The Office of the Comptroller of the Currency (OCC) has issued a notice of proposed rulemaking that would substantially revise its regulations governing the disclosure of non-public OCC information, including confidential supervisory information (CSI). The proposal proposes consequential changes to the way banks, their affiliates, counterparties, regulators, and the public may obtain and use supervisory information and if adopted would provide for a framework for the protection and sharing of confidential supervisory information distinct from the Federal Deposit Insurance Corporation and the Board of Governors of the Federal Reserve System.
The proposal reflects the Trump Administration’s broader emphasis on reducing unnecessary regulatory burdens, increasing transparency, and eliminating regulatory provisions that may unnecessarily chill legitimate business activity. At the same time, the OCC seeks to preserve the confidentiality necessary for effective bank supervision by replacing its current “one-size-fits-all” disclosure regime with a more nuanced framework.
Why the OCC Is Proposing These Changes
Under the OCC’s current regulations, supervised institutions generally must obtain OCC approval before disclosing virtually any non-public OCC information, including reports of examination, supervisory correspondence, and other confidential supervisory materials. According to the OCC, experience has shown that this framework is overly restrictive. The agency concludes that the existing rules frequently impede legitimate business activities, including mergers and acquisitions, relationships with affiliates, and other transactions where supervisory information may be important to informed decision-making. The OCC also believes that the current framework discourages institutions from seeking disclosure approvals because of the perceived risk associated with unauthorized disclosure.
The proposal therefore seeks to better balance two important objectives:
- protecting the confidentiality essential to effective bank supervision; and
- allowing appropriate disclosure where doing so advances legitimate business, supervisory, or governmental interests.
A New Two-Tier Framework
Perhaps the proposal’s most significant innovation is its creation of a two-tier disclosure framework.
Rather than treating all non-public OCC information identically, the OCC proposes to distinguish between:
- Confidential Supervisory Information (CSI)—a defined subset of non-public OCC information entitled to heightened protection; and
- other non-public OCC information (NPOI) that would continue to be handled under the OCC’s traditional approval process.
The OCC believes this distinction better reflects the differing sensitivity of various categories of information and allows disclosure rules to be tailored accordingly.
The most significant change for supervised institutions proposed by the rule is that banks would no longer need prior OCC approval before disclosing CSI in several specified situations, provided prescribed safeguards are satisfied.
Among other things, the proposal contemplates disclosures of confidential supervisory information without OCC consent to:
- affiliates;
- certain service providers;
- prospective merger or acquisition counterparties;
- incoming senior executive officers;
- specified governmental entities; and
- other limited circumstances identified in the proposed regulation.
Most of these disclosures would require confidentiality agreements or other safeguards designed to ensure that the information remains protected and is used only for the authorized purpose.
For disclosures outside these specified categories, the OCC would continue to review requests individually and determine whether disclosure should be permitted and under what conditions.
Clarifying What Constitutes Confidential Supervisory Information
The proposal also carefully defines “confidential supervisory information.”
CSI would generally consist of information protected under either the bank examination privilege or FOIA Exemption 8, including:
- Reports of Examination;
- supervisory correspondence;
- investigative files;
- internal supervisory memoranda; and
- testimony by current or former OCC personnel concerning supervisory activities.
Importantly, the proposal clarifies that business records created by a supervised institution for its own operational purposes generally would not become CSI merely because they were shared with the OCC, although copies maintained by the OCC in connection with supervisory activities may continue to constitute CSI.
Greater Transparency Through FOIA
The proposal also contains notable revisions to the OCC’s FOIA regulations.
Among other changes, the OCC proposes:
- expedited processing procedures for qualifying FOIA requests;
- structural revisions intended to streamline FOIA administration; and
- greater public access to certain historical supervisory materials.
One particularly noteworthy proposal would permit disclosure of records that are at least 25 years old unless the OCC determines that continued withholding remains justified under FOIA and good cause exists for maintaining confidentiality.
The OCC believes disclosure of older supervisory materials can improve public understanding of the banking system, facilitate academic research, and enhance governmental accountability while posing relatively little risk to current supervisory relationships.
Eliminating References to Criminal Penalties
Another noteworthy aspect of the proposal is its elimination of references suggesting that unauthorized disclosure of non-public OCC information may expose persons to criminal prosecution under 18 U.S.C. § 641.
The OCC explains that recent case law, together with the Administration’s policy against overcriminalization of regulatory offenses, raises substantial questions regarding the applicability of that statute in many circumstances. The agency also notes that criminal prosecutions would, in any event, fall within the Department of Justice’s authority rather than the OCC’s.
The OCC emphasizes that removing these references should reduce unnecessary chilling effects while preserving its ability to refer extraordinary cases to the Department of Justice where appropriate.
How the FDIC and Federal Reserve Address Confidential Supervisory Information
Both the Federal Deposit Insurance Corporation (FDIC) and the Federal Reserve Board (FRB) maintain their own regulatory frameworks governing confidential supervisory information, and those regimes are broadly similar in structure and philosophy, even if they differ in detail.
FDIC Framework
The FDIC’s rules governing confidential supervisory information are primarily found in its regulations implementing the Freedom of Information Act and internal policies governing examination materials.
Like the OCC, the FDIC treats examination reports, supervisory correspondence, and related materials as highly confidential and generally prohibits their disclosure without prior agency approval. The FDIC also relies heavily on the bank examination privilege and FOIA Exemption 8 to protect supervisory records from public disclosure.
The FDIC has historically maintained a more centralized, case-by-case approval process for the release of supervisory information, particularly where third parties or counterparties are involved and has often refused to permit release of examination information even if it would be useful in the sale of a troubled institution
Federal Reserve Board Framework
The Federal Reserve’s approach is similar in substance but is implemented through a combination of regulations, supervisory guidance, and internal policies applicable to the Board of Governors, the Federal Reserve Banks, and supervised institutions.
The Federal Reserve also treats supervisory information as confidential and generally restricts disclosure of examination reports, supervisory letters, and related materials. Like the OCC and FDIC, it relies on FOIA Exemption 8 and the bank examination privilege to protect supervisory communications.
The Federal Reserve has, in certain contexts, provided more structured guidance on information sharing within banking organizations and with affiliates, particularly in the context of consolidated supervision.
Are the FDIC or Federal Reserve Moving in the Same Direction?
At present, neither the FDIC nor the Federal Reserve has issued a proposal that mirrors the OCC’s rulemaking in scope or ambition.
Why This Proposal Matters
For banks and other OCC-supervised institutions, these proposed revisions could substantially simplify routine business interactions that today often require regulatory approval before supervisory information can be shared that is often impossible to obtain.
The proposal could prove especially important in:
- merger and acquisition due diligence;
- relationships with affiliates;
- engagements with third-party service providers;
- executive recruiting;
- coordination with governmental agencies; and
- other situations requiring informed evaluation of an institution’s supervisory posture.
Looking Ahead
This proposal reflects a broader shift in regulatory philosophy. Rather than viewing confidential supervisory information primarily through the lens of secrecy, the OCC seeks to adopt a more flexible framework that better accommodates legitimate business needs while preserving effective supervision.
Financial institutions, trade associations, and other interested parties should carefully review the proposal and consider submission of comments in support of the proposed regulations. If adopted substantially as proposed, it would materially change long-standing practices governing the handling of confidential supervisory information and could significantly reduce administrative burdens while promoting greater transparency regarding the OCC’s supervisory process.