Two Thresholds, One Supervisory Continuum
This chapter examines the two central tests in the 2026 OCC/FDIC framework: when conduct may be an unsafe or unsound practice, and when it may support a Matter Requiring Attention (MRA). The useful judgment is not to memorize two similar definitions. It is to see which elements must exist together, which route can operate independently, and why an MRA may be appropriate before the higher unsafe-or-unsound standard is met.
The Higher Standard Starts With Imprudence
The final rule defines an unsafe or unsound practice through two connected gates. The first is about the conduct itself. A practice, act, or failure to act must be contrary to generally accepted standards of prudent operation. The rule allows the agencies to consider one act or omission on its own, or several related acts and omissions together. It does not require a long pattern before the definition can apply.
The phrase “generally accepted standards of prudent operation” is not a synonym for whatever an examiner would prefer a bank to do. The agencies declined to turn it into a closed list, a set of fixed best practices, or a universal safe harbor. They describe it as a judgment grounded in objective facts and sound reasoning, and they say that an institution does not engage in an unsafe or unsound practice merely because it takes a risk. Identifying, measuring, incurring, and managing risk are part of banking. The concern is a departure from prudent operation that also satisfies the rule's second gate.
That second gate is about financial consequence. If the practice, act, or failure to act continues, it must be likely to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund. Alternatively, the conduct may already have materially harmed the institution's financial condition. The word “and” matters: material harm by itself does not establish an unsafe or unsound practice if the conduct was not contrary to generally accepted standards of prudent operation, and an imprudent act by itself does not meet the definition without the required financial consequence.
Consider poor underwriting. A bank may make a poorly underwritten loan, and that individual act can be relevant under the rule if it otherwise meets the definition. The question is not whether every underwriting mistake is automatically an unsafe or unsound practice. The question is whether the underwriting departs from prudent operation and whether the evidence shows the required likely or actual material financial consequence. A single decision can matter when the decision itself, or its connection with related conduct, is capable of producing that consequence. The agencies still retain discretion about whether an isolated or technical incident warrants an enforcement action.
The same logic applies to a failure to act. If a bank does not maintain an appropriate contingency-funding arrangement, the omission is not automatically unsafe or unsound simply because the arrangement is incomplete. The analysis must connect the omission to a prudent-operation standard and then to a qualifying consequence. Under stress, the missing arrangement might impair liquidity and increase the risk that the institution fails in a way that creates a material loss to the Deposit Insurance Fund. Without evidence of that connection, the finding remains a description of a weakness rather than a completed conclusion under the rule.
Nor does the word “practice” impose a requirement that the agency wait for a repeated pattern. A single act may be evaluated alone, while a series of acts may be evaluated together when their interconnectivity reveals the relevant risk. That prevents an institution from treating each transaction as too small to matter when the transactions collectively form the source of the harm. It also prevents an examiner from treating a collection of unrelated imperfections as one practice merely to reach a more serious label. The connection among the acts, the prudence standard, and the financial consequence still has to be reasoned through.
This structure prevents two opposite errors. The first is result-based strict liability: a bank suffers a loss, therefore the conduct must have been unsafe or unsound. Banking involves risk, and losses can occur even when risk is prudently taken. The second is conduct-only reasoning: a practice looks untidy or falls short of a preferred process, therefore it qualifies. Under the final rule, the conduct must be tied to material financial risk or actual material harm through the rule's elements.
The higher standard also has a particular legal significance. The definition applies to the agencies' enforcement actions under section 8 of the Federal Deposit Insurance Act and to their supervisory activities. It is not the only possible basis for enforcement. The final rule does not displace separate statutory grounds such as an actual violation of law or a breach of fiduciary duty. Nor does it turn every supervisory communication into an enforcement action. It supplies a defined standard for one important kind of unsafe-or-unsound determination.
The MRA Test Is Wider in Time, Not Loose in Evidence
The MRA standard shares some vocabulary with the unsafe-or-unsound definition, but it is designed for an earlier supervisory intervention. The agencies may issue an MRA for a practice, act, or failure to act, alone or together with other conduct, when one of two routes is satisfied.
The first route is safety and soundness. The conduct must be contrary to generally accepted standards of prudent operation, and, if continued, it could reasonably be expected under current or reasonably foreseeable conditions to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund. The same route also covers conduct that has already materially harmed the institution's financial condition. The second route is legal compliance: the conduct is an actual violation of a banking or banking-related law or regulation. This second route does not require the MRA analysis to prove the safety-and-soundness elements as well.
The difference between “likely” and “could reasonably be expected” is the hinge. For an unsafe-or-unsound finding based on future harm, the agencies require harm to be likely. For an MRA based on future harm, they use a lower reasonable-expectation standard tied to current or reasonably foreseeable conditions. The agencies explain that a reasonably foreseeable outcome does not have to be the most likely outcome; it can include a range of possible outcomes. But speculation is not enough. The MRA standard is more proactive, not unbounded.
