OCC Regulatory Updates

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the Supervisory Framework on Bank Use of Super Intelligence for examiner use.

Suggested considerations

• Compliance teams may wish to inventory current and planned SI and agentic-SI use cases, including embedded functionality supplied by vendors, and map each use case to its business owner, permitted actions, autonomy level, human oversight, data sources, and potential consequences of failure or misuse.
• Banks should consider documenting a risk-based classification methodology focused on potential consequences, transfer of agency, and degree of human oversight rather than technical sophistication alone.
• Risk and control owners may wish to assess whether existing model-risk, governance, data-governance, privacy, cybersecurity, compliance, operational-resilience, vendor-management, testing, monitoring, documentation, auditability, and independent-challenge controls adequately address SI-enabled activities.
• Higher-consequence or more autonomous use cases should be considered for stronger restrictions on permitted actions, more direct human oversight, independent validation or challenge, enhanced performance monitoring, audit trails, testing, fallback procedures, and resilience measures.
• Boards and senior management may wish to clarify accountability for SI deployments without creating a separate SI risk appetite unless the bank determines that one is useful internally; the OCC framework does not require one.
• Internal audit and compliance teams may wish to retain evidence showing how SI risks are identified, measured, monitored, controlled, and escalated within existing risk-management frameworks, particularly because examiners may use the framework during ordinary examinations despite its nonbinding status.
• Banks should consider reviewing contracts and oversight arrangements for SI vendors, including access to data, model changes, incident notification, testing rights, service continuity, explainability or transparency, subcontracting, and termination or fallback arrangements.
• Compliance teams may wish to monitor future OCC revisions and stakeholder feedback because the framework is expressly intended to be a living document.

What changed

The OCC provided examiners with a risk-based, proportionate framework covering SI used in activities including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Examiners are instructed to consider the bank’s size, complexity, risk profile, and the nature, consequences, autonomy, and complexity of each SI use case; banks are not required to create a separate SI risk category or SI-specific risk appetite. The framework identifies 16 components across six pillars: purpose, risk, control, oversight, resilience, and assurance.

Key dates

2026-11-04

The OCC issued Bulletin 2026-54 and the accompanying supervisory framework for examiner use.

2026-10-02

Executive Order 14434 was published in the Federal Register and is cited by the OCC as the source for the “super intelligence” terminology and broader definition.

Suggested considerations

• Firms should consider maintaining an inventory of SI and agentic use cases, documenting each system’s purpose, permitted actions, accessible data and systems, prohibited uses, degree of autonomy, human-oversight model, and business owner.
• Compliance teams may wish to prioritize review of use cases according to potential consequences of failure or misuse, transfer of decision-making agency, reversibility, customer or market impact, data sensitivity, and the practical ability of personnel to intervene.
• Banks should consider testing whether human reviewers can meaningfully understand, reject, pause, or stop system outputs and actions, rather than relying solely on nominal approval checkpoints or high-volume bulk approvals.
• Risk functions may wish to map SI-enabled activities to existing model risk management, operational-risk, cybersecurity, privacy, consumer-protection, compliance, and business-continuity controls instead of creating a standalone SI risk category.
• Governance teams should consider assigning accountable owners across the system lifecycle, including approval, deployment, change management, incident response, suspension, retirement, and post-incident remediation.
• Banks should consider establishing monitoring capable of detecting model drift, erroneous or harmful actions, unauthorized activity, control exceptions, low-frequency high-impact events, and customer harm, with defined escalation and containment procedures.
• Third-party risk teams may wish to review contracts for vendor notification of model changes and new SI functionality, incident and notification timelines, audit and testing rights, data-use restrictions, responsibility for model errors, service suspension rights, and operational-resilience obligations.
• Internal audit and independent validation functions should consider whether they can reconstruct material outputs and actions, assess control effectiveness, and provide effective challenge to developers, business owners, and validation teams.

What changed

The OCC provided examiners with a framework that supplements existing model risk management, governance, technology, compliance, cybersecurity, and operational-risk practices. It covers 16 components organized around purpose, risk, control, oversight, resilience, and assurance, including permitted use and authority, criticality assessment, human-in-the-loop and human-on-the-loop controls, governance and accountability, performance monitoring, operational resilience, documentation and auditability, vendor risk, testing, and independent challenge.

Key dates

2024-04-01

Bank of America self-identified the inaccurate wire-transmittor information issue, according to the OCC enforcement order; the date is included as an approximate month-level historical reference represented by the first day of the month.

