FDIC Proposed Rule on Disclosure of Information

FEDERAL DEPOSIT INSURANCE CORPORATION 12 CFR Parts 303, 306, 309, 327 and 337 RIN 3064–AG30 Disclosure of Information AGENCY: Federal Deposit Insurance Corporation. ACTION: Notice of proposed rulemaking. SUMMARY: The Federal Deposit Insurance Corporation (FDIC) is inviting comment on a notice of proposed rulemaking that would update, clarify, and supplement the FDIC’s regulations regarding the disclosure of confidential information by the FDIC and other parties, including by enhancing the ability of insured depository institutions to share confidential supervisory information with affiliates and certain other entities for appropriate business purposes, without seeking prior authorization from the FDIC. The proposal also would significantly simplify and clarify the requirements and restrictions applicable to the FDIC’s discretionary disclosure of confidential information. Finally, the proposal would update and simplify the FDIC’s rules regarding disclosures required under the Freedom of Information Act and would clarify how and when FDIC information may be disclosed in connection with legal proceedings and as a result of service of process made upon the FDIC and its directors, officers, and employees. DATES: Comments must be received by the FDIC no later than August 31, 2026. ADDRESSES: Comments should be directed to the FDIC, identified by RIN 3064–AG30, by any of the following methods:

Agency Website: https://
www.fdic.gov/resources/regulations/ federal-register-publications/. Follow instructions for submitting comments on the FDIC website.
Mail: Jennifer M. Jones, Deputy
Executive Secretary, Attention:
Comments—RIN 3064–AG30, Federal Deposit Insurance Corporation, 550 17th Street NW, Washington, DC 20429.
Hand Delivered/Courier: Comments
may be hand-delivered to the guard station at the rear of the 550 17th Street NW building (located on F Street NW) on business days between 7 a.m. and 5 p.m.
Email: comments@FDIC.gov.
Include RIN 3064–AG30 on the subject line of the message.
Public Inspection: Comments
received, including any personal information provided, may be posted without change to https://www.fdic.gov/ resources/regulations/federalregister publications/. Commenters should submit only information that the commenter wishes to make available publicly. The FDIC may review, redact, or refrain from posting all or any portion of any comment that it may deem to be inappropriate for publication, such as irrelevant or obscene material. The FDIC may post only a single representative example of identical or substantially identical comments, and in such cases will generally identify the number of identical or substantially identical comments represented by the posted example. All comments that have been redacted, as well as those that have not been posted, that contain comments on the merits of this notice will be retained in the public comment file and will be considered as required under all applicable laws. All comments may be accessible under the Freedom of Information Act. This proposal, all comments received, and a summary of not more than 100 words of the proposed rule pursuant to the Providing Accountability Through Transparency Act of 2023, 5 U.S.C. 553(b)(4), are available at https:// www.fdic.gov/federal-registerpublications. FOR FURTHER INFORMATION CONTACT:
Sonya L. Allen, Regional Counsel, (816) 234–8036, soallen@fdic.gov, Bruce W. Hickey, Senior Counsel, (202) 898–6748, brhickey@fdic.gov, Andrew A. Lubash, Senior Attorney, (703) 562–6209, anlubash@fdic.gov, Legal Division. SUPPLEMENTARY INFORMATION:
Table of Contents
I. Background and Policy Objectives
II. Proposed Amendments to 12 CFR Part 309
A. Organization, Scope, and Purpose B. Disclosure of Information Under the Freedom of Information Act

Overview
Definitions
Making a Records Request to the FDIC
Under FOIA
FDIC Practices for Processing,
Reviewing, and Responding to FOIA Requests
Fees for FOIA Requests
Dispute Resolution and Administrative
Appeals
Supplemental Procedures for
Confidential Commercial Information
C. Discretionary Disclosure of Confidential
Information
Overview
Purpose, Scope, and General
Requirements
Definitions
The ‘‘Good Cause’’ Standard
Procedure for Requesting Discretionary
Disclosure
Disclosure by the FDIC
Disclosure of FDIC Confidential
Information by Insured Depository Institutions and Their Parent Holding Companies a. General Disclosure Authorizations b. Disclosure of Historical Information
c. Disclosure of Confidential Information
by Parent Holding Companies d. Disclosure of Data for Aggregated Analyses
Disclosure of FDIC Confidential
Information by Service Providers and Other Persons D. Disclosure of Confidential Information in Legal Proceedings in Which the FDIC Is Not a Party
Overview and Scope
Definitions
Use and Request of FDIC Information in
a Non-Party Legal Proceeding
Decisions on Requests
Waiver of Requirement for Requests
III. New Part 306 on Service of Process
A. Overview, Purpose, and Scope B. Definitions
C. Service of Process Requirements and
Processes
IV. Technical Amendments to Other Parts of
the FDIC’s Regulations
V. Expected Effects
A. Scope of Affected Entities B. Expected Benefits
Discretionary Requests To Disclose
Confidential Information
Other Changes
C. Expected Costs
D. Conclusion
VI. Matters of Regulatory Procedure
A. Regulatory Flexibility Act B. Paperwork Reduction Act
C. Riegle Community Development and
Regulatory Improvement Act D. Executive Orders 12866 and 14192
I. Background and Policy Objectives
The FDIC’s regulations set forth procedures, requirements, and restrictions for the disclosure of information by the FDIC and by other parties, including insured depository institutions, that may be in possession of the FDIC’s confidential information. These include rules related to disclosure by the FDIC of information under the Freedom of Information Act (FOIA), disclosure by the FDIC and other parties of information that is confidential and exempt from disclosure under FOIA, and information related to legal proceedings (collectively, the information disclosure regulations). The FDIC has not significantly revised the information disclosure regulations in approximately 30 years. As a result, the FDIC’s current information disclosure regulations (1) do not reflect or appropriately accommodate the business relationships and transactions that often give rise to a need by insured depository institutions to disclose the information subject to these provisions; (2) include administrative impediments to disclosing information that are

