Compliance Guide · 2026 · 03 · 9 min read

How to Write an OCC MRA Response That Actually Closes

Every year, thousands of community and regional banks receive Matters Requiring Attention (MRAs) from the OCC, Federal Reserve, or FDIC following safety and soundness or compliance examinations. Many banks treat the response as a formality — a letter to be filed and forgotten. That is a costly mistake.

An MRA that fails to fully address the examiner's concern doesn't just linger on your record. It escalates. It can become a Matter Requiring Immediate Attention (MRIA). It invites follow-up examination. In extreme cases, unresolved supervisory concerns feed into formal enforcement actions, consent orders, or civil money penalties.

What is an MRA and why do examiners issue them?

An MRA is a written finding from a federal banking regulator identifying a deficiency in your bank's operations, policies, procedures, or controls that requires corrective action. MRAs are not violations of law; they are supervisory concerns. But they carry significant weight: they are tracked at the board level, they persist across examination cycles until validated as closed, and a pattern of unresolved MRAs is one of the strongest predictors of a downgraded management rating.

The four components of a response that closes

1. Acknowledgment without argument

Start by acknowledging the finding precisely as the examiner framed it. Do not argue with the finding, minimize it, or offer explanations that read as excuses. Even if you believe the characterization is partly incorrect, save that conversation for the exit meeting — not the written response.

2. Root cause analysis

Examiners want to know that you understand why the deficiency occurred — not just that you patched the symptom. A shallow root cause ("we overlooked this provision") is far less convincing than a structural one ("our policy review process did not include a systematic comparison against current Reg E requirements, leaving a gap in our annual update cycle"). Root causes worth investigating include stale policy templates, review cycles that lag regulatory change, unclear ownership between compliance and the business line, and reliance on a departed employee's institutional knowledge.

3. Corrective actions with owners and dates

Each corrective action needs a named accountable owner (a title, not a committee), a completion date the bank can actually meet, and a description specific enough that an examiner can later test whether it happened. "Enhance training" closes nothing; "Compliance will deliver Reg E error-resolution training to all deposit operations staff by June 30, with attendance logged and a knowledge check scored" can be validated.

4. Validation and sustainability

The strongest responses describe how the bank will verify the fix worked and how it will stay fixed: an independent review after implementation, a recurring control (for example, an annual policy-to-regulation mapping), and board or committee reporting until closure. Examiners close MRAs when they can see the deficiency cannot quietly recur.

The errors that keep MRAs open

The same failure patterns appear across public enforcement history: promising completion dates that slip without notice to the regulator; assigning ownership to a committee no individual answers for; fixing the cited document while leaving the process that produced it unchanged; and declaring an item complete before evidence of effectiveness exists. Each of these converts a routine MRA into a credibility problem — and credibility, once spent, makes every subsequent examination harder.

Timeline discipline

Respond within the window the examiner sets, typically 30 to 60 days. If a corrective action will take longer than the response window, say so explicitly and give the interim milestones. Regulators accept realistic multi-quarter remediation plans; what they do not accept is silence or serial date changes.