When the Issue Is a Violation—or Only an Observation

The 2026 OCC/FDIC framework does not force every supervisory concern through the financial-risk test. This chapter focuses on the two neighboring routes that are easy to confuse: an actual banking-related violation that may support an MRA, and a weakness that remains a supervisory observation below the MRA threshold. The goal is to distinguish what the institution may be required to do from what an examiner may communicate as an informal improvement, without treating “not an MRA” as “not important.”

An Actual Violation Is Its Own MRA Route

The final rule permits the OCC or FDIC to issue an MRA for an actual violation of a banking or banking-related law or regulation. This is a separate route from the safety-and-soundness route. A violation does not have to be repackaged as an unsafe or unsound practice before it can support an MRA. Conversely, the existence of a legal violation does not automatically settle the supervisory response. The agencies say they intend to use the MRA authority judiciously for substantive violations.

That distinction matters because law and financial risk answer different questions. The safety-and-soundness route asks whether conduct departs from generally accepted standards of prudent operation and could cause, or has caused, the specified financial harm. The violation route asks whether the institution actually failed to comply with a banking or banking-related legal requirement. A bank can violate a requirement without the available facts showing a likely material loss to capital or earnings. It can also have a prudent-operation weakness that is not an actual violation of a banking-related law. The two routes may overlap, but neither should be assumed from the other.

The agencies describe four categories that guide their stated use of MRAs for substantive violations. The first is a pattern or systemic violation. Repeated or ongoing violations can demonstrate a pattern, taking into account both the number of violations and the length of time over which they occurred. A systemic violation is widespread or prevalent within an institution or business line. The concern in either case is not just that an isolated rule was missed; it is that the institution's way of operating shows a recurring or distributed failure.

The second category covers a violation that has, or could reasonably be expected to have, a more-than-minimal adverse impact on the institution's financial condition, the accuracy of its books and records, or its customers. “More than minimal” is deliberately lower than “material,” but it excludes trivial or de minimis impact. For a financial-condition effect, the agencies call for a direct, clear, and predictable connection between the violation and the impact. That keeps this route from treating every technical noncompliance as financially significant while recognizing that a violation need not reach the higher materiality threshold used in the safety-and-soundness analysis.

The third category involves violations that require, or could reasonably be expected to require, more-than-minimal restitution. The question is not limited to whether an individual received a payment. The agencies say the assessment can consider the expected size of restitution, the degree of adverse impact, and the number of people affected.