Beginning in June, the federal banking agencies helped usher in the summer with the systematic removal of reputation risk references across 15 interagency guidance documents. Now fall is officially upon us, culminating with a joint final rule from the FDIC and OCC heightening the standards to issue public enforcement actions or supervisory Matter Requiring Attention (MRAs) for unsafe or unsound practices, and a wave of related OCC and FDIC guidance rolling back strict standards on third-party risk management oversight and increasing federal and state banks’ ability to share supervisory findings directly with their fintech partners.
As the seasons have shifted, the federal banking agencies have stayed focused on the singular mission: narrowing subjective areas of supervisory and enforcement activity and allowing banks more autonomy in establishing risk-based controls. While each of these actions has a direct impact on banks and fintechs contemplating a bank charter, when viewed collectively these changes have far-reaching ramifications to the future of bank-fintech partnerships. Below is a summary of the recent actions taken by the FDIC and OCC.
Creating Uniform Standards Streamline Formal Supervisory Actions
On August 27, the OCC and FDIC issued a final rule to adopt a uniform definition for the term “unsafe or unsound practice” for the purposes of the agencies’ enforcement actions under 12 U.S.C. § 1818 and supervisory activities. Prior to issuing a public enforcement action, the agency must conclude while using “objective facts and sound reasoning” whether the bank is engaging in unsafe or unsound practice. Enforcement actions brought under Section 8 of the FDI Act must now prioritize material financial risk over policy, process, and documentation concerns.
This joint rule also creates uniform standards for when and how OCC and FDIC examiners may issue MRAs based on specifically enumerated practices, acts or omissions, tailored to institution-specific risk factors. Specifically, the OCC and the FDIC must articulate that the practice, acts or omissions of a bank under current or reasonably foreseeable conditions will likely result in an “unsafe or unsound practice” or is “an actual violation of a banking or banking-related law or regulation.”
Similarly, on August 4, 2026, the FDIC launched a standalone Office of Supervisory Appeals (OSA), replacing the former Supervision Appeals Review Committee as the final level of review for material supervisory determinations. The OSA operates independently of the divisions that make supervisory determinations, is staffed by reviewing officials with mixed supervisory and industry experience and will decide appeals “without deferring to the judgments of either party, subject to the reasonableness of and the support for the positions advanced.” Notably, banks’ appeal rights were expanded to permit appeals in certain cases where an enforcement action is proposed or pending.
These actions address the long-standing concern from banks and fintechs that different agencies and exam teams exercised broad discretion in applying the same standards differently across supervised institutions. The rule sets uniform standards for issuing enforcement actions, MRAs, or communicating other informal supervisory observations to level the playing field for banks regardless of exam team or agency leadership.
Streamlining Prescriptive Third-Party Risk Management Requirements
The FDIC, OCC, Federal Reserve, and NCUA proposed guidance to replace the Biden-era 2023 Interagency Guidance on Third-Party Relationships: Risk Management, which the agencies said has frequently been interpreted in an overly broad manner, discouraging innovation, and with an unfair emphasis on risk elimination instead of prudent risk management. The streamlined proposal emphasizes core risk management components, tools for risk identification and assessment, and outlines methods for appropriate risk oversight and residual risk acceptance, with the assessed risk of each specific third-party relationship and the bank’s own size, complexity, and risk profile.
Importantly, the proposal states that noncompliance with the guidance alone would not trigger supervisory action. This allows banks greater latitude to structure their risk management oversight programs to uniquely address the risks of using specific vendors or engaging with different fintech partners, instead of requiring a one-size-fits-all approach to third-party risk management.
Expanded Supervisory Information Sharing for Banks and Fintechs
In October, both the FDIC and OCC independently solicited public comment on the treatment of Confidential Supervisory Information (CSI), in an effort to reduce the regulatory burden on banks that want to share relevant supervisory information directly with their fintech and critical vendor partners.
Historically, the FDIC’s information sharing provisions have been more restrictive than those of the OCC and the Federal Reserve. Under the FDIC’s current regulations, banks must seek the prior approval of the FDIC to disclose CSI to third parties, including the bank’s attorneys, accountants, auditors, and other critical partners. The FDIC is now expanding the ability of banks to share CSI with relevant third parties without obtaining prior FDIC approval.
