An MRA response letter has one job: convince your regulator that management understands the deficiency, has a credible plan to fix it, and will produce evidence of correction on a stated timeline. The template below gives you the structure examiners expect, a corrective action plan (CAP) format that maps each finding to owners, dates, and evidence, and the board language that most responses get wrong. It works for OCC, FDIC, Federal Reserve, and state findings with minor adaptation.
This page is the template companion to our full guide on how to respond to an MRA from the FDIC, which covers the response process end to end. If you are still determining the severity of what you received, start with MRA vs. MRIA differences.
Key Takeaways:
- A complete MRA response contains five parts: acknowledgment, root cause, corrective actions with dates, accountability assignments, and board oversight commitments
- Every corrective action needs a named owner, a completion date, and a description of the evidence that will prove completion
- The letter is signed by the CEO or president, with the board's review documented in minutes before submission
- Restating the finding and promising to "enhance" or "strengthen" a process without specifics is the most common weakness examiners cite
What an MRA Response Letter Must Contain
Examiners read dozens of responses a year, and they evaluate them against a consistent standard. Federal Reserve SR 13-13/CA 13-10 directs supervisory findings to the board of directors for corrective action, and OCC Bulletin 2014-52 describes MRAs in terms of the concern, its root cause, its consequence, the required corrective action, and management's commitment. Your response should answer each of those elements explicitly.
A complete response letter covers five things:
- Acknowledgment of each finding, restated accurately by number or caption from the report of examination
- Root cause analysis, what actually allowed the deficiency to occur, not a description of the symptom
- Specific corrective actions, each with a named accountable owner and a hard completion date
- Evidence commitments, the artifacts that will exist when each action is complete (revised policy, system configuration record, training rosters, QA testing results)
- Board oversight, how and how often the board or a designated committee will track progress to closure
If any of the five is missing, expect a follow-up letter or a finding about the response itself.
The MRA Response Letter Template
Adapt the bracketed fields. Keep the letter short, two to three pages, and push the detail into the CAP attachment.
[Bank Letterhead]
[Date]
[Regional Director / Assistant Deputy Comptroller / Officer in Charge]
[Agency and Regional Office]
[Address]
Re: Response to Report of Examination dated [exam date],
[Bank Name], [City, State], Cert/Charter No. [number]
Dear [Title and Name]:
The Board of Directors and management of [Bank Name] have reviewed the
Report of Examination dated [date] and the [number] Matters Requiring
Attention identified therein. The Board reviewed this response and the
attached Corrective Action Plan at its meeting on [date], as reflected
in the Board minutes.
We take each finding seriously. For every matter, we have identified
the root cause, assigned a member of management as the accountable
owner, and established completion dates and the evidence that will
document correction. A summary of each response follows; the attached
Corrective Action Plan provides detail.
MRA 1: [Caption as stated in the ROE]
Root cause: [One or two sentences identifying the underlying cause,
e.g., "The transaction monitoring system thresholds were not revised
after the Bank's 2025 deposit growth, because no control existed
requiring periodic threshold revalidation."]
Corrective actions: [Numbered actions, each with owner and date, e.g.,
"1. Complete a documented threshold revalidation of all monitoring
scenarios. Owner: BSA Officer. Completion: March 31. 2. Adopt a
standing control requiring annual scenario revalidation with results
reported to the BSA Committee. Owner: BSA Officer. Completion:
April 30."]
Evidence of completion: [e.g., "Revalidation workpapers, updated
scenario documentation, BSA Committee minutes accepting the results."]
[Repeat for each MRA.]
Board oversight: The Board has directed the [Audit / Compliance]
Committee to receive a written status report on each matter at every
regularly scheduled meeting until all corrective actions are complete
and validated. [Internal audit / an independent party] will validate
the effectiveness of corrective actions before management reports any
matter as complete.
We believe the actions described above fully address the matters
identified. Please contact [name, title, phone] with any questions.
Sincerely,
[Name]
President and Chief Executive Officer
cc: Board of Directors
Enclosure: Corrective Action Plan
The Corrective Action Plan Attachment
The CAP is where examiners spend their time at the follow-up exam. Use one row per corrective action, not per finding, because a single MRA usually requires several distinct actions. For a full treatment of running the plan after submission, see the MRA closure process.
| Field | What goes in it |
|---|---|
| Finding reference | MRA number and caption from the ROE |
| Root cause | The underlying cause this action addresses |
| Corrective action | The specific change: policy, system, staffing, or process |
| Accountable owner | A named individual with authority over the affected process, not a department |
| Milestone dates | Interim dates for multi-step actions, plus the final completion date |
| Evidence of completion | The dated artifacts that will exist when done |
| Validation method | Who independently confirms effectiveness (internal audit, QA testing, second-line review) and how |
| Status | Not started / in progress / complete / validated |
Two rules keep the CAP credible. First, dates are commitments: if a date slips, report the slippage to the board and, where the agency requested progress reports, to the agency, before the date passes. Second, "complete" and "validated" are different statuses. Examiners will test whether the fix is implemented, effective, and sustained, which is covered in detail in how examiners validate remediation.
