How to Respond to an MRIA, and Why It's Different from an MRA

An MRIA (Matter Requiring Immediate Attention) is not a more strongly worded MRA. It signals that examiners have identified a deficiency severe enough to threaten the institution's safety, soundness, or compliance posture right now, and that the response window is compressed accordingly. Confusing the two, or applying the same remediation timeline and rigor to both, is one of the fastest ways to escalate a supervisory relationship from cooperative to adversarial.

The distinction between MRIA and MRA drives everything downstream: how fast you respond, who gets notified, what interim controls you deploy, and how much tolerance the FDIC has for timeline extensions. Getting this wrong isn't a paperwork problem, it's a path to formal enforcement.

Key Takeaways:

• MRIAs require corrective action within 30-60 days; MRAs typically allow 90-180 days
• MRIAs demand immediate board notification, at the next board meeting, not the next quarterly report
• An interim control must be in place immediately for MRIAs; the permanent fix can follow on a longer timeline
• Repeat MRIAs are among the strongest predictors of formal enforcement action

Defining MRA and MRIA: The Severity Spectrum

The FDIC uses a two-tier finding classification for supervisory concerns that require corrective action. Understanding where each sits on the severity spectrum determines your entire response approach.

Matter Requiring Attention (MRA)

An MRA identifies a deficiency that, if left unaddressed, could deteriorate into a more serious problem. It represents a practice, policy gap, or control weakness that needs corrective action but doesn't pose an imminent threat to the institution.

MRAs cover a wide range of issues:

• Policy gaps that create compliance risk but haven't yet resulted in violations
• Process weaknesses that could lead to errors or regulatory breaches
• Control deficiencies identified through examiner testing
• Management practices that don't meet supervisory expectations

The response timeline for MRAs is typically 90-180 days, depending on complexity. Examiners expect a written corrective action plan, but there's generally more flexibility in phasing the remediation.

Matter Requiring Immediate Attention (MRIA)

An MRIA signals that examiners have found a deficiency that poses an immediate risk to the institution's safety, soundness, or compliance with law. The word "immediate" is operative, it means the issue cannot wait for a normal remediation cycle.

The FDIC's Supervisory Insights publications describe MRIAs as findings that involve:

• Active violations of law or regulation causing consumer harm
• Deficiencies that could result in material loss
• Safety and soundness concerns requiring urgent correction
• BSA/AML program deficiencies that impair suspicious activity detection or reporting (31 CFR § 1020.210)

The response timeline for MRIAs is 30-60 days, and interim controls must be deployed immediately, often within days of the exit conference.

Side-by-Side Comparison

How to Respond to an MRIA

The MRIA response process mirrors the MRA process but operates on a compressed timeline with heightened documentation requirements. Every day counts.

Days 1-3: Immediate Triage and Board Notification

Upon receiving an MRIA, whether verbally at the exit conference or in the written ROE, take three immediate steps:

1. Notify the board chair and compliance committee chair within 24 hours. Don't wait for the next scheduled meeting. If necessary, call a special session. Document the notification in writing.
2. Assign a senior owner, not a junior analyst. MRIAs require someone with authority to allocate resources, make process changes, and communicate directly with the FDIC.
3. Identify the interim control, what can you put in place today to mitigate the risk while the permanent fix is developed? For a BSA monitoring deficiency, that might be manual daily review of high-risk transactions. For a disclosure timing issue, it might be a hold on the affected product until disclosures are corrected.

Days 3-10: Root Cause and Corrective Action Plan

The corrective action plan for an MRIA must be more detailed and more aggressive than an MRA response:

• Interim control documentation: What was deployed, when, by whom, and how it mitigates the identified risk
• Root cause analysis: Completed within the first week, not the first month
• Permanent corrective actions: Specific, measurable actions with 30-60 day deadlines
• Escalation protocol: What happens if milestones are missed
• Progress reporting cadence: Weekly internal reporting to the compliance committee; monthly to the full board

Days 10-30: Execution with Evidence

Execute the corrective action plan and capture evidence at every step. For MRIAs, the FDIC may request interim progress reports before the next examination. Be prepared to provide:

• Status of interim controls, including any exceptions
• Evidence of completed corrective actions
• Updated timeline for remaining actions with justification for any changes
• Board meeting minutes showing active oversight

The FDIC's examination manual notes that examiners may conduct targeted follow-up reviews for MRIAs before the next full-scope examination. This means your remediation evidence needs to be examination-ready within 60 days, not at the next annual exam.

Escalation Consequences: What Happens When MRAs and MRIAs Go Unresolved

The consequences of unresolved findings differ significantly by severity tier.

Unresolved MRA Escalation Path

Exam 1: MRA issued → Exam 2: Repeat MRA (or escalated to MRIA) → Exam 3: MRIA or formal enforcement consideration

An MRA that appears in two consecutive examinations becomes a repeat finding. The FDIC treats repeat findings as evidence that the board and management either lack the willingness or the capability to correct deficiencies. Under the FDIC's Statement of Policy on Enforcement Actions, the effectiveness of prior supervisory actions is a factor in determining whether to pursue formal enforcement.

