The Office of the Comptroller of the Currency has issued a comprehensive cease-and-desist order against USAA Federal Savings Bank, replacing enforcement actions from 2019 and 2022 that the bank had failed to fully remediate. The order, announced on 18 December 2024 in OCC News Release 2024-137, covers a broad range of deficiencies spanning management, earnings, information technology, consumer compliance, internal audit, and Suspicious Activity Report filing obligations.
The consolidation of the prior orders into a single comprehensive instrument reflects the OCC's conclusion that USAA Federal Savings Bank has not achieved the corrective progress required under the predecessor enforcement actions. The bank has been subject to continuous OCC enforcement since 2019, making the December 2024 action the culmination of more than five years of regulatory concern about the institution's ability to operate safely and soundly across multiple fundamental operational and compliance domains simultaneously.
BROAD DEFICIENCIES ACROSS CORE BANK FUNCTIONS
The OCC's order identifies failures across several areas that are fundamental to the governance and risk management of a regulated institution. The management deficiencies encompass the adequacy of senior oversight and accountability structures. The earnings-related findings indicate that the OCC has concerns about the quality or sustainability of the bank's financial performance as reported. Information technology shortcomings suggest that the bank's systems and infrastructure do not meet the standards expected of an institution of its size and complexity.
Consumer compliance failures indicate that USAA Federal Savings Bank has not adequately adhered to the federal consumer protection laws and regulations that govern its dealings with customers, including members of the US military community and their families. The internal audit findings suggest that the bank's independent assurance function has not been operating with sufficient rigour or independence to provide adequate assurance to the board and senior management over the bank's risk and control environment. SAR-related violations — concerning the bank's duty to report suspicious transactions to the Financial Crimes Enforcement Network — are treated by US bank regulators as a particularly serious category of breach given their direct connection to anti-money laundering obligations.
The OCC further found that USAA Federal Savings Bank was not in compliance with the agency's Heightened Standards requirements for large banks, codified in 12 CFR Part 30, Appendix D. These standards impose enhanced expectations on institutions that meet certain size thresholds regarding the quality of their risk governance frameworks, the articulation and implementation of risk appetite, and the level of board-level engagement with risk management. Non-compliance with the Heightened Standards is a serious supervisory classification that compounds the gravity of the other findings in the order.
GROWTH RESTRICTIONS AND PATH TO REMEDIATION
The cease-and-desist order places direct operational constraints on USAA Federal Savings Bank, prohibiting it from adding new products or services and from expanding the criteria under which new members are eligible to join the institution while the order remains in effect. These restrictions directly constrain the bank's ability to grow its customer base and product offering — core strategic levers for a membership-based institution — until the OCC is satisfied that the underlying deficiencies have been genuinely and sustainably remediated.
USAA Federal Savings Bank serves a membership base drawn from the United States military community, encompassing active-duty service members, veterans, National Guard and Reserve members, and their eligible family members. The institution's mission-oriented positioning and the trust its members place in it give the OCC's findings and the accompanying restrictions a reputational dimension that extends well beyond the financial and operational implications. The bank will be required to develop and execute comprehensive corrective action plans across the areas identified in the order, with progress subject to ongoing OCC oversight and monitoring.