I still remember the first time I sat through a long conversation with a compliance officer who looked completely drained after yet another round of examiner findings. Most of the notes were about missing signatures on routine memos or slight wording differences in internal policies. Nothing that threatened the bank’s capital, liquidity or customers. Yet those notes generated weeks of remediation plans, board presentations and follow-up meetings. Watching that process made me wonder when supervision had drifted so far from actual risk. This week the Office of the Comptroller of the Currency offered a clear answer by rewriting its approach.
A Clear Shift Toward Material Financial Risks
On August 27 the agency released updated supervisory manuals and a joint final rule with the Federal Deposit Insurance Corporation. The message is straightforward. Examiners should concentrate on practices that create real financial risk or clear legal violations instead of chasing every procedural shortcoming. In my view this feels like a long-overdue course correction.
The revised enforcement manual rests on three simple principles. First comes escalation. Second is tailoring. Third is limiting corrective actions to what is actually needed to fix a specific problem. Enforcement should feel proportionate and predictable. Size and complexity of the institution matter. A practice that might warrant formal action at a large complex bank may not justify the same response at a smaller community institution. That difference is intentional.
Larger banks carry greater potential impact if something goes wrong. Their failures can ripple further. The new framework still demands that any response stay tied to a concrete deficiency. It is not a free pass. It is a call for better judgment.
The agency is returning to risk-based supervision with clearer guardrails so examiners and institutions can prioritize material financial risks and violations of law.
Comptroller Jonathan Gould framed the changes as a return to fundamentals. Whether consistency improves will depend on how examiners apply the guidance day after day. Policy statements alone never guarantee uniform outcomes. Implementation is where the real test begins.
Matters Requiring Attention Get Tighter Boundaries
A Matter Requiring Attention has long been the everyday tool supervisors use when they want a bank’s board and management to fix a deficient practice. These directives usually stay non-public. They still consume significant time and attention inside institutions.
For the first time the OCC publicly released its dedicated manual on Matters Requiring Attention. The document tells examiners to tailor every MRA around financial risk factors. Issuance is now limited to conduct that meets the updated standard. The joint final rule with the FDIC further defines an unsafe or unsound practice as conduct that creates material financial risk. It also clarifies when supervisors may issue these directives for safety, soundness or legal compliance issues.
The practical effect should be fewer MRAs that rest mainly on policy wording, paperwork gaps or internal process quirks when those issues do not produce meaningful risk. Weak controls that actually generate harm or legal problems remain fully actionable. I have seen banks spend months closing out findings that never threatened a single customer or the institution’s stability. Reducing that kind of activity feels constructive.
Proposed Rule Creates Substantive Versus Technical Violations
Alongside the final materials the OCC floated a separate proposal that would sort legal and regulatory breaches into two categories. Only substantive violations would support an MRA or formal enforcement action. Technical ones would still need correction, yet examiners could not dictate the exact method or demand unrelated remediation work.
A violation becomes substantive when its nature, duration, frequency or severity could meaningfully affect the bank or its customers. At least one of five criteria must be present.
- Systemic patterns that show repeated or widespread problems
- More-than-minimal financial effects on the institution
- Inaccurate books and records that impair reliable reporting
- Customer harm or the need for restitution
- Insider misconduct or self-dealing
Everything else falls into the technical bucket. Banks would still have to fix the issue and stay within the law. They simply would not face an enforcement order or formal Matter Requiring Attention for pure technical shortcomings. That distinction could reduce a great deal of friction without lowering overall standards.
Comments are due thirty days after the proposal appears in the Federal Register. Because the official publication date was not yet set when the announcement came out, no fixed calendar deadline exists yet. Institutions and industry groups now have a window to weigh in on whether the split offers useful clarity or risks limiting necessary intervention.
How Crypto-Focused Institutions Fit Into The New Picture
These changes cover every national bank, federal savings association and federal branch supervised by the OCC. That includes trust banks engaged in digital-asset custody, stablecoin reserve management or blockchain settlement activities. The framework does not hand out new powers for crypto activities. It also leaves untouched the existing requirements around capital, liquidity, cybersecurity, sanctions screening, anti-money-laundering programs and consumer protection.
