The OCC and the FDIC's final rule on matters requiring attention, published on September 1, 2026 and effective November 2, 2026, says an agency "may only issue a matter requiring attention" for a practice that could reasonably be expected to materially harm the bank's financial condition or the Deposit Insurance Fund, or for "an actual violation of a banking or banking-related law or regulation" (91 FR 56004). Two other labels sit beside it. A supervisory observation is informal and creates no obligation to act. An "other violation" is a violation without an MRA, which the bank may still be required to remediate. For a compliance team the practical change is in tracking: one list of findings becomes three kinds, each with its own obligations and its own way of closing. Botminds' Regulatory Exam Management tracks findings from examiners and internal audit to closure on one timeline, and this guide sets out what each new label asks of the bank.
Which label a finding gets under the November 2026 rule
Is it an actual violation of a banking or banking-related law or regulation?
Yes
Did the agency issue an MRA or take an enforcement action for it?
Yes
MRA
The bank must correct it. A bank over $10 billion gets no MRA for federal consumer financial law; that is the CFPB's.
No
Other violation
The agency "may require an institution to remediate" it. At the FDIC, if it is still unremediated at follow-up, it can become an MRA.
No
Is it a practice contrary to prudent operation that could reasonably be expected to materially harm financial condition or the Deposit Insurance Fund?
Yes
MRA
The safety and soundness test: a material financial risk, now or reasonably foreseeable.
No
Supervisory observation
Informal. No requirement to take it to the board or to take corrective action.
What is a matter requiring attention?
A matter requiring attention (MRA) is a written finding in an exam report that the bank must correct, with the board involved. Each agency has used its own names: the OCC's MRA, the Federal Reserve's MRA and the more urgent MRIA, and in FDIC consumer compliance exams the Matter Requiring Board Attention (MRBA). The Federal Reserve's guidance shows the weight one carries: "the banking organization's board of directors is required to provide a written response to the Reserve Bank regarding its plan, progress, and resolution of the MRA" (SR 13-13). An MRA is short of an enforcement action, but it stays open on the record, it is followed up at the next exam, and one left unaddressed can be escalated.
Until this year, when an examiner could write one was a matter of each agency's guidance, not regulation. The new rule changes that for the OCC and the FDIC: it writes into regulation when an MRA may issue, and gives the findings that fall short of that test two names of their own.
What does the new OCC and FDIC MRA rule change?
It defines, for the first time in regulation, when examiners may issue a matter requiring attention, and it narrows that to two grounds. The first is financial: a practice that "Is contrary to generally accepted standards of prudent operation" and, "If continued, could reasonably be expected to, under current or reasonably foreseeable conditions: (1) Materially harm the financial condition of the institution; or (2) Present a material risk of loss to the Deposit Insurance Fund", or that has already done so. The second is legal: the practice "Is an actual violation of a banking or banking-related law or regulation" (12 CFR 4.92(c)).
The preamble makes the intent plain. The agencies say "it is critical that examiners and institutions prioritize material financial risks over concerns related to policies, process, documentation, and other nonfinancial risks". On the legal prong, examiners may issue MRAs "only ... for actual violations of law and not for violations of law that may occur in the future". A weak procedure that has not yet produced a violation is no longer MRA material, unless it meets the financial test.
For consumer compliance at large banks the rule says something narrower still. In footnote 36, "the agencies will not issue MRAs in response to violations of Federal consumer financial laws ... for insured depository institution with total assets of more than $10 billion and any affiliate thereof", because the CFPB supervises those banks for those laws.
Findings before and after November 2, 2026, at the OCC and the FDIC
Before the rule: Not defined in regulation; set by each agency's own guidance.
From November 2, 2026: Only for a material financial risk, or an actual violation of a banking or banking-related law.
Before the rule: Not limited by regulation to actual violations.
From November 2, 2026: Not on the legal prong: actual violations only. Supervisory observations can still flag the weakness.
Before the rule: No separate label in regulation.
From November 2, 2026: "Other violations": the agency may require remediation, and they can count in ratings.
Before the rule: No regulatory definition; the FDIC manual speaks of recommendations.
From November 2, 2026: Supervisory observations, with no requirement to present them to the board or to act.
Before the rule: Not addressed in regulation.
From November 2, 2026: No OCC or FDIC MRAs for those violations.
Which violations of law can still be an MRA? The four substantive categories
Not every actual violation. The preamble says the agencies "intend to exercise their supervisory discretion to issue MRAs for violations only in response to substantive violations", and names four categories (91 FR 56004). Consumer protection rules are squarely inside the rule's reach: "Consumer protection laws or regulations applicable to bank products or services, like the Electronic Fund Transfer Act and the Equal Credit Opportunity Act, are also considered banking or banking-related." Guidance is not: "Nonconformance with guidelines ... is not considered a violation of banking or banking-related law or regulation."
