Matters Requiring Attention: A Bank Compliance Guide
Reglith Editorial Team · October 2026
A matter requiring attention is a supervisory finding that a bank or credit union has a practice, condition or control weakness a regulator views as unsafe or unsound, or that could become a violation of law if left uncorrected. Regulators use matters requiring attention to prompt corrective action before issues escalate. The findings are not public records, but they sit in the confidential supervisory record and shape the next examination.
What is a matter requiring attention in banking?
A Matter Requiring Attention (MRA) is a supervisory tool used by federal and state regulators to document unsafe or unsound practices, violations of law, or weaknesses in governance, risk management or internal controls. The term generally appears in examination reports and supervisory letters, and an MRA communicates that the agency expects the board and management to correct the issue within a defined timeframe.
An MRA is not a formal enforcement action. It is an informal supervisory communication that stops short of a Cease and Desist Order or a Civil Money Penalty. MRAs are not published and are not generally released the way formal enforcement actions are. They form part of the confidential Supervisory Record, shared with the institution's board and management but not with the public.
The primary purpose is corrective: to prompt action before the issue escalates to a violation of law or a formal enforcement referral. A matter requiring attention often addresses governance, risk management or compliance culture issues that may not yet have produced a consumer harm but create the conditions for one. For mortgage compliance teams, that means an MRA can target the Compliance Management System (CMS) itself, not just a single transaction or disclosure error. The distinction matters because a CMS-related MRA may require changes to policies, training, monitoring and audit rather than a one-time remediation.
How do the OCC, FDIC, and NCUA define and use MRAs?
The Office of the Comptroller of the Currency (OCC) uses MRAs in its supervision of national banks and federal savings associations. The OCC's framework identifies unsafe or unsound practices and communicates them through the examination report, distinguishing between MRAs and MRIAs, with MRIAs reserved for issues that pose immediate risk and require a faster response.
The Federal Deposit Insurance Corporation (FDIC) uses a similar approach for state nonmember banks and savings associations. The FDIC communicates supervisory findings through the examination report and generally expects a written response. Terminology is consistent across agencies, but the threshold for what counts as a "significant" finding can vary; an issue one agency documents as an MRA another may address in the examination report narrative without a formal MRA designation.
The National Credit Union Administration (NCUA) uses MRAs and MRIAs for credit unions. The NCUA's supervisory framework carries the same distinction: MRAs for issues that require correction, and MRIAs for issues that require immediate attention. The examination process documents findings and tracks corrective action.
| Agency | Applies to | Distinction |
|---|---|---|
| OCC | National banks, federal savings associations | MRA vs. MRIA; informal supervisory tool |
| FDIC | State nonmember banks, savings associations | MRA; written response generally expected |
| NCUA | Credit unions | MRA vs. MRIA; corrective action tracked |
What is the $3,000 rule for banks?
The "$3,000 rule" refers to a historical OCC threshold for reporting individual employee misconduct or loss events. Under this framework, institutions were expected to report certain losses or misconduct, generally involving employee dishonesty, when the amount met or exceeded a threshold. The dollar figure was a reporting trigger for specific loss events, not a general MRA threshold.
The distinction matters. Loss event reporting is a separate requirement from supervisory findings. An MRA is a finding about a practice, condition or control weakness; a loss event report is a notification about a specific incident. The two may be related, but they are not the same. An MRA may reference loss event reporting failures as part of a broader finding, but the MRA itself is not triggered by a dollar amount.
Regulations and guidance may have updated or recast the historical dollar figure over time. Institutions should consult current OCC guidance and the specific reporting requirements that apply to them; whether and how the threshold applies turns on the agency, the charter type and the date. The figure is not a general MRA threshold and should not be applied as a rule for MRA determination.
How do institutions respond to an MRA?
The customary response to an MRA is a written response or Corrective Action Plan submitted to the regulator. The response should identify the root cause of the issue, not just the symptoms. A Root Cause Analysis examines why the issue occurred, whether it is isolated or systemic, and what changes will prevent recurrence.
The timeline for an initial response is often in the range of 30 to 60 days, though this varies by agency and by the specific finding, and the examination report or supervisory letter typically states the expected date. A response generally includes a description of the corrective action, the responsible parties, the timeline for completion, and the method for validating that the issue is resolved. Examiners evaluate the response to determine whether the issue is resolved or requires escalation.