2024-10-01

Bank of America stopped the inaccurate transmittor-information practice in 2024; the OCC order does not provide an exact day, so this is an approximate month-level historical reference represented by the first day of the month.

2026-10-08

The OCC announced the American Express National Bank cease-and-desist order and $350 million civil money penalty.

2026-10-13

The OCC announced the Bank of America $750 million civil money penalty, described as the largest penalty in OCC history, in coordination with Treasury and FinCEN actions.

2026-10-22

The OCC published the October 2026 consolidated enforcement-actions release.

Suggested considerations

• Firms should consider reassessing whether their BSA/AML risk assessments cover the risks of all material products and services, rather than concentrating on narrower deposit activity while underweighting credit-card, charge-card, correspondent, or payment activity.
• Compliance teams may wish to test end-to-end transaction-monitoring workflows for alert generation, escalation, investigation, disposition, and SAR filing, including backlog governance, aging thresholds, management information, and evidence that suspected trade-based money laundering is escalated promptly.
• Firms should consider validating that customer identification, customer due diligence, beneficial-ownership information, and ongoing-risk-rating processes are complete, accurate, risk-based, and aligned to the institution's actual customer and product populations.
• Banks may wish to perform a targeted review of outgoing wire data to confirm that originator or transmittor names and other required fields are accurate, consistently populated, retained, and not overwritten by deficient interfaces or manual processes.
• Boards and senior management should consider documenting sufficient staffing, subject-matter expertise, training, independent testing, audit coverage, and issue-remediation ownership for BSA/AML programs.
• Institutions operating under prior supervisory findings should consider independent validation that corrective actions are complete, effective, sustainable, and supported by evidence, rather than merely implemented procedurally.
• Compliance teams should consider reviewing whether third-party, correspondent, and payment-processing arrangements create data-quality or monitoring dependencies that could delay SAR filing or impair law-enforcement traceability.

What changed

This publication announces enforcement outcomes rather than a new rule or generally applicable deadline. American Express National Bank is subject to a cease-and-desist order and a $350 million penalty for an inadequately designed and monitored BSA/AML program, inadequate resources and expertise, internal-control weaknesses, weak independent testing and training, systemic failures involving approximately $13 billion of suspected trade-based money-laundering activity, and customer identification and customer due diligence deficiencies.

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2024-12-01

The OCC issued the December 2024 cease-and-desist order requiring Bank of America to address deficient BSA/AML controls; the publication does not specify the precise day of issuance.

2026-10-13

The OCC announced the $750 million civil money penalty and coordinated action with FinCEN.

Suggested considerations

• Compliance teams may wish to perform a documented gap assessment against 12 CFR 21.21 and 12 CFR 21.11, including transaction monitoring, customer and activity risk coverage, escalation procedures, SAR timeliness and accuracy, and recordkeeping.
• Banks should consider testing whether potentially suspicious activity is consistently escalated to appropriately skilled investigators and whether alert disposition processes can demonstrate timely decisions on SAR filing.
• BSA officers and relevant personnel should consider competency-based training covering suspicious-activity identification, investigation, SAR preparation, trade-based money laundering indicators, and escalation responsibilities, with evidence of completion and effectiveness testing.
• Internal audit and independent testing functions may wish to assess whether their scope, expertise, sampling, issue validation, and reporting are capable of detecting systemic BSA/AML weaknesses rather than merely confirming policy existence.
• Management and boards of directors should consider reviewing BSA/AML remediation governance, resourcing, milestones, risk acceptance, issue escalation, and the treatment of repeated or overdue corrective actions.
• Banks with material trade finance, correspondent banking, card, payments, or cross-border activity should consider targeted testing for trade-based money laundering typologies and transaction-monitoring coverage gaps.
• Institutions operating under a consent order or cease-and-desist order should consider independently validating that remediation is complete and effective, rather than relying solely on management representations or closure of project milestones.
• Compliance teams may wish to compare their control framework with the broader market reading of the action: industry reporting characterized the case as a record penalty driven by systemic and longstanding failures, while professional commentary on the evolving BSA/AML framework emphasizes the distinction between establishing an effective program and maintaining it in operation.

What changed

The publication is an enforcement action, not a new generally applicable rule or safe harbor. It establishes a major OCC enforcement precedent that persistent failures to implement an effective BSA/AML program after a formal supervisory order can result in exceptionally large penalties, including where deficiencies affect transaction monitoring, SAR escalation and filing, personnel competence, training, and audit effectiveness.

