As the federal banking agencies consider how best to reform the bank examination process, a crucial issue will be the role of a “Matter Requiring Attention,” or MRA. It is the most common tool by which agency examiners require banks to change their practices to meet examiner preference, yet MRAs are largely unknown to the public and most policymakers. This lack of awareness is understandable given that MRAs are nowhere mentioned in law or regulation, but instead were invented by the agencies through guidance documents issued without notice and comment. The agencies consider all MRAs to be “confidential supervisory information” and therefore banks are barred from disclosing them publicly, under threat of criminal sanction.
This note describes (1) how MRAs are issued and enforced in practice, and (2) the lack of any legal authority for issuance in their current form. The note concludes that a primary feature of any examination reform should be conforming the agencies’ use of MRAs to their statutory authorization and purpose.
What is an MRA?
An MRA is a written communication from bank examiners to a bank’s management or board requiring a change in practice. It is typically conveyed in a formal examination report or supervisory letter.
Each agency has its own definition of what constitutes an MRA or its cousins, such as an MRIA. (A glossary is provided in Appendix A.) None of the standards for MRAs has ever been subject to notice and comment.[1] What all the agency definitions have in common is the “R” – they are required, not optional. Below, we refer to them all as MRAs.
Given its name, one might expect an MRA to identify a specific violation of law or a specific bank practice and require the bank to correct it. In current practice, however, MRAs are often entirely process-oriented, with any issue of concern identified only vaguely. The MRA generally requires a bank to (i) develop a detailed “remediation plan,” often with the help of a third-party consultant, (ii) have that plan approved by the agency, (iii) complete implementation of that plan, (iv) have its own internal compliance and/or audit functions review implementation to ensure it is “sustainable” for a period of time after all of that work is finished, and (v) obtain a final determination from the regulator that all of the foregoing has been successfully completed. Each of these steps must be completed before the MRA may be closed. Furthermore, the agencies generally expect the bank’s board of directors to oversee the remediation process.[2] For more complex MRAs, it can frequently take more than a year after the bank completes all of its work for an agency to close an MRA.
While MRAs are kept secret by the agencies, some were disclosed as part of the investigation of Silicon Valley Bank, and they are instructive. Among numerous similar examples in the supervisory materials released by the Federal Reserve, here is an MRA issued to Silicon Valley Bank concerning “Formalization and Maturity of Internal Credit Review” in 2021:
“Required Action: Management is required to address the following:
- Develops an independent credit risk assessment that can inform the loan review planning process
- Develops a formal process to assess staffing needs and expertise
- Develops guidance for assessing compliance with policy and underwriting performance that includes benchmarks
- Develops policy/procedure guidance for the issues tracking process
- Defines applicable time frames regarding completion of activities to hold staff accountable
- Develops a continuous monitoring process
- Develops efficient ICR management information systems (MIS) capabilities to report credit risk comparative trends that includes the adequacy of and adherence to internal policies and procedures
- Requires ICR to formally respond to consultant recommendations
- The Board, or its delegated committee, should develop a work plan that includes appropriate action steps, time frames, and accountability standards to address each of the issues mentioned above.”[3]
As this example reveals, MRAs often fail to identify any particular practice of concern. Rather, they seek to direct how banks manage themselves at an operational level, emphasizing process over results, with no standard for success and examiners as the final, subjective arbiter of whether the bank is being managed to their expectations.[4]
Why do MRAs matter?
