BPI Comments on OCC Availability of Information Proposal

The Bank Policy Institute^[1] is submitting this comment letter on the proposal issued by the OCC to revise its disclosure framework concerning non-public OCC information.^[2] We support the OCC's policy objectives of balancing the confidentiality of NPOI with supervised entities' business needs to disclose information. Our recommendations in this letter are aimed at creating clearer standards that are consistently and rationally applied to supervised entities, while also promoting the important public policy underlying the regulatory restrictions on disclosure of NPOI.

Maintaining appropriate confidentiality of NPOI and confidential supervisory information is important, but the current rules are not well calibrated to that goal. Indeed, as the proposal acknowledges, "the current NPOI disclosure framework . . . hampers a supervised entity's ability to effectively manage its operations by significantly limiting its ability to share information in legitimate situations."^[3]

It is also essential that NPOI and CSI be defined reasonably and with precision because whether information is subject to the NPOI framework affects the day-to-day operations of supervised institutions. The mechanisms that permit sharing of confidential information should operate without creating undue burden. Institutions routinely handle confidential information and dedicate significant resources to compliance programs designed to minimize the risk of improper handling or disclosure of confidential information. Nonetheless, maintaining control over the dissemination of ordinary course communications between banks and regulators may be challenging and create compliance risk.

The proposal would make many necessary changes to the OCC's current regulations regarding NPOI and CSI to address these issues. The proposal acknowledges that the current regulations do not accommodate business relationships and impose unnecessary administrative burdens.^[4] These reforms are particularly important because the existing framework impedes ordinary governance, legal, compliance, and risk-management activities, even where the limited sharing of CSI would present little or no meaningful safety and soundness risk.

While BPI supports these changes, additional changes are necessary to fully accomplish the policy objectives set forth in the proposal. Most importantly, the OCC, FDIC, and Federal Reserve should align their respective rules governing the disclosure of CSI. We strongly encourage the OCC and FDIC to coordinate their concurrent rulemakings to ensure that their final rules are consistent and establish a common framework.

I. Executive Summary

BPI supports the OCC's effort to modernize its regulations governing the disclosure of NPOI and CSI and welcomes several important updates. In particular, the proposal would permit supervised entities to share CSI without prior OCC approval with recipients that commonly need such information for legitimate purposes, including affiliates, service providers, prospective senior officers, transaction counterparties and advisers, the FDIC and Federal Reserve, and banking trade associations.

These proposed changes are positive developments. For example, the current rules require that a supervised entity obtain OCC approval before sharing CSI with its affiliates. This creates unnecessary internal friction while doing little to reduce the risk of inappropriate or inadvertent disclosure of CSI. Allowing banks to share such information with affiliates without prior approval would eliminate that friction without materially increasing the risk of improper disclosure.

To fully achieve the proposal's objectives, however, the OCC should make several targeted revisions. The final rule should define NPOI and CSI clearly, narrowly, and with precision. Institution-generated business, governance, risk management, legal, accounting, and remediation materials should not become CSI in the institution's hands, or otherwise become subject to restrictions on the institution's use or disclosure, merely because they are provided to, discussed with, or reviewed by the OCC, though the OCC should be restricted from disclosing any confidential materials an institution provides to it. Further, the OCC should revise the definition of confidential commercial information to align with other regulators' definition of that term.

The OCC should replace the proposed prescriptive confidentiality-agreement requirements with a principles-based framework. Further, the OCC should revise the framework for disclosure to affiliates, service providers, prospective senior officers, participants in M&A transactions, trade associations, and other supervisors. The OCC should also expand the categories of third parties that may receive CSI without prior OCC approval to include holding companies, prospective directors, majority shareholders, and contingent workers and independent contractors performing ordinary-course employee functions. In addition, the OCC should adopt a more flexible, principles-based approach to disclosures involving service providers.

The final rule should protect supervised entities' interests in their own CSI by providing notice and an opportunity to object before the OCC makes a discretionary disclosure of institution-specific CSI or confidential commercial information. The OCC should not adopt a categorical presumption favoring release of institution-identifiable CSI after 25 years but instead should promote transparency through aggregated and anonymized historical information. The rule should also permit disclosures required by law or reasonably necessary for judicial review. In addition, while BPI supports the removal of references to criminal sanctions in the proposed rule, the OCC should clarify that inadvertent or technical disclosures do not constitute criminal conduct.

Finally, the OCC, FDIC, and Federal Reserve should work together to align their regulations on CSI. The opportunity for alignment is particularly salient given the FDIC's concurrent rulemaking.

To read the full comment letter, please click here, or click on the download button below.

[1] The Bank Policy Institute is a nonpartisan public policy, research, and advocacy group that represents universal banks, regional banks, and the major foreign banks doing business in the United States. The Institute produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.

[2] OCC Rules Regarding the Availability of OCC Information, 91 Fed. Reg. 50610, 50631 (Aug. 5, 2026).

[3] Id. at 50611.

[4] Id.