Key dates

2026-10-08

The OCC announced the cease-and-desist order and $350 million civil money penalty against American Express National Bank; the Federal Reserve announced a coordinated action against American Express Company and American Express Travel Related Services Company.

Suggested considerations

• Compliance teams may wish to reassess whether the BSA/AML risk assessment accurately reflects the institution's largest and most complex products, customer segments, payment flows, geographies, channels, and transaction types, rather than relying primarily on deposit-account risk.
• Firms should consider testing whether customer identification, customer due diligence, beneficial-ownership information, and account-risk-rating processes provide sufficiently complete and reliable data for transaction monitoring and suspicious-activity reporting.
• Banks may wish to conduct a targeted lookback for trade-based money-laundering indicators in card, merchant, payment, cross-border, and related repayment activity, including activity involving insiders or connected accounts, and document escalation and reporting decisions.
• Compliance teams should consider validating that monitoring scenarios, alert thresholds, investigative workflows, case-management controls, quality assurance, and SAR filing processes can identify and report suspicious activity within applicable regulatory timeframes.
• Boards and senior management may wish to review whether BSA/AML staffing levels, expertise, reporting lines, technology, data governance, and independent-testing coverage are proportionate to the institution's size, complexity, and risk profile.
• Firms should consider strengthening role-based BSA/AML training for employees, directors, and senior management, with evidence of completion, competency, and periodic refreshers.
• Internal audit or another suitably independent function may wish to perform end-to-end testing of risk assessment, customer due diligence, monitoring, investigation, SAR decisioning, and governance controls, with tracked remediation and board-level reporting.
• U.S. banking organizations may wish to compare their programs against the OCC's findings and the market commentary emphasizing that the principal lesson is product-risk misalignment and the need for enterprise-wide controls, not merely remediation of isolated monitoring alerts.

What changed

This is an enforcement action and supervisory precedent, not a new generally applicable rule. The OCC required American Express National Bank to remediate a BSA/AML program that was not reasonably designed to assure and monitor compliance with the BSA and its implementing regulations. The findings specifically reinforce expectations that risk assessments cover the institution's actual product mix, including credit and charge cards; customer identification and customer due-diligence procedures support effective monitoring; transaction-monitoring and suspicious-activity reporting processes...

Key dates

2026-08-27

The OCC issued Bulletin 2026-42 announcing the notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to inventory open and recently closed MRAs arising from alleged legal or regulatory violations and assess whether each matter would satisfy one or more of the proposed substantive-violation criteria.
• Firms should consider strengthening documentation linking examination findings to duration, frequency, systemic characteristics, financial-condition effects, books-and-records impacts, customer harm, restitution, or insider misconduct.
• Banks may wish to separate remediation plans for legal or regulatory violations from broader supervisory enhancements, because the proposal would limit examiner authority over technical violations to directing correction of the violation itself.
• Compliance and examination-management teams should consider preparing comments or internal positions on the undefined terms more than minimal, systemic, pattern, and meaningfully impact, including how those terms should be applied to isolated but high-severity events.
• Management may wish to review escalation thresholds so that technical-violation treatment does not result in under-escalation of recurring findings that could become systemic or satisfy the proposed substantive criteria.
• Banks should monitor the Federal Register publication of the notice of proposed rulemaking and calculate the 30-day comment period from that publication date rather than from the OCC bulletin date.
• Legal and regulatory-change teams may wish to assess this proposal alongside the OCC-FDIC final rule and related supervisory reforms concerning unsafe or unsound practices, MRAs, and material financial risk, while treating the proposal as nonfinal until adopted.

What changed

The proposed rule would provide that the OCC may issue an MRA for a violation of a banking or banking-related law or regulation only when the violation is substantive. A violation would be substantive when its nature, duration, frequency, or severity could meaningfully impact the bank or its customers, and at least one of five criteria would need to be met: the violation is systemic or constitutes a pattern; it has had or could reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the bank's financial condition; it has had or could reasonably be expected...

Key dates

2026-08-27

OCC issued revised PPM 5310-3 and PPM 5400-11; PPM 5310-3 replaces the May 25, 2023 manual, PPM 5400-11 replaces the February 27, 2026 version, and OCC Bulletin 2023-16 is rescinded.

