OCC Regulatory Updates

Key dates

2026-08-27

The OCC issued Bulletin 2026-42 announcing the notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to inventory open and recently closed MRAs arising from alleged legal or regulatory violations and assess whether each matter would satisfy one or more of the proposed substantive-violation criteria.
• Firms should consider strengthening documentation linking examination findings to duration, frequency, systemic characteristics, financial-condition effects, books-and-records impacts, customer harm, restitution, or insider misconduct.
• Banks may wish to separate remediation plans for legal or regulatory violations from broader supervisory enhancements, because the proposal would limit examiner authority over technical violations to directing correction of the violation itself.
• Compliance and examination-management teams should consider preparing comments or internal positions on the undefined terms more than minimal, systemic, pattern, and meaningfully impact, including how those terms should be applied to isolated but high-severity events.
• Management may wish to review escalation thresholds so that technical-violation treatment does not result in under-escalation of recurring findings that could become systemic or satisfy the proposed substantive criteria.
• Banks should monitor the Federal Register publication of the notice of proposed rulemaking and calculate the 30-day comment period from that publication date rather than from the OCC bulletin date.
• Legal and regulatory-change teams may wish to assess this proposal alongside the OCC-FDIC final rule and related supervisory reforms concerning unsafe or unsound practices, MRAs, and material financial risk, while treating the proposal as nonfinal until adopted.

What changed

The proposed rule would provide that the OCC may issue an MRA for a violation of a banking or banking-related law or regulation only when the violation is substantive. A violation would be substantive when its nature, duration, frequency, or severity could meaningfully impact the bank or its customers, and at least one of five criteria would need to be met: the violation is systemic or constitutes a pattern; it has had or could reasonably be expected to have a direct, clear, predictable, and more than minimal impact on the bank's financial condition; it has had or could reasonably be expected...

Key dates

2026-08-27

OCC issued revised PPM 5310-3 and PPM 5400-11; PPM 5310-3 replaces the May 25, 2023 manual, PPM 5400-11 replaces the February 27, 2026 version, and OCC Bulletin 2023-16 is rescinded.

Suggested considerations

• Compliance teams may wish to map open MRAs, enforcement orders, capital directives, and supervisory findings against the new material-harm, Deposit Insurance Fund risk, and substantive-violation thresholds.
• Banks should consider reviewing issue-management taxonomies and governance procedures so that MRAs, other violations, and supervisory observations are recorded and escalated according to their distinct consequences.
• Board and committee reporting processes may warrant review because supervisory observations do not automatically require board presentation or a corrective-action plan, whereas MRAs and enforcement actions remain subject to formal remediation and validation expectations.
• Large and complex banks should consider reassessing whether deficiencies that might previously have produced a community-bank-level supervisory response could receive faster escalation under the revised tailoring framework.
• Banks with existing enforcement actions may wish to assess whether their remediation evidence demonstrates substantial compliance with the essential requirements of each order and whether remaining issues are minor and isolated.
• Capital management teams may wish to review procedures for the institution of and termination of individual minimum capital ratios under the revised enforcement manual.
• Legal and regulatory change teams should monitor Federal Register publication of the joint OCC-FDIC final rule and calculate the actual effective date rather than relying on the bulletin date.
• Internal audit and compliance functions may wish to preserve objective factual support for responses to MRAs and other supervisory communications, particularly where the bank believes an issue does not meet the new risk-based threshold.

What changed

Revised PPM 5310-3 replaces the May 25, 2023 version and structures the OCC enforcement framework around escalation, tailoring, and focus. The OCC generally intends to provide banks an opportunity to remediate deficiencies through supervision before initiating a Section 8 enforcement action, although it retains authority to act at any time when legally supportable and warranted.

Key dates

2026-08-27

OCC revised PPM 5310-3 and PPM 5400-11, issued Bulletin 2026-41, and published the proposed rulemaking notice concerning substantive and technical violations. The proposed rule's 30-day comment period begins only upon Federal Register publication.

