- Bob Winstead
- Feb 1
- 5 min read
Updated: Feb 6
Overview
Between June and November 2025, federal banking regulators executed a fundamental reset of supervisory practice. The Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), and Federal Reserve coordinated a shift away from broad, process-heavy supervision toward a framework centered on material financial risks and clear legal violations. This transformation affects how examiners issue Matters Requiring Attention (MRAs), how banks structure governance and compliance functions, and how enforcement actions are prioritized.
The Regulatory Framework Shift
Defining 'Unsafe or Unsound Practice'
The most consequential development is the OCC/FDIC joint proposal to formally define "unsafe or unsound practice" by regulation. Under this proposal, such practices are limited to conduct that:
• Presents material risk of harm to an institution's financial condition
• Creates material risk of loss to the Deposit Insurance Fund
This regulatory definition explicitly rejects MRAs based on remote hypotheticals or violations of non-banking laws. The proposal emphasizes that MRA-worthy issues should demonstrate a clear and predictable relationship to capital, asset quality, earnings, liquidity, or market-risk sensitivity.
New MRA Standards
MRAs may now only be issued where a practice could reasonably be expected—under current or reasonably foreseeable conditions—to become unsafe or unsound, or where it violates specified banking-related laws. This standard represents a significant tightening of supervisory criteria and requires examiners to articulate a causal path from observed weaknesses to material financial harm.
Elimination of Reputation Risk as a Standalone Basis
The agencies have proposed prohibiting "reputation risk" as a standalone basis for supervisory criticism or enforcement. Staff must now tie any reputational concerns back to concrete financial risks or statutory violations. Additionally, the FDIC removed disparate-impact concepts from its Consumer Compliance Examination Manual, narrowing the doctrinal bases for consumer-compliance criticism.
Federal Reserve's Supervisory Operating Principles
The Federal Reserve's November 2025 Statement of Supervisory Operating Principles aligns the Fed with the OCC and FDIC reforms. The Principles direct supervisors to:
• Focus examinations and MRAs/MRIAs on material financial risks
• Reduce duplication with primary regulators
• Rely more heavily on bank internal audit and risk-control structures
• Provide clear, specific supervisory communications
• Take earlier and proportionate actions
Importantly, the Principles emphasize reliance on satisfactory internal audit functions to validate remediation and support issue closure, rather than extended supervisory testing.
Current Enforcement Priorities
Despite the framework changes, enforcement volumes have remained moderate and concentrated among smaller institutions. Mid-2025 enforcement activity centered on three primary areas:
BSA/AML and Sanctions Compliance
Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) compliance continue to generate significant enforcement activity. OCC actions have focused on unsafe or unsound BSA/AML practices combined with governance deficiencies. These enforcement orders typically require comprehensive board-level remediation of:
• Suspicious Activity Report (SAR) processes
• Correspondent banking due diligence
• Compliance staffing levels
• Independent testing programs
Recent high-profile orders have tied sanctions gaps directly to "unsafe or unsound" practices, demonstrating how BSA/AML deficiencies meet the new materiality standards.
Governance and Risk Management Weaknesses
Safety and soundness concerns related to governance structures and risk-management frameworks remain core enforcement themes. These actions often target board-level oversight failures, inadequate risk assessment processes, and deficient internal control structures that implicate institutional financial condition.
Consumer Harm Issues
Consumer compliance enforcement has continued, particularly at community and regional banks. FDIC releases from June through September 2025 show steady flows of consent orders, civil money penalties, and enforcement actions targeting:
• Flood insurance compliance
• Credit administration weaknesses
• Consumer compliance violations
However, with the removal of disparate-impact analysis from FDIC examination procedures, consumer-harm cases now focus on clear harm scenarios involving overdrafts, fees, add-on products, and servicing practices.
Enforcement Distribution
Enforcement actions remain concentrated among institutions under $10 billion in assets. The FDIC's published enforcement actions show consent orders, cease and desist orders, civil money penalties, and deposit insurance terminations predominantly affecting smaller institutions.
The Federal Reserve has issued relatively few public institutional actions during this period. For large, complex institutions, the Fed emphasizes that its primary supervisory leverage operates through MRAs/MRIAs, ratings, and program supervision rather than through high volumes of public enforcement orders.
