Menu

Menu

Menu

Spotlight

The intelligent enterprise in the age of AI

Deals Outlook: the deals built to withstand what's next

Medical cost trend: Behind the numbers

Menu

Spotlight

Tech Effect

Loading Results

OCC and FDIC MRA standards and Iran sanctions – September 4, 2026

  • September 04, 2026

Change remains a constant in financial services regulation

Read "our take" on the latest developments and what they mean.

OCC and FDIC finalize higher bar for unsafe or unsound practices and MRAs

What happened? On August 27th, the OCC and FDIC issued a final rule defining “unsafe or unsound practice” and establishing standards for Matters Requiring Attention (MRAs), supervisory observations and violations that do not result in an MRA or enforcement action. On the same day, the OCC released:

The FDIC also released a statement describing how it will implement the final rule as well as updated versions of its risk management and compliance examination manuals but did not issue an additional proposal relating to violations of law.

What does the final rule do? The final rule largely retains the proposed standards for unsafe or unsound practices and MRAs, with several notable changes. Specifically, it:

  • Defines unsafe or unsound practices based on material financial harm. A practice, act or failure to act must be contrary to generally accepted standards of prudent operation and, if continued, be likely to materially harm the institution’s financial condition or present a material risk of loss to the Deposit Insurance Fund (DIF), or must already have materially harmed the institution’s financial condition. Harm to financial condition refers to financial losses or other negative impacts to capital, asset quality, earnings, liquidity or sensitivity to market risk.
  • Establishes a new MRA standard. The agencies may issue an MRA for an unsafe or unsound practice or intervene before conduct reaches that threshold when, if continued, it “could reasonably be expected to, under current or reasonably foreseeable conditions,” materially harm the institution’s financial condition or present a material risk of loss to the DIF. They may also issue an MRA for actual violations of law or regulation.
  • Requires findings to be supported and tailored. The agencies must use objective facts and sound reasoning when determining whether conduct constitutes an unsafe or unsound practice or warrants an MRA. They must also consider an institution’s capital structure, complexity, activities, asset size and other financial risk-related factors when issuing findings and setting remediation requirements. For institutions presenting greater risk based on those factors, the rule provides for a lower materiality threshold, more granular assessments and greater remediation expectations.
  • Sets parameters for supervisory observations. The agencies may use supervisory observations to communicate weaknesses in an institution’s policies, practices, condition or operations that do not rise to the level of an MRA. These informal observations would not create a requirement or supervisory expectation that the institution present the matter to its board or take corrective action.
  • Creates an “other violation” category. A banking or banking-related violation that does not result in an enforcement action or MRA is an “other violation.” The agencies may require the institution to correct the violation and take other actions required by law.
  • Leaves enforcement against institution-affiliated parties outside the new framework. Unlike the proposal, the final rule does not apply its definition of an unsafe or unsound practice to institution-affiliated parties, such as directors, officers, employees or controlling shareholders. The agencies may still pursue actions against those individuals under their existing statutory authority and applicable legal standards.

What do the revised OCC manuals say? The revised manuals establish more specific procedures for the treatment and escalation of supervisory findings. Among other changes, they establish:

  • More focused MRAs. Each MRA must address one concern, and corrective actions must be directly related to that concern without prescribing in detail how management must act.
  • Limits on lookbacks and third-party reviews. Lookbacks may be required only in specified circumstances, and examiners must weigh their benefits against their costs and burdens. Absent special circumstances, lookbacks involving failures to detect or report suspicious activity are limited to one year or less. Third-party lookbacks are limited to circumstances involving concerns about management’s ability, concealment or other exceptional conditions.
  • Greater reliance on internal audit. Examiners must substantially rely on applicable validation work performed by a satisfactory or better-rated internal audit function. Once corrective actions have been implemented and validated as effective, the OCC must close the MRA without requiring an additional period of sustained performance.
  • A staged and proportionate enforcement approach. The OCC generally will give a bank an opportunity to resolve deficiencies through supervision before taking an enforcement action, although it may act immediately when circumstances warrant. If enforcement is necessary, the OCC should use the least degree of intervention reasonably necessary and include only the corrective provisions needed to address the identified deficiencies.
  • Closure based on substantial compliance. The OCC will terminate an enforcement action once the bank has satisfied its essential requirements, even if some minor, isolated items remain incomplete.

