An MRA is a confidential supervisory finding that requires correction. An MRIA is a more severe finding that requires immediate correction and board attention. A consent order is a public, legally binding enforcement action under 12 U.S.C. § 1818(b) with fixed deadlines and penalty exposure for noncompliance. They are three rungs of one ladder, and the most common way an institution climbs it is by failing to resolve the rung it is already on.
This guide compares all three across severity, legal force, publicity, and resolution timelines, and maps the path between them. For the MRA/MRIA distinction alone, see MRA vs. MRIA differences; for what receiving an order means in practice, see what an FDIC consent order means.
Key Takeaways:
- MRAs and MRIAs are confidential supervisory findings; consent orders are public enforcement actions enforceable in court
- Informal actions (board resolutions, memoranda of understanding) sit between findings and formal orders on the escalation ladder
- Consent order deadlines are legal obligations, commonly 30, 60, or 90 days per provision from the effective date, and missing them risks civil money penalties
- Regulators escalate for the same reasons across agencies: unresolved or repeat findings, inadequate management response, and deteriorating condition
- Every rung is exited the same way: corrective action that is implemented, effective, and sustained, with evidence
The Supervisory Escalation Ladder
Federal banking supervision runs on a graduated scale. Examiners first communicate deficiencies as findings inside confidential examination materials. If findings are serious, unresolved, or recurring, the agency moves to informal actions, then to formal enforcement.
| Rung | Instrument | Legal force | Public? |
|---|---|---|---|
| 1 | MRA (Matter Requiring Attention) | Supervisory expectation | No |
| 2 | MRIA (Matter Requiring Immediate Attention) / MRBA (FDIC) | Supervisory requirement, board-directed | No |
| 3 | Informal action: board resolution, memorandum of understanding (MOU) | Documented commitment, not court-enforceable | No |
| 4 | Formal action: consent order / cease-and-desist order, formal agreement | Legally binding and enforceable under 12 U.S.C. § 1818 | Yes |
| 5 | Civil money penalties, restrictions, removal actions | Legally binding sanctions | Yes |
Terminology varies by agency. The Federal Reserve defined MRAs and MRIAs in SR 13-13/CA 13-10. The OCC uses MRAs, described in OCC Bulletin 2014-52. The FDIC communicates Matters Requiring Board Attention in its reports of examination, with the follow-up framework described in its Risk Management Manual of Examination Policies.
MRA: A Deficiency on a Normal Remediation Clock
An MRA identifies a deficiency that management must correct but that does not pose an immediate threat. The institution responds with a written corrective action plan, typically within 30 to 45 days of receiving the report, then remediates on the committed schedule, usually over three to twelve months depending on complexity.
The finding stays confidential, there is no legal penalty attached, and management retains discretion over how to fix the problem. That discretion is the thing you lose as you climb. A structured response is still mandatory in practice: our MRA response letter template covers what the written response must contain.
MRIA: Immediate Action, Board Accountability
An MRIA signals that the regulator views the matter as significant and urgent: a deficiency with potential to materially affect the institution, substantive noncompliance with law, or an MRA that a prior exam already flagged and the institution failed to fix. Under SR 13-13, MRIAs are directed to the board of directors and written as requirements with the timeframe stated in the finding itself, frequently "immediately."
The practical differences from an MRA: the board, not just management, owns the response; interim risk mitigation is expected while the permanent fix is built; and supervisory follow-up is faster and more intrusive. The full definition and response mechanics are in what an MRIA means.
Informal Actions: The Last Confidential Stop
Between findings and formal enforcement, agencies use informal corrective instruments, described in the FDIC's examination policy manual and parallel OCC and Federal Reserve policy: board resolutions (the board formally commits to corrective steps) and memoranda of understanding (a signed agreement between the institution and the agency). Neither is enforceable in court and neither is published, but both are tracked supervision: compliance is verified at every subsequent examination, and violating an MOU is a direct path to a formal action.
An institution offered an MOU should read it as the agency saying: this is the last stop before the public record. The full taxonomy of informal and formal instruments, MOUs, written agreements, cease-and-desist orders, and civil money penalties, is covered in bank enforcement actions explained.
Consent Order: Public, Binding, Deadline-Driven
A consent order (the FDIC and OCC term; the Federal Reserve typically uses cease-and-desist orders and written agreements) is a formal enforcement action issued under 12 U.S.C. § 1818(b), which the institution agrees to rather than litigating. Three things change at this rung:
- It is public. Orders are published in the agencies' enforcement databases, such as the FDIC's Enforcement Decisions and Orders. Counterparties, partners, and the press will read it.
