OCC and FDIC Final Rule: Prohibition on the Use of Reputation Risk by Regulators

When an examiner raises concerns about your institution’s business relationships, compliance professionals must now distinguish between legitimate risk-based supervision and prohibited “reputation risk” pressure. As of June 9, 2026, the OCC and FDIC are legally barred from using reputation risk as a basis for criticism or adverse action. This regulatory shift affects all OCC-supervised institutions and all FDIC-supervised insured depository institutions.

NETBankAudit experts have over 25 years of experience in regulatory compliance audits and risk management. If you have any questions after reading this guide, please reach out to our team.

Executive Order 14331: The Policy Foundation and Key Definitions

This regulatory change was triggered by Executive Order 14331, “Guaranteeing Fair Banking for All Americans,” signed August 7, 2025. The EO’s policy statement is clear: no American should be denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The EO defines “politicized or unlawful debanking” as any act by a financial institution to restrict access to accounts, loans, or other services based on a customer’s political or religious beliefs, or lawful business activities that the provider disfavors for political reasons. The EO cited concrete harms suffered by debanked individuals and businesses, including frozen payrolls, debt, crushing interest, and damage to livelihoods, reputations, and financial well-being.

The EO’s standard for lawful banking decisions is equally clear: decisions must be based on material, measurable, and justifiable risks, not on political or religious beliefs or lawful business activities. The EO specifically noted that religion-based debanking in credit transactions can be unlawful under the Equal Credit Opportunity Act (15 U.S.C. 1691 et seq.), and the 180-day complaint data review was designed to identify and refer exactly those cases to the Attorney General. The EO directed federal banking regulators to, within 180 days, remove reputation risk from guidance documents, manuals, and examination materials, and to consider amending existing regulations to eliminate it. It also required each federal banking regulator, within 120 days, to review institutions under their jurisdiction for past or current policies encouraging politicized debanking and to take remedial action where authorized, including fines and consent decrees. The EO further required a 180-day review of complaint data for unlawful debanking on the basis of religion, with referral to the Attorney General for civil action if compliance could not be obtained. The EO’s directives to the Small Business Administration (SBA) included notification and reinstatement requirements for clients denied service through politicized debanking, including those denied payment processing services.

Following the EO, the agencies published a proposed rule on October 30, 2025; after a public comment period, the final rule was issued with only minor modifications. Compliance professionals should note that the EO itself does not create any right or benefit enforceable at law or in equity, it is the final rule, effective June 9, 2026, that creates the legally binding and challengeable standard.

What Changed: The Final Rule’s Prohibitions and Definitions

The final rule defines “reputation risk” as:

“Any risk, regardless of how the risk is labeled by the institution or regulators, that an action or activity, or combination of actions or activities, or lack of actions or activities, of an institution could negatively impact public perception of the institution for reasons not clearly and directly related to the financial or operational condition of the institution.”

This definition is critical: it preserves the agencies’ ability to supervise for public perception concerns that directly relate to financial or operational condition (such as solvency or cyberattacks), while eliminating the use of reputation risk as a pretext for other forms of supervisory intervention.

Key Prohibitions Under the Rule

• Prohibits OCC and FDIC from criticizing, formally or informally, or taking adverse action against an institution on the basis of reputation risk.
• Agencies may not require, instruct, or encourage an institution or its employees to refrain from, terminate, initiate, or modify business relationships with any third party on the basis of reputation risk.
• Prohibits requiring, instructing, or encouraging an institution to close, restrict, or modify a customer relationship based on a person or entity’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or lawful business activities that are politically disfavored but legal.
• Bars any supervisory or adverse action designed to punish or discourage engagement in any lawful political, social, cultural, or religious activities, constitutionally protected speech, or lawful business activities that the agency or its personnel disagree with or disfavor.

