Office of the Comptroller of the Currency (OCC)

The Office of the Comptroller of the Currency (OCC) is the independent bureau of the U.S. Department of the Treasury that charters, regulates, and supervises all national banks, federal savings associations, and federal branches and agencies of foreign banks. It was created by the National Currency Act of 1863, and its mission is to ensure those institutions operate safely and soundly, provide fair access to financial services, treat customers fairly, and also comply with all applicable laws.

The OCC as the primary regulator for Federally Chartered Banks

The OCC supervises the federal banking system, not the whole U.S. financial sector. Its scope of authority covers:

• National banks
• Federal savings associations
• Federal branches and agencies of foreign banks

The Comptroller of the Currency is the one who heads the agency; the budget comes primarily from assessments and fees paid by supervised banks rather than congressional appropriations, and more than 2,500 OCC examiners carry out its bank examinations.

State-chartered banks sit outside the OCC and answer to their state regulator and either the Federal Reserve or the FDIC, so check the charter before assuming OCC rules apply to a partner bank.

OCC Compliance Requirements for Supervised Banks

Every OCC-supervised bank must meet safety and soundness standards and run a BSA/AML programme, and covered institutions must also carry a formal risk governance layer on top.

Third-Party and Vendor Risk Management when Outsourcing KYC, screening or monitoring

Under the Integration Guidance on Third-Party Relationships: Risk Management, a bank’s use of third parties does not diminish its responsibility to operate safely and in compliance with applicable law. A vendor can run identity verification, transaction monitoring, and sanctions screening, but the 12 CFR 21.21 programme, and any examination finding against it, is to stay with the bank. The guidance expects some oversight across the whole relationship lifecycle, this is scaled to how critical the outsourced activity is:

• Planning: Assessment of the risk of outsourcing the activity before selecting the provider
• Due Diligence and selection: Testing the provider’s legal and regulatory compliance, information security, and reliance on subcontractors. 
• Contract Negotiation: Set performance standards, audit rights, and exit terms in writing 
• Ongoing Monitoring: Tracking of performance and compliance for the life of the relationship. 
• Termination: Plan how the activity moves back in-house to the other provider. 

Customer Identification Program (CIP) requirements under 31 CFR 1020.220 

The CIP must also screen customers against government terrorist lists and give notice that identity information is being requested. 

OCC AML Compliance Expectations

The OCC runs an examination against the Bank Secrecy Act using the FFIEC BSA/AML Examination Manual. Under 12 CFR 21.21, the programme must be in writing, approved by the board, and at minimum include:

1. Provide a system of internal controls to assure ongoing compliance
2. Provide independent testing, by bank staff or an outside party
3. Designate an individual responsible for day-to-day compliance
4. Provide training for appropriate personnel
5. Implement a CIP, including beneficial ownership checks

Not to mention, FinCEN rules separately require risk based ongoing customer due diligence. Banks are also required to have appropriate controls to screen against Office of Foreign Assets Control (OFAC) sanctions lists and file SARs within 30 calendar days of initial detection. If no suspect was identified, an additional 30 days is allowed to identify such suspect, keeping each SAR and its supporting records for five years after filing.

Examinations often found that the program is complete on paper, but its different functions & controls lack a coherent view of customer risk. For example, customers’ onboarding documents record a subsequent change, but monitoring keeps running on old risk profiles. In this example, the bank should have updated the risk profile and adjusted the monitoring accordingly. Banks with up to $30 billion in assets have been examined under the Community Bank Minimum BSA/AML Examination Procedures since February 1, 2026.

OCC Risk Management Standards

The OCC assesses banks against certain defined risk categories, which are credit, interest rate, liquidity, price, operational, compliance, and strategic risk. For covered banks, 12 CFR 30, Appendix D requires:

• A written risk governance framework approved by the board
• Three lines of defence: front line units, independent risk management, and internal audit
• A risk appetite statement with qualitative and quantitative limits
• Board oversight with independent directors and annual self-assessments

In December 2025, the OCC proposed raising the covered-bank threshold from $50 billion to $700 billion. The $50 billion threshold remains in the rule text at the time of writing.

OCC Bank Enforcement Actions

The OCC can act against a bank or an institution-affiliated party (IAP) if there are any violations of laws, unsafe or unsound practices, or any sort of breach of fiduciary duty. Formal actions are published through the Enforcement Actions Search Tool, and the main enforcement action types are:

Before any of these, the OCC can take informal action also like a memorandum of understanding (MOU), it is a bilateral document drafted by the OCC and signed by the board; neither is it legally binding nor is it published, but a board that fails to honor it hands the OCC some strong evidence for a formal action. 

Concerns usually surface first as Matters Requiring Attention (MRAs) in an examination report. MRAs are not enforcement actions like a cease-and-desist order, and can be resolved by applying required corrections. On August 27, 2026, the OCC revised its enforcement policy and published its MRA policy for the first time, directing examiners to prioritise material financial risks and substantive violations over documentation concerns.

The new policy directs examiners to prioritize substantial violations and material financial risks over minor documentation concerns. OCC generally gives banks a chance to remediate deficiencies before escalating and taking enforcement action, however, it remains OCC’s discretion to take any legally supportable action if the situation requires an enforcement action.