Suggested considerations

• Compliance teams may wish to map open MRAs, enforcement orders, capital directives, and supervisory findings against the new material-harm, Deposit Insurance Fund risk, and substantive-violation thresholds.
• Banks should consider reviewing issue-management taxonomies and governance procedures so that MRAs, other violations, and supervisory observations are recorded and escalated according to their distinct consequences.
• Board and committee reporting processes may warrant review because supervisory observations do not automatically require board presentation or a corrective-action plan, whereas MRAs and enforcement actions remain subject to formal remediation and validation expectations.
• Large and complex banks should consider reassessing whether deficiencies that might previously have produced a community-bank-level supervisory response could receive faster escalation under the revised tailoring framework.
• Banks with existing enforcement actions may wish to assess whether their remediation evidence demonstrates substantial compliance with the essential requirements of each order and whether remaining issues are minor and isolated.
• Capital management teams may wish to review procedures for the institution of and termination of individual minimum capital ratios under the revised enforcement manual.
• Legal and regulatory change teams should monitor Federal Register publication of the joint OCC-FDIC final rule and calculate the actual effective date rather than relying on the bulletin date.
• Internal audit and compliance functions may wish to preserve objective factual support for responses to MRAs and other supervisory communications, particularly where the bank believes an issue does not meet the new risk-based threshold.

What changed

Revised PPM 5310-3 replaces the May 25, 2023 version and structures the OCC enforcement framework around escalation, tailoring, and focus. The OCC generally intends to provide banks an opportunity to remediate deficiencies through supervision before initiating a Section 8 enforcement action, although it retains authority to act at any time when legally supportable and warranted.

Key dates

2026-08-27

OCC revised PPM 5310-3 and PPM 5400-11, issued Bulletin 2026-41, and published the proposed rulemaking notice concerning substantive and technical violations. The proposed rule's 30-day comment period begins only upon Federal Register publication.

Suggested considerations

• Compliance teams may wish to map open and recently closed MRAs and enforcement actions against the revised material-financial-risk threshold and the stated tailoring factors of capital structure, complexity, activities, and asset size.
• Banks should consider documenting objective facts, legal violations, financial-risk consequences, customer impact, duration, frequency, severity, and remediation status supporting the classification and closure of examination findings.
• Large and complex banks may wish to reassess escalation risk because the OCC expressly permits enforcement action for practices that might not produce the same response at a community bank.
• Banks should consider reviewing corrective-action plans to confirm that each action is directly tied to a specific deficiency and is proportionate to the risk, while preserving evidence of substantial compliance with existing orders.
• Compliance teams may wish to distinguish substantive violations from potential technical violations in issue-management inventories, including systemic or repeated conduct, customer restitution, books-and-records impacts, financial-condition effects, and insider misconduct.
• Banks should consider monitoring the Federal Register for publication of the proposed rule and calculating the 30-day comment period from that publication date; affected institutions may wish to submit comments on the proposed substantive-versus-technical framework.
• Examiners may identify lower-level weaknesses as supervisory observations rather than MRAs; banks should consider maintaining internal governance and risk records for such observations without assuming that the OCC may require a board action plan or track remediation in the same manner as an MRA.

What changed

Revised PPM 5310-3, Bank Enforcement Action and Related Matters, replaces the May 25, 2023 version and emphasizes escalation, tailoring, and focused corrective action. The OCC generally expects to provide a bank an opportunity to remediate deficiencies through supervision before taking an enforcement action under section 8 of the Federal Deposit Insurance Act, although it retains authority to act at any time when legally supportable.

Key dates

2026-08-27

OCC and FDIC issued the joint final rule through OCC Bulletin 2026-40. The bulletin applies to all OCC-supervised banks; it does not state the Federal Register publication date, effective date, or a firm compliance deadline.

