On November 2, a new OCC and FDIC rule changes when examiners can issue a Matter Requiring Attention. Seven weeks earlier, on September 14, the OCC, Federal Reserve, and FDIC raised the asset ceiling for the 18-month exam cycle from $3 billion to $6 billion.
Both changes are being read, fairly, as burden relief. For compliance officers at banks under $6 billion, they also change when problems surface. A weakness that used to draw an early written finding will often show up later, after it has become a violation.
That’s a more expensive way to learn about it. It also moves the job of catching problems early from the examiner to the bank’s own program.
What the MRA rule changes
The final rule (91 FR 56004) sets a material-harm test. An unsafe or unsound practice must be “contrary to generally accepted standards of prudent operation.” It also has to be likely, if continued, to “materially harm the financial condition of the institution” or present a material risk of loss to the Deposit Insurance Fund.
MRAs follow the same logic: a practice that could reasonably be expected to cause that kind of material harm under current or reasonably foreseeable conditions. The second route to an MRA is the one compliance officers should care about most: a violation of a banking or banking-related law or regulation. The preamble says consumer protection laws “like the Electronic Fund Transfer Act and the Equal Credit Opportunity Act” count.
Everything below that line becomes a supervisory observation. The agencies describe these as “informal observations of objective facts identifying weaknesses” that don’t rise to the level of an MRA. The rule is direct about the difference: “there is no requirement that an institution will take corrective action in response to a supervisory observation.”
The rule covers OCC- and FDIC-supervised institutions. The Federal Reserve isn’t a party to it.
Why compliance weaknesses will surface as violations
Think about how compliance MRAs have usually read. A complaint program that misses complaints from some channels. Monitoring rules that haven’t been tuned since the product mix changed. A Reg E dispute process with no control over the investigation deadline. Findings like these usually came before anyone could prove a violation, while the fix was still cheap.
Few of those weaknesses will materially harm a bank’s financial condition on their own. So compliance MRAs will now come mainly through the violation route. A weak dispute process can draw a supervisory observation. A dispute process that missed deadlines on real consumer claims can draw an MRA, plus what usually follows a violation: file reviews, customer remediation, and in serious cases, enforcement.
The early warning still exists. Acting on it is now the bank’s call.
Longer exam cycles stretch the gap
The interim final rule (91 FR 58009) implements section 903 of the 21st Century ROAD to Housing Act, which became law on July 11. The OCC’s version is 12 CFR 4.6. A bank under $6 billion qualifies for the 18-month cycle if it is well capitalized and received composite and management ratings of 1 or 2 at its last exam. It also can’t be subject to a formal enforcement proceeding or order, or have had a change in control in the prior 12 months.
The agencies estimate about 188 more banks and savings associations now qualify. They kept their authority to examine more often when they think it’s warranted. Comments on the rule are due October 14.
There’s a BSA angle too. Under 12 U.S.C. 1818(s), each examination of an insured depository institution must include “a review of the procedures” the bank maintains for Bank Secrecy Act compliance. When full-scope exams move further apart, that outside review of the BSA program can move with them, unless the agency schedules BSA work separately.
Put the two rules together. Examiners come less often, and when they do, weaknesses that haven’t become violations get noted rather than ordered fixed. Anything the bank’s monitoring, testing, and audit miss can run longer before anyone outside the bank sees it.
Sponsor banks under $6 billion should read this closely. A clean-rated sponsor bank may now see examiners less often while its fintech partners keep launching products. A sponsor bank under a formal enforcement action doesn’t qualify for the longer cycle at all.
What to do before November 2
- Treat supervisory observations as findings. The rule doesn’t require corrective action, but nothing stops the bank from requiring it of itself. The CCO logs every observation in the issue tracker with an owner, a plan, and a target date, and reports status to the board or compliance committee alongside open MRAs. An observation still open at the next exam is a likely repeat, this time as a violation.
- Set the testing calendar by risk, not by the exam calendar. If compliance testing and BSA independent testing were timed to land ahead of a 12-month exam, re-plan them. Transaction monitoring, Reg E error resolution, and fair lending on the highest-volume products shouldn’t go 18 months untested because the examiner isn’t due. The evidence is a committee-approved testing plan with dates driven by residual risk.
- Make self-identification visible. Board reporting should show what compliance found, what was fixed, and what’s still open, including anything that might be a violation. A violation the bank finds, corrects, and documents makes for a very different exam conversation than one the examiner finds first. Keep the minutes that show the board saw it.
These rules don’t change what the underlying laws require. They change who is expected to find the problem first, and for a well-rated bank under $6 billion, that’s now the bank.
The banks that handle this well will have an issue log and a testing plan that don’t wait for the examiner’s calendar.
Sources
- Unsafe or Unsound Practices, Matters Requiring Attention, 91 FR 56004 | OCC and FDIC (Sept. 1, 2026)
- Expanded Examination Cycle for Certain Small Insured Depository Institutions, 91 FR 58009 | OCC, Federal Reserve, and FDIC (Sept. 14, 2026)
- 12 CFR 4.6, Frequency of Examination | eCFR (current)
- 12 U.S.C. 1818(s), Compliance with Monetary Transaction Recordkeeping and Report Requirements | U.S. Code (govinfo)