The four kinds of violation that support an MRA under the OCC and FDIC final rule
| Category | What the preamble says | How it might look in consumer compliance |
|---|---|---|
| Pattern or systemic | "repeated or ongoing violations, considering the number of violations and the length of time", or "widespread or prevalent within an institution or business line" | Regulation E error claims decided late across a year, not in one month |
| More than minimal adverse impact | On financial condition, the accuracy of books and records, or customers, including non-financial impacts; lower than "material" but not "trivial or de minimis" | Applicants denied or discouraged in breach of ECOA, with no fee to refund |
| More than minimal restitution | Judged by the expected size of payments, the degree of the impact and the number of people affected | Closing cost tolerance breaches refunded across hundreds of mortgages |
| Insider misconduct or self-dealing | Violations "perpetrated by an insider knowingly or for the benefit of the insider or the insider's associate" | Preferential terms to an insider's associate |
The preamble also keeps one door open by statute. Some laws require action on any violation, and the agencies cite the civil money penalties that federal flood law mandates; "Depending on the facts and circumstances, a violation of the Flood Act, like any violation of a banking or banking-related law or regulation, could meet the criteria of a substantive violation." For the rest, the agencies say they "will not direct an institution to take any action other than to remediate the violation, unless such other actions are required by applicable state or Federal law."
What is the difference between an MRA and a supervisory observation?
An MRA must be fixed, reported and closed. A supervisory observation, under the rule, "is an informal observation that does not rise to the level of a matter requiring attention ... that identifies weaknesses in an institution's policies, practices, condition, or operations", and it "does not create a requirement or supervisory expectation that the supervisory observation will be presented to the institution's board of directors or that the institution will take corrective action" (12 CFR 4.92(g)).
The "other violation" is the label to watch. It is "An actual violation of a banking or banking-related law or regulation for which the OCC does not take an enforcement action or issue a matter requiring attention", and "The OCC may require an institution to remediate an other violation". The FDIC's side carries an escalation the preamble spells out: "if the FDIC determines at a subsequent examination or visitation that a supervised institution has failed to remediate any 'other violations' after the FDIC has directed the institution to remediate the violation, the FDIC would be permitted to cite such an uncorrected violation as an MRA as part of the follow-up examination or visitation". And "Violations for which the agencies do not issue an MRA can be considered in ratings determinations."
An other violation is not an MRA today. Left unremediated after the FDIC directs a fix, it can become one at the next visit.
At the FDIC, the manual's own label for the most serious findings has been the Matter Requiring Board Attention (MRBA), alongside recommendations for "issues ... that have a lower risk of consumer harm". The FDIC says it is reviewing its Consumer Compliance Examination Manual "to incorporate updates based on recent rule changes (e.g., ... Unsafe or Unsound Practices, Matters Requiring Attention (12 CFR part 305))" (CCEM II-6). Until the manual is revised, banks will see the old labels in the manual and the new definitions in the rule.
The Federal Reserve's 2026 principles: plain words, and internal audit closes the loop
The Federal Reserve is not party to the rule, but its April 2026 operating principles move in the same direction. "Examiners and other supervisory staff will no longer be permitted to communicate MRAs and MRIAs in vague or overbroad language", and each deficiency must be described "with sufficient specificity so that a typical bank employee can readily know what such deficiency is and what a non-deficient state would be" (Federal Reserve, 2026).
Two of the principles change how findings close. Examiners "should not perform their own duplicative validations of whether a firm has fully remediated an MRA or MRIA ... unless ... the firm's internal audit function ... is ineffective or unsatisfactory, the firm does not have an internal audit function, or the firm's internal audit function has not validated the remediation". And a self-identified deficiency that the bank "promptly starts remediating ... will presumptively be treated as giving rise to a supervisory observation rather than an MRA or MRIA". The Fed says it "will be amending SR 13-13". The principles are framed largely around safety and soundness, and how they apply to every consumer compliance MRA is not spelled out, but the direction is clear: internal audit's validation is the evidence that closes a finding.
SR 13-13 still describes the obligations that follow an MRA at the Fed. "The banking organization's board of directors is required to provide a written response to the Reserve Bank regarding its plan, progress, and resolution of the MRA", and action plans that span "a twelve-month period with regard to consumer compliance issues, should include interim progress targets". For consumer compliance, MRIAs include "matters that have the potential to cause significant consumer harm" (SR 13-13). The CFPB, for its part, says its MRAs "will focus on pattern and practice violations of law where there is substantive and identifiable consumer harm or clear violations of the disclosure requirements" (CFPB, April 2026).