Unresolved MRIA Escalation Path

Exam 1: MRIA issued → Follow-up review: Inadequate progress → Formal enforcement action

MRIAs have a much shorter escalation runway. An MRIA that isn't adequately addressed may lead directly to a consent order or cease-and-desist order under 12 U.S.C. § 1818(b). The FDIC does not need to wait for the next full-scope examination to take enforcement action on an unresolved MRIA.

The FDIC's enforcement statistics show that institutions receiving MRIAs related to BSA/AML deficiencies face the highest rate of escalation to formal actions. FinCEN coordination adds another layer, BSA-related MRIAs may trigger parallel FinCEN review and potential civil money penalties under 31 U.S.C. § 5321.

Board and Management Responsibilities

For MRAs

• Board informed at next scheduled compliance or risk committee report
• Board approves corrective action plan
• Quarterly progress reports in board minutes
• Board questions and directives documented

For MRIAs

• Board notified within 24-48 hours of MRIA receipt
• Special board session if next meeting is more than 7 days away
• Board approves corrective action plan and interim controls
• Monthly (or more frequent) progress reports in board minutes
• Board actively directs resource allocation for remediation
• Individual board members may need to attest to understanding of the issue and oversight commitment

The distinction matters because examiners apply a higher standard of board engagement for MRIAs. Board minutes that show passive receipt of an MRIA status report, without questions, directives, or evidence of active management, can themselves become a finding related to board oversight under 12 CFR Part 337.

Common Mistakes in MRIA Response

Treating it like an MRA with a shorter deadline. The response structure is fundamentally different. An MRIA requires immediate interim controls, compressed root cause analysis, and a level of board engagement that goes beyond standard reporting.

Delaying interim controls until the permanent fix is ready. If you identified a BSA monitoring gap, the FDIC expects that gap to be mitigated now, even if the permanent system enhancement takes 90 days. "We'll fix everything at once" is not acceptable for MRIAs.

Under-resourcing the response. MRIAs often require pulling staff from other priorities, engaging external consultants, or accelerating vendor timelines. Institutions that treat MRIA remediation as a normal-course activity frequently miss deadlines.

Failing to communicate proactively with the FDIC. If a milestone will be missed, notify your examiner-in-charge before the deadline. Examiners tolerate timeline adjustments when they're communicated proactively with justification and interim measures. They don't tolerate discovering missed deadlines at the next review.

For a structured approach to the first month after receiving any finding, see our guide on what to do in the first 30 days after a regulatory finding.

How Teams Manage MRA and MRIA Responses

The difference between institutions that close findings and those that accumulate them: the response is systematic, not heroic. Every finding (MRA or MRIA) follows the same structured workflow with appropriate urgency calibration.

Canarie maps each finding to a response workflow with severity-appropriate timelines, evidence gates, owner assignments, and board reporting triggers. MRIAs get compressed timelines and escalation paths. MRAs get standard cadence with the same documentation rigor. When examiners arrive, the remediation package is assembled, not being assembled.

See how compliance teams manage findings from triage to validated closure →

Frequently Asked Questions

Can an MRA be escalated to an MRIA during the same examination?

Not typically during the same exam cycle, since both classifications are issued in the same ROE. However, if an examiner initially communicates a concern as an MRA-level issue during the exam and then discovers the deficiency is more severe than expected, it may be classified as an MRIA in the final report. The more common escalation path is an MRA from one examination becoming an MRIA at the next examination if it wasn't adequately remediated.

How does the FDIC decide between issuing an MRA and an MRIA?

The classification depends on the severity and immediacy of the risk. Factors include: whether a law or regulation is being actively violated, whether consumers are being harmed, whether the deficiency could result in material financial loss, and whether the issue requires correction before the next examination cycle. The FDIC's Risk Management Manual and internal examiner guidance provide classification criteria, though examiners exercise professional judgment in borderline cases.

Are MRAs and MRIAs public information?

No. MRAs and MRIAs are contained in the Report of Examination, which is a confidential supervisory document under 12 CFR Part 309. They are not publicly disclosed. However, if findings escalate to formal enforcement actions, such as consent orders or cease-and-desist orders, those actions are publicly available through the FDIC's enforcement database. See our guide on FDIC consent orders for more detail.

What if we receive both MRAs and MRIAs in the same examination?

This is common, particularly in comprehensive examinations. Prioritize MRIA remediation first, interim controls within days, corrective action plan within two weeks. MRA remediation runs in parallel but on its own timeline. Resource allocation should reflect severity: MRIAs get dedicated staff and budget priority. Report both to the board, but ensure MRIA reporting cadence is monthly or more frequent while MRA reporting can follow quarterly cycles.