Status and the correct legal phrase
The relevant term is “unsafe or unsound practice.” On August 27, 2026 the OCC and FDIC announced a final rule defining it and revising standards for supervisory communications. The rule was published September 1 and becomes effective November 2, 2026. As of September 27, it is final but not yet effective. [1, 2]
Its codified locations are OCC 12 CFR 4.92 and FDIC 12 CFR 305.1. It is separate from OCC Part 30 and from the FFIEC’s proposed revisions. Agency scope matters: the joint rule should not automatically be represented as a Federal Reserve rule. [2]
A legal threshold does not define every worthwhile repair
A recurring service problem may be costly for customers and employees even when it does not justify a particular supervisory label. A bank can choose to correct confusing communications, repeated payment errors or unnecessary customer effort because doing so improves its business. It need not wait for a formal enforcement threshold.
The opposite distinction also matters: a serious legal violation cannot be dismissed merely because the institution has not measured a large balance-sheet loss. The final rule’s separate treatment of unsafe or unsound practices, and legal violations should remain explicit. The verified effective date is November 2, 2026. [2]
The two elements of an unsafe or unsound practice
In paraphrase, the definition combines conduct contrary to accepted prudent operation with material financial harm already caused, likely future material harm if continued, or a likely material risk of loss to the Deposit Insurance Fund. Acts and omissions can be assessed together. The standard concerns financial condition rather than a generic objection to an institution’s business choices. [2]
The OCC’s explanation connects financial harm to capital, asset quality, earnings, and market-risk sensitivity. It also emphasizes tailoring to the institution’s risk profile. [3]
Analytical implication: an examiner and a bank should be able to explain the causal chain. What practice is deficient? What is the exposure? How would harm occur? Why is it material for this institution? A disagreement over policy wording is different from evidence that a lender cannot identify loans or fund customer withdrawals.
MRAs have a different threshold
Under the final text, a can concern imprudent conduct reasonably expected to create specified material harm under current or reasonably foreseeable conditions, or an actual violation of banking or banking-related law or regulation. That forward-looking MRA test should not be collapsed into the definition used for unsafe-or-unsound-practice enforcement. [2]
The agencies also distinguish informal supervisory observations from MRAs. An observation does not itself create an expectation for board presentation or corrective action. Other violations can still require remediation. The classification of a communication is therefore important, but a less severe label does not repeal the underlying law. [3]
Recommended issue management records the legal basis, communication type, relevant facts, management response and remaining financial exposure. Preserve disagreements accurately. Do not translate every suggestion into an identical board-level requirement, and do not delete an acknowledged legal violation because it was not called an MRA.
Several small defects can share one costly cause
Suppose, illustratively, that 12,000 avoidable service contacts each take ten minutes. They consume 2,000 hours. At an assumed $40 per hour, the capacity value is $80,000 before technology work or customer remedies. No individual contact needs to be catastrophic for the aggregate problem to matter commercially.
That arithmetic is not a legal materiality test or a forecast of cash savings. It helps identify the scale of repeated work and whether a common cause deserves investigation. The business case should also consider whether a proposed repair introduces new errors or merely moves the effort to customers.
Worked example: process weakness versus a loss mechanism
Illustrative example A: a credit policy contains an outdated committee name, but authority, approvals and decision logs function correctly. The document should be corrected. Without additional facts, it is difficult to show how that error materially harms financial condition.
Illustrative example B: an automated limit-increase program omits recent information for $200 million of accounts, has no independent validation and continues to expand exposure. A scenario of only 1% additional loss equals $2 million. Whether that is material depends on the institution and evidence, but the mechanism is identifiable. The analysis should establish likelihood and exposure rather than treating the scenario itself as proof.
Example C: a practice violates an applicable banking law even though the bank has not quantified a material balance-sheet loss. The separate legal-violation basis for an matters. Financial materiality is not a universal defense to noncompliance.
What changes in the supervisory conversation
The agencies describe the reform as focusing supervision on material financial risks and providing clearer standards. [1] The strongest benefit would be more precise findings and remediation proportional to risk. A bank can respond with loss scenarios, control testing and evidence rather than debating abstract expectations.
The countervailing concern is that a narrow reading could delay action until weak controls have produced visible damage. My assessment is that this risk is best addressed through credible forward-looking evidence: leading indicators, repeated exceptions, failed controls and concentration. Management need not wait for the legal threshold for enforcement before correcting a problem.
Avoid inventing a universal dollar cutoff. The final framework explicitly contemplates tailoring. A $2 million exposure can mean different things at institutions with different capital, earnings and operating complexity. Several small weaknesses may also interact to produce a larger risk.
Precision can improve both challenge and cooperation
Employees can respond more effectively when a finding identifies the practice, evidence and consequence. A bank can dispute a legal characterization while still correcting an acknowledged service defect. Keeping those decisions distinct can prevent a procedural disagreement from leaving practical work unowned.
Evidence of success includes reduced recurrence and more dependable service, alongside appropriate resolution of the supervisory matter. A lower issue count may reflect changed classification rather than better performance. The broader assessment should track what happened to the underlying problem after the terminology changed.
Preparation before November 2
Recommended preparation is a legal and risk review of how the institution classifies supervisory communications, tracks remediation and explains financial effects. Retain existing commitments and orders unless the responsible authority changes them. An internal decision to relabel an issue does not modify an enforceable obligation.
Train first-line managers to distinguish correcting a control from challenging the legal basis of a finding. Both can proceed with a clear record. Independent validation should test whether risk actually declined, while the legal team handles interpretation and procedural questions.
Measure remediation quality through residual exposure, recurrence and reliable reporting. A lower count of is not necessarily an improvement if the same operational weaknesses remain and simply appear under another label.
What would warrant a revision
Monitor the November effective date, authoritative corrections, implementation materials and any judicial decisions changing the framework. Update this article if the Fed adopts a corresponding standard or if subsequent interpretation changes the distinction among enforcement, and observations.
The business thesis is clearer supervisory standards alongside continued responsibility for reliable service and prudent financial decisions. Evidence of more consistent findings and earlier correction would support the reform’s stated objective. Evidence that meaningful risks remain unaddressed because they lack an immediately visible loss would argue for a more cautious assessment.
Sources
- OCC/FDIC: August 27, 2026 final-rule announcementOfficial releaseBack to text: ↑1↑2↑3
- Federal Register: final rule, September 1, 2026; effective November 2Official sourceBack to text: ↑1↑2↑3↑4↑5
- OCC Bulletin 2026-40: unsafe or unsound practices and MRAsOfficial sourceBack to text: ↑1↑2