unnecessarily burdensome and may produce inconsistent results; (3) use terms that are outdated or vague; and (4) impose additional restrictions on the disclosure of confidential information by insured depository institutions that are not imposed under information disclosure regulations of the other federal banking agencies. The proposal seeks to address these and other issues, including by providing flexibility to FDIC-supervised institutions to disclose information they commonly seek to share with certain third parties without prior approval of the FDIC and significantly reorganizing the FDIC’s information disclosure regulations. The FDIC invites comments on all aspects of the proposal, including ways the information disclosure regulations could be revised to further improve their clarity and reduce administrative burden.
II. Proposed Amendments to 12 CFR
Part 309
A. Organization, Scope, and Purpose
Part 309 of the FDIC’s regulations sets
forth the FDIC’s policies regarding the information it maintains and the procedures for obtaining access to such information. Part 309 addresses, among other information disclosures, both requests from the public for FDIC information subject to FOIA and requests from insured depository institutions and other parties to disclose FDIC confidential information to third parties or to receive such information from the FDIC. As noted in section I of this Supplemental Information, part 309 has not been significantly amended in approximately 30 years. In that time, through its processing of requests for information under FOIA and its interactions with insured depository institutions and other parties seeking to disclose or receive FDIC confidential information, the FDIC has observed that
part 309, both in its structure and
content, has led to confusion among stakeholders and does not appropriately balance the need to protect sensitive, confidential information with the benefits of allowing greater transparency and access to information in appropriate circumstances. To address these concerns and improve the FDIC’s information disclosure regulations, the proposal would reorganize part 309 into the following four subparts: (1) subpart A describes general aspects of the regulation, including the rule’s scope and organization; (2) subpart B sets forth the FDIC’s FOIA policies and procedures; (3) subpart C establishes the FDIC’s policies and procedures regarding discretionary disclosures of confidential information exempt from FOIA, including circumstances when an insured depository institution may disclose FDIC confidential information in its possession without the FDIC’s prior approval; and (4) subpart D describes the FDIC’s policies and procedures regarding disclosure of confidential information in connection with legal proceedings. As discussed later in this Supplemental Information, the FDIC’s service of process regulations that currently appear in part 309 would be relocated to proposed part 306. The following table summarizes the proposal’s changes to the content and organization of the FDIC’s information disclosure regulations. Current rule Proposed rule General Provisions Subpart A 12 CFR 309.1–12 CFR 309.2 12 CFR 309.1 12 CFR 309.1—Purpose and scope ........................................................ 12 CFR 309.1—Purpose and scope. 12 CFR 309.2—Definitions ....................................................................... 12 CFR 309.11 (Subpart B) 12 CFR 309.31 (Subpart C). 12 CFR 309.51 (Subpart D). 12 CFR 306.2. FOIA Provisions Subpart B—FOIA 12 CFR 309.3 to 12 CFR 309.5 12 CFR 309.10–12 CFR 309.24 X ............................................................................................................... 12 CFR 309.10—Scope. 12 CFR 309.3—Federal Register publication ......................................... X. 12 CFR 309.4—Publicly available records .............................................. 12 CFR 309.12—FDIC information that may be made available on request. 12 CFR 309.5—Procedures for requesting records ................................ (See below). 12 CFR 309.5(a)—Definitions .................................................................. 12 CFR 309.11—Definitions. 12 CFR 309.5(b)—Making a request for records .................................... 12 CFR 309.13—Making a request for records.
12 CFR 309.5(c)—Defective requests .....................................................
12 CFR 309.5(d)—Processing requests .................................................. 12 CFR 309.14—Processing requests—in general. 12 CFR 309.15—Processing requests—expedited processing. 12 CFR 309.5(e)—Providing responsive records .................................... X. 12 CFR 309.5(f)—Fees ............................................................................ 12 CFR 309.17—Fees in general. 12 CFR 309.18—Types of fees. 12 CFR 309.19—Charging fees. 12 CFR 309.20—Payment of fees. 12 CFR 309.21—Waiver or reduction of fees. 12 CFR 309.5(g)—Exempt information .................................................... X. 12 CFR 309.5(h)—Dispute resolution ...................................................... 12 CFR 309.22—Dispute resolution. 12 CFR 309.5(i)—Appeals ....................................................................... 12 CFR 309.23—Administrative appeals. 12 CFR 309.5(j)—Records of another agency ........................................ 12 CFR 309.16—Consultations and referrals. X ............................................................................................................... 12 CFR 309.24—Supplemental procedures for confidential commercial information.

Current rule Proposed rule Disclosure of Exempt Records Subpart C—Discretionary Disclosure of Confidential Information 12 CFR 309.6 12 CFR 309.30–12 CFR 309.39 X ............................................................................................................... 12 CFR 309.30—Purpose and scope. X ............................................................................................................... 12 CFR 309.31—Definitions. 12 CFR 309.6(a)—Disclosure prohibited ................................................. 12 CFR 309.32—Disclosure prohibited. 12 CFR 309.6(b)—Disclosure authorized ................................................ 12 CFR 309.33—Disclosure authorized; limitations. 12 CFR 309.34—Procedure for requesting discretionary disclosure. 12 CFR 309.35—Standard for discretionary disclosure. 12 CFR 309.6(b)(1) through (b)(6)—(Disclosures by the FDIC to enumerated parties). 12 CFR 309.36—Disclosure by the FDIC. 12 CFR 309.6(b)(7)—Authorization for disclosure by depository institutions or other third parties. 12 CFR 309.37—Disclosure by insured depository institutions and certain other entities. X ............................................................................................................... 12 CFR 309.37(a)—Disclosure by insured depository institutions. X ............................................................................................................... 12 CFR 309.37(b)—Disclosure by insured depository institutions of confidential information created over twenty-five years ago. X ............................................................................................................... 12 CFR 309.37(c)—Disclosure by parent holding companies. 12 CFR 309.6(b)(7)(i) ............................................................................... 12 CFR 309.37(d)—Disclosure by insured depository institutions and parent holding companies to other persons. X ............................................................................................................... 12 CFR 309.37(e)—Disclosure by service providers to insured depository institution partners. 12 CFR 309.6(b)(7)(ii)—Disclosure by third parties ................................. 12 CFR 309.38—Disclosure by other persons. 12 CFR 309.6(b)(7)(iii) ............................................................................. X. 12 CFR 309.6(b)(7)(iv) ............................................................................. X. 12 CFR 309.6(b)(8)—Disclosure by General Counsel ............................ (See Subpart D below). 12 CFR 309.6(b)(9)—Authorization for disclosure by the Chairman of the Corporation’s Board of Directors. 12 CFR 309.36(i)—Authorization for disclosure by the FDIC chairperson 12 CFR 309.6(b)(10)—Limitations on disclosure ..................................... 12 CFR 309.39—Conditions and limitations. Disclosure by General Counsel Subpart D 12 CFR 309.6(b)(8) 12 CFR 309.50–12 CFR 309.55 X
............................................................................................................... 12 CFR 309.50—Scope. X ............................................................................................................... 12 CFR 309.51—Definitions. 12 CFR 309.6(b)(8)(i) ............................................................................... 12 CFR 309.52—Use of FDIC information in a non-party legal proceeding. 12 CFR 309.53—Submitting a request. 12 CFR 309.54—Decision on requests. 12 CFR 309.6(b)(8)(ii) .............................................................................. 12 CFR 309.55—Waiver and exemption of requirement for requests. Service of Process 12 CFR Part 306 12 CFR 309.7 12 CFR 306.1–12 CFR 306.3 X ............................................................................................................... 12 CFR 306.1—Scope. X ............................................................................................................... 12 CFR 306.2—Definitions. 12 CFR 309.7(a)—Service ....................................................................... 12 CFR 306.3—Service of process. 12 CFR 309.7(b)—Notification by person served .................................... X. 12 CFR 309.7(c)—Appearance by person served ................................... X. In addition, the proposal would make a number of revisions to part 309 that are generally intended to provide greater clarity, simplify administrative processes, and, where appropriate, remove or narrow restrictions on the ability of insured depository institutions to disclose FDIC confidential information to certain third parties. Importantly, while insured depository institutions are typically required to obtain prior approval from the FDIC before disclosing FDIC confidential information under the FDIC’s current information disclosure regulations, the proposal would permit insured depository institutions to disclose such information to certain third parties without prior approval for a business purpose, subject to having in place a qualifying confidentiality agreement with each intended recipient. These third parties include, for example, an insured depository institution’s legal counsel, majority shareholder, qualifying service providers, and certain potential merger counterparties. In addition, where prior approval from the FDIC would still be required, the proposal would clarify and simplify the standard under which the FDIC may authorize an insured depository institution or other party to disclose FDIC confidential information. As described in section III of this Supplemental Information, the proposal also would remove the provisions currently in part 309 regarding service of process in a legal proceeding and relocate them to a separate part of the FDIC’s regulations, proposed part 306. The FDIC has observed that the service of process provisions bear little relation to the other provisions of part 309 regarding information maintained
by the FDIC and the policies and procedures for the disclosure of such information. Relocation of these service of process requirements to a separate part of the FDIC’s regulations would improve the clarity of both the service of process requirements and the information disclosure requirements more generally. Question 1: Does the proposed reorganization of part 309 achieve its intended objectives? If not, how can the structure and organization of part 309