Suggested considerations

• Firms should identify the final rule’s Federal Register publication and effective date, because the OCC bulletin itself does not state either date or a compliance deadline, and should monitor OCC and FDIC implementation guidance before relying on any transition treatment.
• Compliance teams may wish to inventory open MRAs, supervisory recommendations, enforcement matters, and examination findings and map each item to the final rule’s material-financial-risk, DIF-risk, actual-violation, or already-caused-harm criteria.
• Firms should consider separating board-level MRA remediation obligations from discretionary management responses to supervisory observations and documenting why a weakness is treated under one category rather than another.
• Risk and compliance functions may wish to enhance evidence files supporting assessments of likelihood, materiality, current and reasonably foreseeable conditions, and impacts on capital, asset quality, earnings, liquidity, and market-risk sensitivity.
• Banks should consider documenting how supervisory requirements and remediation plans are tailored to asset size, complexity, activities, capital structure, and other financial-risk factors, particularly where the institution has heightened systemic, concentration, liquidity, or operational complexity.
• Legal and compliance teams may wish to distinguish actual violations of banking or banking-related laws and regulations from prudential weaknesses, because an actual violation can support an MRA without separately satisfying the prudent-operation and material-risk test.
• Boards and senior management should consider reviewing governance procedures so that MRAs receive required escalation and tracking while supervisory observations are clearly identified as non-binding potential enhancements.
• Firms should consider preparing a process for requesting and retaining the objective facts and reasoning underlying an MRA or unsafe-and-unsound-practice determination, as the rule requires examiners to share that basis.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either is likely, if continued, to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. “Likely” requires more than a merely possible risk; relevant financial-condition effects include impacts on capital, asset quality, earnings, liquidity, and sensitivity to market risk.

Key dates

2026-08-27

OCC and FDIC issued the final rule and OCC published Bulletin 2026-40 describing its application to OCC-supervised banks.

Suggested considerations

• Compliance teams may wish to map existing and anticipated MRAs, enforcement commitments, supervisory recommendations, and examination findings against the new material-financial-risk and actual-violation criteria.
• Firms should consider separating board-level corrective-action items from nonbinding supervisory observations and documenting why each issue does or does not meet the MRA threshold.
• Risk and compliance functions may wish to update issue-taxonomy and escalation procedures to assess impacts on capital, asset quality, earnings, liquidity, sensitivity to market risk, and the Deposit Insurance Fund.
• Banks should consider retaining objective evidence and documented reasoning supporting materiality assessments, including institution-specific factors such as asset size, complexity, activities, and capital structure.
• Management and boards may wish to review outstanding policies, process, and documentation findings to determine whether they remain mandatory remediation matters, are better treated as supervisory observations, or independently constitute violations of banking or banking-related law.
• OCC-supervised banks should monitor the related examination guidance and assess whether planned lookbacks, independent-consultant requirements, or suspicious-activity review scopes are affected by the revised supervisory approach described in industry reporting.
• Firms should track Federal Register publication and calculate the 60-day effective date once publication occurs; the August 27, 2026 announcement date is not itself the effective date.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either, if continued, is likely to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. Relevant financial-condition impacts include capital, asset quality, earnings, liquidity, and sensitivity to market risk; reputation concerns unrelated to financial condition are excluded.

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2026-08-12

Federal Register publication of the proposed rule at 91 FR 52114

2026-10-13 Deadline

Comments due on the proposed rule

Suggested considerations

• Compliance teams may wish to map the proposed changes against current CRA policies, exam procedures, public file practices, and community development grant approval workflows.
• Institutions may wish to assess how the proposed asset-size thresholds would change their CRA category and associated data collection, reporting, and evaluation obligations.
• Banks making grants or donations may wish to review documentation standards for recipient use of funds, overhead limits, and evidentiary support needed for CRA consideration.
• Community development and CRA governance teams may wish to identify which activities would still qualify under the revised CD definitions and performance tests.
• Legal and regulatory affairs functions may wish to prepare comments on the proposed lending focus, grant criteria, sunshine requirements, and technical changes to OCC public welfare and corporate activity rules.
• Banks subject to CRA-related agreements may wish to verify whether the proposed technical amendments would affect disclosure timing, content, or filing processes.

What changed

['The proposal would amend the OCC and FDIC Community Reinvestment Act rules to make substantive, technical, and process-oriented changes aimed at refocusing the statutory objective on meeting community credit needs and reducing burden, particularly for community banks.', 'The agencies propose to better ensure that community development grants reach intended communities and to provide greater clarity on how to obtain CRA consideration for activities.', 'The OCC and FDIC also propose technical changes to their CRA sunshine rules under the Federal Deposit Insurance Act, which govern disclosure...