Mistakes That Weaken an MRA Response
These patterns show up repeatedly in responses that generate follow-up criticism:
- Restating the finding as the plan. "The Bank will strengthen its BSA program" is not a corrective action. Name the control, the change, the owner, and the date.
- Treating the symptom. If late CTR filings were caused by a staffing gap, a memo reminding staff to file on time will fail validation. The root cause line forces this discipline.
- Assigning everything to the compliance officer. Corrective actions belong to whoever owns the deficient process. See who is responsible for remediation for the accountability model examiners expect.
- No evidence commitments. If the letter never says what artifacts will prove completion, the follow-up exam becomes an argument about whether work happened.
- Committing the board to nothing. SR 13-13 directs findings to the board. A response that never mentions board oversight reads as a management-only effort.
- Overcommitting. An aggressive date you miss is worse than a realistic date you hit. Missed CAP dates are themselves a supervisory concern and a step on the escalation path described in MRA vs. MRIA vs. consent order.
Adapting the Template by Regulator
The structure holds across agencies; the vocabulary and transmittal details change.
- FDIC: Findings arrive in the ROE, often as Matters Requiring Board Attention (MRBA). The transmittal letter states the response deadline, commonly 30 to 45 days. Address the response to the Regional Director. The FDIC Risk Management Manual of Examination Policies describes the examination and follow-up framework.
- OCC: MRAs follow the concern, cause, consequence, corrective action, commitment structure of OCC Bulletin 2014-52. Mirror that structure in your response and address it to your Assistant Deputy Comptroller or examiner-in-charge.
- Federal Reserve: Distinguish MRAs from MRIAs. An MRIA requires immediate action and board attention under SR 13-13; the response timeline is stated in the finding itself.
- State banking departments: Most follow the federal framework of their joint exams. Match the terminology used in the state's transmittal letter.
Keeping the Promises the Letter Makes
The letter is the easy part. The institution then has to execute every committed action, hit every date, capture every evidence artifact, and keep the board current, often across a dozen or more concurrent actions owned by different departments. That coordination work is where responses quietly fail: a spreadsheet goes stale, an owner changes roles, a date passes unnoticed, and the follow-up exam finds open commitments.
Canarie turns each CAP commitment into an owned, dated task with evidence capture built in, so the status your board sees is the status examiners will verify. When the follow-up exam arrives, the closure package, actions, dates, artifacts, and validation results, already exists.
See how exam findings get tracked to verified closure →
Frequently Asked Questions
How long do you have to respond to an MRA?
The deadline is stated in the transmittal letter that accompanies the report of examination, most commonly 30 to 45 days from receipt. If no deadline is stated, respond within 45 days, and never silently miss a stated date: request an extension in writing before it passes if you need one.
Who should sign an MRA response letter?
The president or chief executive officer signs, because the response is an institutional commitment rather than a departmental one. The letter should state that the board reviewed the response and the corrective action plan, with that review documented in board minutes before submission.
Is an MRA response letter public?
No. MRAs are supervisory findings communicated in confidential examination materials, and the response is part of that confidential supervisory record. This differs from formal enforcement actions such as consent orders, which are published. See MRA vs. MRIA vs. consent order for the distinction.
What is the difference between an MRA response and a corrective action plan?
The response letter is the cover communication: acknowledgment, root cause summaries, and board oversight commitments. The corrective action plan is the working attachment that lists every action with its owner, dates, evidence, and validation method. Examiners track remediation against the CAP, so it must be specific enough to audit.
Should the response dispute a finding the bank disagrees with?
You can present factual corrections and context with supporting documentation, but do it precisely and professionally, and still provide a corrective plan for any part of the finding that stands. Blanket disagreement without evidence damages credibility. Formal appeal channels exist at each agency if the disagreement is material.
An MRA response letter succeeds when every sentence can be verified later: a named owner, a hard date, a described artifact. Write the letter the follow-up examiner will test, not the one that is easiest to send, and run the plan with the same discipline you committed to on paper.