1 12 U.S.C. 552a.
2Proposed section 309.15 also would permit the FDIC to move any request to expedited processing as appropriate. be further improved to enhance the FDIC’s disclosure of information regulations? Are there additional structural and organizational changes to the proposal that would help reduce burden? B. Disclosure of Information Under the Freedom of Information Act

Overview
Under the proposal, requirements for parties requesting information from the FDIC under FOIA and the FDIC’s processes for reviewing and responding to such requests would be codified at a new subpart B of part 309. Based on the FDIC’s experience in processing FOIA requests, the FDIC believes its current requirements for FOIA requests, which are codified at sections 309.3 through
309.5 of part 309, could be clarified to
better explain the FDIC’s existing processes and improve readability. The proposed rule would also amend certain aspects of the FDIC’s FOIA requirements to align them more closely with the applicable statutory requirements.
Definitions
Proposed section 309.11 would introduce certain new defined terms that the FDIC believes will help clarify the FDIC’s FOIA requirements and better align the terminology used in the regulation with applicable statutory definitions. Confidential commercial information would mean trade secrets and commercial or financial information obtained by the FDIC from a submitter that may contain material exempt from disclosure under Exemption 4 of FOIA. Defective request would mean a request that does not reasonably describe the information requested or that does not otherwise comply with the requirements of subpart B of part 309, including those related to fees. FOIA public liaison would mean the FDIC official responsible for assisting requesters by explaining the FOIA process, providing information on the status of requests, and resolving any disputes. Submitter would mean any person or entity that provides confidential commercial information to the FDIC. The term ‘‘submitter’’ includes, but is not limited to, corporations, state governments, and foreign governments. Other terms defined in proposed
section 309.11 would have the meaning
currently given to them in section 309.5(a) or would include minor modifications to better align with applicable statutory definitions. Question 2: Do the new defined terms help clarify the FDIC’s requirements for FOIA requests? Should the definitions set forth in subpart B be further clarified or revised? If so, how? Should the proposal include any additional defined terms related to FOIA requests?
Making a Records Request to the FDIC
Under FOIA
Proposed sections 309.12 and 309.13 would describe the requirements for requesting information from the FDIC under FOIA. These proposed sections would be generally consistent with the requirements currently codified at
section 309.5 of part 309, with revisions
to clarify existing processes, improve readability, and use more modern terminology. The proposal would make certain changes related to how parties may request information from the FDIC under FOIA. First, section 309.13(c) would provide more explicit guidance on the contents of a records request, including by directing requesters to include details about the records sought so that the FDIC can locate them with a reasonable amount of effort, and stating that requests about very general topics, or those without limitations or dates, are more likely to be viewed as defective requests. Second, proposed section 309.13(d) would add a new provision to clarify the FDIC’s existing practice that individuals requesting records pertaining to themselves must satisfy the identify verification requirements established under 12 CFR 310.4(c), which ensures the FDIC’s compliance with the Privacy Act.1 Third, proposed section 309.13(e) would describe requirements for requesting information about third parties (i.e., about parties other than the requester). Specifically, this paragraph provides that a requester seeking records regarding third parties may receive greater access to requested records by submitting a written authorization by the individual who is the subject of the record. This paragraph also provides that, when requested records concern a deceased individual, a requester must submit proof that the individual is deceased and that the FDIC may require other verification documentation.
FDIC Practices for Processing FOIA
Requests
Paragraph (d) of section 309.5 of the current rule establishes how the FDIC processes requests for information under FOIA. The proposal would include substantively consistent provisions, with modifications to clarify existing procedures and improve readability. Proposed section 309.14 would generally replace paragraph 309.5(d) of the current rule and explain how the FDIC processes requests for information. Proposed section 309.14 would also include an updated and more detailed description of how the FDIC conducts multitrack processing and may aggregate certain requests. Proposed section
309.15 would establish how the FDIC
conducts expedited processing for certain requests. This section is generally consistent with section 309.5(d)(3) of the current rule, with modifications to clarify existing practices and improve readability. Furthermore, proposed section 309.15 would establish that, in addition to the current rule’s eligibility criteria, requests that involve the loss of substantial due process rights or possible questions of federal government integrity may be eligible for expedited processing. Any request for expedited processing would be required to be made concurrently with the initial record request and include a statement explaining the basis for expedited processing.2 In addition, proposed
section 309.16 would replace paragraph
309.5(j) of the current rule and provide additional detail regarding the circumstances under which the FDIC may consult with, and refer requests to, another agency that may have an interest in a request received by the FDIC.
Fees for FOIA Requests
Proposed sections 309.17 through
309.21 would provide a general
overview of the fees charged by the FDIC to requesters and how requesters may seek a waiver or reduction of fees. While substantively consistent with
section 309.5(f) of the current rule, the
proposal would make significant revisions to the fees-related provisions of part 309 to clarify existing procedures and improve readability. Proposed sections 309.19 and 309.20 explain how the FDIC charges fees to requesters and requests payment, replacing and clarifying section 309.5(f)(1) of the current rule. In particular, proposed section 309.19 clarifies that, if the FDIC notifies a requester of the estimated fee for a request and does not receive a response or request for modification from the requester within thirty calendar days, the request will be closed. Additionally, proposed section 309.19 provides