- Deadlines are legal obligations. Orders assign deadlines per provision, commonly 30, 60, or 90 days from the effective date for plans and policies, with ongoing obligations (compliance committee meetings, quarterly progress reports to the regional office) running until termination.
- Noncompliance has statutory consequences. Violating an order supports civil money penalties under § 1818(i) and further restrictions.
Timeline Comparison: From Receipt to Resolution
| Dimension | MRA | MRIA | Consent order |
|---|---|---|---|
| Written response due | Typically 30-45 days (per transmittal letter) | As stated in the finding, often immediately | N/A, obligations start at the effective date |
| First deliverables | Corrective action plan | Interim risk mitigation plus CAP | Plans, policies, committee formation, commonly due in 30-90 days per provision |
| Typical path to closure | Next exam cycle or follow-up review, often 3-12 months | Accelerated follow-up, often within months | Sustained compliance across exam cycles, commonly years |
| Who verifies closure | Examiners at follow-up or next exam | Examiners, on an accelerated schedule | Examiners plus, frequently, independent third-party validation required by the order |
| Exit standard | Corrective action implemented, effective, sustained | Same, on an immediate timeline | Full compliance with every provision, sustained, then agency terminates the order |
The exit standard is the constant. At every rung, the regulator closes the matter only after verifying the fix is implemented, effective, and sustained, a process covered in how examiners validate remediation.
How Escalation Actually Happens
Escalation is rarely a surprise. The drivers repeat across agencies and across the public record:
- Repeat findings. The same deficiency cited at consecutive exams is the single most reliable escalation trigger. SR 13-13 explicitly contemplates elevating an MRA to an MRIA when the banking organization fails to address it.
- Missed commitments. CAP dates that pass without completion or communication tell the agency that supervisory findings do not change the institution's behavior, which is precisely the conclusion that justifies a binding order.
- Inadequate response quality. Vague plans without owners, dates, or evidence commitments generate follow-up criticism and shorten the agency's patience.
- Severity and condition. A serious enough deficiency, significant BSA/AML program failure, unsafe or unsound practice, or consumer harm at scale, can skip rungs entirely. Nothing requires an agency to issue an MRA before an order.
- Growth outrunning controls. In the partner banking space, several institutions moved from clean exams to public orders in short order when oversight did not scale with program growth; see sponsor bank consent orders for that pattern.
De-escalation is the same mechanics in reverse: hit every committed date, produce evidence without being asked, and make findings close at first follow-up.
Staying Off the Ladder: Findings Management as a Discipline
Institutions that never see rung three treat every finding, internal audit, self-identified, or examiner-issued, as a tracked object with an owner, a date, evidence requirements, and validation before closure. Institutions that escalate usually manage findings in spreadsheets and email, where commitments go stale silently.
Canarie gives banks one system where each finding becomes a corrective action plan with named owners, deadlines, captured evidence, and board-ready status reporting, so the response you send a regulator stays true for the months it takes to verify.
See how teams track findings from response to verified closure →
Frequently Asked Questions
Is an MRA or MRIA an enforcement action?
No. MRAs and MRIAs are supervisory findings communicated in confidential examination materials. They carry a clear expectation of corrective action, and ignoring them leads toward enforcement, but they are not legally binding orders and they are not public.
Are MRAs and MRIAs public information?
No. They are part of confidential supervisory information, which institutions are generally prohibited from disclosing. Consent orders, cease-and-desist orders, formal agreements, and civil money penalties are published by the issuing agency.
Can a bank receive a consent order without getting an MRA first?
Yes. The graduated ladder describes the common path, not a required one. A sufficiently serious deficiency, such as a significant BSA/AML program failure or widespread consumer harm, can produce a formal action directly, and statutory provisions mandate action for certain BSA program failures.
How long does a consent order take to resolve?
Most initial deliverables are due within 30 to 90 days of the effective date, but termination requires full, sustained compliance with every provision, verified through examinations and required reporting. In practice, orders commonly remain in place for two or more years. The agency, not the bank, decides when the order terminates.
What is the difference between an MOU and a consent order?
A memorandum of understanding is an informal, non-public agreement documenting corrective commitments; it is not enforceable in court. A consent order is a formal, public action under 12 U.S.C. § 1818 that is legally enforceable and carries civil money penalty exposure for violations. Agencies typically reach for an MOU when problems are serious but management is viewed as capable and cooperative.
The three instruments differ in force, but they ask for the same thing: identified root causes, specific corrective actions, named owners, dates that hold, and evidence that survives verification. Build that discipline at the MRA stage and the higher rungs stay theoretical.