OCC Bulletin 2026-29: Lending and Loan Portfolio Risk

Reference: Bulletin 2026-29

Official publication: Read the full Bulletin 2026-29 on the agency website

This public memo addresses a recent regulatory development from OCC and is intended to help readers identify the practical issues that may need legal, compliance, or operational review. It does not assume that every institution or business is affected in the same way; the important first step is to compare the agency action against the reader’s actual products, policies, customer communications, contracts, and pending matters.

Executive Summary

• Agency action: Credit Risk: “Lending and Loan Portfolio Risk Management” Booklet of the Comptroller’s Handbook and Rescissions.
• Known source detail: The Office of the Comptroller of the Currency today issued the "Lending and Loan Portfolio Risk Management" booklet of the Comptroller's Handbook.
• Immediate legal significance: the release may affect how regulated parties document compliance decisions, respond to supervisory inquiries, evaluate consumer-facing practices, or preserve support for future disputes.
• Recommended next step: assign an owner to review the official source, compare it to current policies and workflows, and memorialize whether any update is needed.
• Risk note: even when a release is framed as a notice, appointment, data update, request for comment, or procedural change, it can still signal what the agency is prioritizing and what market participants should be ready to explain.

What the Regulator Issued

Credit Risk: “Lending and Loan Portfolio Risk Management” Booklet of the Comptroller’s Handbook and Rescissions

The Office of the Comptroller of the Currency today issued the "Lending and Loan Portfolio Risk Management" booklet of the Comptroller's Handbook.

For legal and compliance teams, the important issue is not only the headline. The release should be read for the specific authority cited, the persons or entities covered, the conduct or reporting obligation discussed, and whether the agency is announcing a final position, seeking public input, updating a process, publishing market data, or identifying an enforcement or supervisory priority. Those categories call for different responses: a final rule may require implementation planning, a proposed rule may require a comment strategy, a data release may require market monitoring, and a leadership or committee announcement may affect policy direction without immediately changing obligations.

Official source: Read the agency publication.

What Changed in Bulletin 2026-29

OCC Bulletin 2026-29, issued June 25, 2026, announces the new Lending and Loan Portfolio Risk Management booklet of the Comptroller’s Handbook. The bulletin describes an examiner-focused resource covering risks associated with lending, risk-based supervision, common practices across the loan life cycle, and loan-portfolio risk management. It also includes examination procedures used as appropriate based on risk, with emphasis on material financial risks. The handbook is made public for transparency into the OCC’s supervisory process; readers should use it alongside applicable statutes, regulations, policy statements, and the organization’s current loan documents.

• Consolidated handbook reference: The new booklet replaces the older Loan Portfolio Management booklet and combines related Office of Thrift Supervision examination-handbook sections covering lending operations, programs, lending-overview questionnaires, and portfolio-diversification questionnaires.
• Additional rescissions: The bulletin also rescinds the loan-portfolio-management section of the Internal Control Questionnaire booklet, the Interest on Loans section of the Other Consumer Protection Laws and Regulations booklet, and OTS Thrift Bulletin 78a.
• Appendix K: OTS Thrift Bulletin 78a’s investment-limitations material is incorporated as appendix K of the new booklet rather than left as a separate current reference.
• Community-bank context: The OCC says the booklet applies across banks of all sizes, with procedures and expectations considered in light of an institution’s size, complexity, and risk profile.

Why the rescissions matter

For a bank’s legal, credit-risk, compliance, and examination teams, the practical task is to replace outdated citations without assuming that every policy must be rewritten. Search current policies, examiner-request packages, lending manuals, internal-control questionnaires, training materials, board or committee reporting, and vendor documentation for references to the rescinded materials. Then record which current OCC booklet, regulation, accounting source, or internal standard controls each topic. That reference map helps the organization explain its review if an examiner asks how lending-risk practices were evaluated.

Practical lending-risk review points

1. Identify the risk profile: note the legal entity, lending products, portfolio mix, concentrations, complexity, and material financial risks that should shape the review.
2. Trace the loan life cycle: compare controls from origination and underwriting through approval, servicing, monitoring, problem-loan management, and portfolio reporting.
3. Check supervisory evidence: preserve risk assessments, policy exceptions, concentration reporting, trend or emerging-risk analysis, committee minutes, internal-audit work, and management responses where relevant.
4. Separate sources: distinguish the examiner-facing handbook from enforceable law, regulations, loan agreements, and other applicable OCC or interagency guidance before assigning an action item.
5. Assign follow-up: document the owner, affected procedure, current source, decision, and any later OCC update or examination question that should be monitored.