The consequences of failing to obey an MRA are difficult to overstate. Unresolved MRAs are frequently the basis for a downgrade of the bank’s examination rating, including its CAMELS Management component or composite rating or (at the bank holding company) one or more of its Large Financial Institution component ratings. That downgrade, in turn, may result in an automatic halt on most types of expansion.[5]
Even if a rating change does not result, a refusal to accede to or remediate an MRA would nonetheless likely put the bank into “penalty box” for purposes of mergers and acquisitions. The Federal Reserve’s supervisory guidance on how it reviews applications, Supervisory Letter 14-2, states that in order to expect favorable regulatory action, “[t]he organization … must be responding appropriately to and must have made notable progress in addressing supervisory concerns.”[6] Refusal to accept an MRA would almost certainly qualify. OCC guidance suggests that it imposes a similar standard.[7]
Finally, for the bank employees responsible for remediating the MRA, any failure to comply with examiner mandates can result in the agency “losing confidence” in them, leading to dismissal – all behind the cloak of examination secrecy and with the employee having effectively no process rights, in many cases unaware that their termination was agency-mandated.
What legal authority do the agencies have to issue MRAs?
Recognizing that MRAs are not optional suggestions but rather mandatory commands, the legal basis of agencies’ issuance of MRAs becomes a crucial question.
Examination Authority
While MRAs are a product of the examination process, the examination power granted to the agencies by Congress does not authorize them. Those statutes permit the agencies to examine banks’ books and records and obtain information from banks upon examiner request, but do not empower the agencies to require that the banks take (or desist from) any particular action. For example, the OCC is authorized to “make a thorough examination of all the affairs of [any national] bank” and its affiliates;[8] the Federal Reserve to “examine at its discretion the accounts, books, and affairs . . . of each member bank and to require such statements and reports as it may deem necessary”;[9] and the FDIC to “make a thorough examination of any insured depository institution or affiliate.”[10] None of these basic examination powers includes any authority to order a bank to change its practices.
Enforcement Authority
Indeed, it is for this very reason that Congress amended the banking laws in 1966 to authorize each banking agency to require banks to take certain actions through the issuance of a cease-and-desist order.[11] Specifically, in cases in which a bank is or is about to engage in an “unsafe or unsound practice” or violation of law, Section 8(b) of the Federal Deposit Insurance Act permits the agencies to issue, after notice and a hearing, an order that may “require the depository institution … to cease and desist from [the violation of law or unsafe or unsound practice] and, further, to take affirmative action to correct the conditions resulting from any such violation or practice.”
The dichotomy here is crystal clear but has been erased by agency practice: the examination power is just that – the power to review books and records; enforcement action is how banks are forced to change practice, and that action requires due process.
The ramifications for MRAs are significant.
First, the agencies’ actual legal authority is far too narrow to justify the expansive scope of today’s MRAs. As illustrated by the SVB examples, many MRAs are now focused on dictating how banks manage themselves and do not even cite an unsafe or unsound practice or violation of law.[12]
Second, such orders can only be issued after notice and an opportunity for a hearing. MRAs come with no such process.[13]
Thus, the only basis for an MRA would appear to be as a non-binding warning that an enforcement order would be forthcoming if a practice or violation is not corrected — akin to a Wells notice in the SEC enforcement context.[14] But if issued in conformance with law, such a warning would not only be non-binding, but also groundless if it was about something other than a violation of law or a specific unsafe or unsound practice that an agency can bring an enforcement action to correct.
Other Authority
Perhaps given the lack of a legal basis for MRAs in the examination or enforcement authority, the federal banking agencies at one point suggested an alternative authority: the agencies’ “visitorial powers.”
Congress has conferred upon the agencies the authority to exercise visitorial powers with respect to supervised institutions. The Supreme Court has indicated support for a broad reading of the agencies’ visitorial powers. See, e.g., Cuomo v. Clearing House Ass’n L.L.C., 557 U.S. 519 (2009); United States v. Gaubert, 499 U.S. 315 (1991); and United States v. Philadelphia Natl Bank, 374 U.S. 321 (1963). The visitorial powers facilitate identification of supervisory concerns that may not rise to a violation of law, unsafe or unsound banking practice, or breach of fiduciary duty under 12 U.S.C. 1818.”[15]
The assertion that an MRA could be based on visitorial powers is baseless.
