42.3 Supervisory Findings, Responses and Enforceable Actions

Rating 3: Deficient CMS (Requires Significant Improvement)

• Oversight & Resources: Board and management oversight is deficient. Management is reactive rather than proactive; compliance staffing or technical tools are inadequate for the bank's risk profile.
• Program Execution: Significant weaknesses exist across one or more CMS pillars—such as outdated policies, ineffective training, superficial monitoring, or uncoordinated complaint tracking.
• Violations & Harm: Violations are numerous, recurring, or reflect systemic deficiencies. Violations may cause monetary injury to consumers. The bank lacks an effective mechanism to self-identify and remediate compliance failures without regulatory intervention.

Rating 4: Seriously Deficient CMS

• Oversight & Resources: Board and management fail to exercise adequate oversight, tolerate high compliance risk, or actively disregard regulatory requirements. Severe resource deficiencies exist.
• Program Execution: The compliance program has broken down across multiple core dimensions. Monitoring is non-existent or ignored; policies are obsolete; training is neglected.
• Violations & Harm: Pervasive, severe, or repeat violations of consumer protection laws, often resulting in significant financial harm or discriminatory impact. Management lacks the capacity or willingness to correct deficiencies, typically necessitating formal supervisory enforcement action.

Rating 5: Critically Deficient CMS (Total Breakdown)

• Oversight & Resources: Total collapse of board and management oversight. Wilful blindness, pervasive managerial incompetence, or active circumvention of consumer protection laws.
• Program Execution: Complete absence or utter failure of the Compliance Management System.
• Violations & Harm: Flagrant, continuous, and widespread violations across core consumer statutes causing catastrophic consumer harm. Formal enforcement, supervisory intervention or cease-and-desist orders may be used to protect consumers, subject to the applicable authority and process.

---

3. Responding to Supervisory Findings & Enforcement Actions

When regulatory examinations uncover operational weaknesses or violations of law, supervisory agencies utilize a graduated hierarchy of formal criticisms and enforcement actions.

Supervisory Criticisms: Recommendations, MRAs, and MRBAs

• Supervisory Recommendations: Informal, advisory suggestions communicated in supervisory correspondence to improve operational efficiencies or adopt industry best practices; do not require formal board resolutions.
• Matters Requiring Attention (MRAs): Formal supervisory findings documented in the ROE or official supervisory letter. MRAs represent serious deficiencies in risk management or internal controls addressed directly to executive management.
  • Response requirements: Submit the requested response and corrective action plan by the actual communication’s deadline. There is no universal thirty-to-sixty-day MRA clock.
  • Tracking: Report progress and provide validation evidence under the agency’s process. Closure can use document review or other methods; an on-site visit is not universally required.
• Matters Requiring Board Attention (MRBAs): An elevated category of formal supervisory finding reserved for severe compliance failures, enterprise governance breakdowns, repeat uncorrected MRAs, or practices threatening material safety and soundness or causing severe consumer harm.
  • Direct Board Accountability: Addressed directly to the Board of Directors. Board oversight should address the findings, resources, corrective plan and progress reporting. A board resolution or signed progress certification is required when the particular order or supervisory communication requires it; it is not automatic for every MRA.

Informal vs. Formal Enforcement Actions

When an institution's CMS is rated 3, 4, or 5, or when systemic violations are discovered, agencies escalate beyond MRAs to administrative enforcement actions:

Informal Enforcement Actions

• Legal Characteristics: Non-public, confidential supervisory agreements between the regulatory agency and the bank's board of directors.
• Common Tools: Memoranda of Understanding (MOUs), formal Board Resolutions, and Commitment Letters.
• Supervisory Application: Deployed when an institution exhibits moderate to severe compliance deficiencies (typically Rating 3) but supervisory examiners retain confidence that existing board leadership and executive management possess the integrity, competence, and commitment to remediate the weaknesses without public legal compulsion.

Formal Enforcement Actions

• Legal Characteristics: Public documents, published on agency websites and public registries, legally enforceable in federal district court under Section 8 of the Federal Deposit Insurance Act (12 U.S.C. § 1818).
• Common Tools: Consent Orders (COs), Cease-and-Desist (C&D) Orders, and Formal Written Agreements.
• Civil Money Penalties (CMPs): Federal agencies possess statutory authority to levy substantial financial penalties under 12 U.S.C. § 1818(i)(2) across three inflation-adjusted statutory tiers:
  • Tier 1: Apply Section 1818(i)(2)(A)’s enumerated violation grounds and the current agency inflation adjustment.
  • Tier 2: Apply the specified violations, reckless unsafe-or-unsound practices or fiduciary breaches together with the pattern, more-than-minimal-loss or benefit conditions in Section 1818(i)(2)(B).
  • Tier 3: Apply the knowing-conduct and substantial-loss-or-gain standards in Section 1818(i)(2)(C). The statutory maximum differs for individuals and institutions and is inflation-adjusted; an institution’s asset-based cap must be assessed under the actual rule.
• Individual Officer Liability under FIRREA: Under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA), enforcement remedies extend directly to Institution-Affiliated Parties (IAPs)—including directors, officers, compliance executives, and employees. Regulators can issue:
  • Personal Civil Money Penalties: Levied directly against individual bank officers, which should be paid out-of-pocket and cannot be reimbursed or indemnified by bank funds or Directors and Officers (D&O) insurance.
  • Industry Prohibition and Removal Orders: Barring the individual from participating in covered banking activities, subject to the order and any statutorily permitted agency consent.

FDIC CMS examination framework.

Supervisory findings and enforceable actions

An MRA or MRBA is a supervisory communication, not itself a cease-and-desist order. Agencies use different terminology and closure processes. Respond with validated facts, corrective actions and progress reports by the date in the actual communication; do not assume a universal thirty- or sixty-day response period or mandatory on-site closure testing. Orders and formal written agreements under the applicable authority impose enforceable obligations. Read the actual document before classifying its legal effect. Regulatory reports must be accurate and complete; preserve privileged or confidential information through authorized processes without withholding requested material on an invented blanket rule.

FDIC consumer compliance rating framework.