Key dates

2026-08-05

OCC published the proposed rule in the Federal Register (91 FR 50610)

2026-10-05 Deadline

Comment period closes for the proposed rule

Suggested considerations

• Compliance teams may wish to map which internal records fall into the proposed CSI category and compare current disclosure controls against the new exceptions and safeguard requirements.
• Supervised entities may wish to review any confidentiality agreements and onward-sharing practices to determine whether they would satisfy the proposed conditions for permitted CSI disclosures.
• Legal and FOIA teams may wish to update request-handling workflows for expedited processing requests, fee-waiver appeals, and request tracking once the rule is finalized.
• Banks and other recipients of OCC information may wish to reassess litigation, government-reporting, and interaffiliate sharing procedures to ensure they align with the revised disclosure framework.
• Firms may wish to submit comments by the close of the comment period if the proposed CSI scope, disclosure exceptions, or FOIA procedures would affect their supervisory, legal, or records-management processes.

What changed

The proposal would restructure the OCC’s information-disclosure rules in 12 CFR part 4 and make conforming changes in parts 5, 7, 21, and 163. It would create a new subcategory of non-public OCC information called confidential supervisory information (CSI), clarify when supervised entities and other recipients may disclose CSI without prior OCC approval, and require applicable safeguards and, in some cases, qualifying confidentiality agreements. The OCC also proposes to permit certain disclosures of CSI in limited circumstances to support business efficiency, government accountability, and...

Key dates

2026-08-03

OCC issued Bulletin 2026-37 announcing the proposed rulemaking on availability of OCC information

2026-10-02 Deadline

Comment period closes 60 days after publication, based on the OCC’s stated deadline formula in the related rulemaking notice

Suggested considerations

• Compliance teams may wish to review current controls for handling nonpublic OCC information and identify where internal policies reference the existing 12 CFR part 4 subparts B and C.
• Firms may wish to assess whether any current or planned disclosures of supervisory materials could fall within the proposed expanded exceptions for business efficiency, government accountability, or supervisory coordination.
• Banks may wish to inventory records that could qualify as aged CSI once the final rule is issued, so they can update retention and disclosure procedures accordingly.
• Legal and compliance functions may wish to monitor the final rule and any comment-driven changes to the proposed FOIA expedited-processing and fee-waiver appeal procedures.
• Institutions may wish to align employee training with the OCC’s clarified position on unauthorized disclosure and potential criminal referral exposure.

What changed

The proposal would amend the OCC’s disclosure framework in 12 CFR 4 by creating a new subcategory of nonpublic OCC information called confidential supervisory information (CSI). It would modify the prior-approval regime for supervised entities that want to disclose CSI by expanding exceptions for business efficiency, government accountability, and supervisory coordination, while adding safeguards around those exceptions. The OCC also proposes to provide for the release of certain aged CSI, which would create a time-based disclosure concept not described in the current rule.

Key dates

2026-08-03

OCC issued the notice of proposed rulemaking

2026-10-05 Deadline

Comments on the proposal are due 60 days after publication in the Federal Register

2026-08-05

Federal Register publication date of the proposed rule

Suggested considerations

• Compliance teams may wish to review current internal controls for handling OCC nonpublic information and map where the proposed CSI category could affect disclosure workflows.
• Firms may wish to assess whether existing information-sharing arrangements with government agencies or service providers would fit within the proposed exceptions and safeguards.
• Teams responsible for FOIA or public records requests may wish to update procedures for expedited processing requests and any related appeal handling.
• Banks and supervised entities may wish to submit comments on operational burden, safeguards, and the practical impact of the proposed disclosure exceptions before the comment deadline.

What changed

The proposal would make structural and substantive changes to the OCC’s disclosure framework in 12 CFR part 4. According to the OCC, it would create a new nonpublic information category called confidential supervisory information (CSI), modify the prior-approval framework for supervised entities that want to disclose CSI, and add tailored exceptions for business efficiency, government accountability, and supervisory coordination, subject to safeguards.

Key dates

2026-06-24

Venezuela experienced a pair of strong earthquakes off the northern coast west of Caracas, triggering the humanitarian crisis referenced by the agencies.

2026-07-27

FinCEN issued a substantively similar statement of enforcement policy regarding Venezuela-related financial services.

2026-07-31

The OCC, Federal Reserve, FDIC, and NCUA issued the joint enforcement policy.

2026-07-31

Start of the period during which authorized financial services to persons or entities in Venezuela are covered by the enforcement commitment.

2027-01-29 Deadline

End of the covered period for the joint enforcement commitment.

