The Supervisor Blinks First
The OCC and FDIC just narrowed what counts as an “unsafe or unsound practice.” The quiet casualty is how examiners police commercial-real-estate concentration risk — and the timing is the story.
What Happened
On August 27, 2026, the Office of the Comptroller of the Currency and the FDIC jointly adopted a final rule that codifies a single definition of “unsafe or unsound practice” and raises the bar for issuing a Matter Requiring Attention (MRA). It was published at 91 FR 56004 and takes effect November 2, 2026. A practice now qualifies as unsafe or unsound only where it is contrary to generally accepted standards of prudent operation and is likely to materially harm the institution’s financial condition — its capital, asset quality, earnings, liquidity, or sensitivity to market risk. An MRA may issue only for a practice meeting that bar, judged under current or reasonably foreseeable conditions, or for an actual violation of law. Weaknesses in policies, processes, and documentation that have not produced financial harm are relegated to non-binding “supervisory observations.” The Federal Reserve did not join, so the rule reaches OCC- and FDIC-supervised banks; the Fed says it will pursue a similar approach through internal policy.
Why It Matters to CRE Lending
Commercial-real-estate concentration has never been governed by a hard rule. Since 2006 it has been supervised through interagency guidance — Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices (71 FR 74580) — with its familiar screening thresholds (construction and land above 100% of capital; total CRE above 300% and growing) and, more importantly, its expectations for board-approved limits, portfolio monitoring, market analysis, and stress testing. Those are process expectations, and examiners have long enforced them through MRAs at concentrated banks carrying no current loss — the citation that forced a bank to tighten limits and stress-test before the cycle turned. The new rule expressly provides that nonconformance with such guidance is not a violation of law. A thin concentration risk-management program therefore can no longer, by itself, support an MRA. This is not the caricature of blinded examiners: the rule keeps a forward-looking hook, and the agencies point to Silicon Valley Bank and 2022 interest-rate risk as harms that were “reasonably foreseeable.” The real shift is subtler. To keep a concentration criticism binding, an examiner must now forecast material harm — the hardest thing to prove in the one asset class where losses lag underwriting by years, and the easiest for a well-capitalized bank to rebut.
Practical Implication
Lenders should not read this as license to relax. The 2006 thresholds and sound-practice expectations still define what a court, a plaintiff, or a later enforcement action will treat as prudent operation; what has changed is that the examiner may no longer paper the file. The stress testing and portfolio limits built to satisfy supervisors are now internal governance, not an external requirement — keep them. For owners and borrowers in concentrated markets, a lighter-touch overlay means banks are less likely to be pushed to shrink CRE exposure on a schedule, which is modestly supportive of near-term credit availability. For attorneys, the standard-of-care calculus resets in both directions: the absence of an MRA no longer implies the bank operated prudently, and a bank cannot defend a concentration decision by pointing to examiner silence. The benchmark reverts to the 2006 guidance and prudent-operation norms, read directly.
My Angle
Supervisory tools get dulled at the top of a credit cycle, and the bill arrives at the bottom. In the 1980s, regulatory forbearance let insolvent thrifts keep operating and “grow out” of their losses; the S&L cleanup ultimately cost taxpayers on the order of $124 billion. The lesson drawn from both that era and 2008 was to identify concentration and risk-management weakness early — before it reaches capital — which is precisely the job the concentration MRA performed. Weakening that function is defensible on its own terms; no bank should be cited for a documentation typo. But consider the timing. More than $300 billion in multifamily loans mature in 2026–27 and refinance 250 to 300 basis points higher; insurance and tax lines are outrunning rents; and serious delinquency at Fannie Mae and Freddie Mac on the asset class everyone underwrote as “safe” is creeping toward levels last seen after 2010. Into that, the agencies shift the burden onto examiners to prove foreseeable harm and demote the process criticisms that were the early-warning system. Regulators are not causing the next CRE problem. But they are dimming the smoke detector because the house has not caught fire — yet.
Sources: OCC/FDIC final rule, “Unsafe or Unsound Practices; Matters Requiring Attention,” 91 FR 56004 (Sept. 1, 2026), effective Nov. 2, 2026 · Interagency Guidance, “Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices,” 71 FR 74580 (Dec. 12, 2006), OCC Bulletin 2006-46 · FDIC (Curry & Shibut), cost of the S&L crisis · Fannie Mae and MBA multifamily delinquency data (2026).
This material is for informational purposes and reflects commercial real estate consulting analysis. It is not legal advice.
