The Label Is a Decision, Not a Description

The subject of this series is the joint Office of the Comptroller of the Currency (OCC) and Federal Deposit Insurance Corporation (FDIC) final rule on unsafe or unsound practices and Matters Requiring Attention (MRAs), issued on August 27, 2026. The question here is narrower than whether a bank has a weakness: when does that weakness justify an MRA, a more serious supervisory or enforcement response, or a less binding form of communication? The answer matters because a label changes who must pay attention, what the institution must do, and how much judgment the examiner is exercising. This series builds a way to make that judgment without treating every criticism as equivalent or every plausible risk as proven.

Why a Weakness Needs a Category

Imagine that an examiner finds that a bank's contingency funding arrangements are incomplete. That sentence identifies a problem, but it does not yet tell the reader what the problem means. Is it a gap that management may improve voluntarily? Is it an MRA that the bank must address? Does it present a financial risk serious enough to support an unsafe-or-unsound finding or an enforcement action? Those are different conclusions, and they require different supporting facts.

The 2026 rule starts from a practical concern: supervisory attention should be concentrated on material financial risks. The agencies specifically distinguish those risks from concerns about policies, processes, documentation, and other nonfinancial matters that may be worth discussing but do not necessarily threaten a bank's financial condition. This is not a declaration that controls or documentation are unimportant. A weak control can be relevant when it is connected to a material financial consequence. But the connection must be shown rather than assumed.

The category also determines the institution's response. An MRA is not simply an examiner's note that something could be better. Under the OCC/FDIC framework, an MRA is a concern that rises to the level of requiring board presentation and corrective action. An unsafe or unsound practice is a more consequential legal and supervisory concept: it can support enforcement under section 8 of the Federal Deposit Insurance Act when the rule's elements are met. A supervisory observation sits below the MRA threshold and is intentionally informal. It may identify an operational weakness or suggest an enhancement, but it does not create a requirement that the bank take corrective action or present the matter to its board. An actual banking-related violation that does not receive an MRA or enforcement action can still be treated as an “other violation,” for which remediation may be required.

These categories therefore answer different questions. One asks whether conduct is imprudent and tied to likely material financial harm or a material risk to the Deposit Insurance Fund. Another asks whether material harm could reasonably be expected under current or reasonably foreseeable conditions, or whether an actual banking-related legal violation exists. A third asks whether the concern remains below that threshold and is better communicated as an informal observation. The labels are not a ranking of how much an examiner dislikes a practice. They are conclusions about evidence, authority, and consequence.

The Federal Reserve materials make the same point from a different institutional position. Its 2013 guidance applies to Federal Reserve-supervised banking organizations and distinguishes an MRA from a Matter Requiring Immediate Attention, or MRIA. Both are important findings, but an MRIA requires immediate attention because of its significance and urgency. The guidance also describes board communication, written responses, corrective-action timeframes, follow-up, and possible elevation when a matter becomes more urgent. That is useful context for understanding the governance dimension of a supervisory finding, but it is not the 2026 OCC/FDIC rule. The same acronym does not establish one nationwide test.

flowchart LR A["Observed weakness or conduct"] --> B{"Supervising agency"} B -->|"OCC or FDIC"| C{"What support exists?"} C -->|"Prudence plus material financial risk"| D["Unsafe or unsound practice"] C -->|"Reasonably foreseeable material risk or actual violation"| E["MRA"] C -->|"Below MRA threshold"| F["Supervisory observation"] C -->|"Actual violation without MRA"| G["Other violation"] B -->|"Federal Reserve"| H["MRA or MRIA framework"] D --> I["Agency-specific supervisory or enforcement response"] E --> J["Board attention and corrective action"] F --> K["Voluntary enhancement"] G --> L["Possible remediation"] H --> M["Board response, timing, and follow-up"]

This map is deliberately a map of distinct routes, not a universal checklist. Before asking whether the contingency-funding weakness is an MRA, a reader must know which agency supervises the institution, what conduct or omission is being evaluated, what financial or legal consequence is supported, and what response the applicable framework permits.

