US OCC Proposes Changes to CSI Rules

The US Office of the Comptroller of the Currency (OCC) has issued a notice of proposed rulemaking that would substantially revise how it handles non-public information, including confidential supervisory information (CSI).

The proposal creates a two-tier disclosure framework distinguishing CSI from other non-public OCC information (NPOI). Banks would be permitted to disclose CSI without prior OCC approval in six specified circumstances, including to affiliates, certain service providers, prospective senior executives, and potential counterparties to business combinations, subject to safeguards that vary by recipient. 

Separate provisions would streamline the sharing of CSI with the Federal Reserve, the Federal Deposit Insurance Corporation, and other federal agencies. Non-CSI NPOI would generally not be subject to further disclosure restrictions unless the OCC imposes them.

The proposal also clarifies that a bank’s own business records do not become CSI merely because they are shared with the OCC. Information created for the bank’s own purposes can remain outside the CSI definition while in the bank’s possession, even where a copy provided to the OCC in a supervisory context is treated as CSI. On Freedom of Information Act requests, the OCC would formalize expedited processing procedures and generally release NPOI created or received at least 25 years earlier unless a FOIA exemption applies and the agency finds good cause to withhold it.

Separately, the OCC would remove references in its rules to potential criminal penalties under 18 U.S.C. § 641 for unauthorized disclosure of NPOI. The agency cites recent case law, the Department of Justice’s jurisdiction over such violations, and the current Administration’s policy against “overcriminalization” of federal laws. The change would not prevent the OCC from referring an unauthorized disclosure to the Justice Department where appropriate.