The Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation have finalized a rule that defines "unsafe or unsound practices" in bank supervision, requiring regulators to tie enforcement actions to actual violations of law or material financial risk rather than subjective concerns.
The rule eliminates a decades-long practice in which bank examiners could cite vague reputational or procedural concerns to pressure institutions over lawful customers. Under the new standard, supervisors must document a concrete basis, either a violation of statute or regulation, or demonstrable harm to a bank's financial condition, before designating conduct as unsafe or unsound. The definition has remained undefined in law until now, leaving examiners broad discretion to act on judgment calls.
The term appears in the Bank Holding Company Act and the Federal Deposit Insurance Act as a trigger for regulatory intervention but was never formally defined in statute or binding rule. Regulators relied on guidance documents and enforcement precedent to shape what qualified. Banks say the vagueness enabled supervisors to discourage them from serving entire customer categories, including cryptocurrency firms, without explicit legal justification. The crypto industry has called this pattern Operation Choke Point 2.0, after a 2013-2015 Department of Justice and banking regulator initiative that pressured banks to exit relationships with payday lenders and other high-risk customers.
The OCC and FDIC issued a proposal in May 2025 and received public comment through July. The agencies said in their final rule announcement that the definition would apply to supervisory guidance, examination procedures, and enforcement decisions across both agencies' supervised institutions.
Crypto industry groups and bank trade associations backed the rule during the comment period. Two Republican senators, including one who has made banking access for crypto firms a priority, submitted letters supporting the change. The agencies did not identify specific customer categories in their framing but acknowledged that the rule's requirement for documented risk would constrain supervisory discretion in practice.
The rule takes effect 60 days after Federal Register publication, placing it in operation by late December 2025. It does not prevent regulators from denying or terminating a bank's charter on safety grounds, only from using the unsafe or unsound practices standard as a tool for pressuring customer relationships absent documented violation or harm.
Regulators have used the standard to force banks out of cannabis lending, check cashing, cryptocurrency, and money transmission relationships over the past decade. The new rule does not retroactively affect prior enforcement actions but will constrain future use of the same tool. Whether examiners can achieve similar pressure through other supervisory mechanisms, such as heightened capital or liquidity requirements, remains an open question in bank compliance circles.
The number of banks serving cryptocurrency firms has grown from roughly 45 in 2021 to over 200 as of mid-2025, according to industry trackers, though most crypto custody and trading happens outside the banking system. If the rule operates as written, banks exploring crypto customer relationships will face clearer supervisory thresholds rather than exam conversations based on reputation alone.
The document to watch is whether the OCC and FDIC issue new examination guidance or training materials clarifying how examiners should apply the material financial risk standard to emerging customer categories, or if they resist such clarification and continue to use informal pressure.