What shifts is the classification of deficiencies. A minor documentation gap might now receive technical treatment. Failures in custody controls, inaccurate records, customer losses or systemic compliance breakdowns would still count as substantive. In practice that means crypto-focused institutions face the same risk-based lens as traditional banks. The special reputation-risk language and extra restrictions that once applied have already been withdrawn. Supervision has returned to standard channels.
Recent developments show several crypto companies moving through conditional charter processes and one major stablecoin issuer receiving final approval for a federally supervised digital-asset trust bank. Those institutions will now operate under the updated manuals and the forthcoming violation categories if the proposal becomes final. Consistency across traditional and digital-asset activities is the stated goal.
Practical Implications For Boards And Management Teams
Bank directors and senior managers should start by reviewing how their institutions currently track and remediate examiner findings. Many internal systems still treat every Matter Requiring Attention with the same urgency. Under the new approach that uniform intensity may no longer match supervisory expectations. Prioritizing material risk items becomes more important than ever.
Training for compliance and risk staff will need updating. Examiners are being told to ask different questions. Institutions that continue preparing exhaustive responses to every minor process observation may find themselves over-investing in low-impact work. At the same time, anything that touches customer harm, inaccurate records or systemic patterns must still receive rapid and thorough attention.
I have watched institutions wrestle with the opposite problem for years. They poured resources into closing minor findings while genuine risk issues sometimes moved more slowly. The revised manuals aim to realign that balance. Whether examiners fully embrace the new latitude remains an open question. Culture inside regulatory agencies changes more slowly than written guidance.
Why Escalation And Tailoring Matter In Daily Supervision
Escalation means supervisors should move from informal discussion to formal action only when the situation warrants it. Tailoring requires them to match the response to the size, complexity and specific risk profile of the institution. Limiting corrective actions prevents the common tendency to demand broad process overhauls for narrow problems.
Taken together these principles push examiners toward more disciplined decision-making. A small community bank with a single documentation error should not face the same remediation burden as a large institution with repeated control failures across multiple business lines. That difference has always existed in theory. The new manuals try to make it more consistent in practice.
Perhaps the most interesting aspect is how this interacts with the proposed substantive versus technical distinction. Once both pieces are fully in place, the path from observation to formal directive should become clearer. Banks will still need strong internal audit and compliance functions. The difference is that the bar for public or formal supervisory action rises.
What Stays The Same Under The Updated Framework
Nothing in the new materials reduces the core safety and soundness obligations. Capital adequacy, liquidity risk management, credit quality, operational resilience and consumer protection remain fully in force. Anti-money-laundering programs, sanctions compliance and cybersecurity standards are unchanged. The shift is about how deficiencies are classified and how responses are calibrated, not about lowering the underlying expectations.
Institutions that treat the changes as permission to relax controls would be making a serious mistake. Material risk still triggers strong supervisory responses. Customer harm still triggers strong supervisory responses. Systemic breakdowns still trigger strong supervisory responses. The relief applies mainly to technical and procedural items that never rose to that level.
In my experience the healthiest institutions already focused their boards and risk committees on material issues. The new guidance simply brings supervisory practice closer to that internal prioritization. For banks that previously scrambled to close every minor finding with equal intensity, the adjustment may feel liberating. For those that already operated with clear risk hierarchies, the change may feel more incremental.
Looking Ahead At Implementation And Industry Feedback
The manuals themselves establish current agency policy and take effect immediately. The legal-violation framework remains a proposal. Its provisions become binding only after the full federal rulemaking process concludes. That process includes the public comment period already announced.
Industry groups, banks of all sizes and consumer advocates now have the chance to tell the agency whether the substantive-technical split provides useful consistency or cuts too deeply into supervisory flexibility. Some will argue that technical violations can still signal deeper cultural or control problems. Others will welcome the explicit limitation on using formal tools for purely technical items.
I expect the comment letters to be detailed and occasionally sharp. That is healthy. Rulemaking works best when the practical effects are pressure-tested by the people who must live with the outcome every day. Thirty days is not a long window, so preparation should begin quickly once the Federal Register notice appears.
Balancing Clarity With Necessary Supervisory Judgment
One quiet tension runs through the entire package. Clearer standards improve predictability. They also reduce examiner discretion. Finding the right balance has always been difficult in bank supervision. Too much discretion produces inconsistency and occasional overreach. Too little discretion can leave supervisors unable to address emerging problems that do not fit neat categories.
