Publications

On August 3, 2026, the Office of the Comptroller of the Currency (the “OCC”) issued a proposal to overhaul its rules on disclosing confidential supervisory information (“CSI”)—which generally refers to supervisory and examination records and correspondence protected by the bank examination privilege.^[1] The Federal Deposit Insurance Corporation (the “FDIC”) proposed similar changes at the end of June 2026.^[2] Together, these proposals would generally let covered banks and holding companies share CSI with affiliates, service providers, and merger counterparties without seeking case-by-case agency approval—a significant departure from today’s prior-approval regime. If finalized, these rules would represent the most significant updates to the agencies’ confidential information disclosure regimes in decades.

These actions are the culmination of a long-standing debate regarding the appropriate balance between the competing policy interests related to the disclosure or non-disclosure of CSI. These proposals are also a response to industry complaints that the current rules impede the ability of banks to address supervisory concerns, partner with third-party providers, or conduct appropriate merger-related due diligence.

Importantly, both proposed rules would for the first time clearly permit the sharing of CSI with counterparties in connection with potential mergers, subject to certain conditions and limitations (including limiting the sharing to no more than two potential counterparties in connection with a particular transaction). These proposed changes should give buyers and sellers greater transparency into each other’s supervisory status, help identify potential regulatory-approval hurdles earlier in the process, and provide buyers with greater visibility into regulatory or compliance weaknesses that may need to be addressed in diligence, transaction planning, valuation, or post-closing integration.

Taken together, if finalized as drafted, the OCC and FDIC proposals would move both agencies toward a more practical disclosure framework, but banks will need to manage meaningful differences in eligible recipients, confidentiality-agreement requirements, counterparty limits, and treatment of information held by holding companies.

OCC Proposal

As a first and critical step, the OCC is proposing a definition of CSI that provides important clarity to what has historically been a confusing concept. The proposed rule defines CSI as information that is exempt from disclosure under either (1) FOIA Exemption 5 (5 U.S.C. § 552(b)(5)) (privileged interagency or intra-agency memoranda or letters) in connection with the bank examination privilege; or (2) FOIA Exemption 8 (5 U.S.C. § 552(b)(8)) (information contained in or related to certain examination, operating, or condition reports concerning financial institutions, which is commonly known as the bank examination exemption). The proposal goes on to give four examples of CSI, including:

• records created or obtained by the OCC in connection with the performance of its responsibilities;
• records compiled by the OCC in connection with its enforcement responsibilities;
• an examination report, supervisory correspondence, agency investigatory file, and any internal agency memorandum (whether in the possession of the OCC or any other person); and
• sworn statements or deposition testimony from a current or former employee, officer, or agent of the OCC related to their work.

The proposal also would establish a specific exemption from the definition of CSI for information that (1) is in the supervised entity’s own possession; (2) was not prepared for a federal banking agency in response to the applicable agency’s supervisory or enforcement activities; and (3) is not supervisory feedback from a federal banking agency or information on the enforcement activities of these agencies, or a summary of such information. The OCC proposal states that this exemption “means that the same business plan can be both CSI, when in the possession of the OCC, and not CSI, when in the possession of the supervised entity.” The line between CSI and non-CSI for bank-produced work product has been ambiguous and hotly debated given the OCC’s extensive access to bank information. Although this is helpful in straightforward situations, it isn’t clear that the proposed exemption materially clarifies the line between CSI and non-CSI in more nuanced situations where internal bank documents discuss regulatory or compliance issues.

The OCC proposed rule would permit national banks to share certain CSI without prior approval “when necessary or appropriate for the efficacy of the supervision process.” The OCC concluded that the current approach “hampers a supervised entity’s ability to effectively manage its operations by significantly limiting its ability to share information in legitimate situations, such as in negotiating a business combination or with an affiliate.”

Under the proposal, national banks may share CSI without OCC approval within six categories of recipients if certain safeguards and limitations are satisfied.

Note that several categories would require a “qualifying confidentiality agreement” between the party receiving the information and the bank. The OCC’s proposal would require the agreement to include provisions that could be problematic for third-party service providers, including acknowledging and consenting to regulation and enforcement by the OCC to the same extent as if the service was being performed by the bank itself. The OCC’s proposal did not discuss any deficiencies in the current arrangements between banks and their service providers.

This new requirement will likely be controversial and make it more difficult for banks to retain legal counsel, professional consultants, or auditors.