First, as a statutory matter, the term “visitorial powers” appears in federal banking law in only three instances, none of which grants or expands federal visitorial authority beyond an agencies’ statutory power to examine a bank’s books and records.[16]
- The first and oldest of these statutory provisions is 12 U.S.C. § 484 — titled “Limitations on visitorial powers.” The first word is instructive. Section 484 states that “[n]o national bank shall be subject to any visitorial powers except as authorized by Federal law, vested in the courts of justice or such as shall be, or have been exercised or directed by Congress or by either House thereof or by any committee of Congress or of either House duly authorized.”[17] Thus, Section 484 does not grant any visitorial power, but rather restricts its use, particularly by state governments acting under state law.
- The other two instances, 12 U.S.C. §§ 25b and 1465, were enacted in 2010 and apply to national banks and federal savings associations, respectively. These provisions codify the core holding of Cuomo v. Clearing House by stating that no provision of the National Bank Act “shall be construed as limiting or restricting the authority of any . . . State to bring an action against a national bank in a court of appropriate jurisdiction to enforce an applicable law and to seek relief as authorized by such law.”[18] Again, these statutory provisions grant no visitorial power but rather restrict the OCC’s use of it.
Second, this assertion is flatly inconsistent with the Supreme Court precedent that the agencies cited as purported support for their position:
- Nothing in Cuomo indicates “support for a broad reading of the [federal] agencies’ visitorial powers.” To the contrary, that case adopts a narrow construction of “visitorial powers” by clearly distinguishing visitorial powers from enforcement powers. It states explicitly: “In sum, the unmistakable and utterly consistent teaching of our jurisprudence, both before and after enactment of the National Bank Act, is that a sovereign’s visitorial powers and its power to enforce the law are two different things.”[19] In other word, it emphatically endorses the dichotomy between the examination and enforcement power that the agencies have sought to eliminate.
- United States v. Philadelphia Nat’l Bank refers to the federal banking agencies’ visitorial powers as “broad,” but it describes them by clear reference to the various examination powers granted to the agencies by statute, and not as anything separate and apart from them. Moreover, and fatal to the agencies’ suggestion, this case as well clearly endorses the dichotomy between the agencies’ “surveillance” powers (i.e., the power to examine and require reports) and their enforcement powers.[20]
- United States v. Gaubert does not address the scope of visitorial powers at all.[21]
Finally, even on its own terms, the agencies’ assertion of visitorial power as the basis for an MRA is baseless. As noted above, they state that “visitorial powers facilitate identification of supervisory concerns.” But so does the examination power. Thus, visitorial powers bring nothing new to the party. The agencies did not assert that visitorial powers include the ability to take enforcement action without due process, as provided in section 8 of the FDI Act. Thus, as described, an MRA issued under the agencies’ self-described “visitorial” power would appear to be no more self-enforcing than one issued under their examination power.
So, in sum, the agencies’ examination powers do not authorize them to issue MRAs that compel bank conduct; nor do they possess penumbral “visitorial powers” that can serve as a process-free alternative to the enforcement action power. And that enforcement power is limited to a far more narrow set of circumstances than those for which the agencies issue MRAs.
What does this mean for reform?
As the above makes clear, MRAs are currently issued and enforced in a way that cannot be reconciled with the agencies’ legal authorities. This might be less concerning if the MRA were a little-used tool with limited consequences, but the MRA operates today as the cornerstone of modern bank examination. It is the most common way by which individual examiner preferences are converted into government mandates that a bank manage its business to examiner standards, under threat of significant sanction. Urgent reform is thus needed.
Fortunately, the solution to this problem is both clear and simple: the agencies should establish policies that clearly define MRAs consistent with longstanding and robust case law on what constitutes an unsafe or unsound practice or a violation of law.[22] They should make clear that an MRA is not a binding order but a warning of potential enforcement action if the practice or violation is not corrected within a specified time. They should also make clear that MRAs should not be used as a means to communicate (and demand conformance with) supervisory recommendations, preferences or best practices, or to enforce non-binding guidance or “supervisory expectations,” as has become increasingly common.