Previously, the OCC restricted the sharing of non-public OCC information (NPOI), which included information created or obtained by the OCC in the performance of its duties, such as reports of examination (ROE), supervisory correspondence, and information related to enforcement actions. A bank can only share NPOI with OCC prior approval, subject to specified exceptions, including to share with the bank’s attorneys, accountants, auditors, and other consultants.
The OCC proposes to create a new definition of CSI, which is a subcategory of NPOI, to share additional information without OCC approval in the following situations: (1) to an affiliate, (2) to a U.S.-based service provider with a business need for the information, (3) to a potential senior executive officer of the bank with the appropriate confidentiality agreements in place, (4) to a counterparty regarding a potential transaction or series of transactions with the bank, (5) to U.S.-based consultants and attorneys of a potential counterparty, and (6) to a trade association. The loosening of restrictions on sharing supervisory information will likely increase the level of information sharing between banks and fintechs.
Reducing Regulatory Burden, Updating Supervisory Processes, and Improving Transparency
Over the past year, the OCC and the FDIC have jointly taken a series of actions, specifically to reduce supervisory burdens for banks with respect to updating the model risk management guidance, proposing guidance for a simplified Community Reinvestment Act strategic plan process, and streamlining examination procedures for smaller community banks.
These actions have focused on creating opportunities for smaller and community banks to remain competitive, without undue regulatory burdens. Notably, the FDIC spent the summer updating its supervisory processes to improve transparency and bank competition through the following actions:
- BMA Application Reform: The FDIC Board issued proposed rulemaking reforming its Bank Merger Act review process, including accounting for credit unions and centrally booked deposits in the competitive-effects analysis, and creating a new “de minimis merger transaction” category eligible for rapid filing automatic approval, revising the historic “statutory factors” review. The proposal also tailors filing requirements in an effort to reduce processing time and minimize unnecessary paperwork. Chairman Hill tied the proposal to two major objectives: merger reviews have historically taken too long, stifling business opportunities, and the existing competitive-effects framework needs to reflect that banks now compete with credit unions, thrifts, and online providers well beyond local branch networks.
- Deposit Insurance Application Reform: The FDIC adopted a two-phase review process for new deposit insurance applications received after August 15, 2026, namely issuing a contingent authorization within 120 days of an institution submitting a substantially complete application, followed by the FDIC issuing a final approval within the subsequent 12 months once organizational and pre-opening steps are complete. This process is intended to give organizing institutions greater clarity before they commit significant capital-raising and staffing resources to the process.
The sheer volume of activity around the OCC and the FDIC supervisory activities shows that the regulators are gaining clarity in their focus for enhanced oversight and monitoring of real financial risks to the system. While this all appears to be a sign of thawing regulatory scrutiny for banks and their partners, banks and fintechs should be careful not to view this as regulatory reprieve, but instead it is a realignment of supervisory priorities. Banks and fintechs must still be thoughtful and cautious when crafting risk management policies and engaging with regulators.
What This Means to You
Banks and fintechs should treat these developments as an occasion to revisit, not relax, their risk management and supervisory engagement practices. Institutions should review their current strategic objectives and consider whether their existing risk management programs are appropriately tailored to address the risks inherent with any use of new third party partners or the launch of new products and services. Banks engaging with fintech partners and other critical vendors should monitor the FDIC and OCC final rules on CSI treatment, as the proposed changes may open new channels for sharing supervisory information once finalized. Finally, financial institutions contemplating a bank merger, applying for deposit insurance, or submitting a charter application should carefully consider the scope and substance of these reforms into transaction timelines and planning. Across all of these areas, banks and fintechs should continue to engage proactively with their regulators and document the reasoning behind their risk-based decisions, since the agencies have signaled a realignment of supervisory priorities rather than a reduction in overall scrutiny.
Contact Us
We routinely advise banks and fintechs on supervisory and enforcement matters that impact banks and fintech partners. Contact Susan Seaman, Kavitha Subramanian, or your Husch Blackwell attorney if you want to discuss these recent federal bank supervisory developments or their impacts on banks and their fintech partners.
This article provides general legal information. It does not constitute legal advice to the reader and does not create an attorney-client relationship between the reader and Husch Blackwell LLP. The reader should seek legal advice if they have questions about how this legal information may apply to their own circumstances.