Suggested considerations

• Compliance teams may wish to map open and recently closed MRAs and enforcement actions against the revised material-financial-risk threshold and the stated tailoring factors of capital structure, complexity, activities, and asset size.
• Banks should consider documenting objective facts, legal violations, financial-risk consequences, customer impact, duration, frequency, severity, and remediation status supporting the classification and closure of examination findings.
• Large and complex banks may wish to reassess escalation risk because the OCC expressly permits enforcement action for practices that might not produce the same response at a community bank.
• Banks should consider reviewing corrective-action plans to confirm that each action is directly tied to a specific deficiency and is proportionate to the risk, while preserving evidence of substantial compliance with existing orders.
• Compliance teams may wish to distinguish substantive violations from potential technical violations in issue-management inventories, including systemic or repeated conduct, customer restitution, books-and-records impacts, financial-condition effects, and insider misconduct.
• Banks should consider monitoring the Federal Register for publication of the proposed rule and calculating the 30-day comment period from that publication date; affected institutions may wish to submit comments on the proposed substantive-versus-technical framework.
• Examiners may identify lower-level weaknesses as supervisory observations rather than MRAs; banks should consider maintaining internal governance and risk records for such observations without assuming that the OCC may require a board action plan or track remediation in the same manner as an MRA.

What changed

Revised PPM 5310-3, Bank Enforcement Action and Related Matters, replaces the May 25, 2023 version and emphasizes escalation, tailoring, and focused corrective action. The OCC generally expects to provide a bank an opportunity to remediate deficiencies through supervision before taking an enforcement action under section 8 of the Federal Deposit Insurance Act, although it retains authority to act at any time when legally supportable.

Key dates

2026-08-27

OCC and FDIC issued the joint final rule through OCC Bulletin 2026-40. The bulletin applies to all OCC-supervised banks; it does not state the Federal Register publication date, effective date, or a firm compliance deadline.

Suggested considerations

• Firms should identify the final rule’s Federal Register publication and effective date, because the OCC bulletin itself does not state either date or a compliance deadline, and should monitor OCC and FDIC implementation guidance before relying on any transition treatment.
• Compliance teams may wish to inventory open MRAs, supervisory recommendations, enforcement matters, and examination findings and map each item to the final rule’s material-financial-risk, DIF-risk, actual-violation, or already-caused-harm criteria.
• Firms should consider separating board-level MRA remediation obligations from discretionary management responses to supervisory observations and documenting why a weakness is treated under one category rather than another.
• Risk and compliance functions may wish to enhance evidence files supporting assessments of likelihood, materiality, current and reasonably foreseeable conditions, and impacts on capital, asset quality, earnings, liquidity, and market-risk sensitivity.
• Banks should consider documenting how supervisory requirements and remediation plans are tailored to asset size, complexity, activities, capital structure, and other financial-risk factors, particularly where the institution has heightened systemic, concentration, liquidity, or operational complexity.
• Legal and compliance teams may wish to distinguish actual violations of banking or banking-related laws and regulations from prudential weaknesses, because an actual violation can support an MRA without separately satisfying the prudent-operation and material-risk test.
• Boards and senior management should consider reviewing governance procedures so that MRAs receive required escalation and tracking while supervisory observations are clearly identified as non-binding potential enhancements.
• Firms should consider preparing a process for requesting and retaining the objective facts and reasoning underlying an MRA or unsafe-and-unsound-practice determination, as the rule requires examiners to share that basis.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either is likely, if continued, to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. “Likely” requires more than a merely possible risk; relevant financial-condition effects include impacts on capital, asset quality, earnings, liquidity, and sensitivity to market risk.

Key dates

2026-08-27

OCC and FDIC issued the final rule and OCC published Bulletin 2026-40 describing its application to OCC-supervised banks.

Suggested considerations

• Compliance teams may wish to map existing and anticipated MRAs, enforcement commitments, supervisory recommendations, and examination findings against the new material-financial-risk and actual-violation criteria.
• Firms should consider separating board-level corrective-action items from nonbinding supervisory observations and documenting why each issue does or does not meet the MRA threshold.
• Risk and compliance functions may wish to update issue-taxonomy and escalation procedures to assess impacts on capital, asset quality, earnings, liquidity, sensitivity to market risk, and the Deposit Insurance Fund.
• Banks should consider retaining objective evidence and documented reasoning supporting materiality assessments, including institution-specific factors such as asset size, complexity, activities, and capital structure.
• Management and boards may wish to review outstanding policies, process, and documentation findings to determine whether they remain mandatory remediation matters, are better treated as supervisory observations, or independently constitute violations of banking or banking-related law.
• OCC-supervised banks should monitor the related examination guidance and assess whether planned lookbacks, independent-consultant requirements, or suspicious-activity review scopes are affected by the revised supervisory approach described in industry reporting.
• Firms should track Federal Register publication and calculate the 60-day effective date once publication occurs; the August 27, 2026 announcement date is not itself the effective date.