3E.O. 12600, 3 CFR 235 (1988). 4 12 U.S.C. 1813. details regarding when advanced payment of fees is required and explains the circumstances in which fees will not be charged, noting that absent unusual or exceptional circumstances, the FDIC will not charge certain fees if the FDIC fails to comply with the time limits in which to respond to a request. Finally, to promote transparency and better align the information disclosure regulations with applicable statutory requirements, proposed section 309.21 would clarify the factors the FDIC considers when evaluating whether a waiver or reduction of fees may be appropriate on public interest grounds. Providing this information directly in
part 309 would help inform requests for
a waiver or reduction in fees.
6. Dispute Resolution and
Administrative Appeals Proposed sections 309.22 and 309.23 would describe the processes available to a requester for dispute resolution and administrative appeals of requests for information that have been subject to adverse determinations. These proposed sections are generally consistent with the provisions currently codified at paragraphs (h) and (i) of section 309.5 of part 309, with revisions to clarify existing processes and improve readability. For example, section 309.22 now clarifies that dispute resolution is a voluntary process, and section 309.23 details what constitutes adverse determinations by the FDIC, which may be appealed through the administrative process, and also provides more specific instructions on how and when an appeal must be submitted.
7. Supplemental Procedures for
Confidential Commercial Information Executive Order 12600 requires that agencies subject to FOIA ‘‘establish procedures to notify submitters of records containing confidential commercial information . . . when those records are requested’’ under FOIA, if the agency ‘‘determines that it may be required to disclose the records.’’ 3 Proposed section 309.24 would add new supplemental procedures regarding both the submission and disclosure of confidential commercial information to better align the FDIC’s information disclosure regulations with this requirement. First, proposed section 309.24 would clarify the requirements for a party that submits confidential commercial information to the FDIC (for example, confidential commercial information that an insured depository institution may submit in connection with an application to the FDIC) to designate, at the time of submission or thereafter, information the submitter claims could reasonably be expected to cause substantial competitive harm if disclosed. Second, proposed section
309.24 would establish the process by
which the FDIC would provide notice to a submitter of confidential commercial information in the event that a FOIA request would seek the disclosure of such information, how a submitter may object to disclosure, and how the FDIC would respond to an objection. If the FDIC were to provide notice to a submitter of a request under FOIA for confidential commercial information, proposed section 309.24 would also require the FDIC to inform the requester that such notice has been made. Question 3: Do the proposed amendments to subpart B of part 309 help clarify the FDIC’s FOIA process? Question 4: Are there additional revisions that can be made to subpart B of part 309 to clarify the FDIC’s FOIA process or reduce administrative burden?
C. Discretionary Disclosure of
Confidential Information

Overview
Under the proposal, subpart C of part 309 would establish the FDIC’s policies and procedures regarding discretionary disclosures of confidential information that is exempt from disclosure under FOIA, replacing most of the provisions of section 309.6 of the current rule. Proposed subpart C would make a number of substantive changes to the current rule, including: (1) significantly expanding the categories of parties with which insured depository institutions and certain other entities can share confidential information without making a request to the FDIC, subject to certain conditions; (2) updating the process by which parties may request disclosure of confidential information to increase flexibility, including by allowing FDIC authorized directors to modify certain requirements and disclose confidential information on their own initiative; and (3) clarifying that the general standard for disclosure under this subpart is ‘‘good cause,’’ as determined by the appropriate authorized director. These changes are being proposed to reduce or eliminate procedural barriers and inefficiencies that exist under the current rule. The FDIC intends for the proposed rule to streamline disclosures of confidential information, both by the FDIC and by insured depository institutions and other parties with confidential information in their possession, while providing safeguards to ensure that such information remains appropriately protected. Additionally, the proposal would make a number of non-substantive changes to improve the rule’s clarity and readability.
Purpose, Scope, and General
Requirements
Proposed section 309.30 would describe the purpose and scope of subpart C. Proposed sections 309.32 and
309.33 would establish the general
prohibition on the disclosure of confidential information, except as permitted under subpart C. Proposed
section 309.39 would establish the
conditions and limitations that would apply to any disclosure of confidential information under subpart C. With the exception of the clarification of the ‘‘good cause’’ standard in section 309.30, as described in more detail in
section II.C.4 of this Supplemental
Information, these proposed provisions regarding the regulation’s purpose, scope, and general requirements are not intended to substantively modify the FDIC’s current information disclosure rules or practices. The requirements, restrictions, and authorizations of subpart C would apply to all insured depository institutions (as well as other parties) in possession of FDIC confidential information in respect of such FDIC confidential information, regardless of whether the FDIC is the appropriate federal banking agency, as defined in section 3 of the Federal Deposit Insurance Act,4 in respect of an insured depository institution. For example, disclosure of FDIC confidential information by an insured depository institution for which the FDIC is not the appropriate federal banking agency must be authorized under subpart C. However, subpart C would neither restrict nor authorize the disclosure by an insured depository institution, including an insured depository institution for which the FDIC is the appropriate federal banking agency, or by any other party, of the confidential information of another federal banking agency or a state banking authority that an insured depository institution may possess. Additionally, the FDIC recognizes there are certain records or information that may be confidential information of both the FDIC and another supervisory agency. In such cases, insured depository institutions would still need to ensure their ongoing compliance with any information disclosure restrictions

5The following terms would be removed from
part 309 under the proposal: depository institution,
disclose/disclosure, examination, record, report of examination, customer financial records, and director of the division having primary authority. and data privacy laws to which they may be subject. Question 5: Should the FDIC provide additional clarity on disclosure of records or information that is confidential information of both the FDIC and another federal or state supervisory agency? If so, what additional clarity would be helpful?
3. Definitions
Proposed section 309.32 would introduce certain new defined terms that the FDIC believes will help clarify the FDIC’s disclosure requirements regarding its confidential information. Affiliate would mean any company that controls, is controlled by, or is under common control with another company as defined in 12 U.S.C. 1841(k). Authorized director would mean any of the directors of FDIC divisions and offices, or their designees, who have primary responsibility for FDIC records or information; and deputies to the chairperson of the FDIC Board of Directors, to the extent such officials have primary responsibility for FDIC records or information. Confidential information would mean any FDIC record or other FDIC information in any form that is exempt from disclosure under FOIA, and any information derived from or related to such FDIC record or information. This would include but is not limited to information about FDIC’s supervision or resolution of depository institutions and financial companies; information about FDIC’s enforcement of laws and regulations; and information about consumer complaints received by the FDIC. Confidential information would not include: (1) documents prepared by or for an insured depository institution, or any other party, for its own business purposes that are in its own possession, even though copies of such documents in the FDIC’s possession otherwise would constitute confidential information; or (2) final orders, amendments, or modifications of final orders, or other actions or documents that are specifically required to be published or made available to the public pursuant to 12 U.S.C. 1818(u), the Community Reinvestment Act, or other applicable law. Parent holding company would mean a company that has control of an insured depository institution. Control for purposes of this subpart C is defined in 12 U.S.C. 1841(a)(2). Person would mean an individual, or an entity in any form, including a government agency. Qualifying confidentiality agreement would mean an agreement that: (1) is written; (2) is governed by the laws of the United States or a State of the United States; (3) prohibits the use of the information by the recipient for purposes other than that for which it is provided and provides that the recipient will not further disclose or make public in any manner the information; (4) limits access to the information at a recipient entity to those directors, officers, or employees who have a business need to know the information and are bound by the qualifying confidentiality agreement; and (5) expressly provides that the FDIC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action filed in the U.S. District Court for the District of Columbia and any other court having jurisdiction and venue over disputes arising from the agreement. Qualifying service provider would mean an entity that: (1) has a contractual relationship with a depository
institution and (2) provides:
(A) products or services to the institution that are used in connection with the provision of financial products or services to the depository institution’s customers; (B) advisory or consulting services related to the management or operations of the depository institution; or (C) technological infrastructure to the depository institution. This definition would include third party ‘‘fintech’’ companies that provide services used in connection with the provision of financial products or services to customers. The definition is intended to strike a balance by capturing types of service providers with respect to which insured depository institutions have the greatest need to share confidential information, while excluding service providers that are less likely to need confidential information as part of the services provided. Question 6: Are the proposed defined terms appropriate for the purpose and intent of proposed subpart B? Should the FDIC include any additional defined terms or modify any of the proposed defined terms? Question 7: Is the proposed definition of confidential information appropriate? Should the definition be revised to broaden or narrow it to appropriately capture the types of FDIC information that should be treated as confidential by insured depository institutions? Question 8: Is the proposed definition of qualifying confidentiality agreement appropriate? What, if any, additional terms or requirements should the FDIC consider to appropriately protect the integrity of confidential information? For example, should a qualifying confidentiality agreement be required to be governed by U.S. law or include provisions that impose restrictions on how the confidential information is used, require the eventual destruction or return of the confidential information by the recipient, or require the recipient to acknowledge and consent to be subject to the FDIC’s regulatory, examination, and enforcement authorities? Question 9: Is the proposed definition of qualifying service provider appropriate? Should the definition be revised to broaden or narrow it to capture the universe of third parties that insured depository institutions should be able to share information with without requiring FDIC approval? Proposed section 309.31 would not incorporate any terms currently defined in section 309.2 of part 309.5
4. The ‘‘Good Cause’’ Standard
The proposed rule would substantially clarify the standard under which the FDIC may approve the disclosure of confidential information. Specifically, proposed section 309.35 would establish ‘‘good cause’’ as the general standard for authorizing disclosure of confidential information and provide a non-exhaustive list of factors the authorized director may consider when making a good cause determination. This standard would apply to decisions by the FDIC to disclose confidential information under subpart C—either on its own initiative or in response to a request—and decisions by the FDIC to permit an insured depository institution to disclose to a third party confidential information in the insured depository institution’s possession, in those circumstances where such approval would continue to be required. The factors to be assessed under the good cause standard would include: (1) whether disclosure will serve a legitimate regulatory, supervisory, resolution, or law enforcement purpose; (2) whether there is another source for the confidential information; (3) whether disclosure of the confidential information is unduly burdensome or otherwise may adversely affect or prejudice the FDIC, its mission, or its operations; (4) the scope and nature of the confidential information; (5) the recipient’s intended use of the confidential information; (6) whether disclosure is lawful; (7) whether the confidential information includes