What would the OCC’s violations proposal do? The proposal would further limit when a violation of law or regulation may result in an MRA. Specifically, it would:

  • Limit violation-based MRAs to substantive violations. A violation would be substantive if its nature, duration, frequency or severity could meaningfully affect the institution or its customers and it falls into at least one of five categories: systemic or patterned violations; violations affecting financial condition; violations affecting books and records; violations requiring restitution or adversely affecting customers; and violations involving insider misconduct or self-dealing. With the exception of insider violations, the relevant impact or restitution generally must be more than minimal.
  • Create a technical violation category. A violation that does not result in an enforcement action or MRA would be treated as a technical violation. The OCC could require correction but could not prescribe how the institution corrects the violation or require unrelated corrective action.
  • Exclude separate safety and soundness guidelines. Noncompliance with the OCC’s guidelines for safety and soundness would not, by itself, be classified as a substantive or technical violation. The OCC could continue to address noncompliance through the existing supervisory process for those guidelines.

How is the FDIC implementing the final rule? The FDIC’s implementation statement provides additional detail on how the new framework will affect examinations and supervisory findings. Specifically, the FDIC will:

  • Review outstanding findings. The FDIC will assess existing findings against the final rule and notify institutions whether they will be redesignated as MRAs, closed or, where they involve a violation of law, treated as “other violations” that still require remediation.
  • Revise examination reporting. Examination comments will generally become more concise, and MRAs will explain the issue, the basis for requiring remediation and the FDIC’s expectations for addressing it. Unlike the OCC, which generally will communicate supervisory observations separately from examination reports, the FDIC may include them in reports of examination as factual support for examination conclusions and ratings.
  • Limit violation-based MRAs to substantive violations. Although the FDIC did not issue a separate violations proposal, it intends to issue MRAs only for substantive violations, applying criteria similar to those in the OCC proposal. These include violations that are systemic or patterned, have a more-than-minimal impact on the institution or its customers, require more-than-minimal restitution, or involve insider misconduct or self-dealing. Other violations may still require correction or restitution.
  • Continue implementation efforts. The FDIC will provide examiner training, revise additional agency materials and work with state and federal regulators to align interagency guidance with the final rule. It is planning broader revisions to its risk management and consumer compliance examination manuals for next year.

What’s next? The joint final rule will take effect November 2nd. Comments on the OCC’s violations proposal are due October 1st.

Our Take

Codification should promote consistency, but it will not guarantee it

The final rule will cement the already sharp decline in new MRAs by placing a substantially higher bar for formal findings into regulation. Even if agency leadership changes, examination teams will remain bound by the new requirement to justify with “objective facts and sound reasoning” why a concern rises to the level of an MRA. Publication of the OCC’s previously internal MRA manual should further reinforce that shift by making examiner instructions more transparent and giving institutions a clearer basis for distinguishing supervisory requirements from examiner preferences. However, important terms such as “material harm,” “reasonably foreseeable” and “more than minimal” will continue to depend on examiner judgment. The OCC’s proposal also leaves consequential questions open, including the treatment of state-law violations, safety and soundness guidelines, and the ability of examiners to impact credit classifications and nonaccrual decisions. Consistent implementation will therefore depend on examiner training, internal review and how the agencies resolve questions that arise in practice. Even consistent implementation by the OCC and FDIC would not produce a single supervisory standard for firms also overseen by the Fed. Although the Fed has adopted a similar focus on material financial risk, it has not issued any formal rulemaking on the topic and continues to apply its own framework with different thresholds for findings. As such, firms with multiple regulators will need to account for differences among regulators while remaining consistent enough to support enterprise-wide risk decisions.