What changed

An unsafe or unsound practice is now defined as a practice, act, or failure to act that is contrary to generally accepted standards of prudent operation and either, if continued, is likely to materially harm the bank’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or has already materially harmed the bank’s financial condition. Relevant financial-condition impacts include capital, asset quality, earnings, liquidity, and sensitivity to market risk; reputation concerns unrelated to financial condition are excluded.

Key dates

2026-04-22

The CFPB published a final rule amending Regulation B provisions concerning special purpose credit programs, including new restrictions applicable to programs offered or participated in by for-profit organizations.

2026-07-21

The CFPB's Regulation B amendments became effective. For-profit special purpose credit programs offered or participated in on or after this date must comply with the amended requirements, including the prohibition on using race, color, national origin, or sex as a common eligibility criterion.

2026-08-25

The seven agencies rescinded the 2022 interagency statement and OCC Bulletin 2022-3, effective immediately. Creditors should no longer rely on those issuances or related guidance.

Suggested considerations

• Compliance teams may wish to inventory special purpose credit programs, marketing, eligibility criteria, underwriting policies, written plans, and monitoring practices that were developed or supported by the 2022 interagency statement, OCC Bulletin 2022-3, or related guidance.
• Firms should consider reassessing any program that uses race, color, national origin, or sex as a common eligibility criterion, particularly for credit extended on or after July 21, 2026, against 12 CFR 1002.8 as amended.
• For-profit creditors may wish to confirm that each written special purpose credit program plan contains evidence of need, explains why the relevant class would not receive credit under the organization's ordinary creditworthiness standards, and supports any eligibility characteristic used by the program.
• Compliance teams may wish to remove rescinded guidance from policies, procedures, training materials, legal inventories, product governance documents, and examiner-facing materials, while retaining records needed to explain prior program design and implementation.
• Firms should consider reviewing program communications and applicant data practices for potential discrimination or misleading reliance on the rescinded statement, including communications suggesting that protected-class distinctions are broadly authorized.
• Banks and credit unions may wish to brief fair-lending, legal, product, underwriting, marketing, and model-risk stakeholders and document the governance decision regarding whether each program should be amended, suspended, or continued under current law.

What changed

The 2022 interagency statement and OCC Bulletin 2022-3 are rescinded, effective immediately, and creditors are instructed not to rely on those issuances or related guidance. The rescission does not eliminate the statutory or regulatory framework for special purpose credit programs under ECOA and Regulation B, including 12 CFR 1002.8; rather, it clarifies that those programs remain subject to applicable fair-lending prohibitions. The agencies specifically identify the prior version of Regulation B referenced by the 2022 statement as having been amended.

Key dates

2026-08-12

Federal Register publication of the proposed rule at 91 FR 52114

2026-10-13 Deadline

Comments due on the proposed rule

Suggested considerations

• Compliance teams may wish to map the proposed changes against current CRA policies, exam procedures, public file practices, and community development grant approval workflows.
• Institutions may wish to assess how the proposed asset-size thresholds would change their CRA category and associated data collection, reporting, and evaluation obligations.
• Banks making grants or donations may wish to review documentation standards for recipient use of funds, overhead limits, and evidentiary support needed for CRA consideration.
• Community development and CRA governance teams may wish to identify which activities would still qualify under the revised CD definitions and performance tests.
• Legal and regulatory affairs functions may wish to prepare comments on the proposed lending focus, grant criteria, sunshine requirements, and technical changes to OCC public welfare and corporate activity rules.
• Banks subject to CRA-related agreements may wish to verify whether the proposed technical amendments would affect disclosure timing, content, or filing processes.

What changed

['The proposal would amend the OCC and FDIC Community Reinvestment Act rules to make substantive, technical, and process-oriented changes aimed at refocusing the statutory objective on meeting community credit needs and reducing burden, particularly for community banks.', 'The agencies propose to better ensure that community development grants reach intended communities and to provide greater clarity on how to obtain CRA consideration for activities.', 'The OCC and FDIC also propose technical changes to their CRA sunshine rules under the Federal Deposit Insurance Act, which govern disclosure...