privileged information, trade secrets, or confidential commercial or financial information; and (8) whether disclosure would present safety and soundness or financial stability risks. While the good cause standard and associated factors have been established as a matter of internal FDIC practice, they are not currently provided for in the FDIC’s information disclosure regulations. The FDIC believes that incorporating the standard and associated factors into part 309 will help promote transparency and consistency in assessing potential disclosures of confidential information, as well as providing prior notice regarding the types of requests for disclosure that may not be authorized. Question 10: Would the proposal provide sufficient clarity regarding the good cause standard? Question 11: Should the FDIC consider any other factors when assessing whether there is good cause for disclosure of confidential information? Are any of the proposed factors not appropriate to be considered as part of the good cause standard?
5. Procedure for Requesting
Discretionary Disclosure Proposed section 309.34 would describe the process for an insured depository institution or other party to request discretionary disclosure of confidential information in a manner that is generally consistent with the FDIC’s current information disclosure regulations. Proposed section 309.34 would also introduce certain changes to the FDIC’s information disclosure regulations that are intended to provide for additional flexibility and streamline the process for requesting discretionary disclosure, where appropriate. First, proposed section 309.34 would expressly permit an authorized director to waive one or more of the generally applicable requirements for requesting a discretionary disclosure. In addition, proposed section 309.34 would also explicitly allow an authorized director to self-initiate the disclosure of confidential information without a request from a third party, provided that, in the authorized director’s discretion, the good cause standard in proposed section 309.35 is satisfied.
6. Disclosure by the FDIC
Proposed section 309.36 would provide for the disclosure of confidential information by the FDIC to certain categories of parties that commonly make requests for confidential information. These include:
(1) insured depository institutions and their affiliates; (2) federal, state, and foreign financial regulatory and supervisory authorities; (3) civil investigative and criminal law enforcement agencies and authorities; and (4) certain supervised bank service providers, insured depository institutions that receive services from such service providers, and state and federal authorities that supervise financial institutions serviced by such serviced providers. Proposed section
309.36 would also provide for the
disclosure of confidential information to any other party and clarify the authority of the FDIC chairperson to authorize the disclosure of confidential information, in both cases subject to the good cause standard. While proposed section 309.36 is intended generally to conform to the authorizations and requirements currently codified at paragraphs (b)(1) through (b)(6) and (b)(9) of section 309.6 of the current rule, the proposal would make various modifications to improve consistency, eliminate unnecessary barriers to appropriate disclosures, provide transparency, and reflect current practices. In particular, while the FDIC’s current information disclosure regulations sometimes apply different and unnecessarily complicated procedural requirements for authorizing the disclosure of confidential information to different categories of parties, the proposed rule would make all disclosures of confidential information made under proposed
section 309.36 subject to the good cause
standard established at proposed section
309.35. This is intended to promote
consistency and transparency relative to the FDIC’s current information disclosure regulations. Other changes from the FDIC’s current information disclosure regulations include proposed section 309.36(b), which expressly provides for disclosure by the FDIC to affiliates of insured depository institutions. Under the current rule, such disclosures would be considered disclosures to general third parties and subject to additional requirements that the FDIC does not believe are necessary for ensuring the confidentiality of information. In addition, proposed section 309.36(c), would provide for disclosures of confidential information typically made by the FDIC to federal and state agencies, subject to the good cause standard. While the current rule provides a non-exhaustive list of specific federal government agencies with which the FDIC will share confidential information, the proposed rule is intended to better reflect the FDIC’s general practice to disclose confidential information to any federal or state agency where the good cause standard is satisfied. Question 12: Is proposed section 309.36(c) sufficiently clear or should the rule more explicitly define the term ‘‘federal and state agencies’’? Question 13: What, if any, other revisions should the FDIC consider to clarify the parties to, and circumstances in which, the FDIC could disclose confidential information?
7. Disclosure of FDIC Confidential
Information by Insured Depository Institutions and Their Parent Holding Companies It has long been the FDIC’s position that depository institutions should be able to disclose confidential information concerning their institution to certain third parties, such as accountants, legal counsel, certain service providers, and business partners, to the extent there is a necessary or appropriate business purpose for disclosing such information and the confidentiality of the information is maintained. These disclosures—subject to appropriate safeguards—facilitate normal business operations, including regulatory compliance. The proposed rule would make significant changes to the requirements and restrictions regarding the disclosure of confidential information by insured depository institutions and certain other entities that may be in possession of confidential information. The requirements and restrictions that are presently applicable to the disclosure of confidential information by insured depository institutions are provided for at section 309.6(b)(7). Under section 309.6(b)(7), with the limited exception of the disclosure of certain examination materials to a parent holding company, any disclosure by an insured depository institution of confidential information in its possession requires the prior approval of the appropriate FDIC director. The FDIC’s experience in implementing section 309.6(b)(7) has been that many types of requests from insured depository institutions are routinely approved. Requiring the FDIC’s prior approval in these cases is time consuming, imposes unnecessary administrative burdens on insured depository institutions, and appears to serve no significant policy or other objectives. The FDIC is also aware that the broad restrictions on disclosure of confidential information under section 309.6(b)(7) may impose particular burdens for insured depository institutions in the context of their relationships with certain third-party service providers and other business partners. Furthermore, the FDIC’s