The OCC appears to be betting that the combination of risk-based principles, tighter MRA standards and the proposed violation categories will produce better outcomes overall. Early results will depend heavily on training, quality control and how senior agency leadership responds when examiners and institutions interpret the boundaries differently.
In conversations with risk managers over the past year I have heard consistent frustration with the volume of low-impact findings. At the same time those same managers worry about any signal that standards are softening. The new framework tries to address both concerns at once. Success will be measured by whether material risks receive more focused attention and whether technical items receive proportionate but lighter treatment.
Crypto Banking Under The Same Risk Lens
Digital-asset activities introduce their own set of operational and compliance challenges. Custody of private keys, management of reserve assets, real-time settlement processes and novel forms of market risk all require careful oversight. The updated supervisory approach does not create special carve-outs for these activities. It also does not impose special extra layers beyond the standard risk-based framework.
That even-handed treatment is significant. Earlier periods saw reputation-risk language and activity-specific restrictions that sometimes felt disconnected from actual financial exposure. Returning crypto banking to ordinary supervisory channels while raising the bar for materiality should produce more coherent outcomes. A custody failure that produces customer losses remains substantive. A minor policy wording inconsistency does not.
Institutions already operating under federal trust bank charters or progressing through conditional approvals will need to map their existing issue-tracking systems to the new criteria. Boards should ask management how the inventory of open findings would look under the revised standards. That exercise alone can reveal where resources have been misallocated.
The Role Of Board Oversight In The New Environment
Directors retain ultimate responsibility for the safety and soundness of the institution. The updated manuals do not change that fundamental duty. What changes is the set of issues most likely to reach the board as formal Matters Requiring Attention. Boards may see fewer routine process items and more focus on items that carry genuine financial or customer impact.
That shift should free board time for deeper discussion of strategy, capital planning, risk appetite and emerging threats. It also places greater weight on the quality of internal reporting. If management continues to escalate every minor finding to the board level, the benefit of the new framework will be diluted. Clear internal thresholds that mirror the supervisory materiality standard become more valuable.
I have always believed that the best boards already operated this way. They asked hard questions about residual risk rather than checklist completion. The regulatory changes simply make that posture easier to maintain without constant second-guessing from examiners focused on minor procedural points.
Measuring Success Over The Next Supervisory Cycle
True success will show up in the volume and character of examination findings over the coming year. If the share of technical or low-impact items declines while material risk issues continue to receive rigorous attention, the framework is working as intended. If examiners simply re-label the same findings or if institutions interpret the changes as permission to delay needed improvements, the effort will fall short.
Quality assurance inside the agency will matter. So will feedback from supervised institutions. The OCC has invited that feedback through the comment process on the proposed rule. Institutions should take the invitation seriously. Concrete examples of how the prior approach created disproportionate burden, paired with suggestions for workable definitions of materiality, will carry more weight than general statements of support or opposition.
Perhaps the most useful contribution any bank can make is to describe, in practical terms, how a clearer distinction between substantive and technical issues would change its allocation of scarce compliance and audit resources. Those real-world illustrations help regulators understand the downstream effects of their choices.
A Measured Step Toward More Focused Oversight
The package released this week does not reinvent bank supervision. It attempts to restore emphasis on what actually threatens financial stability, customer interests and legal compliance. In an industry that has seen waves of both under-regulation and over-prescription, that middle path deserves careful attention.
Banks of every size and business model will feel the effects. Crypto-focused institutions operating under federal charters are included on the same terms as traditional lenders and trust companies. The common framework is intentional. Material risk is material risk regardless of the underlying technology or product set.
As the comment period opens and examiners begin applying the new manuals, the real test begins. Will the principles of escalation, tailoring and limited corrective action produce more consistent and more risk-focused supervision? Early signs will appear in the tone of examination reports and the nature of open Matters Requiring Attention. Those closest to the process will notice the difference first.
For now the direction is clear. Focus on what matters. Fix what is broken. Spend less energy on technicalities that never threatened the institution or its customers. That message, delivered through updated manuals and a thoughtful proposed rule, is worth taking seriously.
The coming months will reveal how fully the shift takes hold. Institutions that prepare thoughtfully, update their internal prioritization and engage constructively in the rulemaking process will be best positioned. Those that wait to see how others respond may find themselves catching up later. In supervision, as in banking itself, clarity and preparation tend to pay off.