Suggested considerations

• Compliance teams may wish to confirm whether current Venezuela-related activity falls within the scope of authorized financial services covered by the joint statement.
• Institutions may wish to verify that their BSA compliance program remains current and that ongoing controls reflect reasonable efforts to comply during the relief period.
• Firms may wish to check whether they have had any final FinCEN or OCC enforcement action involving BSA violations in the prior 24 months before relying on the policy.
• Sanctions teams may wish to confirm continued compliance with all applicable OFAC-administered sanctions regulations and authorizations.
• Institutions with Venezuela exposure may wish to document how they will evidence reliance on the policy and monitor the January 29, 2027 end date.

What changed

The agencies stated that eligible U.S. financial institutions that choose to provide authorized financial services to persons or entities in Venezuela will not be subject to supervisory action, including a citation for a violation of law, or enforcement action related to a Bank Secrecy Act requirement, for those services. The commitment is limited to authorized financial services provided from 2026-07-31 through 2027-01-29 and applies only to statutes or regulations specifically addressed in the joint statement.

Key dates

2026-07-31

OCC Bulletin 2026-35 issued; interagency proposed CRA rule released

Suggested considerations

• Compliance teams may wish to map current CRA inventories against the proposed lending-focused retail services framework to identify deposit-service items that could lose CRA consideration.
• Firms may wish to review community development grant and donation controls to determine whether documentation exists to show direct use for a qualifying primary-purpose community development activity.
• Large banks may wish to assess whether recipient overhead data, written commitments, attestations, tax filings, and budget records would be available to support the proposed 15% overhead limitation.
• Banks near the $1 billion and $10 billion thresholds may wish to model whether the proposed size reclassification would change their CRA evaluation approach, reporting obligations, or supervisory expectations.
• Institutions using or considering strategic plans may wish to reassess whether the proposal would make that option more operationally feasible under the revised framework.
• CRA and public-disclosure teams may wish to inventory public file and notice processes to determine whether technology-enabled publication changes would require procedural updates.

What changed

['The proposal would narrow the retail banking services analyzed under CRA to focus on credit services and would exclude deposit services from that component of the evaluation, while giving greater weight to activities with a lending nexus.', 'Community development grants would count only if they are directly used for a plan, project, or initiative with community development as a primary purpose; for large banks, defined as banks with assets over $10 billion, the recipient would also need documented overhead costs not exceeding 15% of the grant amount.', 'The bank-size framework would be...

Key dates

2026-07-31

OCC and FDIC issued the joint proposal amending CRA rules

2026-10-01 Deadline

Approximate comment deadline, calculated as 60 days after the July 31, 2026 publication date if the proposal was published in the Federal Register on the same day as the release

Suggested considerations

• Compliance teams may wish to review whether current CRA strategies rely materially on deposit services, since the proposal would exclude deposit services from the retail banking services analysis.
• Firms may wish to map all community development grants and donations to identify whether documentation would support that funds are used for the primary purpose of community development and reach the intended assessment areas.
• Banks with assets at or below $10 billion may wish to assess the operational impact of being relieved from data collection, maintenance, and reporting requirements under the proposal.
• Institutions may wish to compare their current CRA performance-test approach against the proposed lending-focused framework and identify activities that could lose or gain CRA consideration.
• Compliance functions may wish to track the Federal Register publication date closely, because the comment window runs for 60 days after publication.

What changed

['The agencies said the proposal would keep the core CRA framework that has generally been in place since 1995, while making substantive, technical, and process-oriented revisions. The proposal follows the agencies’ October 24, 2023 CRA final rules, which were enjoined by the U.S. District Court for the Northern District of Texas before they became effective.', 'The proposal would place greater emphasis on lending performance and would narrow the retail banking services considered under CRA to credit services, expressly excluding deposit services from that part of the analysis.', 'The...

Key dates

2026-07-01

Revisions to the CBLR framework became effective, including the lower 8% threshold and revised grace-period rules

2026-07-30

OCC Bulletin 2026-34 published the updated Community Bank Compliance Guide

Suggested considerations

• Compliance teams may wish to review whether current capital planning and reporting processes reflect the revised 8% CBLR entry threshold.
• Firms that use or may elect the CBLR framework may wish to reassess whether they can remain above the 7% grace-period floor during any temporary noncompliance.
• Banks may wish to confirm how the four-quarter cure period and the eight-quarter cap over five years would operate in their internal capital contingency planning.
• Community banking organizations may wish to reconcile the updated guide with the text of the capital rule, since the guide is only a summary and not binding legal text.