Tracking findings in three buckets: what each label needs from the bank
| Label | Board involvement | What the bank tracks | What closes it |
|---|---|---|---|
| MRA (or MRIA, MRBA) | Required. At the Fed, a written board response on plan, progress and resolution | Action plan, owners, dates, interim targets for consumer plans over 12 months | Remediation evidence, retests and internal audit's validation; examiner confirmation |
| Other violation | Not required by the rule; prudent where remediation is directed | The violation, any remediation directed, customer impact and the fix | Evidence of remediation before follow-up; otherwise it can escalate at the FDIC |
| Supervisory observation | Not required | The weakness and the bank's decision whether to act | The bank's own decision, documented |
| Self-identified issue | Through the bank's own reporting | Root cause, fix, remediation, retest | Correction before the exam; the FDIC generally does not cite self-identified, fully corrected violations |
Does the rule change the consumer compliance rating?
No. The FFIEC's consumer compliance rating system is unchanged: a 1-to-5 scale built on Board and Management Oversight, the Compliance Program, and Violations of Law and Consumer Harm, where "Examiners should weigh each of these four factors--root cause, severity, duration, and pervasiveness--in evaluating relevant violations of law and any resulting consumer harm" (81 FR 79473). Since violations without an MRA "can be considered in ratings determinations", an other violation still counts. An unremediated one adds duration, and a repeated one suggests a root cause nobody fixed.
The oversight factors also include "self-identification of consumer compliance issues and corrective action undertaken as such issues are identified". A bank that finds, fixes and evidences its own problems before the exam is rated on that strength. The new labels make that bank's tracking easier to explain, not less necessary.
Exam and audit findings on one timeline in Regulatory Exam Management
F-23-1, a violation from the last exam, is validated by internal audit and waiting for the CCO to close it: the evidence the next examiner will ask for.
In the solution, the findings tracker logs findings from examiners and internal audit with their actions, owners and dates, reminds owners at 14 and 3 days, and drafts the board update. The rule's three buckets fit that shape: an MRA with its board response and interim targets, an other violation with its directed remediation, an observation with the bank's own decision. Setting up the evidence library covers how closure evidence is kept between exams.
Closing findings: MRAs kept open after the fix
The rule does not set closure timelines, but its preamble names the habit it wants to end. The agencies "have often kept MRAs outstanding for a prolonged period of time after an institution has fully completed its remediation ... because examiners seek to see demonstrated sustainability of the remediation", which "has the potential to distract an institution's board of directors and management, as well as examiners, by inflating the number of MRAs". Suggestions on closure were left for later, outside this rulemaking.
The OCC's own estimate is that fewer MRAs will save its banks money: it "expects that cost savings will likely exceed $100 million due to the decrease in the number of MRAs issued". For a compliance team, the lesson is about evidence. When an examiner wants to see sustainability, a dated retest after the fix, and internal audit's validation of it, are what shorten the wait between remediation and closure.
How to get findings tracking ready for the new labels
Before November 2: getting findings tracking ready for three labels
- Re-label open findings
For each open item, note which bucket it would fall in under the new definitions, and keep the original label from the report.
- Track other violations as seriously as MRAs
They can be directed for remediation, count in ratings and, at the FDIC, escalate if left unfixed.
- Decide on each observation, in writing
No action is required, but a documented decision shows oversight; a self-identified weakness acted on early is a strength.
- Make internal audit's validation the closing step
At the Fed it now decides whether examiners re-validate; elsewhere it is the strongest closure evidence.
- Set interim targets for long plans
Consumer compliance action plans longer than twelve months should carry them at the Fed.
- Keep the board in the loop
Board responses for MRAs; a regular findings report for everything else.
The labels arrive at the end of an exam whose earlier stages are set out in the FDIC compliance exam, step by step.
Questions people ask
What is the difference between an MRA, an MRIA and an MRBA?
At the Federal Reserve, an MRA is important but its timing "need not be 'immediate'"; an MRIA is more urgent and, in consumer compliance, covers matters with the potential for significant consumer harm, and an MRA not addressed in time can be elevated to one. The MRBA is the FDIC consumer compliance manual's term for significant issues needing prompt corrective action by the board and management.
When does the OCC and FDIC MRA rule take effect?
On November 2, 2026. The agencies published the final rule in the Federal Register on September 1, 2026, after 36 comments on the proposal. Its text sits at 12 CFR 4.92 for the OCC and 12 CFR 305.1 for the FDIC, which also defines an unsafe or unsound practice for enforcement purposes.
Does the rule apply to the Federal Reserve or the CFPB?
No. It is an OCC and FDIC rule. The Federal Reserve set out its own principles in April 2026 and is amending SR 13-13; the CFPB describes its MRA focus in its April 2026 exam introduction.
Is a violation of guidance a basis for an MRA?
No. The preamble says nonconformance with guidelines "is not considered a violation of banking or banking-related law or regulation", and the FDIC's manual already said examiners cite only law, regulation and enforceable conditions. A weakness against guidance can still be a supervisory observation.
Who validates MRA remediation?
The bank's internal audit function, increasingly. The Fed's 2026 principles tell examiners not to duplicate an effective internal audit's validation. Examiners still confirm closure, usually at the next exam or visitation.