The OCC wants to let banks share exam findings more widely
An OCC proposal would let national banks and federal savings associations share confidential supervisory information with service providers, affiliates, executive candidates and merger counterparties without asking first. Comments are due 5 October 2026.
Exam findings are confidential supervisory information, and the regulator decides who else a bank may show them to. On 5 August 2026 the OCC proposed to widen the list of people a national bank or federal savings association can share with on its own authority (91 FR 50610). The main changes are in 12 CFR part 4, where two subparts would be combined into one, with conforming edits to parts 5, 7, 21 and 163.
Comments are due on or before 5 October 2026.
Who could see it
Today a supervised entity may share non-public OCC information with "a limited category of service providers (attorneys, auditors, and independent auditors)." The proposal would widen that to service providers generally, if the provider is "incorporated in the United States or a U.S. territory," has a formal agreement or written contract to provide services, has a business need, and signs "a qualifying confidentiality agreement."
It would add three more categories. A bank could share with a candidate for a senior executive officer job, with board approval and a confidentiality agreement, but "cannot disclose the information to more than one potential candidate at a time per open position." A bank could share with potential counterparties in a merger during good-faith negotiations, for due diligence only, as long as it "has not disclosed CSI under this paragraph to three or more other potential counterparties." Affiliates are included too.
What's missing is the parent holding company. "Thus, the OCC decided not to adopt such an exception in the proposed rule," though it "is still considering adopting this exception in the final rule."
The OCC proposal also reworks its FOIA procedures, including expedited processing, and widens the definition of testimony.
What it could mean
For a community bank, the service provider change is the one that matters day to day. Banks hire consultants to fix exam findings, and core and technology providers often need to see an MRA to help close it. Today that can mean a request to the regulator and a wait. The proposal would make it routine, with a contract and a confidentiality agreement as the guardrails. We think that's sensible, and overdue.
It moves the burden, though. The bank would have to log which service providers received what, and it owns the confidentiality agreement. In our view this belongs inside your third-party risk process: a standard CSI clause or agreement, a short log, and someone who signs off before an exam letter goes to a vendor. That's a modest amount of work, and it's far less than you'd spend explaining a leak.
The merger provisions will interest any bank thinking about selling. Three counterparties is a tight limit for a sale process that runs a broad auction. Our guess is that for many community bank deals, where the list of realistic buyers is short, it's enough. The safeguards matter too: the proposal ties sharing to due diligence, with written acknowledgments and a waiver of claims against the OCC. If your likely partner has a different regulator, its rules on CSI may not match these, and that's worth knowing before you open a data room.
And note the OCC's gap on holding companies. If your national bank sits under a parent, the parent's board may still not be able to see exam findings without OCC approval under this proposal. That seems worth a comment.