November 2 Changes What Your Sponsor Bank's Examiner Can Write Up. It May Not Change What Your Sponsor Bank Asks of You

On November 2, 2026, a joint OCC and FDIC final rule takes effect that defines "unsafe or unsound practice" in regulation for the first time. It also sets the standard examiners at those two agencies must meet before they issue a Matter Requiring Attention.

If you run a fintech with a sponsor bank, you will hear about this rule from your bank's compliance team, from vendors, and from your feed. Some of what you hear will overstate it.

Here is what the rule does, what it does not do, and where it touches your program.

What the rule says

The rule is published at 91 FR 56004. It amends OCC regulations in 12 CFR Part 4 and adds a new 12 CFR Part 305 for the FDIC.

An unsafe or unsound practice now requires two elements. First, the practice is contrary to generally accepted standards of prudent operation. Second, one of the following is true: if continued, it is likely to materially harm the institution's financial condition or present a material risk of loss to the Deposit Insurance Fund; or it has already materially harmed the institution's financial condition.

Both elements are required. The second element has alternatives joined by "or."

The rule defines harm to financial condition as financial losses or other negative effects on capital, asset quality, earnings, liquidity, or sensitivity to market risk. Reputational harm unrelated to financial condition is out.

The MRA standard sits lower. An examiner may issue an MRA when imprudent conduct, if continued, could reasonably be expected to cause that material harm under current or reasonably foreseeable conditions. An examiner may also issue one for an actual violation of a banking or banking-related law or regulation.

Below the MRA line, the rule recognizes supervisory observations. These require no corrective action, no action plan, and no tracking by examiners. Repeated non-adoption of an observation is not, by itself, grounds to escalate it into an MRA.

The rule also creates a category called "other violations," for violations of law that do not warrant an MRA. The agencies may direct the bank to remediate them.

Materiality is tailored. The preamble explains that as an institution's risk factors increase, the threshold for material harm drops and the assessment becomes more granular, down to specific business lines, products, or services.

Who it reaches and who it does not

The rule applies to institutions the OCC and FDIC supervise. The OCC counts 986 such institutions. The FDIC counts 2,700.

It does not apply to fintechs. You are not a supervised institution under this rule.

It does not apply to state member banks or other Federal Reserve supervised institutions. The Fed did not join.

It does not apply to credit unions. NCUA is not a party.

It does not apply to institution-affiliated parties such as directors and officers. The proposal would have covered them. The final rule dropped them.

The rule applies prospectively and does not govern the agencies' rulemaking.

Where it touches a fintech program

Your sponsor bank's examiners now work under a higher bar for formal findings. That may change how a finding about your program is classified. It does not change the contract you signed.

Cyber findings did not go away

The preamble addresses information security directly. It states that a significant risk of disruption through IT systems may, in some cases, be likely to cause material financial harm. Its example is weaknesses around unsupported operating systems and patch management, which threat actors commonly use for ransomware and data exfiltration. The agencies say compensating controls are considered.

If your platform sits inside a bank's payment or deposit flow, a control gap in your environment may still draw examiner scrutiny of your sponsor bank. The rule raises the bar. It does not remove the category.

Your sponsor bank's risk appetite is still the contract

Many fintech obligations come from the program agreement, not from an MRA. Vendor risk assessment questionnaires, SOC 2 attestation requests, incident notice clauses, and audit rights typically live in that agreement. A narrower MRA standard at the bank's regulator does not rewrite them.

Some sponsor banks may revisit requirements that existed mainly to head off process findings. Others may keep them. Expect variation.

Classification is now worth asking about

Before November 2, a concern that touched your program might have reached your sponsor bank as an MRA with a remediation plan. After November 2, the same concern may arrive as a supervisory observation, an "other violation," or an MRA. Each carries different consequences.

The rule requires examiners to base unsafe or unsound determinations and MRAs on objective facts and sound reasoning. That gives you a reasonable basis to ask your sponsor bank how a finding was classified and what it requires.

What to do

Confirm your sponsor bank's primary federal regulator. If it is a state member bank, this rule does not govern its exams. The Federal Reserve has issued its own supervisory operating principles, which are separate guidance.

Pull your program agreement and list every security and compliance obligation that came from a past examiner finding. Ask your sponsor bank which of those it plans to keep. Get the answer in writing.

Add a classification field to your findings tracker for anything that reaches you through your sponsor bank: MRA, supervisory observation, or other violation. They carry different remediation expectations.

Do not deprioritize patch management, end-of-life systems, or ransomware resilience on the theory that examiners now care less. The preamble names those weaknesses as an example that may still meet the standard.

Read the proposed interagency third-party risk management guidance published September 15, 2026, at 91 FR 58536. Comments close November 16. It moves in the same direction, toward material financial risk, and it would affect how your sponsor bank assesses you.

SOURCE: OCC and FDIC, "Unsafe or Unsound Practices, Matters Requiring Attention," final rule, 91 FR 56004 (September 1, 2026), FR Doc. 2026-17823, RINs 1557-AF35 and 3064-AG16, effective November 2, 2026. OCC, Federal Reserve, FDIC, and NCUA, "Proposed Third-Party Risk Management Guidance," 91 FR 58536 (September 15, 2026).

This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.