Last week, the New York Department of Financial Services (“NYDFS”) announced a proposed new regulation that provides greater flexibility for entities licensed, chartered, authorized, registered, or supervised by the NYDFS to disclose confidential supervisory information (“CSI”) to legal counsel and independent auditors. The proposal would make NY Banking Law more consistent with federal law, which generally permits supervised institutions to share CSI, such as exam reports, with their advisors and auditors without getting approval from their regulators.

Currently, regulated entities must receive prior written approval from NYDFS each time they want to share CSI with their legal counsel or independent auditors. See Section 36.10 of the NY Banking Law (which generally provides that CSI shall remain confidential “and shall not be made public unless, in the judgment of the superintendent, the ends of justice and the public advantage will be subserved by the publication thereof”).

The new proposed regulation would permit a regulated entity to share CSI with its legal counsel or independent auditor without prior written approval from the NYDFS if there is a written agreement between the regulated entity and their counselor or auditor in which the lawyer or auditor agrees, among other things:

  • To keep such information confidential;
  • To only use disclosed CSI for the purpose of providing legal representation or auditing services to the regulated entity;
  • Not to disclose the CSI to its employees, officers, or directors except to those that “need to know” and only on the condition that they maintain confidentiality of the information;
  • To notify the NYDFS of any demand or request for the CSI and to assert on behalf of the NYDFS “all such legal privileges and protections as the [NYDFS] may request”; and
  • To obtain any required prior consent or approval from any other state or federal agency and to execute a statement affirming such consents and approvals were obtained, or if no other consents or approvals are required, so stating.

The proposed regulation also provides that the regulated entity must keep a written record of all CSI disclosed pursuant to the regulation and a copy of each written agreement.

The new proposed regulation is subject to a 60-day comment period following publication in the NY State Register later this month.