Key dates
- 2026-08-05
- OCC published the proposed rule in the Federal Register (91 FR 50610)
- 2026-10-05 Deadline
- Comment period closes for the proposed rule
Suggested considerations
- Compliance teams may wish to map which internal records fall into the proposed CSI category and compare current disclosure controls against the new exceptions and safeguard requirements.
- Supervised entities may wish to review any confidentiality agreements and onward-sharing practices to determine whether they would satisfy the proposed conditions for permitted CSI disclosures.
- Legal and FOIA teams may wish to update request-handling workflows for expedited processing requests, fee-waiver appeals, and request tracking once the rule is finalized.
- Banks and other recipients of OCC information may wish to reassess litigation, government-reporting, and interaffiliate sharing procedures to ensure they align with the revised disclosure framework.
- Firms may wish to submit comments by the close of the comment period if the proposed CSI scope, disclosure exceptions, or FOIA procedures would affect their supervisory, legal, or records-management processes.
What changed
The proposal would restructure the OCC’s information-disclosure rules in 12 CFR part 4 and make conforming changes in parts 5, 7, 21, and 163. It would create a new subcategory of non-public OCC information called confidential supervisory information (CSI), clarify when supervised entities and other recipients may disclose CSI without prior OCC approval, and require applicable safeguards and, in some cases, qualifying confidentiality agreements.
The OCC also proposes to permit certain disclosures of CSI in limited circumstances to support business efficiency, government accountability, and...
Compliance impact
This is a significant consultation rather than a final rule, but it signals meaningful changes to how OCC supervisory information may be classified, shared, and protected. The OCC indicates that unauthorized disclosure remains tightly controlled and that the rule would preserve enforcement consequences while adding new, limited disclosure pathways and more structured FOIA handling.