Warren Urges Fed, OCC, FDIC to Restore Bank Examiner Powers

Sen. Elizabeth Warren asked the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) on October 23 to reverse supervisory changes she says weaken bank examiner powers as AI-enabled cyberattacks grow.

Warren, the top Democrat on the Senate Banking Committee, sent separate letters to Fed Vice Chair for Supervision Michelle Bowman and, jointly, to Comptroller of the Currency Jonathan Gould and FDIC Chair Travis Hill. The letters are requests from a senator, not orders. None of the policies has been rescinded.

What Warren is asking for on bank examiner powers

She wants the Fed to rescind its September 2026 update to its Statement of Supervisory Operating Principles. She wants the OCC and FDIC to reconsider and reverse their joint final rule on “unsafe or unsound practices” and matters requiring attention (MRAs).

An MRA is a written supervisory finding that tells a bank’s board and management to fix a weakness. It sits below a formal enforcement action but usually carries deadlines and follow-up from examiners.

Warren argues that the changes limit when examiners can issue such warnings and pursue enforcement. Her central claim is that regulators will be unable to intervene early on cybersecurity weaknesses that have not yet caused financial harm.

The letters set out no deadline for a reply, as far as the published materials show. Warren wrote that if the agencies decline to act, they “will share responsibility for the potential harm wrought by future cyberattacks on the banking system.”

The policies that narrow examiner action

The Fed first released its Statement of Supervisory Operating Principles on November 18, 2025. The document directs examiners to focus on material financial risks, cut duplication between exams and streamline how banks fix cited issues. Bowman said at the time that the approach “is not about narrowing our focus” but “about sharpening it.”

The Fed has since updated and replaced the statement. Warren says the September version limits enforcement for unsafe or unsound practices to cases that create “an abnormal probability of abnormal harm” to a banking organization’s financial condition. In her view, that bars action when harm is only possible, when it is material rather than significant, or when its severity is uncertain.

The OCC and FDIC announced their joint rule on August 27, and it was published in the Federal Register on September 1 as document 2026-17823. The OCC described its implementation in Bulletin 2026-40. The rule defines an unsafe or unsound practice under section 8 of the Federal Deposit Insurance Act and changes how MRAs and other supervisory communications are issued. It takes effect November 2, 2026.

Warren reads the rule as allowing examiners to act on a cyber vulnerability only if a cyber incident is likely to harm an institution’s financial condition materially. A “possible” or “plausible” incident would not meet that test.

Why the cyber risk argument matters to banks

Warren’s letters cite a June survey by the Texas Bankers Association. It found that 76% of surveyed banks saw more cyberattacks over the past year, and 84% were raising cybersecurity spending to address AI-related risks.

She argues that the narrower tests reduce the pressure on banks themselves. In her words, the changes weaken bank examiner powers in a way that “undermines incentives for banks to maintain rigorous policies, procedures, and internal controls related to cybersecurity.”

“undermines incentives for banks to maintain rigorous policies, procedures, and internal controls related to cybersecurity.” Elizabeth Warren, Ranking Member, Senate Banking Committee

On the Fed, she wrote that it “should be strengthening bank examiners’ supervisory tools” against AI-enabled attacks rather than “gutting them.”

The dispute is about the trigger for supervisory action. Under a lower threshold, an examiner can cite a control gap before it produces a loss. Under a higher one, the gap may go uncited until harm looks likely.

What the changes mean for compliance and risk teams

For compliance and risk teams, the practical question is how bank examiner powers will apply to cyber and AI findings once the new tests apply. Fewer or narrower MRAs would mean fewer formal findings for boards to track. They would not reduce the underlying obligations, since banks remain responsible for their own information security programs and for the vendors that support them.

Boards still receive the reporting that supervisors, auditors and internal teams produce. The cybersecurity priorities for boardroom executives do not depend on whether an examiner issues a finding. Programs built around cybersecurity inside corporate governance rest on the bank’s own risk appetite as well as on supervisory pressure.

AI adds a second front. Banks are deploying automation in AML, fraud detection and risk monitoring, as described in RegTech Post’s coverage of AI agents in banks. Attackers are using similar tools. Warren’s argument is that supervisors need low thresholds to keep pace with both.

The agencies describe their changes differently. Their stated aim is to focus examiners on material financial risks and to make supervisory and enforcement activity more consistent and transparent. Bowman’s November 2025 release says the Fed wants timely, proportionate action on significant risks.

Agency responses and what comes next

A Fed spokesperson confirmed receipt of Warren’s letter and did not comment further. The OCC and FDIC had not responded as of Tuesday. RegTech Post has asked all three agencies for comment and will update this article with any reply.

Warren’s letters carry no legal force over the agencies. Congress has other routes, including oversight hearings and questions to agency heads, though none has been scheduled in connection with these letters.

The next fixed date is November 2, 2026, when the OCC and FDIC rule takes effect. The OCC has also proposed separate guidance on how violations of law factor into MRA decisions. Comments on that proposal closed on October 1, 2026.