A strong response addresses the underlying control weakness. If an MRA relates to disclosure timing under Regulation Z, 12 CFR 1026, for example, the response would typically address the process that allowed the timing error, not just the specific loan file. That may include changes to the loan origination system, additional training, or enhanced monitoring. The response should be documented and tracked through completion. For a fuller treatment of the CMS side, see Building a Mortgage Compliance Management System (CMS): Policies, Monitoring, Audits, and Regulatory Change.
What is the difference between an MRA and an enforcement action?
An MRA is an informal supervisory tool. It is not a formal enforcement action such as a Cease and Desist Order. MRAs do not carry Civil Money Penalties or public disclosure. They are communicated through the examination report and supervisory letter and remain part of the confidential Supervisory Record.
Formal enforcement actions, by contrast, are generally public documents. They may include Cease and Desist Orders, Civil Money Penalties and other formal actions. The escalation path from an MRA can lead to an MRIA or to a formal enforcement action if the issue is not resolved. Unresolved MRAs can also affect the institution's supervisory rating and its ability to obtain approvals for new activities.
MRAs are often used for governance, risk management or compliance culture issues. These are findings that may not yet have produced a consumer harm but create the conditions for one. An MRA may address a weak CMS, inadequate board oversight, or a compliance culture that does not prioritize regulatory requirements. These findings are serious because they suggest the institution's controls may not be sufficient to prevent future violations.
How does an MRA impact a bank's compliance management system?
An MRA related to compliance generally needs to be integrated into the Compliance Management System (CMS). The CMS should include policies, monitoring, training and audit, and an MRA response should be tracked through the CMS with clear ownership and reporting to the board or a board committee. Many institutions assign a named owner per finding, log the commitment date for each corrective step, and report status to the board or a board committee on a set cadence until closure is validated.
Regulatory Change Management plays a role in tracking MRA-related policy updates. When an MRA requires a policy change, the change should be documented, communicated and incorporated into training. The CMS should also include enhanced monitoring or testing in the specific business lines affected by the MRA. In mortgage operations, that can reach across origination, servicing and disclosure processes, so teams often map the finding to each affected control rather than to a single policy.
Documenting the closure of an MRA is important. The institution should maintain evidence that the corrective action was completed and that the issue is resolved, as this documentation demonstrates effective oversight and can be used in future examinations. Servicing-side findings in particular tend to require systems and reporting changes, as covered in Fannie Mae’s Event-Based Reporting: Adapting Servicing Systems for Real-Time Compliance, while testing of those controls is covered in How to Conduct a Compliance Audit for Mortgage Servicing: Best Practices and Common Pitfalls. HMDA-related findings are common enough that HMDA Getting It Right: A Guide for Compliance Teams is a useful companion, and a broader view of how compliance failures and regulatory expectations interact appears in What Mortgage Lenders Must Understand About Compliance Failures and Regulatory Expectations.
Frequently asked questions
What is a matter requiring attention?
A matter requiring attention is a supervisory finding that an institution has a practice, condition or control weakness a regulator considers unsafe or unsound, or that could become a violation of law. It is an informal supervisory tool, distinct from a formal enforcement action, and is part of the confidential supervisory record.
What does MRA mean in banking?
MRA stands for Matter Requiring Attention. It is a supervisory communication used by the OCC, FDIC, NCUA and state regulators to document findings and prompt corrective action. An MRA is not a public record and does not carry a civil money penalty, but it generally calls for a written response and corrective action.
What is the $3000 rule for banks?
The $3,000 rule refers to a historical OCC threshold for reporting individual employee misconduct or loss events. It is a reporting trigger for specific loss events, not a general MRA threshold. Regulations and guidance may have updated or recast the figure, so institutions should refer to current guidance.
What does "OCC MRA" mean?
An OCC MRA is a Matter Requiring Attention issued by the Office of the Comptroller of the Currency. It documents an unsafe or unsound practice or a control weakness at a national bank or federal savings association. The OCC distinguishes MRAs from MRIAs, which require immediate attention.
Are Matters Requiring Attention public?
Generally no. MRAs are not public records. They are part of the confidential supervisory record and are shared with the institution's board and management but not with the public. Formal enforcement actions, by contrast, are generally public documents.
How long does a bank have to respond to an MRA?
The timeline for an initial response is often in the range of 30 to 60 days, though this varies by agency and by the specific finding. A response generally includes a corrective action plan with root cause analysis, responsible parties and a timeline for completion. Examiners evaluate the response to determine if the issue is resolved.