More flexibility means greater bank accountability. By tying formal supervisory findings and required remediation more closely to material risk, the new framework should give banks greater ability to focus resources on the issues most consequential to their financial condition, customers, and operations, rather than reflexively building remediation programs around process weaknesses or examiner-preferred practices. The distinction between substantive and technical violations would take that shift further at the OCC by reserving MRAs for violations that could meaningfully affect the institution or its customers and removing the OCC’s ability to direct how technical violations are corrected. That said, the underlying legal requirements and potential consequences of noncompliance remain relevant. For example, the OCC proposal notes that certain systemic BSA/AML program or pillar violations would remain substantive, and criminal and other sanctions remain available even where the OCC may limit its own response or required lookbacks (e.g., for identification of suspicious activity).
Similarly, while receiving fewer formal MRAs does not reduce the underlying risks, firms should be cognizant that decreased regulatory focus could make emerging concerns less visible or urgent to management and boards. Supervisory feedback that previously might have resulted in an MRA may instead be communicated through supervisory observations (or not at all), leaving to bank management all decisions around remediation, tracking, and reporting. Firms’ own materiality and escalation judgments, and related decisions around mitigation and remediation, will therefore carry greater weight, while MRA volume may diminish as a risk indicator.

What should firms do now? As the framework takes effect, institutions should consider:

  • Revisiting materiality, issue-classification and escalation methodologies to distinguish consistently among matters requiring formal remediation, substantive violations, technical or other violations, supervisory observations and internally identified issues.
  • Recalibrating risk assessments, monitoring, testing and audit coverage to ensure resources are focused on the institution’s most consequential financial, customer, operational and legal risks rather than on historical supervisory priorities.
  • Reinforcing the authority of risk management and internal audit to make credible judgments on issue severity and remediation, effectively challenge the business, and sustain attention on risks that warrant action. For more, see Internal Audit at an inflection point.
  • Establishing governance for lower-level supervisory matters that supports informed decisions about whether to address, monitor, document or escalate supervisory observations and violations, while accounting for differences among the OCC, FDIC and Fed (which has documented fewer constraints around examiner use of supervisory observations).
  • Reviewing lookback, validation and closure practices in light of the OCC’s cost-benefit test for lookbacks, restrictions on third-party reviews, reliance on internal audit and direction to close MRAs after corrective actions have been validated.

Sanctions: Treasury launches “Economic D-Day” against Iran

What happened? On August 26th, Treasury Secretary Scott Bessent announced Operation Economic Outcast, a whole-of-government campaign targeting Iran’s financial infrastructure.

What does the campaign do? Three significant actions have taken place:

  • Sectoral sanctions. On August 26th, Treasury’s Office of Foreign Assets Control (OFAC) issued five new sectoral sanctions determinations covering digital assets, technology, gold, aviation and shipping. Under this determination, any foreign person operating in those sectors in support of Iran can now be sanctioned regardless of location.
  • Targeted sanctions. Also on August 26th, OFAC designated nearly 60 entities, individuals and vessels tied to nuclear procurement, cyber operations and oil revenue networks. It also suspended general licenses for remittances and academic access and expanded secondary sanctions exposure for institutions still transacting with Tehran.
  • Correspondent bank designations. On August 28th, Treasury’s Financial Crimes Enforcement Network (FinCEN) proposed a rule to designate Banque Misr UAE, the UAE operations of the Egyptian bank, as a financial institution of primary money laundering concern (also known as a Section 311 action). The proposal would prohibit US firms from opening or maintaining correspondent accounts for the bank, require reasonable steps to prevent transactions from reaching it through other correspondent relationships, and require special due diligence on foreign correspondent accounts to guard against pass through exposure. The proposal would apply only to Banque Misr's UAE entity, not its global operations.

