Weekly Real Estate News
Summary
Sen. Elizabeth Warren's October 23 letters ask the Fed, FDIC and OCC to rescind changes to supervisory findings, citing AI-enabled cyber threats. Original Fed operating principles and OCC/FDIC final rule establish the agencies' competing rationale and scope; no reversal has occurred.
Sen. Elizabeth Warren is pressing the Federal Reserve, the Federal Deposit Insurance Corp. and the Office of the Comptroller of the Currency to reverse changes to bank supervision, arguing that new thresholds for formal supervisory findings could make it harder to confront cybersecurity weaknesses before they cause financial harm.
The Massachusetts Democrat, the ranking member of the Senate Banking Committee, made the request in letters dated October 23. The letters are a request from a senator, not a regulatory order. Neither the Fed’s supervisory statement nor the OCC and FDIC’s final rule was rescinded by the correspondence.
At issue is how examiners decide when a bank’s conduct or internal weaknesses warrant a formal matter requiring attention, commonly called an MRA, or an enforcement action. Such findings can compel management attention and remediation. Warren argues that limiting their use could leave emerging operational risks inadequately addressed, particularly as artificial intelligence makes phishing and other cyberattacks easier to conduct.
| Action | Agency | What changed |
|---|---|---|
| September 24 operating principles | Federal Reserve | Focus formal supervisory findings on risks of significant harm; permit observations for lesser issues |
| Final supervisory rule | OCC and FDIC | Define unsafe or unsound practices and standards for formal matters requiring attention |
| October 23 letters | Sen. Elizabeth Warren | Request withdrawal of both changes; no binding agency action |
What the Fed actually changed
The Fed’s September 24 supervisory operating principles tell examiners to concentrate on vulnerabilities posing a significant probability of significant harm to a bank, other institutions, the deposit insurance fund or financial stability. The statement also permits less formal supervisory observations for shortcomings below the MRA threshold.
The Fed says its objective is earlier, more decisive action against the most serious risks. Its document draws on preliminary findings from an independent review of Silicon Valley Bank’s failure, arguing that supervisors previously recognized major interest-rate and liquidity exposures but did not act promptly enough. The agency says examiners should use judgment and avoid becoming consumed by documentation problems that do not materially threaten safety and soundness.
Warren reads the shift differently. In her letter to the Fed, she argues that cybersecurity and vendor-control failures may become dangerous before examiners can demonstrate an abnormal or significant probability of financial loss. The concern is prospective: the senator does not identify a cyberattack caused by the September policy.
The OCC and FDIC rule raises a parallel dispute
The OCC and FDIC have adopted a final rule defining unsafe or unsound practices and standards for MRAs. The agencies say the rule clarifies supervisory expectations and focuses scarce examination resources on material financial risks. It allows supervisory observations for lesser shortcomings and retains enforcement tools when conduct meets the applicable threshold.
The final rule’s own discussion of public comments acknowledges the disagreement. Supporters argued that broad, sometimes vague supervisory findings had diverted banks toward compliance paperwork and away from the risks most likely to damage their financial condition. Opponents warned that procedures, documentation and operational controls can be early indicators of serious problems, even before measurable losses occur.
In a separate letter to the OCC and FDIC, Warren urges the agencies to withdraw the rule. The regulators’ published explanation maintains that the revised approach does not eliminate oversight of nonfinancial risks when they present sufficiently serious threats.
The disagreement therefore concerns the trigger for formal intervention. It does not establish that cybersecurity requirements have been repealed, that banks may disregard security standards, or that every operational weakness will escape examination.
Why mortgage lenders and title companies should watch
The immediate legal scope is banking supervision. Nonbank mortgage originators, title agencies and settlement companies are not automatically subject to the same supervisory framework merely because they handle home loans. Many nevertheless depend on banks for warehouse credit, deposits, payment processing and other services, while banks rely on outside technology and servicing vendors.
Those relationships make vendor risk and incident response relevant beyond a bank’s own walls. A breach affecting payment instructions or borrower records can disrupt closings even where the institution holding the deposits is financially sound. But the senator’s letters do not establish that the new rules will cause such an event.
The mortgage and title industries have already been addressing related concerns. WRE reported this month on additional cybersecurity support for Mortgage Bankers Association members, while updated title-industry practices have emphasized vendor oversight.
Featured image: Declan Sun / Unsplash. Illustrative financial district building; not a bank named in the correspondence.
For regulated banks, the next questions are whether the agencies respond to Warren’s requests and how examiners apply the new standards in actual reviews. For mortgage businesses and their vendors, existing contractual security duties and applicable data-protection rules remain relevant regardless of how this dispute is resolved.
