November 2, 2026. That's when a new rule from the OCC and FDIC takes effect, changing what bank examiners can formally require a bank to fix.
For years, an examiner's written finding told management an issue mattered. For a whole category of weaknesses, that signal is about to go quiet.
The weaknesses won't.
What the rule changes
The final rule, published September 1, 2026, defines an unsafe or unsound practice as one that departs from generally accepted standards of prudent operation and, if continued, is likely to materially harm the bank's financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed it. It narrows when examiners can issue a matter requiring attention, the formal finding a bank must remediate.1
Weaknesses that fall short of that standard can be raised as supervisory observations. These are informal, carry no required corrective action and do not have to be presented to the board. The rule applies to banks the two agencies supervise.
The rule doesn't make those weaknesses disappear. It moves the decision about them. Below the material-harm line, the bank decides what's too small to fix.
"Too small" is a judgment
Some of these weaknesses really are small. Others are small today: a control gap that hasn't caused a loss yet, or a process that works only because one experienced person compensates for it. The rule's test looks at financial harm. A weakness can be financially immaterial now and still be the first link in a larger failure later.
Nobody outside the bank will check that judgment as closely as before. That makes it worth writing down.
A related change cuts the same way. Under the rule, failing to remediate an MRA does not by itself count as an unsafe or unsound practice. The pressure to finish a fix increasingly has to come from inside the bank.
Record the materiality decision
For every weakness, whatever its source, keep the reasoning next to the conclusion:
Weakness: [description]
Source: [exam observation, audit, self-identified]
Judged material? [yes or no], by: [name], because: [rationale]
If not: tracked in [issue log], or accepted by [name] until [date]
Reported to the board: [yes or no, and in what form]
The last line deserves a deliberate answer. The rule says observations don't have to go to the board. It doesn't say they can't. Decide your own threshold for board visibility, have the board approve it, and apply it the same way every quarter.
For a fintech that partners with a bank, expect some of the bank's observations to turn into questions for you. Answer them as if they were findings.
The examiner stopped counting the small things. Someone inside still has to.
Related Reading
Read Beyond Approval: Where Operational Resilience and AI Governance Converge for what happens after approval, when an approved system starts getting things wrong.