What's next? Comments on the Banque Misr UAE proposed rule are due by October 1st, 2026. Treasury indicated it has given foreign governments a defined timeline to shut down identified Iran related activity within their jurisdictions or face further action, suggesting additional sectoral designations and possibly further Section 311 actions are likely in the near term.

Our Take

A coordinated campaign, not isolated action

The “Economic D-Day” campaign marks the broadest and most consequential sanctions measures against Iran to date, following an escalating series of sanctions that have taken place since the beginning of the current Administration. With OFAC significantly widening the net of entities that can be designated and FinCEN taking swift action 48 hours later, Treasury is sending a clear message that there are more designations and enforcement to come – and targets will include a broad set of worldwide actors, not just explicitly Iran-linked entities. Firms should consider the following moving forward:

  • Apply enhanced Iran-specific due diligence to digital assets. With OFAC’s designation of Iran’s digital assets sector and Treasury specifically flagging cryptocurrency as a growing tool of choice for Iranian sanctions evasion, firms should incorporate Iran-specific typologies into their crypto exposure screening. Institutions relying solely on geographic screening risk missing activity structured through intermediary jurisdictions or crypto rails specifically designed to obscure a nexus to Iran.
  • Review sectoral designations for an Iran nexus. Because the new sectoral sanctions apply to any foreign person in those sectors, institutions can no longer rely on jurisdictional proximity to Iran as a proxy for risk. A gold trading firm or shipping broker anywhere in the world can now be swept in based on conduct alone. Firms with significant trade finance, correspondent banking or shipping sector exposure should incorporate specialized intelligence capabilities into their sanctions screening programs to flag vessels with falsified ownership or dark automatic identification system activity near Iranian water, gold and technology shipments routed through intermediary hubs like Turkey, Hong Kong or the UAE without clear commercial rationale, and aviation parts transactions tied to sanctioned carriers’ aging fleets.
  • Know your correspondent banking customers’ customers. The Section 311 action against Banque Misr UAE also reinforces a common correspondent banking due diligence gap: visibility into nested and indirect relationships. Institutions will need reasonable assurance that transactions aren't reaching Banque Misr UAE not just directly but also through second or third tier correspondent relationships. Institutions should treat this as an exercise to test whether their correspondent banking due diligence actually reaches that depth today or stops at direct relationships.
  • Screen sanctions at the entity level. The narrow scope of the Section 311 action, targeting only the UAE entity and not its Banque Misr parent, is a reminder that entity level screening and monitoring capabilities matter just as much as parent level capabilities. Institutions that screen only at the banking group level rather than the specific licensed entity level may miss the precise scope of the recent action and further actions to come.

SEC proposes modernizing transfer agent rules for the digital (and digital asset) era

What happened? On September 1st, the SEC proposed a broad package of amendments to the rules governing registered transfer agents, which are firms that maintain official records of who owns an issuer’s securities and help process changes in ownership and payments to investors.

What is the proposal intended to modernize? SEC Chair Paul Atkins explained that the rule – which was written when firms typically held paper share certificates – should be modernized to reflect the realities of electronic transfers, blockchain technology and tokenized securities.

What would the proposal do? The proposal would update rules intended to support accurate and timely securities processing and protect the securities and funds handled by transfer agents by addressing today’s electronic operating environment, including the use of electronic records and communications, distributed ledger technology and tokenized securities. It includes:

