OCC Heightened Standards (12 CFR Part 30, Appendix D)
The OCC's heightened standards for large national banks, Federal savings associations and Federal branches (12 CFR part 30, appendix D), as in force on 25 September 2026: a written risk governance framework designed by independent risk management and approved by the board, the duties of front line units, independent risk management and internal audit, the strategic plan, risk appetite statement, limits and breach handling, concentration risk, risk data aggregation, talent and compensation, and the board's oversight, independence, training and self-assessment. Reputation risk left the framework's scope on 9 June 2026; the December 2025 proposal to raise the threshold from $50 billion to $700 billion is recorded, not yet final.
OCC Heightened Standards (12 CFR Part 30, Appendix D) is a compliance framework from United States (OCC: national banks, Federal savings associations, Federal branches) with 3 domains and 63 controls that map to 111 other frameworks. The largest domains are II. Standards for the risk governance framework – OCC Heightened Standards (12 CFR Part 30, Appendix D) (53 controls), III. Standards for the board of directors – OCC Heightened Standards (12 CFR Part 30, Appendix D) (6 controls), I. Introduction: scope, parent frameworks and independence structures – OCC Heightened Standards (12 CFR Part 30, Appendix D) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
I. Introduction: scope, parent frameworks and independence structures – OCC Heightened Standards (12 CFR Part 30, Appendix D)
| Code | Title |
|---|---|
| occ-heightened-standards-12-cfr-part-30-appendix-d::I.3 | I.3 Using the parent company's risk governance framework |
| occ-heightened-standards-12-cfr-part-30-appendix-d::I.5 | I.5 Own risk governance framework where risk profiles differ |
| occ-heightened-standards-12-cfr-part-30-appendix-d::I.E.7 | I.E.7 Independence structure of independent risk management |
| occ-heightened-standards-12-cfr-part-30-appendix-d::I.E.8 | I.E.8 Independence structure of internal audit |
II. Standards for the risk governance framework – OCC Heightened Standards (12 CFR Part 30, Appendix D)
| Code | Title |
|---|---|
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.A | II.A Formal, written risk governance framework |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.B | II.B Scope of the framework: risk categories |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(a) | II.C.1.(a) Front line units: Ongoing assessment of material risks |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(b) | II.C.1.(b) Front line units: Written policies with front line unit risk limits |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(c) | II.C.1.(c) Front line units: Procedures to comply with the unit's policies |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(d) | II.C.1.(d) Front line units: Adhere to independent risk management's policies |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(e) | II.C.1.(e) Front line units: Talent and staffing for the front line role |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(f) | II.C.1.(f) Front line units: Talent management processes (II.L) |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.1.(g) | II.C.1.(g) Front line units: Compensation and performance management (II.M) |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(a) | II.C.2.(a) Independent risk management: Design the risk governance framework |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(b) | II.C.2.(b) Independent risk management: Identify and assess aggregate risks |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(c) | II.C.2.(c) Independent risk management: Enterprise policies with concentration risk limits |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(d) | II.C.2.(d) Independent risk management: Procedures to comply with enterprise policies |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(e) | II.C.2.(e) Independent risk management: Escalate to the CEO and board on risk differences and non-adherence |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(f) | II.C.2.(f) Independent risk management: Escalate to the board on differences with the CEO |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(g) | II.C.2.(g) Independent risk management: Talent and staffing for independent risk management |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(h) | II.C.2.(h) Independent risk management: Talent management processes (II.L) |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.2.(i) | II.C.2.(i) Independent risk management: Compensation and performance management (II.M) |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(a) | II.C.3.(a) Internal audit: Complete inventory of material processes and risks |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(b) | II.C.3.(b) Internal audit: Risk-based audit plan |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(c) | II.C.3.(c) Internal audit: Written reports with root cause to the audit committee |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(d) | II.C.3.(d) Internal audit: Annual independent assessment of the framework |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(e) | II.C.3.(e) Internal audit: Report non-adherence to the audit committee |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(f) | II.C.3.(f) Internal audit: Quality assurance program |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(g) | II.C.3.(g) Internal audit: Talent and staffing for internal audit |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(h) | II.C.3.(h) Internal audit: Talent management processes (II.L) |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.C.3.(i) | II.C.3.