OCC Issues Guidance to Banks on Sharing Consumer Data with Government Agencies and Complying with Executive Order 14331

On September 8, in light of a report by the House Judiciary Committee and the Select Subcommittee on the Weaponization of the Federal Government concluding that certain Office of the Comptroller of the Currency (OCC) regulated financial institutions coordinated with federal law enforcement to surveil and share private financial information of individuals that may have participated in the events of January 6, 2021 or who held views associated with conservatism, the OCC issued a bulletin reminding banks of their legal obligation to protect customers’ financial information under the Right to Financial Privacy Act (RFPA), which generally prohibits the sharing of consumer financial information with government authorities, unless the government authority certifies in writing that it has complied with the RFPA by obtaining proper authorization and providing proper notice to consumers. The OCC also cautioned banks not to use Suspicious Activity Report filings to improperly disclose consumer financial information. Finally, the OCC advised banks to review Executive Order 14331 (Guaranteeing Fair Banking for All Americans) and adjust their policies and procedures as needed to ensure that no American is denied access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views, and to ensure that politicized or unlawful debanking is not used as a tool to inhibit such beliefs, affiliations, or political views.

On September 8, the OCC issued a bulletin clarifying that, consistent with Executive Order 14331 (Guaranteeing Fair Banking for All Americans), politicized or unlawful debanking, and a bank’s record of policies and procedures designed to avoid engaging in politicized or unlawful debanking, will be factored into the OCC’s evaluation of licensing filings by banks seeking to engage in various corporate activities and entities seeking a federal charter or license. When assessing an insured bank’s performance under the Community Reinvestment Act (CRA), the OCC may also consider whether a bank has engaged in politicized or unlawful debanking in determining the bank’s CRA rating. Accordingly, the OCC intends to clarify these principles as relevant in the normal course of updating the booklets of the Comptroller’s Licensing Manual, the “Community Reinvestment Act Examination Procedures” booklet of the Comptroller’s Handbook, and relevant regulations.

On August 29, the Federal Deposit Insurance Corporation (FDIC) announced an update to its Consumer Compliance Examination Manual to reflect that it will now evaluate potential discrimination under the Equal Credit Opportunity Act and Fair Housing Act only through overt or comparative evidence of disparate treatment, removing all references to disparate impact analysis. This update follows the issuance of Executive Order 14281 (Restoring Equality of Opportunity and Meritocracy), which forbade federal agencies from applying disparate impact liability in all contexts. This change applies to the FDIC and all FDIC-supervised institutions.

On September 8, the FDIC updated its Formal and Informal Enforcement Actions Manual to relax the agency’s minimum standards for terminating cease-and-desist and consent orders issued under the Federal Deposit Insurance (FDI) Act. Section 8(b) of the FDI Act allows the FDIC to issue a cease-and-desist order if an action is not contested and the facts reasonably support the conclusion that an insured depository institution (IDI) has engaged, or is about to engage in unsafe or unsound practices, or a violation of a law, regulation, written agreement with the FDIC, or written condition imposed by the FDIC in connection with an application or another request. The previous policy, adopted in 2022, did not allow for the termination of a cease-and-desist order unless the IDI was in full compliance with the order. Now, such orders may be considered for termination if: (1) the IDI has achieved at least substantial compliance with the order; (2) the order is no longer applicable to the IDI’s current circumstances (e.g., the IDI is closed, self-liquidated, or merges with another entity); or (3) deterioration leads to the issuance of a new or revised formal action. Termination may also be considered if a regional office believes that an exception should be granted and it obtains concurrence from the Washington office to terminate an order.