What changed

The agencies revised the non-binding compliance guide to align with the updated CBLR framework in the capital rule. The key substantive change is the minimum leverage ratio for CBLR qualification, which was lowered from greater than 9% to greater than 8%. The grace period for a bank that elects the CBLR framework but temporarily fails to meet the qualifying criteria was revised from two quarters to four quarters, provided the bank maintains a leverage ratio greater than 7% and does not exceed eight quarters in grace-period status over a five-year period.

Key dates

2026-07-13

OCC, FDIC, and NCUA issued the interagency guidance

2026-06-08

CFPB issued its Statement on Ability To Repay and Immigration Status, referenced by the guidance

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that repayment capacity, source of repayment, and overall financial condition are assessed consistently for borrowers whose work authorization is uncertain.
• Firms may wish to test whether account management, credit classification, and allowance methodologies adequately capture elevated credit risk linked to employment authorization uncertainty.
• Institutions may wish to review consumer compliance controls for alignment with TILA, Regulation Z, ECOA, and Regulation B when evaluating applicants affected by immigration or work-authorized status.
• Risk and compliance teams may wish to update portfolio monitoring, concentration analysis, and documentation standards so that the identified credit risk factors are reflected in governance and reporting.
• Community banks may wish to verify that loan policy language and examiner-facing documentation clearly show how these risks are being identified, measured, monitored, and controlled.

What changed

The publication is guidance, not a new rule or statute, and it reinforces existing expectations rather than imposing a new legal prohibition. It states that lending to individuals not legally authorized to work in the United States may present elevated credit risk because their ability to generate income, maintain employment, and remain financially stable may be more uncertain.

Key dates

2026-07-09

OCC Bulletin 2026-30 was issued, highlighting FinCEN’s updated Section 314(b) Fact Sheet.

Suggested considerations

• Compliance teams may wish to review whether current Section 314(b) registration status is current and whether the institution has designated internal points of contact for information-sharing requests.
• Firms may wish to assess whether existing BSA/AML and fraud-monitoring procedures explicitly cover the newly highlighted examples of shareable information, including cyber-related data and video surveillance footage.
• Institutions may wish to confirm that information-sharing protocols limit disclosures to permissible Section 314(b) purposes and maintain security and confidentiality controls over information received from peers.
• Banks may wish to refresh training for BSA, fraud, and investigations staff on when sharing is permissible, including the safe-harbor conditions and the scope of eligible counterparties.
• Compliance teams may wish to verify that procedures for responding to requests and documenting reliance on Section 314(b) remain aligned with FinCEN’s updated fact sheet.

What changed

FinCEN’s updated Section 314(b) Fact Sheet clarifies that a participating financial institution may share information about suspected fraud, money laundering, terrorist financing, or other specified unlawful activities with any other financial institution eligible to participate in the Section 314(b) program.

Key dates

2026-06-22

OCC bulletin announcing the notice of proposed rulemaking was issued

2026-07-22 Deadline

Planned deadline for comments, if the Federal Register publication date aligns with the bulletin date and the OCC’s 30-day comment period is measured from publication

Suggested considerations

• Compliance teams may wish to assess whether the entity falls within the OCC-supervised PPSI category or within the state-qualified issuer population covered by OCC authority under the GENIUS Act.
• Firms may wish to review existing AML/CFT and sanctions controls against the BSA, FinCEN, and OFAC requirements referenced in the proposal, including reporting, monitoring, and risk assessment procedures.
• Compliance teams may wish to map governance, escalation, and record-sharing workflows to the proposed OCC-FinCEN consultation framework, particularly for potential significant supervisory or enforcement matters.
• Firms may wish to consider whether their current policies, procedures, and internal controls are sufficiently tailored to stablecoin-specific risks and whether additional board or senior management oversight would be needed.
• Compliance teams may wish to evaluate whether they should submit comments during the 30-day Federal Register comment period if aspects of the proposed framework could affect operating models or compliance design.

What changed

The proposed rule would require OCC-supervised PPSIs to comply with the BSA, sections 4(a)(5) and 4(a)(6)(B) of the GENIUS Act, and applicable FinCEN and OFAC regulations, including AML/CFT program, sanctions program, and reporting requirements. It would also create a supervision and enforcement framework for PPSI AML/CFT programs, so the OCC can take AML/CFT supervisory and enforcement action against covered issuers. The rule would establish a formal consultation process between the OCC and FinCEN when the OCC intends to initiate an AML/CFT enforcement action or a significant AML/CFT...