Federal Regulators Propose a Substantial Overhaul of Confidential Information Regulations

The Federal Deposit Insurance Corp. (FDIC) and the Office of the Comptroller of the Currency (OCC) recently proposed the first significant updates in decades to their rules governing confidential supervisory information (CSI). The notices of proposed rulemaking issued within weeks of each other, seek to “update, clarify, and supplement” the rules regarding the disclosure of FDIC CSI and “establish a more nuanced approach” to the OCC’s disclosure framework.” Perhaps most significantly for institutions supervised by the agencies, the proposed rules would expand institutions’ ability to disclose CSI, including to certain service providers and potential merger partners, without the agencies’ pre-approval. Comments on the FDIC’s proposed rule, which includes 30 specific questions posed by the FDIC, are due by August 31, 2026, and comments on the OCC’s proposed rule, which includes 21 questions of its own, are due by October 5, 2026.

Structurally, the FDIC’s proposed rule would reorganize Part 309 of the FDIC’s regulations into four subparts and would relocate the service-of-process rules to a new Part 306. The OCC’s proposed rule would simplify Part 4 of its regulations by combining subparts B and C, which currently govern Freedom of Information Act (FOIA) requests and the disclosure of otherwise-exempt non-public OCC information (NPOI), respectively.

The proposed rules are in many regards similar and reflect coordination between the agencies. Most significantly, both proposals would relax prohibitions on the disclosure of CSI to allow disclosure to specified recipients under certain circumstances discussed below. Both proposals would also update the process for submitting and responding to FOIA requests and would clarify the agencies’ handling of confidential commercial information. The FDIC’s proposed rule also adds general policy statements and updates its procedures for seeking disclosure of CSI in third-party legal proceedings, while the OCC’s proposal creates a new CSI subcategory of NPOI that captures materials exempt from disclosure under sections (b)(5) (privileged interagency or intra-agency memoranda or letters) and (b)(8) (bank examination exemption) of the FOIA; only such CSI would be subject to the new relaxed disclosure provisions. Both proposals would also update or add relevant definitions and make technical and conforming changes.

While all of the proposed changes have potentially significant ramifications for depository institutions and other interested parties, it is the revised provisions regarding permitted disclosures of CSI that likely will have the greatest daily impact on agency-supervised institutions.

The details of each proposed rule differ in certain respects, but, broadly speaking, both would allow institutions supervised by the agencies to disclose CSI to the following categories of recipients, provided that certain conditions are met:

• Affiliates of the institution.
• Service providers (e.g., legal counsel, auditors, IT providers — limited to U.S. service providers in the case of the OCC).
• Individuals under consideration for a position as a senior executive officer.
• Potential merger counterparties and certain of their advisors, with quantitative limits.

Both proposals would also allow for presumptive disclosure of certain materials 25 years old, although the OCC’s version covers only its own disclosures while the FDIC’s draft would allow for disclosures by institutions. There are also substantive differences between the two proposed rules. The FDIC would permit sharing with greater-than-50% shareholders, as well as sharing by holding companies on the same terms as their subsidiary banks, while the OCC only asks for feedback on such terms. Conversely, the OCC would allow for anonymized sharing with non-profits, while the FDIC merely solicits comments on the idea. All disclosures would be subject to safeguards, such as a legitimate-need test and nondisclosure agreements, among other restrictions.

It is important to note that while the proposed rules are similar in many ways, there are important distinctions and nuances that institutions should carefully review. Further, parties not on the pre-authorized list would still require agency approval to receive non-public agency information.

The proposed rules should come as a welcome development for agency supervised institutions. While the OCC and other prudential regulators have long permitted some of these disclosures, such as to auditors and counsel, the FDIC’s regulations have always been much more restrictive. Further, the provisions allowing sharing with merger partners and potential executive hires are innovative and address a significant pain-point for banks. Interested parties should review the details of the new provisions, as well as the specific questions posed by the agencies and determine whether to comment.