The Rule's Subject and Its Boundary

The primary subject is not “bank supervision” in the abstract. It is the 2026 OCC/FDIC framework for selected supervisory activities and enforcement actions involving institutions those agencies supervise. The OCC rule covers national banks, Federal savings associations, and Federal branches or agencies of foreign banks. The FDIC rule covers insured State nonmember banks, insured State-licensed branches of foreign banks, and insured State savings associations. The provisions are parallel, but the authority still depends on the institution and the agency involved.

The final rule defines unsafe or unsound practices, establishes the conditions for issuing an MRA, permits informal supervisory observations, and identifies other violations. It also requires tailoring based on factors such as capital structure, complexity, activities, asset size, and other financial-risk-related characteristics. Finally, it requires determinations to rest on objective facts and sound reasoning. These pieces belong together: a threshold without a factual basis is arbitrary, and a factual concern without a defined consequence leaves the institution unsure what it must do.

The boundary is important for another reason. The agencies did not extend the new definition to institution-affiliated parties. The preamble says that enforcement actions against those parties continue under prior standards, procedures, and controlling appellate case law. Nor does the rule replace every possible enforcement ground or govern the agencies' rulemaking authority. It addresses a defined part of the supervisory and enforcement relationship with supervised institutions.

The Federal Reserve document has a similarly clear but different boundary. SR 13-13 / CA 13-10 is addressed to Federal Reserve-supervised banking organizations. It standardizes how examiners communicate findings and says that “Observations” should no longer be used as a separate category, although informative or advisory matters may remain in narrative discussion. When examiners expect the organization to take action, the matter should be treated as an MRIA or MRA under that guidance. That communication logic cannot be silently transplanted into an OCC or FDIC analysis, and the OCC/FDIC rule cannot be presented as a Federal Reserve rule merely because both frameworks use MRA.

The boundary also protects the reader from a common overstatement: “nonfinancial” does not mean “outside supervision.” The 2026 agencies explain that an information-technology weakness, for example, may matter under the rule when its severity and likelihood make material financial harm probable; unsupported systems or poor patch management can sometimes create a route to disruption, data exfiltration, or costly remediation. The relevant question is not whether a concern began as a process issue. It is whether the evidence shows a qualifying connection to financial condition, DIF risk, or an actual banking-related violation. If that connection is not shown, the concern may remain an observation or another form of communication rather than an MRA.

The Judgment This Series Makes Possible

A reliable answer to the title question needs five distinctions. First is conduct: the rule can reach a practice, an individual act, a failure to act, or several related acts together. Second is prudence: unsafe-or-unsound and safety-and-soundness MRA findings require a departure from generally accepted standards of prudent operation, while an actual legal violation creates a separate MRA route. Third is consequence: the relevant harm concerns capital, asset quality, earnings, liquidity, or sensitivity to market risk, or a material risk of loss to the DIF. Fourth is probability: “likely” is more than speculation, while “could reasonably be expected” permits a lower, proactive threshold tied to current or reasonably foreseeable conditions. Fifth is response: board attention, required corrective action, remediation, voluntary enhancement, urgency, and follow-up do not all attach to the same label.

Keeping those distinctions separate is more useful than memorizing a ladder from “observation” to “MRA” to “enforcement.” A weakness can become more serious because the bank's condition deteriorates, because a foreseeable stress scenario becomes better supported, because an actual violation is identified, or because the institution's risk profile makes a smaller or more localized impact material. Conversely, a real weakness can remain below the MRA standard when the evidence does not establish the required financial or legal connection. The label follows the supported judgment, not the emotional force of the criticism.

The agencies also resist the apparent simplicity of a numeric answer. They do not set a universal percentage for “likely,” a dollar floor for “material,” or a fixed time horizon. They do not publish an asset-size matrix that tells an examiner exactly when a concern crosses the line. Instead, they require objective facts and sound reasoning and direct examiners to tailor the analysis to the institution. That approach leaves room for judgment, but it also gives the institution a basis to ask how the facts, causal link, risk profile, and requested response fit together.

The central question, then, is not whether a supervisory weakness exists. Weaknesses are common starting points for supervision. The question is whether the applicable agency's standard is satisfied, what evidence supports that conclusion, and what consequence the framework attaches to it. The next step is to examine the two core thresholds—unsafe or unsound practice and MRA—because their similarity in language conceals the difference that makes proactive attention possible without treating every concern as an enforcement case.

References