  • Comprehensive safeguarding and risk management. The proposal would require transfer agents to implement written policies and procedures to protect securities and funds against theft, loss, misuse, destruction and unauthorized access and to identify, monitor and mitigate material custody, operational, cybersecurity and other risks. Transfer agents would also have to hold issuer, investor and other third-party funds in separate bank accounts and maintain a business continuity plan.
  • Stronger transaction-processing standards. It would require written policies and procedures designed to promote timely processing, align processing and ownership-record update deadlines with the securities settlement cycle and update the standards the SEC uses to determine when processing delays may limit a transfer agent’s ability to expand its business.
  • Modernized recordkeeping and technology requirements. The proposal would update the records transfer agents must maintain, establish a consistent retention period for most records and modernize requirements for electronic recordkeeping systems and third-party recordkeepers. It would also update regulatory terminology to reflect electronic communications, blockchain-based recordkeeping and securities represented electronically rather than by physical certificates.
  • Additional protections for investors with inactive accounts. The proposal would require transfer agents and broker-dealers to notify investors whose accounts have been inactive and would update existing requirements to reflect electronic communications and payments.
  • Restrictions on the resale of securities. New requirements would govern the placement and removal of notations indicating that securities cannot be freely resold. Transfer agents generally could not facilitate an unregistered transaction unless they had a reasonable basis to believe that it complied with federal securities law.
  • Updated SEC filings and elimination of certain exemptions. The proposal would revise transfer agent registration and annual reporting requirements and the related SEC forms. It would also eliminate exemptions from certain processing and recordkeeping requirements for specified securities and transfer agents, potentially making some smaller transfer agents newly subject to the annual independent accountant reporting requirement under Rule 17Ad-13.
  • Formal compliance programs. Registered transfer agents would be required to establish and maintain written policies and procedures designed to comply with the federal securities laws and SEC rules applicable to their activities.

What's next? Comments on the proposal are due November 3rd.

Our Take

Transfer agent controls will need to catch up with technology

Transfer agents have long been expected to maintain accurate ownership records and protect the securities and funds entrusted to them, but those responsibilities now depend heavily on technology. An unauthorized user, system outage, corrupted electronic record or failure at a critical service provider could interrupt transfers or compromise the integrity of securityholder records just as directly as a breakdown in traditional processing or custody controls. These risks will become increasingly important as transfer agents support securities represented through distributed ledger technology or other tokenized structures, where the technology used to record and transfer ownership may form part of the control environment itself. The proposal could therefore require transfer agents to take a more connected view of safeguarding, cybersecurity, operational resilience, electronic recordkeeping and third-party risk. To address these risks, transfer agents involved with tokenized securities will need to stand up private key management, blockchain architecture and smart contract capabilities.

Assurance coverage may need to expand alongside the control environment

Smaller transfer agents that could become newly subject to Rule 17Ad-13 may face the most significant readiness challenge because they would need to establish an independently testable control framework while implementing the proposal’s broader requirements. Although Rule 17Ad-13 itself would remain largely intact for transfer agents already subject to the rule, the anticipated expansion of the underlying control environment could affect both Rule 17Ad-13 testing and SOC 1 scope. Transfer agents and their auditors should consider the following:

  • Assess necessary control enhancements. Determine which controls over access, unauthorized transactions, record integrity, recoverability, business continuity and third-party services are sufficiently connected to ownership transfers and safeguarding of related securities and funds to warrant inclusion.
  • Map the proposed requirements across Rule 17Ad-13 examinations, SOC 1 reports and other activities to identify gaps, overlaps and areas where complementary assurance may be needed.
  • Prepare to show your cyber and operational resilience readiness. The SEC’s request for comment on independent assessments of cybersecurity and operational risk management, including SOC 2 reports or similar attestations, also signals that regulators may expect greater visibility into how separate assurance activities collectively address the risks affecting transfer agent services.

On our radar

Treasury announces the launch of the Quantum-Readiness Task Force. On August 24th, the Treasury department announced the launch of the Quantum-Readiness Task Force, which will develop guidelines to strengthen cryptographic protections for US sensitive data, critical infrastructure and the digital economy in accordance with Executive Order 14412.