6For example, the Office of the Comptroller of the Currency explicitly allows national banks and Federal savings associations to disclose non-public OCC information to attorneys, auditors, and consultants without a request under 12 CFR 4.37(b)(2). Additionally, the Board of Governors of the Federal Reserve System explicitly allows supervised financial institutions to disclose confidential supervisory information to its legal counsel, auditors, and service providers without a request under 12 CFR 261.21(b)(3)–(4). broadly expansive requirement for prior approval for the disclosure of confidential information by insured depository institutions is not consistent with the information disclosure rules of other federal bank regulators, which allow for disclosure without prior approval in some instances.6 a. General Disclosure Authorizations Consequently, while the current rule requires that insured depository institutions make a request and obtain FDIC authorization prior to disclosing confidential information to other parties in almost all circumstances, the proposed rule would enable insured depository institutions and certain other entities to disclose confidential information without prior approval from the FDIC in certain circumstances, subject to certain conditions. Disclosure of such confidential information without a request to the FDIC would not compromise safety and soundness and will, among other things, reduce burden, facilitate regulatory compliance, and improve efficiencies—including between an institution and third parties that have business relationships with the institution. The proposed rule would establish safeguards to help ensure the confidential information is adequately protected (and not used for impermissible purposes) by the recipient(s) of such information. In some circumstances, these safeguards include requiring recipients to have agreed to a qualifying confidentiality agreement. In addition, insured depository institutions may only share confidential information without FDIC approval if sharing is ‘‘necessary or appropriate for business purposes,’’ meaning it must be in furtherance of specific objectives related to the insured depository institution’s business. In other circumstances, such as disclosure of certain confidential information by an insured depository institution to its affiliates and to directors, officers, and employees of its affiliates, no qualifying confidentiality agreement would typically be required. These changes are intended to reduce the burdens and detailed processes in the current rule to permit a more streamlined flow of confidential information between insured depository institutions and other parties when necessary or appropriate for business purposes. The proposed rule would also retain the authority of the FDIC to authorize disclosure of confidential information in other circumstances, subject to the good cause standard. In general, proposed section 309.37(a) would allow insured depository
institutions to disclose confidential information to certain persons where necessary or appropriate for business purposes without making a request to the FDIC. In circumstances where disclosure of confidential information to a party would be neither necessary nor appropriate for a business purpose, such disclosure would not be authorized under proposed section 309.37(a). Proposed paragraphs (a)(1)(i) and (ii) of section 309.37 would allow insured depository institutions to disclose, without prior approval of the FDIC, confidential information to (1) the insured depository institution’s own directors, officers, or employees (as permitted under the current rule); and (2) the insured depository institution’s affiliates and the directors, officers, or employees of the insured depository institution’s affiliates. The FDIC has observed that requests for disclosing confidential information to affiliates are typically necessary or appropriate for business purposes. Furthermore, the FDIC routinely approves requests to disclose confidential information to affiliates under the current rule and has not observed that such disclosures present risks to the integrity of its confidential information. Accordingly, the FDIC believes that permitting such disclosures to take place without the FDIC’s prior approval will reduce administrative burden for insured depository institutions and permit a more efficient sharing of information between insured depository institutions and affiliates when necessary or appropriate for business purposes. Subject to entering into a qualifying confidentiality agreement with the intended recipient of the confidential information, proposed paragraphs (a)(1)(iii) through (vi) of section 309.37 would allow insured depository institutions to disclose confidential information, without the prior approval of the FDIC, to: (1) their external legal counsel, accountant, or auditor; (2) a shareholder of the insured depository institution that owns over 50 percent of the voting stock of the insured depository institution; (3) qualifying service providers, as defined in section II.C.3. of this Supplemental Information; and (4) individuals to whom an offer of employment has been made to serve as a senior executive officer, as defined in 12 CFR 303.101, of the insured depository institution. As with the disclosures that would be permitted under paragraphs (a)(1)(i) and (ii), the disclosures that would be permitted under paragraphs (a)(1)(iii) through (vi) are intended to reduce administrative burdens on insured depository institutions in connection with disclosure of confidential information to those parties where circumstances giving rise to a necessary or appropriate business purpose for such disclosure would be expected to regularly arise. In addition, proposed section 309.37(a)(1)(vii) would allow insured depository institutions to disclose confidential information to directors, officers, employees, affiliates, auditors, and legal counsel of an
insured depository institution that is a potential merger counterparty. Such authorization would be limited to three potential counterparties over a five-year period and subject to certain other conditions. These restrictions, however, would not apply where there is a written agreement to enter into a merger or similar transaction in place between the insured depository institution and any counterparty. The FDIC regularly receives requests from insured depository institutions to disclose confidential information in the context of a merger transaction and recognizes that such information can be highly relevant for potential merger counterparties. The FDIC believes that, subject to certain conditions, permitting insured depository institutions to disclose confidential information to potential merger counterparties that are themselves insured depository institutions should help facilitate these transactions without presenting undue risk of inappropriate disclosure of confidential information. The FDIC notes, however, that access to the confidential information contemplated to be disclosed under section 309.37(a)(1)(vii) is not intended to replace a potential counterparty’s due diligence for such transactions. Under the proposal, confidential information that is shared under paragraphs (a)(1)(iii) through (vii) of
section 309.37 would be subject to the
requirement that, prior to or concurrently with any such disclosure, the insured depository institution must enter into a qualifying confidentiality agreement with the intended recipient of the information. The requirements for a qualifying confidentiality agreement are described in section II.C.3 of this Supplemental Information. Question 14: Does the proposal appropriately identify the types of parties to, and circumstances in which,

