On September 11, 2026, the OCC, FDIC, Federal Reserve, and NCUA proposed to replace the 2023 Interagency Guidance on Third-Party Relationships with a shorter, principles-based document.¹ Two companion releases complete the package: a final interagency statement on the supervision of the use of core service providers by community banks, effective on issuance,² and a proposed Federal Reserve guide for traditional community banks (the Community Bank Guide).³ Comments are due November 16, 2026.⁴

Key Takeaway

On September 2, 2026, the Federal Reserve, FDIC, NCUA, OCC, and FinCEN confirmed that a bank may tell a customer that an account restriction or closure, or a rejected deposit, may be related to suspected fraud or other suspicious activity, so long as the communication does not reveal that a SAR was or will be filed.

What Happened

On September 2, 2026, the Federal Reserve, the FDIC, the NCUA, the OCC, and FinCEN issued a joint statement on the application of SAR confidentiality to banks’ communications with their customers (Joint Statement). The Bank Secrecy Act prohibits a bank from disclosing a suspicious activity report or any information that would reveal that one exists, and in particular from notifying any person involved in a transaction that the transaction has been reported. In practice, those prohibitions have led many banks to say nothing at all when a payment is held, a deposit is rejected, or an account is closed and the customer asks why. The Joint Statement confirms that the SAR confidentiality prohibitions are narrower than that practice: the regulators confirmed that a bank may communicate with a customer about potentially fraudulent transactions, other suspicious activity, or account closures, provided the communication does not reveal the existence of a SAR. The Joint Statement responds to comments on the agencies’ payments fraud initiative and invokes Executive Order 14331 on fair banking.

On August 27, 2026, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) jointly issued a final rule that, for the first time, gives the term “unsafe or unsound practice” a binding regulatory definition.¹ With it came a uniform standard for Matters Requiring Attention (MRAs) and revised OCC examination manuals.² The Federal Reserve did not join the rulemaking, but has adopted comparable standards through guidance. What that means for holding companies and state-chartered institutions is addressed below.³ The regulation takes effect November 2, 2026, and the revised OCC examination manuals took effect upon their issuance on August 27.

For boards, general counsel, and risk and compliance leaders, the headlines suggest clarity and potential relief. However, while the rule changes what federal bank examiners may require to bring enforcement, it does not change the standards of prudent risk management a bank is held to, the discretion examiners keep over ratings, or the exposure that sits with state supervisors, the holding company, and individual officers and directors. This client alert explains what changed and how to consider responding.

Cristina Diaz was recently featured in an in-depth Corporate Counsel Q&A that covers her return to private practice after more than a decade in-house at UBS.

In the interview, Cristina discusses what her years in-house taught her about turning regulatory requirements into practical business solutions, why she returned to private practice, and how she approaches…