Status and the important distinction
The OCC issued AA-ENF-2024-96 against USAA Federal Savings Bank on December 18, 2024. It terminated and replaced the bank’s January 2019 and March 2022 orders while incorporating unresolved requirements. The OCC’s public records reviewed September 29, 2026 did not identify a subsequent termination of this replacement order. That is a bounded statement about the reviewed public record, not a report of confidential examination findings.
The replacement expressly identifies noncompliance with specified articles of the earlier orders. It therefore would be misleading to describe the two terminations, by themselves, as evidence that remediation had been completed. This is a binding consent order, rather than a proposal or an informal supervisory observation. The bank neither admitted nor denied the OCC’s findings.
Remediation uses the same scarce resources as product development
An institution can have enough funding for several projects and still lack the experienced people, reliable data or change capacity to complete them together. Correcting shared systems may compete with a new product for the same engineers and operational specialists. A plan that treats those resources as unlimited can make both the repair and the launch less credible.
The business question is which dependencies must be repaired before other work can succeed. A common customer record, dependable service workflow or effective testing process can benefit several products at once. The order’s restrictions on specified new products, services and membership expansion make the connection between remediation and business choices particularly visible. [1][2]
What the order connects
The OCC described deficiencies involving management, earnings, information technology, consumer compliance and internal audit, together with suspicious activity reporting violations and noncompliance with heightened standards. The order calls for a coordinated action plan, governance improvements and board oversight. These are agency findings and requirements; they are not a basis for assigning a public .
The analytical connection is that control failures often share infrastructure. An incomplete customer record can affect complaint resolution, transaction monitoring, risk reporting and management decisions simultaneously. Fixing four downstream reports while preserving the unreliable source does not necessarily remove the cause. A consolidated order makes the dependency problem visible even when the work is assigned to separate departments.
Why an action plan needs dependencies
A useful remediation plan identifies the source system, accountable owner, downstream users, validation procedure and condition for closure. It should distinguish a policy drafted, a system deployed, a control operating and a control independently demonstrated to be effective. Those milestones represent different amounts of risk reduction. Treating them as interchangeable can produce impressive completion percentages with little evidence of durable improvement.
The sequencing matters. If a monitoring control depends on a customer-data correction, testing the monitoring control before the correction is complete may generate a false pass or a predictable failure. Management should show which dates are conditional on upstream work and which interim controls cover the gap. Moving a due date without revising the underlying dependency map makes a plan less credible.
The cost includes the opportunity postponed
Suppose a hypothetical institution assigns six specialists to a remediation effort for six months. That is 36 specialist-months of capacity. If the same people were needed for a service improvement, the opportunity cost includes the delay to that improvement; it cannot be measured simply by adding their salary to a project budget.
The alternative is not to bypass required repairs. It is to sequence work honestly, hire or obtain support where useful, and avoid launching new dependencies before the underlying service can sustain them. Outsourcing can add capacity but still requires internal ownership and time to understand and verify the work.
A hypothetical closure problem
Assume a bank has 100 required data fields across several systems and corrects 95. The remaining five include customer identifiers and transaction timestamps used in suspicious-activity monitoring. Reporting 95% completion would be arithmetically correct but economically incomplete: the remaining defects could prevent reliable matching and timely review across much of the population.
A better hypothetical dashboard weights critical dependencies, shows affected records and demonstrates whether controls detect missing data. Closure evidence might include reconciliations over several production periods and independent attempts to reproduce exceptions. This example is not a description of USAA’s systems or remediation results; it explains why task counts should not substitute for an assessment of residual exposure.
Board challenge and independent evidence
Boards need information they can challenge without recreating every technical test. For material issues, a decision package should explain the failure mechanism, customer or prudential consequences, remaining uncertainty and the evidence supporting management’s proposed closure. Audit should evaluate the evidence and testing design, not simply confirm that management uploaded documents to a tracking platform.
Independent validation also needs access to failed samples and reopened issues. A process that measures only the final successful test can hide repeated defects. Maintaining the unsuccessful results provides a more useful record of how the control matured and whether implementation quality varies across products, channels or time periods. Clear escalation rules prevent disagreements over severity from becoming silent delays.
A consolidated plan should simplify the customer’s experience
Customers experience billing, support and account access as connected services even when separate remediation workstreams own them. Improvements should therefore be tested across the actual journey, including exceptions and handoffs. A repaired component can leave the overall experience unreliable if the next team receives incomplete information.
A stronger business assessment would show fewer repeated defects, dependable service and capacity for approved growth. Termination of an old document followed by a broader replacement does not establish that outcome. Conversely, the public order alone does not quantify profitability, customer attrition or solvency. Those conclusions require their own current evidence.
Costs and tradeoffs
Consolidated remediation can reduce duplicated work, but it can also create a large central program whose reporting consumes resources needed for actual corrections. The practical balance is a common evidence standard with accountable operating owners. Central coordination should resolve dependencies and resource conflicts, while business and technology teams remain responsible for controls that must continue after the program ends.
Interim controls may require manual review, slower releases or limits on certain activities. Their cost should be compared with the exposure they contain and their expected duration. A temporary workaround that becomes permanent can create its own operational fragility. Exit criteria should therefore be documented when the workaround is introduced, rather than after staff become dependent on it.
What would change the assessment
A later OCC termination, amendment or replacement would change this article’s status description. It would need to be read for its stated reason and scope rather than reduced to a headline count of closed orders. Public company statements about progress can add context but cannot substitute for the regulator’s legal action when describing whether an order remains in force.
The general lesson is to follow obligations across documents. An order inventory should link predecessor and successor actions, preserve historical deadlines and show which requirements survived. For readers comparing banks, the relevant question is what changed in the obligations and underlying controls. The number of documents terminated is an unreliable shortcut for that assessment.
Sources
- OCC consent order AA-ENF-2024-96; December 18, 2024Official source · PDFBack to text: ↑
- OCC announcement of USAA action; December 18, 2024Official releaseBack to text: ↑
- OCC December enforcement actions; December 19, 2024Official release
- OCC enforcement action search, USAA charter 707975; reviewed September 29, 2026Official source