an insured depository institution should be permitted to share confidential information without the prior approval of the FDIC? Are there additional parties or circumstances in respect of which an insured depository institution should be permitted to share confidential information without the prior approval of the FDIC? If so, please explain why the benefits of permitting greater information sharing with such parties and in those circumstances would outweigh the costs associated with the risk of inappropriate disclosure of confidential information. Are there any parties listed in section 309.37(a) of the proposal that should be removed or narrowed? Question 15: Would the safeguards to be introduced under the proposal sufficiently mitigate the risk of inappropriate disclosure of confidential information? Should the FDIC consider any additional safeguards? For example, should insured depository institutions be required to maintain a written record of disclosures of confidential information and the legal basis for such disclosures? If so, should this requirement be applicable to any disclosure or only in respect of disclosures to certain recipients (e.g., disclosures to qualifying service providers)? Question 16: Should different types of confidential information be subject to more stringent safeguards than those contemplated under the proposal? b. Disclosure of Historical Information Proposed section 309.37(b) would allow insured depository institutions to disclose confidential information if at least twenty-five years have elapsed since that confidential information was created, unless otherwise notified by the FDIC, and any such disclosure maintains compliance with privacy and trade secret laws. The FDIC believes that the justifications for maintaining the confidentiality of information would generally be diminished after twentyfive years. Such information may still be of value, however, for research, analytical, and other purposes. Accordingly, the FDIC believes it is appropriate to allow for the disclosure of such information without the prior approval of the FDIC. Question 17: Would this proposed authorization to disclose historical information be of value? Question 18: Is twenty-five years the appropriate amount of time required to have passed to permit the disclosure of historical confidential information? If not, what other time period would be more appropriate? Question 19: What, if any, safeguards, should the FDIC require in respect of the disclosure of historical confidential information? Are there any types of historical confidential information in respect of which FDIC approval is required prior to disclosure?
c. Disclosure of Confidential
Information by Parent Holding Companies The proposed rule would permit a parent holding company of an insured depository institution that is lawfully in possession of the FDIC’s confidential information to disclose such confidential information, without the prior approval of the FDIC, to the same extent and subject to the same conditions, and to the same categories of recipients, as an insured depository institution could disclose confidential information under sections 309.37(a) or 309.37(b). This would allow the parent holding company to, for example, disclose FDIC confidential information to its affiliates, lawyers, auditors, accountants, and qualifying service providers of the parent holding company, when necessary or appropriate for business purposes, without a request to the FDIC. This provision is intended to maintain consistency with the proposed insured depository institution sharing provisions and would similarly reduce unnecessary procedural hurdles for the disclosure of this information by parent holding companies in these circumstances. d. Disclosure of Data for Aggregated Analyses The FDIC recognizes there may be value in third party entities being able to receive certain FDIC confidential information on an aggregated basis from multiple insured depository institutions in order to provide transparency with respect to, and facilitate analysis of, the supervisory process, without requiring preapproval from the FDIC. Such third parties could include, for example, law firms or nonpartisan nonprofit banking trade associations. The FDIC seeks comments on the extent to which this is an appropriate purpose to permit disclosure of confidential information and how the FDIC might implement such an approach. Question 20: To what extent should the FDIC permit sharing confidential information with additional third parties for purposes of aggregating information across insured depository institutions? To what type(s) of entities should the FDIC consider allowing access to such information? What safeguards, if any, should the FDIC consider to help ensure such information sharing would not raise antitrust or other concerns? Question 21: If the FDIC were to permit FDIC-supervised institutions to share confidential information with organizations for these purposes, should the FDIC place limits on the types and nature of information that may be shared? Should the FDIC consider different types of limits or requirements depending on the type of entity receiving the information? Question 22: Should the FDIC take any steps to mitigate the risk that the identity of a specific institution that is the subject of the information can be reverse engineered, and if so how? Question 23: To what extent should such organizations be able to make public disclosures on the basis of aggregated information that has been derived from FDIC confidential information? What, if any, risks may be posed by inaccuracies in such public disclosures, and what, if any, requirements
should the FDIC consider to mitigate such risks?
8. Disclosure of FDIC Confidential
Information by Service Providers and Other Persons The FDIC has observed that thirdparty service providers that are subject to examination by the FDIC (FDICexamined service providers) may be in possession of confidential information that could be relevant to their insured depository institution partners. Accordingly, proposed section 309.37(e) would allow FDIC-examined service providers in possession of confidential information to share such confidential information with insured depository institutions to which they are providing services without the prior approval of the FDIC, subject to certain limitations. As with other disclosures of confidential information that would be permitted without the prior approval of the FDIC, the disclosure of confidential information by these service providers to their insured depository institution partners would only be permitted when necessary or appropriate for a business purpose. Such service providers would also need to have in place a qualifying confidentiality agreement with the intended recipient of the information. The FDIC is not, at present, proposing to permit an FDIC-examined service provider to disclose confidential information without the prior approval of the FDIC to parties other than an insured depository institution that is an existing partner. The FDIC recognizes, however, that there may be benefits to facilitating greater disclosure of

examined service providers to other parties—for example, insured depository institutions that are evaluating whether to enter into a business partnership with such a service provider and seeks comment on whether expanding this provision would be appropriate. Question 24: Should an FDICexamined service provider be permitted to share confidential information with insured depository institutions that are potential partners? If so, what conditions or safeguards should apply to such arrangements? Should an FDICexamined service provider be permitted to share confidential information with any other type of parties? Finally, proposed section 309.38 would provide for disclosures by other parties that may have confidential information in their possession. Consistent with section 309.6(b)(7)(ii) of the current rule, such disclosures would be subject to the prior approval of the FDIC. The proposed rule, however, would simplify the requirements for such disclosures, including by eliminating the requirement that such approval be preceded by a written request for disclosure. Under certain exigent circumstances, such as a significant financial crisis, a written request may neither be timely nor necessary. Question 25: Would the proposed amendments clarify and streamline the process for requesting discretionary disclosure of FDIC confidential information? Question 26: What are the advantages and disadvantages of permitting FDICsupervised institutions to disclose confidential information to the categories of third parties identified in the proposed rule? Should these provisions apply to other categories of third parties and, if so, why? If the FDIC were to extend the applicability of these provisions to other third parties, are there additional requirements that should apply and, if so, to what type of information sharing arrangements? D. Disclosure of Confidential Information in Legal Proceedings in Which the FDIC Is Not a Party