Given the overwhelming importance of MRAs to the bank supervision process, we can think of no better process for that reform than the one prescribed by law – notice and comment rulemaking, with the resulting policy codified in regulations that bind the agencies and their examiners. And importantly, they should do so jointly and uniformly, ideally through coordination by the U.S. Treasury Department, and arrive at a single, uniform standard.
Appendix A
| Federal Reserve Definition[23] | OCC Definition[24] | FDIC Definition[25] |
| “MRIAs arising from an examination, inspection, or any other supervisory activity are matters of significant importance and urgency that the Federal Reserve requires banking organizations to address immediately and include: 1. matters that have the potential to pose significant risk to the safety and soundness of the banking organization; 2. matters that represent significant noncompliance with applicable laws or regulations; 3. repeat criticisms that have escalated in importance due to insufficient attention or inaction by the banking organization; and 4. in the case of consumer compliance examinations, matters that have the potential to cause significant consumer harm. …MRAs constitute matters that are important and that the Federal Reserve is expecting a banking organization to address over a reasonable period of time, but when the timing need not be ‘immediate.’” | “Matters Requiring Attention (MRA) describe practices that: – Deviate from sound governance, internal control, and risk management principles, and have the potential to adversely affect the bank’s condition, including its financial performance or risk profile, if not addressed; or – Result in substantive non-compliance with laws and regulations, enforcement actions, or conditions imposed in writing in connection with the approval of any application or other request by the bank.” | “A MRBA is defined as an issue or risk of significant importance that requires board attention. Examples of matters requiring board attention that could warrant highlighting include: Emerging issues in which the board needs to be more proactive in establishing policy and risk management parameters; Policy weaknesses that, if left unaddressed, could increase the institution’s risk profile or, adversely affect the condition of the institution; Ineffective management; Repeat examination recommendations or regulatory, audit, or risk management criticisms that have escalated in importance; Enforcement action provisions requiring continued attention (these should be included in one summary bullet point); or Significant noncompliance with laws, regulations, or the bank’s own policies.” |
[1] As best as we can tell, the documentary origin of the MRA was the introduction of a “Matters Requiring Board Attention” page to the then-four federal banking agencies’ common core Report of Examination. See FFIEC Policy Statement on the Uniform Common Core Report of Examination (1993), available at www.occ.gov/static/news-issuances/bulletins/pre-1994/examining-bulletins/eb-1993-7a.pdf.
[2] The FDIC uses “Matters Requiring Board Attention,” or MRBAs, which self-evidently are directed to the Board. As noted above, the Federal Reserve proposed in 2017 to revise its guidance to reduce the number of MRAs and MRIAs (Matters Requiring Immediate Attention) that were directed to directors, but ultimately chose not to do so.
[3] Federal Reserve Bank of San Francisco & California Department of Financial Protection and Innovation, Silicon Valley Bank CAMELS Examination Report at 7 (May 3, 2021), available at https://www.federalreserve.gov/supervisionreg/files/svb-2020-camels-examination-report-20210503.pdf.
[4] For a more detailed description of how the Federal Reserve’s supervisory approach to SVB was principally focused on nonfinancial risks and regulatory compliance matters, and not the fundamental weaknesses in SVB’s risk profile that led to its failure, see Jeremy Newell & Pat Parkinson, A Failure of (Self-) Examination: A Thorough Review of SVB’s Exam Reports Yields Conclusions Very Different From Those in the Fed’s Self Assessment (May 8, 2023), available at https://bpi.com/a-failure-of-self-examination-a-thorough-review-of-svbs-exam-reports-yields-conclusions-very-different-from-those-in-the-feds-self-assessment/.
