings, to the institution’s financial risk-related factors, as set forth in the Final Rule. In this regard, the Enforcement Action PPM notes that “the OCC may escalate to an enforcement action against a large or complex bank based on practices that would not trigger a similar response against a community bank. Further, the OCC may escalate to an enforcement action more quickly with respect to larger or more complex banks.”[37] 
• Focus. Enforcement actions issued by the OCC will contain focused corrective actions targeted to correct specific deficiencies. Under the Enforcement Action PPM, an enforcement action must contain only those requirements necessary to remediate the deficiency.[38]

The revised Enforcement Action PPM specifically underscores that the OCC will terminate an enforcement action when an institution has achieved “substantial compliance,” meaning that the institution has “satisfied the essential requirements of the order even if minor, isolated requirements have not been fully satisfied.”[39] It further states that “[w]hen performing validation activities to confirm effectiveness of corrective actions in a bank enforcement action, examiners must substantially rely on applicable work performed by a bank’s internal audit when that function is rated satisfactory.”[40]

Importantly, in its revisions to the Enforcement Action PPM, the OCC removed former Appendix C, “Actions Against Banks With Persistent Weaknesses,” which had been added in May 2023 in response to the focus by then-Acting Comptroller Michael Hsu on addressing what he termed the “too-big-to-manage” problem.[41] Former Appendix C defined institutions with “persistent weaknesses” to include those with composite or management component ratings of 3 or worse for more than three years or multiple enforcement actions outstanding during a three-year period.[42] For the set of large banks to which it applied (generally those subject to the OCC’s Heightened Standards Guidelines),[43] former Appendix C established a presumption in favor of “additional and increasingly severe” action where a bank was found to have continuing, recurring or increasing deficiencies for a prolonged period and had not, in the OCC’s view, made sufficient progress toward correcting them.[44] Under this prior policy, the set of potential remedial requirements included: (i) requiring the board to oversee an enterprise-wide remediation plan; (ii) restricting the bank’s growth, business activities or payment of dividends; or (iii) requiring the bank to take affirmative actions, including making targeted investments in the bank’s operations, or acquiring or holding additional capital or liquidity.[45] If a bank failed to correct its “persistent weaknesses” in response to those or other measures, former Appendix C stated that the OCC would consider further action requiring the bank to simplify or reduce its operations, including by reducing its asset size, divesting subsidiaries or business lines, or exiting one or more markets of operation.[46] In connection with the elimination of former Appendix C, the revised Enforcement Action PPM reverts back to pre-2023 language that simply notes that the OCC has the authority to “restrict asset growth” under a cease-and-desist order.[47]

Matters Requiring Attention

Consistent with the Proposed Rule, the Final Rule provides that the agencies may issue an MRA to an institution only for:

a practice, act or failure to act, alone or together with one or more other practices, acts or failures to act, that:

(1) (i) Is contrary to generally accepted standards of prudent operation; and

(ii)(A) If continued, could reasonably be expected to, under current or reasonably foreseeable conditions:

(1) Materially harm the financial condition of the institution; or

(2) Present a material risk of loss to the DIF; or

(B) Materially harmed the financial condition of the institution; or

(2) Is an actual violation of a banking or banking-related law or regulation.[48]

The Final Rule’s standard for when an MRA may be issued can be distinguished from its definition of an “unsafe or unsound practice” in two significant respects.

• First, the agencies may issue an MRA for an imprudent practice, act or failure to act if, under current or reasonably foreseeable conditions, its continuation could “reasonably be expected to” materially harm the institution’s financial condition. This threshold represents a lower probability of material harm than the “likely” threshold used in the unsafe or unsound practice definition, and, accordingly, an agency may issue an MRA before an unsafe or unsound practice is present.[49]
  • Reasonably Foreseeable. The agencies explained that “reasonably foreseeable” does not necessarily mean “the most likely future outcome” and could include a range of possible outcomes; the determination of what is reasonably foreseeable is fact-dependent and must be arrived at by examiners “based on objective facts and sound reasoning.”[50] The agencies stressed that “[s]peculative concerns about future harm, however, should not support the issuance of an MRA.”[51] According to the agencies, this standard “would have been capable of proactively addressing the risks that precipitated the failure of Silicon Valley Bank.”[52]
• Second, the Final Rule permits the agencies to issue an MRA for any practice, act or failure to act that constitutes an actual violation of a banking or banking-related law or regulation.[53]
  • Actual Violation of a Banking-Related Law. As under the Proposed Rule, any MRA to be issued on the basis of a violation of law must be based on an “actual” violation of a “banking-related” law or regulation. As underscored in the MRA PPM, under the Final Rule “[e]xaminers cannot issue MRAs for violations that have not yet occurred but may occur in the future.”[54]