When a legal or compliance review is useful: if the bulletin intersects with an examination request, a disputed credit decision, a governance concern, or a related business or litigation issue, preserve the official bulletin and the organization’s analysis and request a consultation about the specific facts.

Who Is Impacted

The potentially impacted audience depends on the details of the release, but the first review should usually include legal, compliance, risk, operations, customer response, vendor management, and executive stakeholders. Financial institutions, investment firms, payment companies, service providers, insurers, fintech vendors, and businesses that rely on regulated financial products may need to understand whether the action changes expectations for documentation, disclosures, complaint handling, data reporting, governance, board reporting, or customer remediation.

Organizations should also consider indirect exposure. A release aimed at one sector may affect counterparties, third-party vendors, technology providers, investors, borrowers, consumers, or affiliated companies. If the subject overlaps with open customer disputes, pending claims, examiner requests, remediation projects, or public statements, the organization should preserve the release and record how it evaluated the issue. That record can be useful later if a regulator, court, customer, shareholder, or business partner asks why the organization acted or declined to act.

Key Dates and Deadlines

Source date: June 25, 2026. The release should be checked for any separate effective date, comment deadline, implementation period, transition rule, sunset date, or meeting date.

Timing deserves separate attention because regulatory obligations often turn on more than the publication date. A proposed rule may require comments before a deadline; a final rule may include delayed compliance dates; an interpretive release may influence conduct immediately; and a data or committee announcement may not impose a deadline at all but may still affect planning. The safest workflow is to identify every date in the official source, assign responsibility for each, and store the source alongside the organization’s analysis.

Practical Action Checklist

• Save the official publication, any linked releases, and any referenced rule text or agency archive page in a central file.
• Identify whether the release is final, proposed, interpretive, procedural, enforcement-related, data-oriented, or informational.
• Map the subject matter to affected business lines, products, disclosures, contracts, reporting systems, consumer communications, and vendor relationships.
• Check whether existing policies, desk procedures, training materials, call scripts, complaint workflows, or board materials mention the same issue.
• Determine whether any current examinations, audits, claims, litigation holds, investigations, or remediation projects involve similar facts.
• Assign an accountable owner for legal review and an operational owner for implementation or monitoring.
• If the release requests public comment, evaluate whether the organization should submit comments directly, through a trade association, or not at all.
• If the release changes or clarifies expectations, document whether policy updates, training updates, customer notices, or vendor instructions are needed.
• Track follow-on FAQs, speeches, enforcement actions, examination manuals, supervisory highlights, or interagency statements that may explain the agency’s practical position.
• Keep a short decision log showing who reviewed the release, what was concluded, and what action items remain open.

Open Questions / Watch Items

Several questions may remain open until the agency publishes additional guidance or market participants test the release in practice. Readers should watch whether the agency issues FAQs, compliance guides, technical specifications, no-action relief, examination procedures, enforcement examples, or coordinated statements with other regulators. It may also be important to monitor whether state regulators, private plaintiffs, counterparties, or consumer advocates treat the release as evidence of a broader standard of care.

Organizations should be especially careful where the release touches customer funds, disclosures, reporting data, complaint systems, cybersecurity, payment systems, crypto or digital assets, investor communications, consumer remediation, or resolution planning. Those areas often create a paper trail that may later be reviewed outside the original regulatory context. The goal is not to overreact to every agency publication, but to create a disciplined review process so important changes are not missed.

My Law Tampa publishes these regulatory memos to help readers stay oriented when agencies issue new releases, proposals, public statements, and compliance developments. The memo is designed as a practical issue-spotting tool, not as a substitute for reviewing the governing source materials.

This memo is for informational purposes only. It does not provide legal advice and does not create an attorney-client relationship. Readers facing a specific legal, compliance, insurance, business, or litigation issue should speak with qualified counsel about their facts and deadlines.

Source Materials

• Official publication: Bulletin 2026-29
• Regulator archive: OCC memo archive
• Memo library: browse the full regulatory memo archive
• Related memo: Financial Data Transparency Act of 2022: Analysis of the Joint Final Rule on Data Standards
• Related memo: OCC Proposes Weekly and Quarterly Reporting Standards Under the GENIUS Act
• Related memo: Bank Supervision: Removing References to Reputation Risk