FDIC publishes a reciprocal-deposit interim final rule. On August 27th, the FDIC issued a final rule that materially expands the reciprocal deposits that qualifying institutions may exclude from brokered-deposit treatment. A well-capitalized bank with a CAMELS 1, 2 or 3 can now qualify as an agent institution, and the previous general cap is replaced by a tiered cap reaching a maximum of $30 billion. Comments are due October 1st.

Agencies issue Joint Statement on Suspicious Activity Report Confidentiality Considerations. Issued September 2nd, the statement clarifies that the BSA and related regulations do not prohibit a bank from communicating with a customer about potentially fraudulent or other suspicious transactions involving the customer's account or notifying the customer that the bank intends to close the account for potentially fraudulent or suspicious activity, provided the communication does not reveal the existence of a SAR.

Seven agencies rescind the 2022 interagency Special Purpose Credit Program statement. On August 25th, the FDIC, NCUA, OCC, CFPB, HUD, DOJ and FHFA issued a notice of rescission that creditors should no longer rely on the February 2022 statement or related issuances and must instead apply current Equal Credit Opportunity Act (ECOA) requirements, Regulation B and, where applicable, the Fair Housing Act. The notice specifically points to CFPB’s April 2026 Regulation B amendments as making the earlier guidance obsolete.

SEC proposes rescission of pay-to-play rule. On September 3rd, the SEC issued a proposal to rescind Advisers Act Rule 206(4)-5, which prohibits investment advisers from providing compensated advisory services to a government client for two years after certain political contributions, along with related recordkeeping requirements. Other Advisers Act obligations, including the antifraud, fiduciary duty, compliance, and code of ethics rules, would remain in place.

SEC and CFTC further extend Form PF amendment compliance date. On August 31st, the SEC and CFTC published a joint final rule postponing compliance with 2024 amendments to Form PF from October 1st, 2026 to July 1st, 2027. The delay is intended to give the agencies additional time to consider an April 2026 proposal that would raise filing thresholds and modify or eliminate several expanded reporting requirements before firms incur implementation costs.

CFTC publishes SEF order-book proposal. On August 26th, the CFTC issued a proposal to eliminate the requirement that a swap execution facility maintain an order book for “permitted transactions” swaps not subject to mandatory trade execution. The proposal would not eliminate execution requirements for to “required transactions.”

CFTC finalizes amendments to its mandatory interest-rate-swap clearing requirements to complete benchmark transitions. On September 2nd, CFTC finalized a rule updating clearing requirements for derivatives to new successor benchmark rates for Canadian dollars and Mexican pesos. The rule becomes effective 30 days after Federal Register publication.

House Republicans unveil the Consumer Financial Protection Accountability and Reform Act of 2026. On September 1st, House republicans released a bill that would subject the CFPB to congressional appropriations; impose expanded cost-benefit and retrospective-review requirements; narrow UDAAP and nonbank supervision authority; raise the bank-supervision threshold from $10 billion to $30 billion; create new statutory frameworks for small-dollar lending and earned wage access; and limit certain enforcement, complaint-handling and market-monitoring practices.

California passes small business lending law. On August 20th, the California legislature passed Assembly Bill (AB) 2116, which would create a California licensing, reporting and UDAAP-style regulatory regime for providers and brokers of small-business commercial financing of $500,000 or less. Banks are generally exempt, but nonbank fintech, marketplace and commercial-financing partners may be subject to the new licensing requirements and restrictions. The bill will now need to be signed by the CA Governor to become law.

NYC issues FAQs on new debt collection law. On August 4th, the NYC Department of Consumer and Worker Protection published an FAQ on the implementation of amendments to its rules relating to debt collectors, known as the SHIELD Rule, which substantially expands the regulation of debt collection beyond the federal Fair Debt Collection Practices Act (FDCPA) and Regulation F.

Our Take: Financial services regulatory update – September 04, 2026

(PDF of 296.45KB)

{{filterContent.facetedTitle}}

Follow us

© 2017 - 2026 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details.