Regulators Have Now Written Down What "Unsafe or Unsound" Means. Reputation Risk Is Not In It.

Two banking agencies did something on August 27 that supervisors have avoided for decades: they wrote a definition of "unsafe or unsound practice" into regulation. The phrase is the legal hinge of bank supervision — it is what allows a regulator to order a bank to change something without pointing to a specific broken law — and until now it lived in case law, examiner manuals and custom.

The definition

Under the final rule described in OCC Bulletin 2026-40, an unsafe or unsound practice is an act or failure to act that is contrary to generally accepted standards of prudent operation and that either has caused, or if continued would be likely to cause, material harm to the bank's financial condition or a material risk of loss to the Deposit Insurance Fund.

Two words carry the weight. "Prudent" imports an external standard rather than an examiner's preference. "Material" sets a floor, and the rule ties it to financial condition — capital, asset quality, earnings, liquidity and sensitivity to market risk — rather than to non-financial concerns.

What was taken out

The rule excludes from the definition risks to a bank's reputation that are unrelated to its financial condition. Reputation risk had been a standing supervisory category, and its breadth is what made it contentious: a supervisor uncomfortable with a bank's customers could raise it without having to show a number moving.

The MRA threshold

A Matter Requiring Attention is the workhorse supervisory instrument — a written finding a bank is expected to fix. Under the final rule, an MRA may be issued only where the practice either meets the material-harm standard above or constitutes an actual violation of a law or regulation.

• Weaknesses below that bar can still be raised, but as "supervisory observations," which do not direct corrective action.
• American Banker reported that the joint rule instructs examiners to prioritise material financial risks over concerns about policies, process, documentation and other non-financial risks.
• The agencies also said they will not direct remedial action beyond what the law requires for violations that do not rise to the MRA level.

The second bulletin

OCC Bulletin 2026-41, issued the same day, replaced two internal policy manuals: PPM 5310-3 on bank enforcement actions, superseding the May 25, 2023 version, and PPM 5400-11 on Matters Requiring Attention, superseding a version issued on February 27, 2026. It rescinded Bulletin 2023-16.

The revised enforcement manual states three principles: escalation, meaning the OCC's response is generally graduated and gives a bank a chance to fix a problem before formal action; tailoring, meaning the response is scaled to the institution's size and complexity; and focus, meaning an enforcement action contains only the corrective measures needed for the identified deficiency.

American Banker also reported a limit on examination "lookbacks" — retrospective reviews of a bank's past transactions. The OCC set a general one-year cap on lookbacks involving failures to detect or report suspicious activity, with higher-level approval required to go further back.

Why it matters

Supervisory findings are not public, so bank customers rarely see them. They shape what banks do all the same — which lines of business a bank will take on, how much documentation it demands, and which customers it declines. A narrower definition of what supervisors may compel is a narrower set of things a bank can be made to do without a rule or a statute behind it.