Key dates

2026-08-05

OCC published the proposed rule in the Federal Register (91 FR 50610)

2026-10-05 Deadline

Comment period closes for the proposed rule

Suggested considerations

• Compliance teams may wish to map which internal records fall into the proposed CSI category and compare current disclosure controls against the new exceptions and safeguard requirements.
• Supervised entities may wish to review any confidentiality agreements and onward-sharing practices to determine whether they would satisfy the proposed conditions for permitted CSI disclosures.
• Legal and FOIA teams may wish to update request-handling workflows for expedited processing requests, fee-waiver appeals, and request tracking once the rule is finalized.
• Banks and other recipients of OCC information may wish to reassess litigation, government-reporting, and interaffiliate sharing procedures to ensure they align with the revised disclosure framework.
• Firms may wish to submit comments by the close of the comment period if the proposed CSI scope, disclosure exceptions, or FOIA procedures would affect their supervisory, legal, or records-management processes.

What changed

The proposal would restructure the OCC’s information-disclosure rules in 12 CFR part 4 and make conforming changes in parts 5, 7, 21, and 163. It would create a new subcategory of non-public OCC information called confidential supervisory information (CSI), clarify when supervised entities and other recipients may disclose CSI without prior OCC approval, and require applicable safeguards and, in some cases, qualifying confidentiality agreements. The OCC also proposes to permit certain disclosures of CSI in limited circumstances to support business efficiency, government accountability, and...

Key dates

2026-08-03

OCC issued Bulletin 2026-37 announcing the proposed rulemaking on availability of OCC information

2026-10-02 Deadline

Comment period closes 60 days after publication, based on the OCC’s stated deadline formula in the related rulemaking notice

Suggested considerations

• Compliance teams may wish to review current controls for handling nonpublic OCC information and identify where internal policies reference the existing 12 CFR part 4 subparts B and C.
• Firms may wish to assess whether any current or planned disclosures of supervisory materials could fall within the proposed expanded exceptions for business efficiency, government accountability, or supervisory coordination.
• Banks may wish to inventory records that could qualify as aged CSI once the final rule is issued, so they can update retention and disclosure procedures accordingly.
• Legal and compliance functions may wish to monitor the final rule and any comment-driven changes to the proposed FOIA expedited-processing and fee-waiver appeal procedures.
• Institutions may wish to align employee training with the OCC’s clarified position on unauthorized disclosure and potential criminal referral exposure.

What changed

The proposal would amend the OCC’s disclosure framework in 12 CFR 4 by creating a new subcategory of nonpublic OCC information called confidential supervisory information (CSI). It would modify the prior-approval regime for supervised entities that want to disclose CSI by expanding exceptions for business efficiency, government accountability, and supervisory coordination, while adding safeguards around those exceptions. The OCC also proposes to provide for the release of certain aged CSI, which would create a time-based disclosure concept not described in the current rule.

Key dates

2026-08-03

OCC issued the notice of proposed rulemaking

2026-10-05 Deadline

Comments on the proposal are due 60 days after publication in the Federal Register

2026-08-05

Federal Register publication date of the proposed rule

Suggested considerations

• Compliance teams may wish to review current internal controls for handling OCC nonpublic information and map where the proposed CSI category could affect disclosure workflows.
• Firms may wish to assess whether existing information-sharing arrangements with government agencies or service providers would fit within the proposed exceptions and safeguards.
• Teams responsible for FOIA or public records requests may wish to update procedures for expedited processing requests and any related appeal handling.
• Banks and supervised entities may wish to submit comments on operational burden, safeguards, and the practical impact of the proposed disclosure exceptions before the comment deadline.

What changed

The proposal would make structural and substantive changes to the OCC’s disclosure framework in 12 CFR part 4. According to the OCC, it would create a new nonpublic information category called confidential supervisory information (CSI), modify the prior-approval framework for supervised entities that want to disclose CSI, and add tailored exceptions for business efficiency, government accountability, and supervisory coordination, subject to safeguards.

Key dates

2026-06-24

Venezuela experienced a pair of strong earthquakes off the northern coast west of Caracas, triggering the humanitarian crisis referenced by the agencies.

2026-07-27

FinCEN issued a substantively similar statement of enforcement policy regarding Venezuela-related financial services.

2026-07-31

The OCC, Federal Reserve, FDIC, and NCUA issued the joint enforcement policy.

2026-07-31

Start of the period during which authorized financial services to persons or entities in Venezuela are covered by the enforcement commitment.

2027-01-29 Deadline

End of the covered period for the joint enforcement commitment.

