Skip to main content
FinCrime Institute
Category: Enforcement and Penalties

Matters Requiring Attention

Also known as: MRA, Matter Requiring Attention, MRAs
Simply put

A Matter Requiring Attention (MRA) is a written notice from bank examiners to a bank's management or board identifying a problem the bank is expected to fix. It is one of the main ways supervisors communicate criticisms and require changes in a bank's practices.

Formal definition

In the US bank supervisory context, an MRA is a written communication issued by examiners to a supervised institution's management or board requiring a change in practice, and it functions as a core mechanism by which examiners convey supervisory criticisms. Under recent US rulemaking, MRAs generally are issued for practices, acts, or failures to act that meet applicable standards relating to material harm, and examiners are expected to share with the bank the basis for identifying an unsafe or unsound practice or for issuing an MRA. The precise standards, thresholds, and procedures governing MRA issuance are set by the relevant US federal banking agencies (such as the OCC and FDIC) and should be confirmed against the applicable agency guidance and rules; terminology and practice may differ across agencies and jurisdictions.

Why it matters

Matters Requiring Attention sit at the core of how US bank supervision actually operates. Formal enforcement actions attract public attention, but the day-to-day supervisory relationship is largely conducted through examiner communications like MRAs, which convey criticisms and require banks to change specific practices. For a compliance function, an MRA touching on BSA/AML controls, such as deficiencies in transaction monitoring, customer due diligence, or suspicious activity reporting processes, signals that examiners expect remediation and will track the institution's response, making MRAs a practical driver of how AML programs evolve between examination cycles.

Because MRAs are the mechanism through which supervisory expectations are transmitted, questions about the standards and procedures governing their issuance have real consequences for banks and their compliance teams. Recent US rulemaking has sought to sharpen when MRAs are issued, with the FDIC indicating that MRAs generally will be issued for practices, acts, or failures to act that meet the rule's standards relating to material harm, and the OCC stating that examiners must share with a bank the basis for identifying an unsafe or unsound practice or issuing an MRA. Commentary from bodies such as the Bank Policy Institute and the Conference of State Bank Supervisors reflects an ongoing debate over whether common standards and practices for MRAs have been consistently applied.

For compliance and risk professionals, the significance is operational as well as legal: an outstanding MRA can shape resource allocation, board reporting, and remediation timelines, and unresolved MRAs may escalate toward more formal supervisory measures. It is important to note that an MRA is a supervisory communication requiring a change in practice; it is not itself a finding of criminal wrongdoing, and its precise legal weight, thresholds, and procedures should be confirmed against the applicable agency guidance and rules.

Who it's relevant to

BSA/AML compliance officers
Compliance officers are often the direct owners of remediation when an MRA touches on anti-money laundering controls such as customer due diligence, transaction monitoring, or suspicious activity reporting processes. They must translate an examiner's criticism into a corrective action plan, evidence the changes made, and coordinate reporting on progress. Understanding that MRAs generally address practices meeting standards relating to material harm helps compliance teams gauge severity and prioritize response, though the specific standards should be confirmed against the issuing agency's guidance.
Bank boards and senior management
Because MRAs may be directed to a bank's management or board, senior leaders bear responsibility for ensuring identified practices are corrected and for overseeing remediation timelines. Boards typically need to track outstanding MRAs, understand the basis examiners have shared for each, and recognize that unresolved matters can factor into the broader supervisory relationship and potential escalation.
Internal audit and risk management functions
Internal audit and risk teams frequently validate that remediation of an MRA is complete and sustainable, providing independent assurance to management and the board. They also help identify root causes so that a corrected practice does not recur, and they monitor the institution's overall inventory of supervisory findings as an indicator of control health.
Legal and regulatory affairs teams
Legal and regulatory affairs professionals manage the institution's relationship with the OCC, FDIC, or other applicable US federal banking agencies, and interpret how MRA standards and procedures apply given ongoing rulemaking and variation across agencies. They should note that an MRA is a supervisory communication requiring a change in practice, not a determination of criminal liability, and that its precise legal weight should be confirmed against applicable agency rules.

Inside MRA

Supervisory Finding
A specific issue or deficiency identified by a bank examiner during an examination that warrants the attention of a financial institution's board and management. In the US, MRAs are a supervisory communication tool used by federal banking regulators (such as the OCC, Federal Reserve, and FDIC) rather than a formal enforcement action.
Deficiency or Weakness
The substantive concern being flagged, which may relate to deviations from safe and sound practices, weaknesses in risk management, internal controls, or noncompliance with laws and regulations, including AML/BSA program elements. The characterization of severity generally distinguishes MRAs from more serious Matters Requiring Immediate Attention (MRIA), a term used by the Federal Reserve.
Corrective Action Expectation
An articulation of what the institution is expected to remediate, typically requiring management to develop and implement a corrective plan and to commit timeframes for resolution. An MRA generally establishes an expectation of remediation without imposing the legal obligations that accompany a formal enforcement action such as a consent order.
Accountability and Tracking
Assignment of responsibility to the board and senior management for addressing the finding, together with ongoing supervisory tracking of the institution's progress until the examiner determines the matter is resolved. Unresolved MRAs may escalate to more serious supervisory or enforcement responses.
Regulatory Context
MRAs are a construct of US bank supervision and its terminology; other jurisdictions may use different supervisory communication mechanisms and labels. The precise definition, escalation criteria, and usage should be confirmed against the guidance of the applicable US federal banking regulator.