What Counts as “Adverse Action”: The Rule’s Broad Reach

The rule defines “adverse action” broadly, covering:

• Negative feedback in reports of examination, memoranda of understanding, verbal feedback, or enforcement actions
• Any communication characterized as informal, preliminary, or not approved by agency officials
• Downgrades (or contributions to downgrades) of any supervisory rating, including CAMELS, Consumer Compliance, IT, or other rating systems
• Denial of licensing or filing applications
• Conditions attached to approvals, introduction of new or heightened approval requirements
• Adjustments of capital requirements
• Any action that treats an institution differently from similarly situated peers
• A broad “catch-all” for any action that could negatively impact an institution outside of traditional supervisory channels, intent is the defining characteristic here

This means that even informal or preliminary feedback motivated by reputation risk is now explicitly prohibited, providing institutions with a clear regulatory basis to push back against such actions.

The “Solely” Qualifier: A Critical Compliance Nuance

Section (c) of the rule uses the word “solely” in prohibiting action against lawful but politically disfavored business activities. This is deliberate: the prohibition does not prevent regulators from acting when legitimate safety and soundness concerns exist alongside political controversy. For compliance professionals, this means that if an examiner raises concerns about a controversial sector, the key question is whether the concern is genuinely about credit, market, or operational risk, or if it is a pretext for reputation risk supervision. Understanding this nuance is essential to avoid over-relying on the rule as a shield or misreading legitimate examiner concerns.

“Doing Business With”: Broad Scope of Coverage

The rule’s definition of “doing business with” is intentionally broad. It covers not only deposit accounts, but also CRA plans, community benefits agreements, charitable activities, third-party service providers, and both existing and prospective business relationships. Compliance officers working on CRA, vendor management, and community engagement should recognize that the rule’s protections extend to these areas.

Institution-Affiliated Parties: Who Is Protected?

The prohibitions extend beyond the bank itself to institution-affiliated parties, directors, officers, employees, and agents. Examiners cannot take adverse action against these individuals based on reputation risk either. This matters for boards and executives as well as compliance staff.

What the Rule Does Not Change

• The rule applies only to the actions of the OCC and FDIC; it does not restrict or require any actions by financial institutions themselves. Banks retain full discretion in their own business decisions.
• All existing laws and regulations prohibiting discriminatory or predatory banking practices remain fully in force.
• BSA/AML supervision continues, but the rule prohibits using BSA/AML concerns as a pretext for reputation risk supervision.
• Fraud detection and prevention requirements are unchanged, as concerns about fraud directly impact operational and financial condition and are therefore outside the definition of reputation risk.
• Statutory application criteria for certain applications (such as deposit insurance) still apply, but may not be used as a pretext for reputation risk.

What To Do When An Examiner Raises Reputation Risk Concerns

• Document the specific language of examiner feedback, including the date and form of delivery (verbal, written, informal), and whether it was characterized as preliminary or unofficial.
• Note whether similar feedback was given to similarly situated peer institutions. Inconsistent treatment can be evidence of impermissible intent.
• Preserve context showing whether the examiner’s concern was tied to actual financial or operational risk, or if it appeared to be based on political, social, or cultural considerations.
• Evaluate whether the examiner’s justification for the concern is substantiated by specific, articulable facts. Unsubstantiated or poorly substantiated justifications are themselves evidence of impermissible intent under the rule’s catch-all provision.
• Be alert to patterns where supervisory concerns appear targeted at an entire industry or customer category uniformly, actions that effectively deny financial services sector-wide are themselves evidence of impermissible intent, because genuine financial risk would not produce that degree of uniformity.
• Escalate internally before reflexively challenging supervisory feedback, but be prepared to use the regulatory framework to push back if feedback appears motivated by reputation risk.

Examiners can still have constructive discussions about business strategy, market conditions, and competitive pressures. The prohibition applies when those discussions cross into criticism or adverse action based on reputation risk or prohibited considerations.

If you believe your institution has been subjected to reputation risk-based action, complaint channels are available: OCC’s helpwithmybank.gov and FDIC’s information and support center.