[5] Under Section 4(k) of the Bank Holding Company Act, a financial holding company whose bank receives a “3” CAMELS rating for management ceases to be considered “well-managed” and must receive Federal Reserve approval to expand certain non-banking activities. Regulators now extend that to almost any type of expansion. For example, the Federal Reserve also maintains a policy, articulated in guidance not issued through notice and comment, that states that “[o]rganizations rated less than satisfactory or operating under a formal enforcement action are expected to resolve the issues that led to the less-than-satisfactory rating or the enforcement action prior to seeking approval from the Federal Reserve to engage in any expansionary activities, including mergers, acquisitions, asset purchases, investments, new activities, and branching.” Board of Governors of the Federal Reserve System, Supervisory Letter 14-2: Enhancing Transparency in the Federal Reserve’s Applications Process (Feb. 24, 2014), available at https://www.federalreserve.gov/supervisionreg/srletters/sr1402.htm.
[6] Id.
[7] For example, the OCC’s Licensing Manual for Business Combinations states that, when reviewing an applicant bank’s BSA/AML compliance, it reviews MRAs and considers the nature and duration of the issues and the institution’s progress in remediating identified program deficiencies. Office of the Comptroller of the Currency, Licensing Manual for Business Combinations (rev. July 2018), available at https://www.occ.gov/publications-and-resources/publications/comptrollers-licensing-manual/files/bizcombo.pdf.
[8] 12 U.S.C. § 481. See also 12 U.S.C. § 161 (authorizing the Comptroller to “call for additional reports of condition, in such form and containing such information as he may prescribe, on dates to be fixed by him, and . . . for special reports from any particular association whenever in his judgment the same are necessary for his use in the performance of his supervisory duties.”).
[9] 12 U.S.C. § 248(a)(1). Similarly, the Bank Holding Company Act permits the FRB to “make examinations of a bank holding company and [its] subsidiar[ies] . . . in order to (i) inform the Board of the nature of the operations and financial condition of the bank holding company and the subsidiary,” among other things, and “(ii) monitor the compliance of the bank holding company and the subsidiary with” applicable federal law. 12 U.S.C. § 1844(c)(2)(A).
[10] 12 U.S.C. § 1820(b)(6).
[11] See Financial Institutions Supervisory Act of 1966 (Pub. L. 89-695) § 202, codified at 12 U.S.C. § 1818. At the time, in cases where informal dialogue and nonbinding requests were insufficient to remedy a supervisory concern, the “only ultimate correction action” that the agencies could take was to invoke the FDIC’s draconian power to terminate a bank’s deposit insurance. See S. Rep. No. 89-1482, at 5 (1966), available at https://babel.hathitrust.org/cgi/pt?id=umn.31951p006846049&seq=11.
[12] As interpreted over time by the federal courts, an unsafe or unsound practice is one that “threatens the financial integrity of the institution”] or that “would be contrary to generally accepted standards of prudent operation (that is, it constituted an imprudent act), the possible consequences of which, if continued, created an abnormal risk or loss or damage to the financial stability of [a bank].” See Johnson v. OTS, 81 F.3d 195, 204 (D.C. Cir. 1996); Gulf Federal Savings & Loan Association v. Federal Home Loan Bank Board, 651 F.2d 259, 264 (5th Cir. 1981).
[13] By law, all the banking agencies must maintain processes by which banks can appeal material supervisory determinations. These vary by agency, but all involve a process by which any appeal is heard and decided internally, with only a modicum of legitimate due process. See Julie Andersen Hill, When Bank Examiners Get it Wrong: Financial Institution Appeals of Material Supervisory Determinations, 92 Wash. U. Law. Rev. 1101 (describing the appeals process as a “dysfunctional and seldom-used system”), available at https://journals.library.wustl.edu/lawreview/article/5068/galley/21901/view/.