Practical Implications for Financial Institutions
Enhanced Evidentiary Standards
Examiners now operate under increased pressure to articulate a causal path from observed weaknesses to material financial harm. This raises the analytical bar for supervisory findings but creates a clearer framework for banks to contest, prioritize, and remediate issues. The "currency" of MRAs and Section 8 actions is being revalued toward fewer, better-documented findings with higher evidentiary expectations.
Elevated Role of Internal Audit
Internal audit functions have become central to supervisory strategy. Agencies expect to rely more heavily on banks' own control frameworks and on primary regulators' findings to avoid duplicative examinations. A satisfactory internal audit function can validate remediation efforts and support issue closure, reducing the need for extended supervisory testing.
Board-Level Risk Reporting
Issue-management programs and board-level risk reporting require recalibration. Board reporting should emphasize material risk indicators and remediation status for issues that meet the new MRA and Section 8 standards, while de-emphasizing minor process issues that can be tracked through management committees.
Strategic and Capital Planning Integration
Banks must integrate supervisory-sensitive metrics—ratings, MRAs, enforcement status, and trends—into strategic and capital plans. Less-than-satisfactory CAMELS ratings remain tightly linked to material MRAs and enforcement orders and continue to constrain merger and acquisition activity and growth initiatives.
Audit BSA/AML and Sanctions Programs
Conduct comprehensive reviews of customer due diligence, transaction monitoring, SAR quality, sanctions screening, and correspondent banking relationships. These reviews should assess whether existing controls can demonstrate effective risk mitigation under the heightened materiality standards.
Strengthen Internal Audit Independence
Ensure internal audit has appropriate independence, resources, and board access. Audit findings should be comprehensive, well-documented, and capable of supporting supervisory reliance. Management should demonstrate responsiveness to audit findings with clear remediation timelines.
Refine MRA Management Processes
Review existing MRAs to identify those that meet the new materiality threshold versus process-oriented findings. Develop closure strategies that emphasize demonstrated control effectiveness and sustainable remediation rather than documenting process improvements without measurable risk reduction.
Enhance Consumer Harm Controls
Update fair-lending and UDAAP (Unfair, Deceptive, or Abusive Acts or Practices) frameworks to focus on clear consumer-harm scenarios. Build integrated conduct-risk dashboards that flag concentrations of complaints, charge-offs, fee income, and product changes, enabling proactive remediation before patterns form the basis for enforcement findings.
Revise Board Reporting
Recalibrate board-level risk and compliance reporting to emphasize material risk indicators and remediation status for issues that plausibly meet the new MRA and Section 8 standards. De-emphasize minor process issues, tracking them instead through management committees.
Conclusion
The coordinated regulatory reset of 2025 represents a fundamental shift in bank supervision philosophy. The movement toward material financial risk as the organizing principle for MRAs, enforcement actions, and supervisory attention creates both opportunities and challenges for financial institutions.
Institutions that successfully operationalize these adjustments—particularly around MRA materiality, internal audit reliance, and BSA/AML and consumer-harm controls—will be positioned to benefit from fewer but more consequential supervisory actions, faster issue closure, and more constructive examination relationships. For banks supervised by multiple federal and state authorities, the emerging cross-agency consensus around materiality standards and reduced duplication creates a clearer regulatory landscape. However, the elevated evidentiary standards for supervisory findings require more sophisticated internal control frameworks and more rigorous documentation of risk-management practices.
The transition from broad, process-heavy supervision to a framework centered on material financial risks and clear legal violations represents a significant recalibration of the regulatory-institution relationship. Institutions that recognize this shift and adapt their governance, compliance, and risk-management functions accordingly will be better positioned to navigate the evolving supervisory environment.
Note: This analysis reflects regulatory developments through November 2025. Financial institutions should consult with legal counsel and compliance advisors regarding specific applications of these supervisory changes. The opinions expressed regarding optimal institutional responses represent analytical observations and should not be construed as legal or regulatory advice. Regulatory proposals referenced herein remain subject to finalization and may be modified through the rulemaking process.

