When Does a Supervisory Weakness Become an MRA?

The 2026 OCC/FDIC rule gives a conditional answer to this question: a weakness becomes an MRA when the facts satisfy the rule's safety-and-soundness or actual-violation standard, after the agency accounts for the institution's risk profile and explains the judgment with objective facts and sound reasoning. This final synthesis connects the conduct, financial consequence, legal status, tailoring, and governance questions so a reader can evaluate a changing weakness without turning the framework into a numeric scorecard. The central lesson is simple but demanding: an MRA is earned by a supported supervisory conclusion, not by the existence of a flaw or the force of an examiner's preference.

The Short Answer Is Conditional

For an OCC- or FDIC-supervised institution, the shortest accurate answer has two branches. Under the safety-and-soundness branch, the institution has a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and, if continued, could reasonably be expected under current or reasonably foreseeable conditions to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund. The same branch also covers conduct that has already materially harmed the institution's financial condition. Under the separate legal branch, the conduct is an actual violation of a banking or banking-related law or regulation.

The word “could” in the MRA standard does not mean that any imaginable outcome qualifies. The agencies use a lower prospective threshold than the “likely” standard in the definition of an unsafe or unsound practice, but they still reject speculation. A reasonably foreseeable stress can include a range of outcomes and does not have to be the most likely outcome. It must nevertheless be supported by current conditions, foreseeable conditions, and a reasoned connection between the conduct and the material financial consequence.

The distinction from an unsafe or unsound practice is therefore not a difference between “important” and “unimportant.” It is a difference in the conclusion the evidence supports. An MRA can be issued before an unsafe or unsound practice exists because the MRA standard allows attention to be required when material harm or DIF risk could reasonably be expected. An unsafe-or-unsound finding based on future harm requires the higher conclusion that continuation is likely to cause the qualifying consequence, along with the required departure from prudent operation. Actual material harm can support both frameworks when the other elements are met; it removes a forecasting question but not the need to identify the conduct and the relevant standard.

The legal branch adds another route. An actual violation of a banking or banking-related law or regulation can support an MRA without first proving the safety-and-soundness elements. The agencies say they intend to use this authority for substantive violations, including patterns or systemic problems, more-than-minimal adverse effects on financial condition, books and records, or customers, more-than-minimal restitution, and insider misconduct or self-dealing. “More than minimal” is lower than “material,” but it excludes trivial or de minimis impact. The legal violation must also fall within the banking-related scope; a guideline is not automatically a law, and a law unrelated to banking does not become banking-related merely because a bank is subject to it.

Not every weakness reaches either route. A supervisory observation is an informal statement of objective facts identifying a weakness that does not rise to the MRA level. It does not create a requirement or supervisory expectation that the institution present the matter to the board or take corrective action. The institution may still decide to improve the practice, and the information may still matter to ratings, but voluntary action is not the same as an MRA response. An actual banking-related violation that does not receive an MRA or enforcement action becomes an other violation. The agency may require remediation and take other actions required by law, even though the broader MRA response is not imposed.

This gives the classification model a crucial asymmetry. “Not an MRA” can mean different things. It can mean that the issue is a weakness below the MRA threshold and is communicated informally. It can mean that an actual legal violation exists but is handled as an other violation with a narrower remediation path. It can mean that the evidence is not sufficient for the particular route being considered. Those outcomes should not be collapsed into a single conclusion that the issue does not matter.

The MRA also carries a governance consequence. The OCC/FDIC agencies characterize it as a concern that rises to the level of requiring presentation to the board of directors and for which the institution must take corrective action.