BPI Comments on OCC’s Violations of Law Proposal

Ladies and Gentlemen:

The Bank Policy Institute supports the OCC's proposal to limit MRAs based on violations of law to substantive violations and to clarify the distinction between substantive and technical violations.^[1] The proposed rule would enhance transparency regarding how the OCC determines when a violation of law or regulation may warrant an MRA. By establishing defined standards that distinguish between substantive and technical violations, the proposal would promote transparency and consistency in supervisory practice. We also strongly support the OCC's confirmation that noncompliance with guidelines is not a violation of law or regulation.^[2] Further, we agree with the OCC's objective to focus examiners on "those violations that have a greater likelihood to impact the institution or its customers."^[3]

We therefore recommend that the OCC finalize the proposed reforms, with the clarifying revisions set forth below.

I. The Proposal Would Appropriately Limit MRAs Based on Violations of Law to Substantive Violations

Banks take legal compliance seriously and devote substantial resources to this function.^[4] The legal framework applicable to banks, however, is exceptionally broad and detailed, even compared with other regulated industries. As a result, inadvertent, isolated, or immaterial errors can occur even when an institution maintains an effective compliance program.

We support limiting MRAs to substantive violations because doing so will focus examination and bank resources on material legal compliance issues. An overly expansive approach to violations of law can divert bank management and Boards from material issues. As we have previously documented, each MRA can require significant management, compliance, audit, and Board resources for remediation and implementation of supervisory requirements.^[5]

MRAs typically require a bank to (i) develop a detailed "remediation plan," often requiring involvement of a third-party consultant, (ii) receive nonobjection from the agency, (iii) complete implementation of that plan, (iv) have its own internal compliance and audit functions review implementation to ensure it is "sustainable" for a period of time, and (v) obtain a final determination from the regulator that all of the foregoing has been successfully completed. This process is disproportionate for immaterial issues that do not present risk of harm to the financial institution or its customers. Therefore, it is appropriate for the OCC to limit MRAs for violations of law to substantive violations as proposed.

In addition, we support the OCC preserving examiners' discretion to use less formal supervisory mechanisms to address a violation of law or regulation, if examiners believe it would be effective in ensuring the violation ceases and is appropriately corrected.^[6]

Limiting MRAs to substantive violations will also codify and promote more consistent application of existing policy. The prior version of OCC's Enforcement Manual defined a "deficient practice" as one that results in "substantive noncompliance" with laws.^[7]

Similarly, the OCC's examination handbook describes a "concern" for MRA purposes as a practice that could result in substantive noncompliance with laws or regulations.^[8] Thus, the approach in the proposal would codify and effectuate prior OCC practice.

To read the full comment letter, please click here, or click on the download button below.

[1] The Bank Policy Institute is a nonpartisan public policy, research, and advocacy group that represents universal banks, regional banks, and the major foreign banks doing business in the United States. BPI produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.

[2] Violations of Laws or Regulations, 91 Fed. Reg. 56074, 56077, 56080 (Sept. 1, 2026) (the proposal).

[3] Id. at 56075.

[4] A 2024 BPI survey found that 42% of C-Suite time and 43% of board time was devoted to regulatory or supervisory compliance. See Joshua Smith and Benjamin Gross, Survey Finds Compliance is Growing Demand on Bank Resources, (Oct. 29, 2024), https://bpi.com/survey-finds-compliance-is-growing-demand-on-bank-resources/.

[5] See Bank Policy Institute Letter to OCC and FDIC on Proposed Rule on Unsafe or Unsound Practices, Matters Requiring Attention (Dec. 29, 2025), available at https://bpi.com/wp-content/uploads/2025/12/Unsafe-or-Unsound-Practices-and-Matters-Requiring-Attention-Bank-Policy-Institute.pdf ("BPI Unsafe/Unsound Comment Letter").

[6] Proposal at 56075, 56077 n.29.

[7] OCC, Policies and Procedures Manual, Bank Enforcement and Related Matters, PPM 5310-3 (Nov. 13, 2018).

[8] OCC, Comptroller's Handbook, Bank Supervision Process at 46 (Mar. 2025), available at https://www.occ.gov/publications-and-resources/publications/comptrollers-handbook/files/bank-supervision-process/pub-ch-bank-supervision-process.pdf.