The OCC’s new “risk-based” supervision model for community banks is a notable shift—one that gives smaller institutions more breathing room, but also more responsibility. The regulator’s October announcement promises to “relieve these banks of regulatory burden and unproductive reporting requirements,” tailoring oversight to each institution’s unique risk profile. For community banks, experts say in a recent ProSight article, that makes now the time to reexamine risk management practices—and prepare to operate with more independence. Here are some takeaways:
Focus Where It Matters Most
Brendan Mulvey of Huron calls the OCC’s move “a less prescriptive, more principles-based approach to supervision,” part of a broader trend toward flexibility and “a re-grounding in core financial risk.” Rather than spreading resources thinly across every possible risk, banks should identify the areas of greatest concern and go deep. As Shaun Harms of Forvis Mazars put it, “This is an opportunity to look at your institution in the mirror and ask what you could be doing better.” Aligning internal focus with what examiners now prioritize could mean fewer regulatory findings—and stronger institutions.
Prepare for More Self-Supervision
With regulators stepping back, banks will need to step up. Mulvey cautioned that the shift implies “more than just having policies, programs, and a defined risk appetite.” CROs should assess whether they have “enough of a self-policing framework in place,” especially as audit and risk teams take on work once covered by regulators. The goal, Mulvey said, is to “navigate in the dark, without this [regulator] flashlight showing us where it is safe to operate.”
A Win-Win—If Banks Stay Proactive
Former FDIC regulator Bobby Bean of Mazars said the OCC’s intent is clear: banks that manage risk proactively will benefit from lighter oversight. “It reduces everyone’s burden if the bank takes a more integral approach to risk management as they go along instead of waiting for a [regulatory finding] on the back end,” he said. “The OCC is saying, ‘If you do it all along, we’re going to reward you and reward the system.’”
Build for Flexibility, Not the Moment
Mulvey added that today’s loosening could swing the other way in the future. The best defense, he said, is a risk framework built around a bank’s own appetite, not regulatory cycles. The OCC’s changes, he noted, have prompted clients “to circle back to this idea of why risk management matters in the first place.”
