Banking's most powerful phrase has never been defined — until now. Here's who wins and what's lost

The most powerful phrase in American bank supervision — "unsafe or unsound practice" — got its first written definition on August 27. For more than half a century, no statute or regulation had spelled out what the phrase meant, even though it is the legal hook behind nearly everything a supervisor can do to a bank: force it to stop an activity, demand new management, or impose limits on how it operates. Courts were left to invent the standard case by case, and produced tests as vague as "abnormal risk or loss." This week, the Office of the Comptroller of the Currency — the Treasury bureau that charters most of the big banks whose names you'd recognize — and the Federal Deposit Insurance Corporation, which supervises thousands of smaller banks and backs insured deposits, published the first definition any agency has ever written down.

Under their joint final rule, a practice now qualifies as "unsafe or unsound" only if it fails a two-part test. It must be contrary to generally accepted standards of prudent operation. And it must be likely to materially harm the bank's financial condition, likely to present a material risk of loss to the deposit insurance fund, or already have caused material harm. It is not enough that harm is merely possible; the rule says the risk must be more than speculative.

The definition is the headline, but the rules around it do most of the work. The agencies raised the bar for "matters requiring attention" — the formal letters examiners send when they find a problem, which in practice had become a catch-all that could drag a bank in any direction over weak internal models, thin documentation, or a stray process. Under the new framework, such procedural weaknesses cannot justify an MRA on their own. The finding has to trace to material financial harm or an actual violation of law. Everything weaker moves into a new, informal category — "supervisory observations" — that a bank is not obligated to present to its board, act on, or even track. The FDIC says it has already gone through the backlog of outstanding criticisms from past examinations and will let a "large majority" of them quietly expire.

Two quieter details matter as much as the headline. The OCC for the first time published the examiners' manual that governs MRAs, so a bank can now check a supervisor's demand against a printed rule instead of guessing at an unpublished playbook. And the OCC proposed a companion framework that sorts violations of law into two buckets: "substantive" ones — systemic or patterned misconduct, more-than-minimal financial or customer harm, inaccurate books and records, insider self-dealing — which can support an MRA, and "technical" violations, which cannot. That piece is still a proposal, open for comment for 30 days once it hits the Federal Register.

None of this came from nowhere. An undefined "unsafe or unsound" was always a standing grant of discretion, and after the 2008 crisis supervisors used that discretion to criticize bank processes as aggressively as bank balance sheets. Community banks spent more than a decade complaining they were drowning in process-based findings that had nothing to do with financial risk. This rule codifies a supervisory reset the OCC has run for about a year: it has already stripped "reputation risk" out of its examinations, and last September it abandoned a consolidated supervision structure it had created that spring, restoring separate examination lines for large, midsize, and community banks.

The most important thing to understand is that the relief is not handed out evenly. The new standard is explicitly tailored: what counts as "material" depends on a bank's size, complexity, and activities, and the OCC says plainly that a practice that draws no response at a community bank can justify escalation at a large, complex one. The megabanks get a more predictable supervisor, not a softer one. The winners are community and midsize institutions, where a single MRA over documentation could once consume a year of management time. For them the change is real money: the agencies' own analysis estimates direct compliance-cost savings across the industry of several hundred million to several billion dollars a year. That is meaningful next to the income of any single small bank, even if it is a rounding error next to the industry's total. The point is where the cut lands — on the fastest-growing, most-resisted line of bank overhead, at the institutions with the least staff to spare.

The harder question is what the system gives up. Formal supervisory criticism was also an early-warning system, and the FDIC's chairman said so himself when the rule was proposed last fall: poor decisions may not show up in a bank's financial metrics immediately. A weakly underwritten loan book can take years to surface. Under the old regime, an examiner who was worried before anything was material could make the concern bite. The new framework deliberately breaks that ladder: an observation cannot be used to escalate, and the FDIC is retiring the board-attention demands and supervisory recommendations that once gave early warnings their teeth. The agencies say examiners can still raise concerns early and need not wait for actual harm — they just can no longer make a bank do much about a worry that has not yet become "material." A supervision system built to stop burdening banks will, by design, catch fewer bank problems early. That trade is not paid by the banks; it is paid by the deposit insurance fund, and by the customers of the banks allowed to keep erring quietly.

One boundary is worth noting before judging how far this reaches. The rule is joint by two of the three federal banking agencies; the Federal Reserve, which supervises many state-chartered banks and the holding companies of the largest firms, is not a party to it. Whatever definitional certainty this week created, it does not yet run across the whole system.

Three practical consequences follow for anyone thinking about banks as investments. First, the burden relief is a slow tailwind to bank efficiency — most of all at community institutions — but it is not a catalyst; bank stocks still move on rates, credit quality, and funding costs. Second, the rule is unusually friendly to banks trying to get out from under supervision: enforcement actions now end once a bank achieves "substantial compliance" even if minor items remain, the OCC deleted the old escalation track for banks with persistent weaknesses, and it changed how and when it sets individual minimum capital ratios — the lever that in practice often blocks a supervised bank from paying dividends. Third, and least certain: all of this is agency policy, not statute. A future administration can unwind it as quickly as this one built it. Enforcement philosophy in Washington swings with whoever holds the pen, and this rule is itself the demonstration — it reverses a decade of post-crisis practice inside a single press cycle.

None of this is a reason to buy or sell any bank next quarter; it compounds slowly. But it redraws a line that held for half a century. Supervision will now follow the numbers, and where the numbers are quiet, the supervisor will wait for them to speak. A cheaper, more predictable regulator is a small, durable positive to a well-run bank. A quieter alarm is the part of the deal no income statement shows — and the part that shows up later, in a failure that used to be caught earlier.