Smarter Decisions.
Faster Clarity.
Better Outcomes.

In September 2026, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation finalized a joint rule that changes how examiners are instructed to evaluate the institutions they supervise. The rule does two things at once: it establishes a uniform definition of "unsafe or unsound practice" for use in enforcement actions under 12 U.S.C. § 1818, and it directs examiners to prioritize material financial risks over findings rooted in policy, process, documentation, and other nonfinancial matters.

For institutions that have spent the past several exam cycles working through a growing list of process-oriented Matters Requiring Attention, this is a meaningful shift. The final rule sets uniform standards for when and how MRAs may be issued and how supervisory observations are communicated to an institution's board and management. Examiners retain the ability to tailor application of the standard based on an institution's risk profile, so the rule is not a blanket reduction in scrutiny. It is a narrowing of what counts as a supervisory finding serious enough to warrant formal action.

What counts as material now. The practical question for any regulated institution is where the new line sits between a material financial risk and a process observation. The rule points examiners toward capital adequacy, asset quality, earnings, liquidity, and sensitivity to market risk, the substance of the CAMELS framework itself, rather than toward the presence or absence of a specific policy document or committee charter. An institution with a documentation gap but a defensible capital and liquidity position should expect a different supervisory conversation than it would have a year ago. An institution with weak asset quality or thin capital should not expect much relief at all.

What does not change. The rule is explicit that its scope is limited to institutions the agencies supervise, and it does not touch the underlying safety and soundness statutes or the CAMELS rating system itself. Boards should not read this as deregulation of core risk categories. If anything, it raises the stakes on getting the financial fundamentals right, since examiners now have clearer instructions to focus there first.

What institutions should do before their next exam. Three things are worth doing now. First, revisit any open MRAs and sort them by whether they address a material financial risk or a nonfinancial process gap; the latter category may resolve differently under the new standard, but should not be assumed to disappear. Second, make sure the institution's own internal risk assessment mirrors the CAMELS components the rule points to, so management is not surprised by where an examiner's attention lands. Third, brief the board directly. A board that understands why an MRA was issued, or why one was not, is better positioned to ask the right questions of management and of examiners alike.

The rule reflects a broader theme in 2026 supervisory policy: prudential regulators are narrowing the aperture of routine examination to the risks that actually determine whether an institution fails, while leaving enforcement tools intact for institutions that need them. For well-run institutions, that should mean fewer process-driven findings. For institutions with real capital, asset quality, or liquidity weaknesses, the rule changes very little.

Source: OCC and FDIC joint final rule, September 2026.

Effective January 1, 2026, the FDIC's final rule on Part 363 regulatory thresholds took a meaningful bite out of the compliance burden facing mid-sized community banks. The rule, adopted in November 2025, raises two of the asset thresholds that determine which annual audit and internal control obligations apply to an insured depository institution, and it builds in an indexing methodology so the thresholds adjust for inflation going forward instead of sitting static for years at a time.

The first threshold moves from 500 million dollars to 1 billion dollars in total assets. Institutions that fall below the new 1 billion dollar line are no longer required to prepare annual reports with audited comparative financial statements, a management report on responsibility for those statements, or to maintain an independent audit committee that meets SEC independence standards. For a bank that crossed 500 million in assets sometime in the last few years and has been carrying those obligations since, this is a genuine reduction in scope, not just a paperwork change.

The second threshold moves from 1 billion dollars to 5 billion dollars. Institutions below the new 5 billion dollar line no longer need to include a management assessment of internal control over financial reporting, or a management assessment of regulatory compliance, in their annual report, and no longer need an independent auditor's report on the effectiveness of internal control over financial reporting. This is the more consequential change for banks in the 1 to 5 billion dollar range, since ICFR assessments and the associated independent audit work represent a substantial share of the cost of Part 363 compliance.

Institutions did not need to comply with the prior thresholds as of December 31, 2025, if they fell below the new thresholds effective the next day, so for many banks this change has already taken hold. The question now is less about the effective date and more about what an institution does with the relief. A bank that no longer needs an ICFR audit still benefits from the discipline that assessment imposed. Boards and audit committees should decide deliberately whether to continue some form of internal control testing on a voluntary basis, particularly if the institution is approaching one of the new thresholds from below and may cross it again within a few years.

The indexing methodology is worth watching too. Static dollar thresholds erode in real terms as a bank's balance sheet grows with inflation and normal business activity, which is part of how banks ended up subject to Part 363's more demanding tier in the first place without necessarily growing in complexity. Indexed thresholds should reduce that drift, but institutions near a threshold should still model out asset growth against the adjusted figures each year rather than assuming today's relief is permanent.

For institutions in the 500 million to 5 billion dollar range, this rule is the most concrete compliance relief to come out of the prudential agencies so far in 2026. The work now is making sure the relief is captured correctly, and that whatever internal discipline the old requirements enforced does not quietly disappear along with the paperwork.

Source: FDIC final rule, Adjusting and Indexing Certain Regulatory Thresholds, effective January 1, 2026.