OCC and FDIC Issue Reputational Risk Final Rule

On April 7, 2026, the OCC and FDIC jointly issued a final rule that removes “reputation risk” from their supervisory programs and codifies a prohibition on using it as a basis for supervisory criticism or adverse action against banks.

Key points:

• Elimination of “reputation risk” as a supervisory category

  • The rule codifies prior direction to staff that reputation risk should no longer be treated as a stand‑alone risk in examination frameworks.

  • The agencies state that concerns about an institution’s reputation should instead be addressed through traditional risk channels (credit, liquidity, market, operational, etc.).

• Definition of “reputation risk” (for purposes of the prohibition)

  • The rule defines reputation risk as any risk that actions (or inaction) by an institution could negatively affect public perception of the institution for reasons not clearly and directly related to the institution’s financial or operational condition.

  • By tying the definition to non‑financial/non‑operational concerns, the agencies preserve authority to act where public perception implicates safety and soundness or operational resilience.

• Prohibition on supervisory use of reputation risk

  • The OCC and FDIC may not “criticize, formally or informally, or take adverse action” against a supervised institution or its employees on the basis of reputation risk.

  • “Adverse action” is defined broadly to include negative exam language, MRAs, ratings downgrades (CAMELS, compliance, IT), conditions on approvals, higher‑than‑minimum capital requirements, and other decisions intended to pressure a bank to address perceived reputation risk.

• Restrictions on “debanking” based on political/ideological factors

  • The agencies are prohibited from requiring, instructing, or encouraging an institution to:

    • Close an account,

    • Refrain from offering an account, product, or service, or

    • Modify or terminate any product, service, or relationship
      on the basis of a person’s or entity’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely because they engage in politically disfavored but lawful business activities perceived to present reputation risk.

  • The same prohibition applies to pressure regarding third‑party relationships (e.g., vendors, processors) on those grounds.

• Link to Executive Order 14331 (“Guaranteeing Fair Banking for All Americans”)

  • The rule is framed as a direct response to concerns in EO 14331 that “reputation risk” had been used as a pretext to restrict access to banking services for lawful but politically disfavored customers and industries.

  • The preamble references prior controversies such as Operation Choke Point and alleged pressure on banks to exit firearms, digital assets, and other lawful but controversial sectors.

• Scope and applicability

  • Applies to all OCC‑supervised institutions and all FDIC‑supervised institutions.

  • The rule makes conforming edits to OCC and FDIC regulations (e.g., removing references to reputation risk from parts 1 and 30 of OCC regulations).

  • The final rule becomes effective 60 days after publication in the Federal Register.

• Relationship to Federal Reserve Board

  • The FRB previously removed “reputation risk” from its exam programs in June 2025 and, on February 23, 2026, issued a proposal to codify similar constraints, but it has not yet finalized a parallel rule.

• Practical implications for banks

  • Examiners should no longer cite “reputation risk” as such, or use it to justify MRAs, ratings, conditions, or other supervisory measures; concerns must be tied to concrete financial or operational risks or violations of law.

  • Banks retain discretion to apply their own risk‑based customer acceptance and exit policies, but the federal banking agencies may not pressure or direct those decisions based solely on customers’ political, ideological, or other protected characteristics or lawful but disfavored activities.