The banking industry is lowering its standards for underwriting loans and letting more credit risk seep back into the financial system, according to a new report from a top federal regulator.

The Office of the Comptroller of the Currency published its semi-annual risk perspective Wednesday, an overview of national banking activity and the amount of risk floating around the financial system. The OCC said credit risk is now rising, after several years of banks trying to reduce risk and clean up bad loans they made prior to the financial crisis in 2008.

“Examiners have observed erosion in the underwriting standards” for a variety of loans, the report said. “Recent examinations of commercial loan portfolios have identified an increase in policy and underwriting exceptions, including some examples of risk layering” such as waiving guarantees or offering extended repayment terms. The OCC singled out mid-sized and community banks in particular, and said they are loosening standards in response to competitive pressures.

The OCC went on to tut-tut banks for various poor risk management practices, such as cutting back on control practices or outsourcing critical control functions to third parties without proper oversight. The twin threats of more competitive pressure and a fast-changing technology environment, the report said, increase the chance that banks might stumble over operational risks; cyber-security threats are another problem and only getting worse, the report added.

Large banks are under pressure thanks to low interest rates squeezing income, but their most pressing risks are more around anti-money laundering compliance and third-party arrangements that might concentrate risks beyond comfortable levels, the report continued.

In contrast, smaller banks face higher strategic risks as they struggle to figure out new ways to make money in a low-interest world, when they don't have the trading power that large banks do. Erosion of banking standards, sophisticated cyber-attacks, and management succession are all other key operational risks these days.