[14] See Securities and Exchange Commission, Enforcement Manual (Nov. 18, 2017) at 19 et seq., available at https://www.sec.gov/divisions/enforce/enforcementmanual.pdf. There is a significant difference. A Wells notice comes if the SEC staff has completed an investigation and intends to recommend an enforcement action to the Commission; it gives the affected party a chance to argue against enforcement action to the staff or the Commission. An MRA provides the bank an opportunity to correct the unlawful act or practice prior to any recommendation of formal enforcement action; however, as documented above, it comes with significant consequences even if no formal enforcement action is taken, without the agency head or board even being aware of it.
[15] Comptroller of the Currency, Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Consumer Financial Protection Bureau, Role of Supervisory Guidance, 85 Fed. Reg. 70512 (Nov. 5, 2020) (proposed rule) at 70515 n.12.
[16] Notably, none of these statutory provisions address the “visitorial powers” of the Federal Reserve or FDIC with respect to bank holding companies, foreign banking organizations, state member or nonmember banks, or any other institution over which either has supervisory oversight.
[17] 12 U.S.C. §484.
[18] 2 U.S.C. §25b(i)(l).
[19] Cuomo, 557 U.S. at 529 (internal quotation marks omitted).
[20] As the court explained: “But perhaps the most effective weapon of federal regulation of banking is the broad visitorial power of federal bank examiners. …. In this way the agencies maintain virtually a day-to-day surveillance of the American banking system. And should they discover unsound banking practices, they are equipped with a formidable array of sanctions. If in the judgment of the [Federal Reserve] a member bank is making undue use of bank credit, the Board may suspend the bank from the use of the credit facilities of the [Federal Reserve]. The FDIC has an even more formidable power. If it finds unsafe or unsound practices in the conduct of the business of any insured bank, it may terminate the bank/s insured status. Such involuntary termination severs the bank’s membership in the [Federal Reserve], if it is a state bank, and throws it into receivership if it is a national bank. Lesser, but nevertheless drastic, sanctions include publication of the results of bank examinations. As a result of the existence of this panoply of sanctions, recommendations by the agencies concerning banking practices tend to be followed by bankers without the necessity of formal compliance proceedings.” United States v. Philadelphia Nat’l Bank, 374 U.S. 321 (1963) at 329-330 (internal quotation marks and citations omitted).
[21] Rather, it examined whether certain supervisory actions of the Federal Home Loan Bank Board were within the “discretionary function” exception to the liability of the United States under the Federal Tort Claims Act, concluding that they are. United States v. Gaubert, 499 U.S. 315 (1991) at 334.
[22] Importantly, this also means that the agencies must apply an appropriate standard for identifying unsafe or unsound practices, as described above.
[23] See Board of Governors of the Federal Reserve System, Supervisory Letter 13-13: Supervisory Considerations for the Communication of Supervisory Findings (2013), available at https://www.federalreserve.gov/supervisionreg/srletters/sr1313.htm. In 2017, the Federal Reserve proposed to rescind and replace this supervisory letter in the context of its proposed guidance on supervisory expectations for boards of directors so as to reduce the number of MRAs that would be directed to the board (rather than management) for corrective action, but never did so. See Board of Governors of the Federal Reserve System, Proposed Guidance on Supervisory Expectation for Boards of Directors, 82Fed. Reg. 37219 (Aug. 9, 2017) (notice); Board of Governors of the Federal Reserve System, Supervisory Letter 21.4: Inactive or Revised SR Letters Related to the Federal Reserve’s Supervisory Expectations for a Firm’s Boards of Directors (Feb. 26, 2021), available at https://www.federalreserve.gov/supervisionreg/srletters/SR2104a1.pdf.
[24] See Office of the Comptroller, Comptroller’s Handbook: Bank Supervision Process, (rev. 2014), available at https://www.occ.gov/publications-and-resources/publications/comptrollers-handbook/files/bank-supervision-process/index-bank-supervision-process.html.
[25] See Federal Deposit Insurance Corporation, Risk Management Manual of Examination Policies at § 16.1 (rev. 2024), available at https://www.fdic.gov/regulations/safety/manual/section16-1.pdf.
