OCC Follows FDIC In Proposing More Practical Rules For Sharing Confidential Supervisory Information

Earlier this week, the Office of the Comptroller of the Currency (“OCC”) issued a notice of proposed rulemaking (“NPR”) to amend its rules regarding disclosure of non-public and limited expansion of the ability for a bank to disclose confidential supervisory information (“CSI”) without OCC approval provided applicable safeguards are observed.

This issuance from the OCC follows a similar, but not identical NPR issuance from the Federal Deposit Insurance Corporation (“FDIC”) in June. Both proposals reflect the same basic conclusion: although CSI should remain protected from public disclosure, the current rules often require banks to seek advance regulatory approval before making routine disclosures needed to operate the institution, engage advisers or evaluate a transaction. The proposals would replace that default with specified disclosure authorizations, backed by confidentiality agreements and other safeguards. The Federal Reserve Board updated its CSI and Availability of Information rules in 2020.

The FDIC proposal would amend 12 C.F.R. Parts 306 and 309, and substantially expand the circumstances in which an FDIC-supervised insured depository institution could disclose CSI without prior FDIC approval. The general standard would permit disclosures that are "necessary or appropriate for business purposes," including disclosures to affiliates, legal counsel, accountants, auditors and qualifying service providers. The proposal also would provide comparable authority to a parent holding company that lawfully possesses the institution's confidential information—an important feature for banking organizations in which supervisory issues are often managed at the holding-company level.

Both proposals should be particularly consequential for bank mergers and acquisitions. The FDIC proposal would permit an institution to disclose CSI to potential transaction counterparties and certain representatives—including employees, auditors and legal counsel—subject to a confidentiality agreement, need-to-know restrictions and a counterparty waiver of claims against the FDIC. The disclosure could not substitute for the counterparty's independent due diligence. Before execution of a definitive transaction agreement, however, the authorization generally would be limited to three potential counterparties during a five-year period. Investment bankers are not included among the permitted representatives.

The OCC proposal follows the same general model, but is broader in purpose and considerably more detailed. The fact that the OCC proposal goes further than the FDIC proposal is consistent with Comptroller Gould’s statement at the June FDIC meeting. The OCC proposal would establish CSI as a defined subset of non-public OCC information and permit OCC-supervised entities to disclose CSI without prior approval in six circumstances: to affiliates, qualifying service providers, prospective senior executive officers, potential counterparties in specified business combinations, U.S.-based attorneys and consultants to those counterparties, and certain nonprofit organizations and trade associations. The OCC's proposal also would revise Freedom of Information Act (“FOIA”) procedures, clarify disclosures to other government agencies and remove regulatory language referring to possible criminal penalties for unauthorized disclosure.

For M&A transactions, the OCC would limit disclosure without prior approval to no more than three potential counterparties for a transaction or series of transactions. The parties would need a qualifying confidentiality agreement making the OCC a third-party beneficiary to the agreement, and the counterparty would provide an acknowledgment and waiver concerning the accuracy and completeness of the CSI. The parties also could not reference the CSI in the transaction agreement—a provision intended to prevent conditions tied to examination reports, supervisory ratings or other CSI. Unlike the FDIC proposal, the OCC's permitted U.S.-based consultants appear broad enough to include investment bankers.

The OCC proposal also contains a novel trade-association provision. A supervised entity could disclose CSI to a qualifying nonprofit organization for a discrete, time-limited project involving aggregation, research or advocacy regarding OCC supervision. That could permit trade associations to identify recurring supervisory practices while anonymizing information attributable to individual institutions. The FDIC did not propose a parallel authorization, although it requested comment on whether one should be adopted.

One notable difference is that the OCC declined, at least for now, to give parent holding companies independent authority to use the proposed disclosure exceptions, citing concerns about the OCC’s ability to oversee entities it does not supervise.

Taken together, the proposals represent a meaningful modernization of CSI rules rather than a retreat from supervisory confidentiality. The FDIC proposal focuses principally on facilitating legitimate business and transaction-related disclosures. The OCC proposal travels further, using the same reform effort to address government accountability, interagency information sharing and the use of aggregated supervisory experience to evaluate the supervisory process itself.

Comments on the FDIC proposal are due August 31, 2026. Comments on the OCC proposal will be due sixty days after publication in the in the Federal Register, which had not occurred yet as we went to press, and so will likely be sometime in early or mid-October.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.