U.S. Regulatory Update — August 31, 2026
CAS thresholds rise sharply for federal contractors, while the OCC and FDIC narrow standards for unsafe or unsound practices and MRAs.
This update reviews final rules placed on Federal Register public inspection on August 31, 2026 and scheduled for publication on September 1, 2026. The published editions should be checked before relying on calculated effective dates.
CAS thresholds rise sharply for federal contractors
The Cost Accounting Standards Board has finalized a substantial revision to the federal Cost Accounting Standards (CAS) regime. The basic threshold for CAS applicability rises from $2.5 million to $35 million. The threshold for full CAS coverage and mandatory Disclosure Statements increases from $50 million to $100 million. The separate $7.5 million trigger is eliminated, and agency-head authority to waive CAS requirements increases from $15 million to $100 million.
The rule becomes effective 30 days after publication in the Federal Register. It also clarifies treatment of indefinite-delivery contracts. For multiple-award IDIQ and IDC vehicles, CAS applicability and exemptions are generally determined separately at the individual task- or delivery-order level. For a single-award IDC, however, applicability is generally determined when the underlying contract is awarded using the contract's ceiling value, subject to applicable commercial-item and competitively awarded firm-fixed-price exemptions.
Existing contractors currently subject to full CAS may transition to modified coverage if they fall below the new $100 million threshold and have no unresolved CAS noncompliance.
Practical implications for contractors
The rule is particularly important for construction contractors, EPC and engineering businesses, defense and infrastructure suppliers, and foreign companies entering the U.S. federal procurement market. Mid-sized contractors may now pursue materially larger federal work without assuming full CAS accounting obligations.
Companies should update bid/no-bid procedures, FAR and CAS representations, accounting-system assessments, and subcontract templates. Single-award IDIQ contractors should remain cautious: a high contractual ceiling can create CAS exposure even where anticipated annual work is substantially lower. Contractors transitioning away from full CAS should also assess whether accounting-practice changes create price-adjustment or contract-administration issues.
Source: OMB/CAS Board final rule on Cost Accounting Standards thresholds
OCC and FDIC narrow standards for unsafe or unsound practices and MRAs
The OCC and FDIC have adopted a joint final rule defining “unsafe or unsound practice” and substantially restructuring the supervisory framework for Matters Requiring Attention (MRAs) and lesser supervisory observations. The rule applies to U.S. banks and savings associations, covered federal branches and agencies of foreign banks, and insured state-licensed branches of foreign banks. It becomes effective 60 days after publication in the Federal Register.
Under the new definition, conduct qualifies as unsafe or unsound only where it is contrary to generally accepted standards of prudent operation and, if continued, is likely to materially harm the institution's financial condition or create a material risk of loss to the Deposit Insurance Fund, or has already caused material harm. The agencies expressly retained “likely” as the probability threshold rather than a merely possible or speculative risk.
Financial harm is evaluated through factors including capital, asset quality, earnings, liquidity, and market-risk sensitivity. The rule also distinguishes more consequentially between an MRA and a supervisory observation. Observations below the MRA threshold do not themselves require corrective action, an action plan, or board presentation; an institution's decision not to adopt an examiner recommendation cannot by itself justify escalation.
Supervisory and enforcement expectations must be tailored to an institution's size, capital structure, complexity, activities, and financial-risk profile. Actual violations of banking or banking-related law can still require remediation and support an MRA even where they do not independently satisfy the unsafe-or-unsound standard.
Practical implications for financial institutions
Banks, U.S. operations of foreign banking organizations, commercial and real-estate lenders, fintech partners, and bank investors should revise examination-response and regulatory-remediation protocols. Boards and compliance teams should distinguish legally consequential MRAs from nonbinding supervisory observations instead of treating every examiner comment as a mandatory remediation item.
In bank M&A and financing diligence, regulatory findings should likewise be categorized by actual legal status and material financial-risk nexus. Institutions have stronger grounds to challenge unsupported supervisory escalation, but the rule does not excuse actual statutory or regulatory violations.
Source: OCC/FDIC final rule on Unsafe or Unsound Practices and Matters Requiring Attention
Key takeaway
These final rules reduce certain compliance burdens while making the relevant thresholds more precise. Federal contractors should recalibrate CAS assessments around the higher thresholds and contract structure. Financial institutions should update examination-response frameworks to reflect the distinction between legally consequential MRAs and nonbinding observations.
This publication is for general informational purposes only and does not constitute legal advice. Regulatory requirements and legal consequences depend on the applicable facts, contracts, institution, and jurisdiction.
Explore Topics
Written by
Muhammet Halil Ucar
ULF New York legal team — New York-based attorneys advising Turkish companies and investors on U.S. market entry, corporate law, real estate, and international trade.