FDIC moves its comment deadline on sharing exam findings to 5 October

If you were planning to get a comment letter to the FDIC today, you have five more weeks. The FDIC's proposal to rewrite its rules on disclosing confidential information was published on 30 June 2026 (91 FR 39726) with comments due 31 August. On 28 August the FDIC extended that (91 FR 55501). Comments must now be received by 5 October 2026.

The FDIC said it had received requests for more time and agreed, "to provide interested parties with additional time to analyze the proposal and prepare comments." The proposal itself is unchanged.

We covered the OCC's similar proposal in an earlier post. This post is about what is worth saying in a comment.

A quick reminder of the FDIC version

The proposal touches 12 CFR parts 303, 306, 309, 327 and 337, and the sharing authority sits in proposed § 309.37. A bank could share without prior FDIC approval when it is "necessary or appropriate for business purposes." Affiliates and the bank's own people need no agreement in the typical case. Outside counsel, accountants and auditors, shareholders owning "over 50 percent of the voting stock," people offered a senior executive officer role and "qualifying service providers" all need a qualifying confidentiality agreement. Merger counterparties are limited to three over a five-year period unless there is a "written agreement to enter into a merger or similar transaction." A parent holding company could make the same disclosures, "to the same extent and subject to the same conditions," as the bank.

Details that deserve attention

Start with the confidentiality agreement. It must be written and governed by federal or state law, limit use to the stated purpose, bar further disclosure, and restrict access to people with a business need who are bound by it. It must also make the FDIC an "intended third-party beneficiary" able to enforce it.

The merger limit is simple to state. The three-in-five-years cap applies until a written agreement is signed.

Then there is an open question. The FDIC asks whether banks should be able to share aggregated analyses with law firms or trade associations, and says it "seeks comments on the extent to which this is an appropriate purpose." It is not proposing that yet. Separately, the proposal says it "would neither restrict nor authorize" disclosure of another federal banking agency's or a state banking authority's confidential information.

What it could mean

We'd use the extra time. Most banks will support the principle, so a letter is more useful if it sticks to practical friction.

The third-party beneficiary clause is our first candidate. Our guess is that very few vendor contracts name the FDIC as a beneficiary today, so a bank that wants to show an exam finding to its core provider would need an amendment first. If the FDIC published a short model agreement, or accepted a standard rider, most of that cost would go away. Asking for one seems reasonable.

The merger cap comes next. Three counterparties over five years sounds generous until a board talks to three possible partners, finds no deal, and wants to try again two years later. A community bank testing the market informally could hit the cap without ever getting close to a signed deal.

The aggregated analyses question is a real opening. A trade association that could see anonymised findings across many small banks might spot a pattern none of them can see alone. If you think that would help, say so. The FDIC asked.

For state banks, we think the limit on other agencies' information is the easy thing to miss. A joint exam report, or one with state findings in it, needs more thought than an FDIC-only one, and a comment asking the FDIC to work with state supervisors on matching rules would be useful.