Common questions

Answers to the questions practitioners most commonly ask about MRA.

Is a Matter Requiring Attention (MRA) the same as a formal enforcement action?
No. An MRA is a supervisory finding used by certain US federal banking regulators to communicate a concern or deficiency that management is expected to address; it is generally a form of supervisory feedback rather than a formal enforcement action such as a consent order or civil money penalty. Enforcement actions typically follow a separate legal process and may carry public disclosure and legally binding obligations. That said, unresolved MRAs may escalate to more serious supervisory or enforcement measures over time. The precise status, terminology, and consequences vary by supervisory agency, so the applicable regulator's guidance should be confirmed.
Does receiving an MRA mean the institution has broken the law or that money laundering has occurred?
Not necessarily. An MRA is a supervisory communication identifying a weakness, deficiency, or area needing improvement, often in an institution's controls, processes, or risk management, and does not by itself establish that a legal violation or any underlying financial crime has taken place. It should be understood as feedback on the adequacy of controls rather than as evidence of wrongdoing. Whether any conduct constitutes a legal violation is a separate determination made under the applicable legal framework.
Who within an institution should own the remediation of an MRA?
In many institutions, ownership is assigned to a specific accountable individual or function, often within senior management or the relevant business or compliance line, with oversight typically provided by the board or a designated committee. Clear accountability, documented remediation plans, and defined timelines are generally expected. Exact governance expectations depend on the supervising regulator and the institution's own governance framework, which should be confirmed against applicable supervisory guidance.
How should an institution track and evidence the closure of an MRA?
Institutions generally maintain documentation showing the identified deficiency, the agreed remediation actions, responsible owners, target dates, and evidence that corrective measures were implemented and validated. Independent validation, for example by internal audit or an independent review function, is often used to support closure. Supervisors typically expect to see that remediation is sustainable rather than a one-time fix, and closure is usually subject to the regulator's own assessment. Specific documentation and closure expectations should be confirmed with the relevant supervisor.
What is the risk of leaving an MRA unresolved past its expected timeframe?
Unresolved or repeat findings may be viewed by supervisors as an indicator of broader governance or risk-management weaknesses and can contribute to escalation to more serious supervisory findings or formal actions. Timeliness and the credibility of remediation efforts are generally weighed by regulators. The specific consequences depend on the supervising agency's practices and the facts of each case, and should be assessed against the applicable regulatory framework.
How can an institution reduce the likelihood of similar MRAs recurring?
Institutions commonly seek to address root causes rather than only the specific symptom identified, which may involve strengthening governance, control design, data quality, staffing, or oversight processes. Embedding lessons learned across comparable areas and monitoring for effectiveness on an ongoing basis are typical approaches. These are measures intended to mitigate and manage risk rather than guarantees against future findings, and their adequacy is ultimately assessed by the relevant supervisor.

Common misconceptions

An MRA is a formal enforcement action carrying legal penalties.
An MRA is generally a supervisory communication used to direct the attention of a bank's board and management to a deficiency; it typically does not, by itself, constitute a formal enforcement action such as a consent order or civil money penalty. Unresolved or escalated matters may, however, lead to formal enforcement responses.
An MRA and a Matter Requiring Immediate Attention (MRIA) are the same thing.
They are distinct in supervisory usage. An MRIA, a term used by the Federal Reserve, generally signals a more serious or urgent concern than an MRA. The precise distinctions and terminology vary by regulator and should be confirmed against the relevant agency's guidance.
The presence of an MRA related to AML/BSA proves the institution facilitated money laundering.
An MRA identifies a supervisory concern or deficiency, such as weaknesses in program design or controls; it is a compliance and risk-management finding, not a determination that money laundering occurred or that any criminal wrongdoing took place.

Best practices

Ensure the board and senior management are formally made aware of each MRA and that clear accountability is assigned for its remediation.
Develop a documented corrective action plan with committed timeframes and defined ownership for every finding, and track progress until the examiner confirms resolution.
Address the root cause of the identified deficiency rather than the surface symptom, so that remediation is sustainable and does not recur in future examinations.
Distinguish MRAs from more serious supervisory communications such as MRIAs and from formal enforcement actions, and calibrate the urgency and resourcing of the response accordingly.
Maintain evidence of remediation steps taken so that progress can be demonstrated to examiners during ongoing supervisory tracking.
Confirm the specific expectations, escalation criteria, and terminology against the guidance of the applicable US federal banking regulator, as usage can differ across agencies.