The agencies declined to provide an enumerated list of all the “banking or banking-related laws and regulations” that could support the issuance of an MRA. However, the agencies explained that such laws or regulations “involve both [f]ederal or applicable state laws or regulations that are inherently associated with the conduct of banking or financial operations and related activities.”[55] In addition to prudential requirements and consumer protection laws applicable to bank products and services (such as the Electronic Fund Transfer Act and the Equal Credit Opportunity Act), the agencies expressly confirmed that “anti-money laundering, counter-terrorist financing, and sanctions laws or regulations” are banking or banking-related, specifically including regulations issued by the Office of Foreign Assets Control to enforce economic and trade sanctions.[56] By contrast, laws “that are wholly unrelated to the business of banking, including zoning or environmental laws,” generally are not banking or banking-related.[57] The agencies additionally clarified that “nonconformance with guidelines, such as the Interagency Guidelines Establishing Standards for Safety and Soundness, is not considered a violation of banking or banking-related law or regulation.”[58]

• • Substantive Violations. Although the text of the Final Rule permits an MRA based on an “actual violation” of a banking or banking-related law or regulation, the agencies state in the preamble that, as a matter of supervisory policy, they “intend to exercise their supervisory discretion to issue MRAs for violations only in response to substantive violations.”[59] The agencies further describe four categories of violations that they consider substantive, generally encompassing those that (i) reflect a “pattern” of violations or violations that are “systemic” in their prevalence within an institution; (ii) violations having “more than minimal” adverse impact on an institution’s financial condition, books and records or customers; (iii) violations requiring more than minimal restitution; and (iv) violations involving “insider misconduct or self-dealing.” As discussed in further detail below, the OCC Proposal would generally codify this policy approach for OCC-supervised institutions, making the limitations described above legally binding on the OCC rather than purely a matter of supervisory discretion.
  • Other Violations. Under the Final Rule, the agencies continue to have discretion to direct an institution to remediate and take such other actions as are required by law in connection with “other violations” (i.e., an actual violation of a banking or banking-related law or regulation for which the agency does not take an enforcement action or issue an MRA).[60] The agencies explain that in the case of such “other violations” they will not direct an institution to take any action other than to remediate the violation, unless such other actions are required by applicable state or federal law. The agencies note, however, that they are permitted to consider such violations in ratings determinations.[61]

Concurrently with the adoption of the Final Rule, the OCC announced corresponding revisions to the MRA PPM and published the section for the first time.[62] The MRA PPM incorporates the Final Rule’s standard for issuing an MRA and framework for substantive violations, although the four listed categories of substantive violations align with the OCC Proposal (discussed below) rather than the Final Rule.[63]

Basis for Agency Determination

In comments on the Proposed Rule, the agencies were urged by certain commenters “to require examiners to provide demonstrable and quantifiable evidence to determine whether the criteria for the definition of unsafe or unsound practice or the issuance of an MRA are met.”[64] The agencies rejected that recommendation on the grounds that “a quantification requirement would give a false sense of precision due to its reliance on subjective assumptions rather than empirical evidence.”[65] In place of any such quantification requirement or burden of proof, the Final Rule instead adopts a requirement that “examiners must justify their determination that a practice, act, or failure to act is unsafe or unsound or meets the standard for the issuance of an MRA based on objective facts and sound reasoning.”[66] The agencies explain that examiners must include within an exam report or supervisory letter “information about the basis for an unsafe or unsound practice or MRA, including a sound justification.”[67] The agencies note that the requirement to communicate such an explanation will “help inform an institution’s reasoned consideration of whether to appeal an MRA or other material supervisory determination and assist the agencies in administering appeals.”[68]

Tailoring

The Final Rule requires the agencies to “tailor [the agency’s] supervisory activities and enforcement actions based on unsafe or unsound practices under [Section 8 of the FDIA] and its issuance of [MRAs] based on the risks associated with the institution’s capital structure, complexity, activities, asset size, and any other financial risk-related factor that the [agency] deems appropriate.”[69] The Final Rule also codifies the agencies’ overarching explanation of how the tailoring framework will be applied: as the risk associated with the enumerated factors increases, (i) the threshold for materiality of the harm decreases, (ii) the assessment of harm becomes more granular (e.g., specific business lines, products, or services) and (iii) the requirements relating to remediation, and expectations regarding prudent operation, increase.[70] As examples, the agencies noted that they “would not expect that a particular projected percentage decrease in capital or liquidity that rises to the level of materiality for the largest institutions would necessarily also be material for community banks,” and that, although they “may consider increased classified assets in a particular business line as a result of the institution’s imprudent practices to warrant an MRA at the largest institutions, the agencies may consider a community bank’s asset quality less granularly and consider the overall asset portfolio at the institution level.”[71]

The MRA PPM also notes: “Generally, there is a higher bar for harm to financial condition to be considered material for a community bank than for larger banks. Materiality should not be assessed solely in quantitative terms.”[72]

