"Unsafe or Unsound" Finally Means Something: Your Bank Regulator Just Got a Rulebook

Bank examiner reviewing a supervisory file on a pale neutral office table

Run: Monday, November 2, 2026, 6 AM ET
Desk: Political & Government, Public Policy & Regulatory.
Byline: By Dakota Jones
LD3 Productions Political & Government desk

Introduction

For about ninety years, “unsafe or unsound” has been the legal equivalent of “I’ll know it when I see it.” Bank examiners could cite it. Banks could fear it. Nobody could actually define it, because defining it was apparently a task for a future generation of federal employees who hadn’t been hired yet.

That changes today. A joint rule from the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) takes effect Monday, November 2. It finally writes a definition of “unsafe or unsound practice” into regulation under Section 8 of the Federal Deposit Insurance Act, the enforcement statute, and it rewrites the standards for matters requiring attention, the findings better known as MRAs. So yes, the two agencies that police your deposits spent months drafting a dictionary entry. The dictionary entry is the enforcement weapon. Welcome to banking supervision.

What happened

The agencies finalized the rule on August 27. It appeared in the Federal Register on September 1 as document 2026-17823, at 91 FR 56004. A September 22 correction fixed an incorrect OCC docket number. It did not change the effective date. The rule takes effect today. (Federal Register final rule; correction)

Here is the enforcement test, finally in writing: an unsafe or unsound practice must be contrary to prudent operation and either materially harm the institution already, or, if continued, be likely to materially harm its financial condition or present a material risk of loss to the Deposit Insurance Fund. Translation: before the government can smack a bank, it now has to point at the part of the bank that actually bleeds. Revolutionary concept. Genuinely.

“Material harm” is not a synonym for “the examiner disliked the paperwork.” The rule defines it as losses or other negative effects on capital, asset quality, earnings, liquidity, or sensitivity to market risk.

MRAs have a different, lower threshold. An MRA can address a matter that, under current or reasonably foreseeable conditions, could reasonably be expected to cause material financial harm or a material risk to the Deposit Insurance Fund. It can also address an actual violation of banking law or regulation. The agencies say this MRA test is lower than the “likely” threshold for enforcement.

In plain English: the enforcement bar and the MRA bar are not the same bar. One is higher. The agencies did not leave that detail in the footnotes, which is thoughtful of them, because footnotes are where good news about your money goes to hibernate.

The rule also separates formal findings from informal supervisory observations. An observation is not an MRA. It does not create a requirement that the bank fix the issue. Nor does it require the bank to present it to its board. Regulators can flag a weakness; the bank is not automatically ordered to act on that observation.

The FDIC building exterior in Washington, D.C.

The FDIC headquarters, shown in an image published with gov.house’s coverage of the rule.

Why it matters

Now for the part that should make you check which bank holds your direct deposit. The practical stakes show up in cybersecurity. Under this framework, a security weakness an examiner cannot tie to the bank’s finances may draw only an informal observation, which is regulator for “we wrote it down and now we are done.” A note that requires nothing. A digital sticky note with a government seal on it.

So the question is no longer whether a security gap exists. It is whether the examiner can connect that gap to the rule’s financial thresholds, on paper, before the hackers do it for them.

That connection is not impossible. The agencies say cybersecurity weaknesses can qualify when the potential severity and likelihood of financial harm meet the standard. But the new framework makes the financial link central. That is a major shift in emphasis, not a declaration that cyber risk has vanished. Hackers did not receive the Federal Register.

There is also a meaningful difference between the two agencies’ approaches to a separate tool. The OCC’s revised enforcement manual allows examiners to use Section 39 of the FDI Act to demand compliance plans for serious IT or information-security deficiencies, even when those deficiencies are not likely to cause material financial harm. The FDIC, by contrast, says it expects to require Section 39 plans only in rare cases, and only when a practice meets the MRA standard.

So the OCC and FDIC agreed on one rule and then handed their examiners two different instruction manuals for the same emergency. Joint rulemaking: shared text, separate footwork. If two regulators watching the same vault can’t agree on when to yell, that’s not a details problem. That’s a design feature with a release date.

Hands inspecting a conventional server rack and network patch panel

Industry reaction is split. The American Bankers Association supports the reforms. Better Markets and Senator Elizabeth Warren oppose them. In an October 23 letter, Warren asked the agencies to rescind the rule, arguing it limits examiners’ ability to enforce strong cybersecurity standards as AI makes attacks easier. She objected to requiring action when harm is “likely,” rather than “possible” or “plausible.”

That concern deserves to be stated accurately. The “likely” threshold applies to the enforcement definition. MRAs use a lower test, and actual banking-law violations can also support an MRA. The debate is about how much room examiners retain to intervene before a financial harm is sufficiently foreseeable, and how reliably cybersecurity problems fit through those doors.

And here’s the number that should bother you more than any legal nuance. FDIC Chairman Travis Hill said a large majority of outstanding supervisory criticisms do not meet the final rule’s standard and will be, or in some cases already have been, closed. Read that again. A pile of existing findings about bank problems just evaporated because they no longer clear the new bar. The bar moved. The findings didn’t. That is not a small administrative adjustment. That is the agency telling you most of its old to-do list was, by its own new definition, not a problem.

One more complication: the Federal Reserve did not issue this rule. The definition therefore applies to only two of the three federal bank supervisors. Separately, the Fed’s stress test transparency rule, amending Regulations Y, LL, and YY, also takes effect today.

Quick answers

Does every cybersecurity weakness become an MRA? No. The issue must meet the MRA test, including a connection to reasonably expected material financial harm, or involve an actual violation of banking law or regulation.

Can an informal observation require a bank to fix something? No. Under this rule, a supervisory observation does not itself create a corrective-action requirement.

Does the new definition apply to all three federal bank supervisors? No. The Federal Reserve is not an issuing agency.

Two unbranded folders representing different supervisory paths

Verdict

Credit where due: after decades of enforcing a phrase nobody had defined, the OCC and FDIC finally wrote the definition down. That is real. Predictability for banks is real.

But look at what predictability cost. The route to formal findings is narrower. Informal observations now absorb the problems that don’t clear the financial-harm bar, and an informal observation requires exactly nothing. The FDIC’s own chairman says most of the old findings don’t survive the new standard, and the two agencies already disagree on how hard they’ll push on cybersecurity fixes. Meanwhile the Fed, the third cop on the beat, didn’t sign the rule at all, so your bank’s level of scrutiny now depends partly on which building it registered under.

Clarity is not the same thing as protection. The rulebook exists now. Whether it catches the next Silicon Valley Bank before the collapse, or files a polite observation on the way down, is the experiment you are the control group for.

Sources

Primary and agency sources

Independent reporting