The OCC will continue to make determinations on disclosure of information that does not fall into these categories on a case-by-case basis and, if disclosure is permitted, any applicable safeguards. The process for sharing CSI with other regulators is also clarified in the proposal—requiring advance written notice to the OCC (15 days for sharing with the Federal Reserve and FDIC; 30 days for other agencies), during which the OCC can object. The proposal would also permit disclosure of CSI in response to FOIA requests after 25 years. The OCC did not propose extending these exceptions to parent holding companies holding CSI with respect to their subsidiary national banks, though it is asking for comments on doing so.

Importantly, the OCC’s proposal also drops references in the current rule to criminal penalties for unauthorized disclosure. This is in response to the current Administration’s Executive Order relating to overcriminalization of regulatory offenses.^[3]

FDIC Proposal

The FDIC proposal also takes meaningful actions to expand the ability of state non-member banks and the FDIC to share what it refers to as “confidential information.” The FDIC’s proposal defines “confidential information” broadly but, unlike the OCC proposal, does not take the extra step of specifically defining CSI. Under the FDIC proposal, “confidential information” would mean any FDIC record or other FDIC information in any form that is exempt from disclosure under FOIA, and any information derived from or related to such FDIC record or information. The proposal states that this includes, but is not limited to:

• Information about the FDIC’s supervision or resolution of depository institutions and financial companies;
• Information about the FDIC’s enforcement of laws and regulations; and
• Information about consumer complaints received by the FDIC.

The definition carves out two categories of information from the scope of “confidential information”:

• Documents prepared by or for an insured depository institution, or any other party, for its own business purposes that are in its own possession—even if copies of the same documents in the FDIC’s possession would otherwise qualify as confidential information; and
• Final orders, amendments, or modifications of final orders, or other actions or documents specifically required to be published or made publicly available under 12 U.S.C. 1818(u), the Community Reinvestment Act, or other applicable law.

Similar to the OCC’s parallel exemption, it isn’t clear that the FDIC’s proposed exemption materially clarifies the line between CSI and non-CSI in more nuanced situations where internal bank documents discuss regulatory or compliance issues.

The FDIC’s current approach to sharing CSI is more limited than either the OCC’s or the Federal Reserve’s. As a result, the proposal would meaningfully expand the situations where state non-member banks may share information without prior FDIC approval.

Similar to the OCC proposal, several categories would require a “qualifying confidentiality agreement.” The FDIC’s proposed definition of “qualifying confidentiality agreement” is less prescriptive than the OCC’s proposed definition discussed above.

The FDIC proposal also would permit disclosure of CSI by a state non-member bank after 25 years. The FDIC did propose extending these exceptions to parent holding companies legally holding CSI with respect to their subsidiary state non-member banks.

The FDIC’s proposed rule includes a new process that would permit key FDIC staff or the Chairman of the FDIC to disclose CSI or permit the disclosure of CSI outside of the categories listed above if there is “good cause.” “Good cause” is defined as a non-exhaustive list of factors, including:

• whether disclosure will serve a legitimate regulatory, supervisory, resolution, or law enforcement purpose;
• whether there is another source for the confidential information;
• whether disclosure of the confidential information is unduly burdensome or otherwise may adversely affect or prejudice the FDIC, its mission, or its operations;
• the scope and nature of the confidential information;
• the recipient’s intended use of the confidential information;
• whether disclosure is lawful;
• whether the confidential information includes privileged information, trade secrets, or confidential commercial or financial information; and
• whether disclosure would present safety and soundness or financial stability risks.

Practical Implications for Banks

If finalized, these proposed changes would materially enhance the ability of national banks and state non-member banks to share CSI within and outside of their organizations in ordinary-course business, vendor-management, executive-hiring, advocacy, and transaction contexts. Given these proposals by the OCC and the FDIC, it is possible the Federal Reserve will also look to amend its regulations to permit additional flexibility in the sharing of CSI for holding companies and member banks. Optimally, all three banking agencies would coordinate their final rules for administrative ease and transparency, and to avoid unnecessary confusion between the application of the different regimes.

Given the scope of the proposed amendments and the differences between the OCC and FDIC frameworks, banks should consider developing a plan to:

• Inventory policies, procedures, controls and recordkeeping related to the sharing of CSI;
• Update these policies, procedures and controls;
• Review the listed categories of counterparties and catalog whether additional actions will be necessary to ensure full compliance with the proposed conditions for sharing CSI, including potential amendments to information-sharing agreements.

Please contact us if you have any questions regarding these proposed rulemakings or need assistance reviewing your bank’s information-sharing procedures.

[1] https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-65.html.

[2] https://www.fdic.gov/news/press-releases/2026/fdic-board-approves-proposal-amend-regulations-regarding-disclosure.

[3] Executive Order 14294, “Fighting Overcriminalization in Federal Statutes” (May 9, 2025).