Suggested considerations

• Compliance teams may wish to confirm whether current Venezuela-related activity falls within the scope of authorized financial services covered by the joint statement.
• Institutions may wish to verify that their BSA compliance program remains current and that ongoing controls reflect reasonable efforts to comply during the relief period.
• Firms may wish to check whether they have had any final FinCEN or OCC enforcement action involving BSA violations in the prior 24 months before relying on the policy.
• Sanctions teams may wish to confirm continued compliance with all applicable OFAC-administered sanctions regulations and authorizations.
• Institutions with Venezuela exposure may wish to document how they will evidence reliance on the policy and monitor the January 29, 2027 end date.

What changed

The agencies stated that eligible U.S. financial institutions that choose to provide authorized financial services to persons or entities in Venezuela will not be subject to supervisory action, including a citation for a violation of law, or enforcement action related to a Bank Secrecy Act requirement, for those services. The commitment is limited to authorized financial services provided from 2026-07-31 through 2027-01-29 and applies only to statutes or regulations specifically addressed in the joint statement.

Key dates

2026-07-31

OCC Bulletin 2026-35 issued; interagency proposed CRA rule released

Suggested considerations

• Compliance teams may wish to map current CRA inventories against the proposed lending-focused retail services framework to identify deposit-service items that could lose CRA consideration.
• Firms may wish to review community development grant and donation controls to determine whether documentation exists to show direct use for a qualifying primary-purpose community development activity.
• Large banks may wish to assess whether recipient overhead data, written commitments, attestations, tax filings, and budget records would be available to support the proposed 15% overhead limitation.
• Banks near the $1 billion and $10 billion thresholds may wish to model whether the proposed size reclassification would change their CRA evaluation approach, reporting obligations, or supervisory expectations.
• Institutions using or considering strategic plans may wish to reassess whether the proposal would make that option more operationally feasible under the revised framework.
• CRA and public-disclosure teams may wish to inventory public file and notice processes to determine whether technology-enabled publication changes would require procedural updates.

What changed

['The proposal would narrow the retail banking services analyzed under CRA to focus on credit services and would exclude deposit services from that component of the evaluation, while giving greater weight to activities with a lending nexus.', 'Community development grants would count only if they are directly used for a plan, project, or initiative with community development as a primary purpose; for large banks, defined as banks with assets over $10 billion, the recipient would also need documented overhead costs not exceeding 15% of the grant amount.', 'The bank-size framework would be...

Key dates

2026-07-31

OCC and FDIC issued the joint proposal amending CRA rules

2026-10-01 Deadline

Approximate comment deadline, calculated as 60 days after the July 31, 2026 publication date if the proposal was published in the Federal Register on the same day as the release

Suggested considerations

• Compliance teams may wish to review whether current CRA strategies rely materially on deposit services, since the proposal would exclude deposit services from the retail banking services analysis.
• Firms may wish to map all community development grants and donations to identify whether documentation would support that funds are used for the primary purpose of community development and reach the intended assessment areas.
• Banks with assets at or below $10 billion may wish to assess the operational impact of being relieved from data collection, maintenance, and reporting requirements under the proposal.
• Institutions may wish to compare their current CRA performance-test approach against the proposed lending-focused framework and identify activities that could lose or gain CRA consideration.
• Compliance functions may wish to track the Federal Register publication date closely, because the comment window runs for 60 days after publication.

What changed

['The agencies said the proposal would keep the core CRA framework that has generally been in place since 1995, while making substantive, technical, and process-oriented revisions. The proposal follows the agencies’ October 24, 2023 CRA final rules, which were enjoined by the U.S. District Court for the Northern District of Texas before they became effective.', 'The proposal would place greater emphasis on lending performance and would narrow the retail banking services considered under CRA to credit services, expressly excluding deposit services from that part of the analysis.', 'The...

Key dates

2026-07-01

Revisions to the CBLR framework became effective, including the lower 8% threshold and revised grace-period rules

2026-07-30

OCC Bulletin 2026-34 published the updated Community Bank Compliance Guide

Suggested considerations

• Compliance teams may wish to review whether current capital planning and reporting processes reflect the revised 8% CBLR entry threshold.
• Firms that use or may elect the CBLR framework may wish to reassess whether they can remain above the 7% grace-period floor during any temporary noncompliance.
• Banks may wish to confirm how the four-quarter cure period and the eight-quarter cap over five years would operate in their internal capital contingency planning.
• Community banking organizations may wish to reconcile the updated guide with the text of the capital rule, since the guide is only a summary and not binding legal text.