Supervisory Observations

The Final Rule also establishes a framework for the issuance of “supervisory observations,” which are informal observations of objective facts that do not rise to the level of an MRA and that identify “weaknesses in an institution’s policies, practices, condition, or operations.”[73] The Final Rule makes explicit that a supervisory observation “does not create a requirement or supervisory expectation that the supervisory observation will be presented to the institution’s board of directors or that the institution will take corrective action in response to the supervisory observation.”[74] The agencies explained: “As a corollary of there being no requirement or supervisory expectation that an institution will take corrective action in response to a supervisory observation, the institution will not be required to submit an action plan to address a supervisory observation or track the implementation of a voluntary decision to address a supervisory observation. Examiners will also be prohibited from tracking the institution’s voluntary implementation of changes in response to a supervisory observation, outside of normal recordkeeping related to examinations.”[75]

The agencies explained that there is no expectation that supervisory observations will warrant escalation into an MRA absent a change in the institution or its operating environment that would support the issuance of an MRA under the legal standard established by the Final Rule.[76] The agencies note, however, that they may use the information underlying supervisory observations to support assigned ratings.[77]

The OCC Proposal on Violations of Law or Regulation

As described above, under the Final Rule, the agencies may issue an MRA for an “actual violation of a banking or banking-related law or regulation,” and both the OCC and the FDIC indicated in the preamble that as a policy matter they “intend to exercise their supervisory discretion to issue MRAs for violations only in response to substantive violations.”[78]

With the OCC Proposal, the OCC (but, notably, not the FDIC) is proposing to revise the Final Rule just adopted to replace the term “actual violation” with “substantive violation,” to codify definitions of “substantive” and “technical” violations and to impose a binding legal limitation on the OCC’s ability to issue an MRA with respect to a violation of law that does not rise to the level of a substantive violation.

• Substantive Violations. Under the OCC Proposal, a violation of law or regulation would be “substantive if its nature, duration, frequency, or severity could meaningfully impact the institution or its customers.”[79] To be regarded as substantive, the violation must:

(i) be systemic, or constitute a pattern;[80]

(ii) have had or reasonably be expected to have a direct, clear,[81] predictable,[82] and more than minimal impact[83] on the institution’s financial condition;[84]

(iii) have had or reasonably be expected to have more than minimal impact on the accuracy of the institution’s books and records;[85]

(iv) require more than minimal restitution[86] or reasonably be expected to have a more than minimal adverse impact to customers;[87] or

(v) involve insider misconduct or self-dealing.[88]

The OCC Proposal notes that, in discussing their intention to exercise supervisory discretion to pursue MRAs only for “substantive violations” in the release that accompanied the Final Rule, the agencies “grouped substantive violations into four categories” and that “the criteria for a substantive violation would be unchanged by this proposal’s regrouping of substantive violations into five categories.”[89] Under the OCC Proposal, the OCC would therefore essentially adhere to the substantive policy articulated in the preamble to the Final Rule and limit its issuance of MRAs to violations of law that are found to be substantive. Relative to the FDIC, the incremental effect of the OCC Proposal would be to make this limitation a matter of binding rule text, as opposed to the OCC continuing to rely (as would the FDIC) purely on the commitment articulated in the preamble to the Final Rule to exercise “supervisory discretion” in this fashion.

• Technical Violations. The OCC Proposal would replace the Final Rule’s “other violations” provision with a “technical violations” framework. Similar to the definition of an “other violation,” a “technical violation” would be defined as a “violation of a law or regulation for which the OCC does not take an enforcement action or issue a matter requiring attention,”[90] and the OCC would not be permitted to “direct an institution that commits a technical violation to take any action other than to correct the technical violation or such other actions as are required by law.”[91] With respect to technical violations, the OCC would not be permitted to specify the corrective action the institution must take or include other corrective actions unrelated to the violation, and the OCC would not be permitted to track whether an institution has corrected a technical violation.[92]
• Noncompliance with Guidelines. Consistent with the confirmation provided in the preamble to the Final Rule, the OCC Proposal would clarify in regulation that “[n]oncompliance with the guidelines” in the OCC’s safety and soundness standards set forth in the appendices to 12 C.F.R. Part 30 (the “Safety and Soundness Guidelines”) “is not a substantive violation . . . or a technical violation.”[93] With regard to instances in which institutions are found to have failed to satisfy such guidelines (which include the OCC’s Heightened Standards Guidelines),[94] the OCC notes that “existing supervisory mechanisms provide the appropriate degree of examiner and institution focus on addressing such noncompliance.”[95] The reference to “existing supervisory mechanisms” appears to refer to the process provided under the OCC’s Safety and Soundness Guidelines, under which an institution can be issued a “notice of deficiency” by the OCC for failure to satisfy a safety and soundness standard within such guidelines, which, if not sufficiently addressed through the submission of a safety and soundness compliance plan, can ultimately form the basis for the OCC to pursue an enforcement proceeding under Section 39 of the FDIA.[96] By making clear that noncompliance with such guidelines is not a “violation of law” that can give rise to an MRA, the OCC Proposal (and associated commentary by both the FDIC and OCC in the preamble to the Final Rule) eliminates a significant potential avenue by which findings of “violations of law” might have been arrived at in a duplicative and overlapping fashion.