For decades, the phrase “unsafe or unsound practice” has been one of the most powerful, and most vague, tools in a bank regulator’s arsenal. On August 27, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation jointly published a final rule that gives that phrase an actual definition.
The rule establishes that an “unsafe or unsound practice” must involve conduct that deviates from generally accepted prudent operational standards and has either already caused, or could reasonably cause, material financial harm to an institution or pose significant risk to the Deposit Insurance Fund.
What the rule actually changes
The final rule does three concrete things that reshape how the OCC and FDIC supervise the banks under their jurisdiction.
First, it creates a uniform, risk-based definition tied to Section 8 of the Federal Deposit Insurance Act. That section gives regulators the authority to issue cease-and-desist orders, remove officers, and impose civil money penalties.
Second, the rule overhauls how Matters Requiring Attention, commonly known as MRAs, get issued. Under the new framework, examiners can only issue MRAs for practices that meet the newly defined risk-based threshold.
Third, the OCC has committed to not pursuing Section 8 enforcement actions without first giving institutions the opportunity to remediate identified issues during the normal supervisory process.
The rule becomes effective 60 days after its publication in the Federal Register.
From broad discretion to bounded authority
The origins of this rulemaking trace back to an October 2025 proposal that drew substantial industry comment. The final version closely mirrors that proposal, with targeted clarifications designed to sharpen the rule’s application in both enforcement and day-to-day supervision.
The new rule explicitly redirects regulatory attention toward actual financial risks. Process-related and non-financial matters that don’t meet the materiality threshold fall outside the scope of what can trigger formal supervisory or enforcement action.
It applies only to OCC- and FDIC-supervised institutions. The Federal Reserve, which supervises state-chartered banks that are Fed members and bank holding companies, is not a party to this rulemaking.
Why this matters for the banking sector
The requirement for remediation opportunities before enforcement action is particularly significant for mid-size and community banks, which often lack the legal and compliance infrastructure to fight formal enforcement proceedings.
The open question is whether the Federal Reserve will adopt a similar framework. If it doesn’t, banks supervised by the Fed could face a stricter, more subjective standard than their OCC- and FDIC-regulated peers.