Why Reputation Risk Was Eliminated: The Agencies’ Rationale and Supporting Data

Reputation risk has been embedded in federal bank supervision since the 1990s, when the OCC introduced a “supervision by risk” framework organized around nine risk categories, one of which was reputation risk. The FDIC similarly incorporated it into guidance and enforcement actions during the same period, making this rule a reversal of more than 30 years of supervisory practice.

The agencies’ core argument is that reputation risk introduces substantial subjectivity without adding material value to safety and soundness supervision. Most activities that could harm a bank’s reputation do so through traditional risk channels, credit, market, or operational risk, which regulators already supervise with sufficient authority. Supervisors have little ability to predict whether specific activities or customer relationships present reputation risks that threaten safety and soundness.

OCC data analysis found that reputation risk ratings do not forecast bank failures after controlling for CAMELS composite ratings. Matters Requiring Attention (MRAs) mentioning reputation risk as a primary or secondary concern also showed no predictive value for bank failures. Natural language processing analysis revealed that supervisory text mentioning “reputation” scored an average subjectivity of 0.41 versus 0.28 for text that did not; MRA text mentioning reputation scored 0.43 versus 0.33 for non-reputation MRAs (on a scale of 0 to 1, higher = more subjective). From 2016–2024, roughly 17% of OCC MRAs per year cited reputation risk as a primary or secondary concern, with the vast majority categorized as secondary rather than primary; by 2025, that dropped to 2.19% secondary and 0% primary, and in 2026 it is 0%.

The agencies also cited Sachdeva, Silva, Slutzky, and Xu, “Defunding controversial industries: Can targeted credit rationing choke firms?”, Journal of Financial Economics, Volume 172, 2025. The study found that targeted reputation risk concerns at certain institutions decreased lending to and terminated relationships with controversial firms, but those firms were generally able to obtain substitute credit elsewhere, though at some cost, and the agencies interpreted this as evidence that harm would have been greater, not lesser, had more banks been simultaneously pressured into cutting off the same firms.

Industry Reactions and Ongoing Debate

While the majority of commenters supported the rule, some opponents argued that examination for reputation risk is necessary for bank safety and soundness. The agencies rejected this, noting that reputation risk ratings do not predict bank failures after controlling for CAMELS ratings, and that the spring 2023 bank failures reflected public concerns about financial solvency rather than the type of non-financial reputation risk the rule eliminates,  all existing anti-discrimination and fraud prevention requirements remain fully operative regardless.

Conforming Regulatory Amendments

The OCC amended 12 CFR Parts 1, 4, and 30 to remove references to reputation risk across investment securities, enforcement and supervision standards, and safety and soundness guidelines. The FDIC amended 12 CFR Parts 302 and 364. Compliance officers should update any internal policy documents, examination prep materials, or regulatory tracking systems that reference these parts.

Key Takeaways for Compliance Professionals

• The rule codifies the elimination of reputation risk as a supervisory tool for OCC and FDIC examiners and is now legally binding and enforceable.
• Prohibitions extend to both formal and informal examiner actions, including those targeting institution-affiliated parties.
• The “solely” qualifier means regulators can still act when legitimate safety and soundness concerns exist alongside political controversy.
• Compliance professionals should document examiner feedback, note inconsistent treatment, be alert to industry-wide targeting, and be prepared to challenge actions that appear motivated by reputation risk.
• Further regulatory and legislative action may be forthcoming, as the EO directed the Treasury Secretary to develop a government-wide strategy for additional measures to combat politicized debanking, and created a pathway for Attorney General referral in cases of unlawful debanking based on religion.

Navigating the new compliance landscape requires careful attention to examiner interactions, documentation discipline, and a clear understanding of the boundaries between prohibited reputation risk supervision and permissible risk-based criticism.

If your institution needs support interpreting the new rule, updating compliance documentation, or preparing for future regulatory changes, contact NETBankAudit.

‍