What changed

The agencies revised the non-binding compliance guide to align with the updated CBLR framework in the capital rule. The key substantive change is the minimum leverage ratio for CBLR qualification, which was lowered from greater than 9% to greater than 8%. The grace period for a bank that elects the CBLR framework but temporarily fails to meet the qualifying criteria was revised from two quarters to four quarters, provided the bank maintains a leverage ratio greater than 7% and does not exceed eight quarters in grace-period status over a five-year period.

Key dates

2026-07-13

OCC, FDIC, and NCUA issued the interagency guidance

2026-06-08

CFPB issued its Statement on Ability To Repay and Immigration Status, referenced by the guidance

Suggested considerations

• Compliance teams may wish to review underwriting standards to confirm that repayment capacity, source of repayment, and overall financial condition are assessed consistently for borrowers whose work authorization is uncertain.
• Firms may wish to test whether account management, credit classification, and allowance methodologies adequately capture elevated credit risk linked to employment authorization uncertainty.
• Institutions may wish to review consumer compliance controls for alignment with TILA, Regulation Z, ECOA, and Regulation B when evaluating applicants affected by immigration or work-authorized status.
• Risk and compliance teams may wish to update portfolio monitoring, concentration analysis, and documentation standards so that the identified credit risk factors are reflected in governance and reporting.
• Community banks may wish to verify that loan policy language and examiner-facing documentation clearly show how these risks are being identified, measured, monitored, and controlled.

What changed

The publication is guidance, not a new rule or statute, and it reinforces existing expectations rather than imposing a new legal prohibition. It states that lending to individuals not legally authorized to work in the United States may present elevated credit risk because their ability to generate income, maintain employment, and remain financially stable may be more uncertain.

Key dates

2026-07-09

OCC Bulletin 2026-30 was issued, highlighting FinCEN’s updated Section 314(b) Fact Sheet.

Suggested considerations

• Compliance teams may wish to review whether current Section 314(b) registration status is current and whether the institution has designated internal points of contact for information-sharing requests.
• Firms may wish to assess whether existing BSA/AML and fraud-monitoring procedures explicitly cover the newly highlighted examples of shareable information, including cyber-related data and video surveillance footage.
• Institutions may wish to confirm that information-sharing protocols limit disclosures to permissible Section 314(b) purposes and maintain security and confidentiality controls over information received from peers.
• Banks may wish to refresh training for BSA, fraud, and investigations staff on when sharing is permissible, including the safe-harbor conditions and the scope of eligible counterparties.
• Compliance teams may wish to verify that procedures for responding to requests and documenting reliance on Section 314(b) remain aligned with FinCEN’s updated fact sheet.

What changed

FinCEN’s updated Section 314(b) Fact Sheet clarifies that a participating financial institution may share information about suspected fraud, money laundering, terrorist financing, or other specified unlawful activities with any other financial institution eligible to participate in the Section 314(b) program.

Key dates

2026-06-22

OCC bulletin announcing the notice of proposed rulemaking was issued

2026-07-22 Deadline

Planned deadline for comments, if the Federal Register publication date aligns with the bulletin date and the OCC’s 30-day comment period is measured from publication

Suggested considerations

• Compliance teams may wish to assess whether the entity falls within the OCC-supervised PPSI category or within the state-qualified issuer population covered by OCC authority under the GENIUS Act.
• Firms may wish to review existing AML/CFT and sanctions controls against the BSA, FinCEN, and OFAC requirements referenced in the proposal, including reporting, monitoring, and risk assessment procedures.
• Compliance teams may wish to map governance, escalation, and record-sharing workflows to the proposed OCC-FinCEN consultation framework, particularly for potential significant supervisory or enforcement matters.
• Firms may wish to consider whether their current policies, procedures, and internal controls are sufficiently tailored to stablecoin-specific risks and whether additional board or senior management oversight would be needed.
• Compliance teams may wish to evaluate whether they should submit comments during the 30-day Federal Register comment period if aspects of the proposed framework could affect operating models or compliance design.

What changed

The proposed rule would require OCC-supervised PPSIs to comply with the BSA, sections 4(a)(5) and 4(a)(6)(B) of the GENIUS Act, and applicable FinCEN and OFAC regulations, including AML/CFT program, sanctions program, and reporting requirements. It would also create a supervision and enforcement framework for PPSI AML/CFT programs, so the OCC can take AML/CFT supervisory and enforcement action against covered issuers. The rule would establish a formal consultation process between the OCC and FinCEN when the OCC intends to initiate an AML/CFT enforcement action or a significant AML/CFT...