A simple example shows why the distinction matters. Suppose a bank has a vulnerability that would make a significant rise in interest rates damaging to its financial condition. Before rates rise or the bank's performance ratios deteriorate, an examiner may be able to identify the rise as reasonably foreseeable and issue an MRA if the other elements are supported. That does not necessarily mean the bank is already engaging in an unsafe or unsound practice under the higher “likely” standard. The MRA allows attention to be required while the evidence is still about a foreseeable risk rather than a likely outcome.
The legal-compliance route explains another difference. A bank may have an actual violation of a banking-related law or regulation even when the facts do not establish that the violation is likely to cause material financial harm. The final rule permits that violation to support an MRA, subject to the agencies' stated approach to substantive violations and supervisory discretion. The relevant question then is not whether the violation can be translated into the unsafe-or-unsound formula. It is whether the actual violation belongs in a supervisory response that requires attention.
The two routes can also overlap. A legal violation may have a direct and predictable effect on financial condition, customers, books and records, or restitution. A process weakness may be both contrary to prudent operation and an actual violation. But the categories should not be merged for convenience. The safety-and-soundness branch asks about prudence and material financial risk. The legal branch asks whether an actual banking or banking-related law or regulation was violated. The evidence supporting one route may not establish the other.
Read the Definitions as Separate Questions
The cleanest way to apply the distinction is to ask what kind of conclusion the evidence is being asked to support. For an unsafe-or-unsound finding, the examiner must connect an imprudent practice, act, or omission to likely material financial harm, material DIF risk, or harm that has already become material. For an MRA based on safety and soundness, the same prudence concern can require attention when material harm or DIF risk could reasonably be expected under current or reasonably foreseeable conditions. The MRA can also rest on an actual banking-related violation, which is a different factual inquiry.
| Question | Unsafe or unsound practice | Matter Requiring Attention |
|---|---|---|
| What is being evaluated? | A practice, act, or failure to act, alone or together with related conduct | The same kinds of conduct, or an actual banking-related violation |
| What must the conduct be? | Contrary to generally accepted standards of prudent operation | Contrary to generally accepted standards for the safety-and-soundness route; the legal route is based on an actual violation |
| What future risk is enough? | If continued, harm or DIF risk must be likely | If continued, harm or DIF risk could reasonably be expected under current or reasonably foreseeable conditions |
| What if harm has already occurred? | Material harm to financial condition can satisfy the consequence prong | Material harm to financial condition can support the safety-and-soundness route |
The table is a comparison of the rule's logic, not a substitute for applying the full facts. It also shows why an MRA is not simply a weaker version of an enforcement finding. It is a supervisory response with its own threshold and purpose. The lower prospective bar lets an examiner require attention while the institution still has an opportunity to prevent deterioration, but it does not remove the need to explain the conduct, the risk, and the reason the expected consequence is more than speculative.
Actual harm changes the probability question, not the prudence question. When material harm to financial condition has already occurred, the agencies do not need to predict whether that same harm is likely to occur in the future. They still must identify the relevant practice, act, or failure to act and, for the safety-and-soundness route, its departure from prudent operation. The actual-violation route is different again: it asks whether a banking-related law or regulation was actually violated. A future violation cannot be turned into an actual one by describing it as foreseeable.
The diagram shows overlapping inputs, not a ladder in which every MRA must mature into an unsafe-or-unsound finding. It also shows why the prudence question cannot simply be skipped. An actual violation is a separate MRA route, but an issue that is neither a qualifying violation nor a supported safety-and-soundness concern does not become an MRA merely because it feels important.
Why an MRA Is Not an Enforcement Finding
The practical consequences make the distinction more than semantic. The agencies describe an MRA as a concern that rises to the level of requiring presentation to the board of directors and for which the institution must take corrective action. That is a serious supervisory expectation. Yet an MRA is not itself a binding enforcement order, and the agencies state that merely failing to remediate an MRA does not automatically constitute an unsafe or unsound practice.
This difference leaves room for escalation without making escalation automatic. If an institution's condition changes, a foreseeable risk becomes more immediate, or new facts establish a higher probability or greater magnitude of harm, the same underlying weakness may later support an unsafe-or-unsound or enforcement response if the relevant criteria are satisfied. But the passage from MRA to enforcement is not a default lifecycle. The governing standard must be met at the later point as well.
The difference also explains why the agencies describe the MRA standard as narrowing the scope of practices that support an MRA while still permitting proactive identification of risks. The rule does not preserve a broad category of examiner concern with a new name. It establishes conditions: a prudence deviation with a reasonably expected material financial consequence, an already material harm, or an actual banking-related violation. Those conditions are lower than the unsafe-or-unsound future-harm standard in one respect, but they remain conditions.
The word “material” does not erase the distinction between the tests. Nor does “reasonable expectation” mean that the examiner must wait until harm is visible. The MRA is the point at which a supported concern becomes important enough that the institution is expected to act and the board's attention may be required. Unsafe or unsound practice is the point at which the conduct satisfies the higher definition used for specified supervisory and enforcement purposes. A bank's management can therefore face a required response before the conduct reaches the higher legal threshold.
The next question is what makes harm material, how a future outcome becomes more than merely possible, and why the Deposit Insurance Fund appears as a distinct route. Those questions determine whether the threshold words describe a supported financial-risk judgment or only a plausible concern.