Status and the important distinction
The OCC issued AA-ENF-2024-96 against USAA Federal Savings Bank on December 18, 2024. It terminated and replaced the bank’s January 2019 and March 2022 orders while incorporating unresolved requirements. The OCC’s public records reviewed September 29, 2026 did not identify a subsequent termination of this replacement order. That is a bounded statement about the reviewed public record, not a report of confidential examination findings.
The replacement expressly identifies noncompliance with specified articles of the earlier orders. It therefore would be misleading to describe the two terminations, by themselves, as evidence that remediation had been completed. This is a binding consent order, rather than a proposal or an informal supervisory observation. The bank neither admitted nor denied the OCC’s findings.
What the order connects
The OCC described deficiencies involving management, earnings, information technology, consumer compliance and internal audit, together with suspicious activity reporting violations and noncompliance with heightened standards. The order calls for a coordinated action plan, governance improvements and board oversight. These are agency findings and requirements; they are not a basis for assigning a public .
The analytical connection is that control failures often share infrastructure. An incomplete customer record can affect complaint resolution, transaction monitoring, risk reporting and management decisions simultaneously. Fixing four downstream reports while preserving the unreliable source does not necessarily remove the cause. A consolidated order makes the dependency problem visible even when the work is assigned to separate departments.
Why an action plan needs dependencies
A useful remediation plan identifies the source system, accountable owner, downstream users, validation procedure and condition for closure. It should distinguish a policy drafted, a system deployed, a control operating and a control independently demonstrated to be effective. Those milestones represent different amounts of risk reduction. Treating them as interchangeable can produce impressive completion percentages with little evidence of durable improvement.
The sequencing matters. If a monitoring control depends on a customer-data correction, testing the monitoring control before the correction is complete may generate a false pass or a predictable failure. Management should show which dates are conditional on upstream work and which interim controls cover the gap. Moving a due date without revising the underlying dependency map makes a plan less credible.
A hypothetical closure problem
Assume a bank has 100 required data fields across several systems and corrects 95. The remaining five include customer identifiers and transaction timestamps used in suspicious-activity monitoring. Reporting 95% completion would be arithmetically correct but economically incomplete: the remaining defects could prevent reliable matching and timely review across much of the population.
A better hypothetical dashboard weights critical dependencies, shows affected records and demonstrates whether controls detect missing data. Closure evidence might include reconciliations over several production periods and independent attempts to reproduce exceptions. This example is not a description of USAA’s systems or remediation results; it explains why task counts should not substitute for an assessment of residual exposure.
Board challenge and independent evidence
Boards need information they can challenge without recreating every technical test. For material issues, a decision package should explain the failure mechanism, customer or prudential consequences, remaining uncertainty and the evidence supporting management’s proposed closure. Audit should evaluate the evidence and testing design, not simply confirm that management uploaded documents to a tracking platform.
Independent validation also needs access to failed samples and reopened issues. A process that measures only the final successful test can hide repeated defects. Maintaining the unsuccessful results provides a more useful record of how the control matured and whether implementation quality varies across products, channels or time periods. Clear escalation rules prevent disagreements over severity from becoming silent delays.
Costs and tradeoffs
Consolidated remediation can reduce duplicated work, but it can also create a large central program whose reporting consumes resources needed for actual corrections. The practical balance is a common evidence standard with accountable operating owners. Central coordination should resolve dependencies and resource conflicts, while business and technology teams remain responsible for controls that must continue after the program ends.
Interim controls may require manual review, slower releases or limits on certain activities. Their cost should be compared with the exposure they contain and their expected duration. A temporary workaround that becomes permanent can create its own operational fragility. Exit criteria should therefore be documented when the workaround is introduced, rather than after staff become dependent on it.
What would change the assessment
A later OCC termination, amendment or replacement would change this article’s status description. It would need to be read for its stated reason and scope rather than reduced to a headline count of closed orders. Public company statements about progress can add context but cannot substitute for the regulator’s legal action when describing whether an order remains in force.
The general lesson is to follow obligations across documents. An order inventory should link predecessor and successor actions, preserve historical deadlines and show which requirements survived. For readers comparing banks, the relevant question is what changed in the obligations and underlying controls. The number of documents terminated is an unreliable shortcut for that assessment.
Sources
- OCC consent order AA-ENF-2024-96; December 18, 2024Official source · PDF
- OCC announcement of USAA action; December 18, 2024Official release
- OCC December enforcement actions; December 19, 2024Official release
- OCC enforcement action search, USAA charter 707975; reviewed September 29, 2026Official source