(i) Internal audit: Compensation and performance management (II.M) |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.D | II.D Written strategic plan |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.E | II.E Risk appetite statement |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.F | II.F Concentration and front line unit risk limits |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.G.1 | II.G.1 Annual board approval of the risk appetite statement |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.G.2 | II.G.2 Communicating and reinforcing the risk appetite |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.G.3 | II.G.3 Quarterly IRM monitoring of risk profile against appetite |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.G.4 | II.G.4 Quarterly front line monitoring of unit limits |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.G.5 | II.G.5 IRM monitoring of front line limit compliance |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.H.1 | II.H.1 Identify limit breaches |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.H.2 | II.H.2 Distinguish breaches by severity |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.H.3 | II.H.3 Escalation protocols including the OCC |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.H.4 | II.H.4 Written description of breach resolution |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.H.5 | II.H.5 Accountability and consequences for breaches |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.I | II.I Concentration risk management |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.J.1 | II.J.1 Data architecture and IT infrastructure for risk aggregation |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.J.2 | II.J.2 Timely aggregation and reporting of material and emerging risks |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.J.3 | II.J.3 Distribution of risk reports to decision makers |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.K | II.K Embedding appetite and limits in other processes |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.L | II.L Talent management processes |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.L.1 | II.L.1 Board talent role: Appoint the CEO, CAE and Chief Risk Executives |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.L.2 | II.L.2 Board talent role: Approve a written talent management program |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.L.3 | II.L.3 Board talent role: Assign and hold accountable talent program owners |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.M.1 | II.M.1 Compensation supporting adherence to the framework |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.M.2 | II.M.2 Front line compensation reflecting issues and remediation |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.M.3 | II.M.3 Attract and retain risk governance talent |
| occ-heightened-standards-12-cfr-part-30-appendix-d::II.M.4 | II.M.4 Prohibit incentives encouraging inappropriate risk |
III. Standards for the board of directors – OCC Heightened Standards (12 CFR Part 30, Appendix D)
| Code | Title |
|---|---|
| occ-heightened-standards-12-cfr-part-30-appendix-d::III.A | III.A Board requires an effective risk governance framework |
| occ-heightened-standards-12-cfr-part-30-appendix-d::III.B | III.B Active oversight of management and credible challenge |
| occ-heightened-standards-12-cfr-part-30-appendix-d::III.C | III.C Independent judgment of each director |
| occ-heightened-standards-12-cfr-part-30-appendix-d::III.D | III.D At least two independent directors |
| occ-heightened-standards-12-cfr-part-30-appendix-d::III.E | III.E Ongoing training program for all directors |
| occ-heightened-standards-12-cfr-part-30-appendix-d::III.F | III.F Annual board self-assessment |
Your Compliance Coverage
If you comply with OCC Heightened Standards (12 CFR Part 30, Appendix D), you already cover:
Protective Security Policy Framework (PSPF) Release 2026
4%
3 controls mapped
Compare →FFIEC IT Examination Handbook
4%
3 controls mapped
Compare →ISO/IEC 27557:2022 - Organisational Privacy Risk Management
4%
3 controls mapped
Compare →+ 108 more: IEC 60601-1 - Medical Electrical Equipment Safety (4%), Annex 11 to EU GMP - Computerised Systems (4%)
See all 111 mapped frameworks ↓Maps to 111 other frameworks
Coverage is not the same as your position
This page shows what OCC Heightened Standards (12 CFR Part 30, Appendix D) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is OCC Heightened Standards (12 CFR Part 30, Appendix D) and who does it apply to?
OCC Heightened Standards (12 CFR Part 30, Appendix D) is a compliance framework from United States (OCC: national banks, Federal savings associations, Federal branches) with 3 domains and 63 controls. The OCC's heightened standards for large national banks, Federal savings associations and Federal branches (12 CFR part 30, appendix D), as in force on 25 September 2026: a written risk governance framework designed by independent risk management and approved by the board, the duties of front line units, independent risk management and internal audit, the strategic plan, risk appetite statement, limits and breach handling, concentration risk, risk data aggregation, talent and compensation, and the board's oversight, independence, training and self-assessment. Reputation risk left the framework's scope on 9 June 2026; the December 2025 proposal to raise the threshold from $50 billion to $700 billion is recorded, not yet final. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does OCC Heightened Standards (12 CFR Part 30, Appendix D) actually require?
OCC Heightened Standards (12 CFR Part 30, Appendix D) has 63 controls organised across 3 domains. The largest domains are II. Standards for the risk governance framework – OCC Heightened Standards (12 CFR Part 30, Appendix D) (53 controls), III. Standards for the board of directors – OCC Heightened Standards (12 CFR Part 30, Appendix D) (6 controls), I. Introduction: scope, parent frameworks and independence structures – OCC Heightened Standards (12 CFR Part 30, Appendix D) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of OCC Heightened Standards (12 CFR Part 30, Appendix D) do I already cover?
OCC Heightened Standards (12 CFR Part 30, Appendix D) maps to 111 other compliance frameworks. The top mapping partners are Protective Security Policy Framework (PSPF) Release 2026 (4% coverage), FFIEC IT Examination Handbook (4% coverage), ISO/IEC 27557:2022 - Organisational Privacy Risk Management (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement OCC Heightened Standards (12 CFR Part 30, Appendix D)?
Start your OCC Heightened Standards (12 CFR Part 30, Appendix D) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about OCC Heightened Standards (12 CFR Part 30, Appendix D) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 63 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required