Overview and Scope
Parties in litigation not involving the FDIC may at times believe the FDIC is in possession of information that is relevant to their litigation. Requirements and restrictions applicable to the disclosure of FDIC information in legal proceedings in which the FDIC is not a party (i.e., legal proceedings that do not involve the FDIC or any of its directors, officers, or employees as a party) are currently provided for at section 309.6(b)(8) of part 309. The proposal would reorganize these provisions into a new subpart D of part 309. The procedure for requests, as provided in subpart D, is intended to promote cooperation between the FDIC and parties or other persons seeking FDIC information for use in a non-party legal proceeding; allow the FDIC to responsibly manage the burden on its staff and resources in searching for, reviewing, and producing FDIC information; and avoid expensive and time-consuming disputes over FDIC information. While the FDIC intends for subpart D generally to be consistent the requirements and restrictions of current
section 309.6(b)(8), the proposed rule
would introduce revisions to provide greater transparency and clarity, as well as certain substantive changes described below in sections II.D.2 through II.D.5 of this Supplemental Information. Question 27: Does proposed subpart D provide sufficient clarity with respect to the requirements and restrictions applicable to the disclosure of FDIC information in legal proceedings in which the FDIC is not a party? What, if any, changes should the FDIC consider in respect of proposed subpart D?
Definitions
Proposed section 309.51 would introduce certain new defined terms that the FDIC believes will help clarify the FDIC’s requirements and restrictions regarding disclosure of its information in legal proceedings in which the FDIC is not a party. Access to FDIC documents or property would mean to produce, provide, or allow examination of FDIC documents or property. Discovery demand would mean a subpoena, court order, request for production of documents, interrogatories, notice of deposition, motion to compel, or other notice or order in a legal proceeding requiring the FDIC or any other person in possession, custody, or control of FDIC information to provide FDIC information for use or possible use in the legal proceeding. FDIC documents or property would mean documents, electronically stored information, tangible things, and premises that are owned by or were created by the FDIC except documents or property of a depository institution or financial company in FDIC receivership or conservatorship that the FDIC has transferred to the custody of a contractor, servicer, acquiring institution, bridge bank or other successor institution, or other third party in the course of the FDIC’s depository institution or financial company resolution activities. FDIC information would mean any FDIC documents, property, or FDIC testimony. FDIC testimony would mean testimony by a current or former director, officer, employee, agent, or contractor of the FDIC concerning: (1) FDIC documents or property; or (2) knowledge or experience acquired, or communications or activities engaged in, as part of their official duties or otherwise related thereto or because of their official status while such individuals were employed by or acted as agent, contractor, or otherwise on behalf of the FDIC. Legal proceeding would mean a judicial or administrative adjudication, action, case, matter, hearing, trial, arbitration, formal inquiry, formal investigation, or similar proceeding initiated before or subject to a court, agency or agency members, commission, board, grand jury, arbitrator, administrative law judge, hearing officer, or other authorized official or body, whether criminal, civil, or administrative in nature, under federal, state, local, or foreign law. Non-party legal proceeding would mean a legal proceeding in which neither the FDIC (in the capacity to which the process is directed) nor an FDIC director, officer, or employee (in the capacity to which the process is directed) is a party. Party would mean a person that is asserting claims or defending against claims in a legal proceeding. This would not include a person who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery. Person would mean an individual or an entity in any form, including a governmental organization. Request would mean a written statement in which a party or other person involved in a legal
proceeding asks the FDIC to provide or authorize access to FDIC documents or property or authorize FDIC testimony for use in a legal proceeding. Testimony would mean a sworn or unsworn statement made by an individual for use or possible use by a party in a legal proceeding. Testimony may include, but is not limited to, live statements at a deposition, hearing, trial, or interview in person or by audio or visual communication; written or recorded responses to questions; or an affidavit, declaration, sworn statement, certification, or attestation. Use, with respect to FDIC information provided in accordance with subpart D,

7 5 U.S.C. 702. would mean that, subject to conditions and limitations required by the FDIC general counsel or designee, authorized parties or other persons involved in a legal proceeding may disclose FDIC information in the legal proceeding in the same manner and with the same protections as information obtained in discovery in the legal proceeding. Proposed section 309.51 would not incorporate any terms currently defined in section 309.2 of part 309.
3. Use and Request of FDIC Information
in a Non-Party Legal Proceeding Proposed sections 309.52 and 309.53 would provide for the general prohibition on the use of FDIC information in non-party legal proceedings without express authorization by the FDIC general counsel or designee and describe when and how to submit a request for FDIC information in a non-party legal proceeding, including the content that should be included in a request. Consistent with the current rule, a party would be required to make such a request prior to seeking FDIC information by means of a subpoena or other discovery demand. While the FDIC believes proposed sections 309.52 and 309.53 to be significantly simplified and clarified relative to the current rule, these proposed sections are not intended to introduce any substantive changes to current regulatory requirements or practices.
4. Decisions on Requests
Proposed section 309.54 would establish the process by which the FDIC general counsel or designee would consider and reach a determination on requests for FDIC information submitted under subpart D. While generally consistent with the current rule and existing FDIC practice, proposed section
309.54 would provide for greater
transparency by identifying the factors that the FDIC general counsel or designee would consider when evaluating requests. These include (1) the contents of the request; (2) whether confidential, personal, commercial, or supervisory information is being requested and, if so, the risk that such information could be publicly disclosed; (3) whether fulfilling all or part of the request will materially interfere with the FDIC’s operations; and (4) the public interest. Providing for these considerations directly in section 309.54 would help to inform the content of such requests. Proposed section 309.54 would also provide requesters an avenue to seek reconsideration of the FDIC general counsel’s decision within ten business days after the date of the written decision. After receipt of a request for reconsideration, the FDIC general counsel would have ten business days to review and decide on the request. A denial of such a request would be considered a final decision and would exhaust the requesting party’s administrative remedies with respect to the request for FDIC information, thereby permitting such party to seek judicial review of such a final decision under the Administrative Procedure Act.7
5. Waiver of Requirement for Requests
Proposed section 309.55 would introduce the authority of the FDIC general counsel or designee to waive the request process otherwise provided for in subpart D. The FDIC believes that the introduction of such waiver authority will provide flexibility to both the FDIC general counsel and prospective requesters in circumstances where the request process is unviable, unnecessary, or otherwise unduly burdensome.
III. New Part 306 on Service of Process
A. Overview, Purpose, and Scope The FDIC’s service of process provisions are currently codified at 12 CFR 309.7. The FDIC has observed that such provisions could benefit from further clarity through various revisions and the use of defined terms. The FDIC also believes that the current placement of its service of process provisions in
part 309 may be potentially confusing to
stakeholders, because the service of process provisions bear little relation to the processes and requirements for seeking disclosure of confidential information pursuant to part 309. To address these concerns, the proposal would recodify the FDIC’s legal service provisions as a separate
part of the FDIC’s regulations, 12 CFR
part 306. The proposal also would
introduce new provisions and defined terms to clarify ambiguities observed in the FDIC’s current service of process provisions. Specifically, the proposal would clarify that part 306 applies to services of process directed to any of the following parties, whether or not as a party to a legal proceeding: (1) the FDIC; (2) any FDIC director, officer, or employee in an official capacity; (3) any FDIC director, officer, or employee in an individual capacity for an act or omission occurring in connection with one’s duties performed on behalf of the FDIC (regardless of whether the individual also is served process in an official capacity); and (4) the FDIC and any FDIC director, officer, or employee in connection with process in a nonparty proceeding requiring, generally, testimony related to FDIC duties or knowledge acquired while performing such duties or production of documents or information in the possession of the FDIC. Question 28: Does the proposal help to clarify the scope of application of the FDIC’s legal service provisions? Are there any revisions that could be made to improve the clarity of proposed scope? B. Definitions
Section 306.2 of the proposed rule
would introduce defined terms specifically related to service of process intended to help address areas of potential ambiguity in the current regulation. Proposed section 306.2 would include the following defined terms:
FDIC’s agent for service of process would mean a person authorized by the FDIC to accept delivery of process on behalf of the FDIC in any capacity or on behalf of an FDIC director, officer, or employee in their official capacity and includes:

The FDIC’s executive secretary or
designee at FDIC, 550 17th Street, NW, Washington, DC 20429; and
The FDIC’s agent for of process at
the appropriate geographic area, as listed on the FDIC’s website. Legal proceeding would mean a judicial or administrative adjudication, action, case, matter, hearing, trial, arbitration, formal inquiry, formal investigation, or similar proceeding initiated before or subject to a court, agency or agency members, commission, board, grand jury, arbitrator, administrative law judge, hearing officer, or other authorized official or body, whether criminal, civil, or administrative in nature, under federal, state, local, or foreign law. Party would mean a person that is asserting claims or defending against claims in a legal proceeding. Party would not include a person who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery. Person would mean an individual or an entity in any form, including a governmental organization. Process would mean a summons, complaint, pleading, motion, subpoena, writ, discovery demand, or other notice or order issued in a legal proceeding and required to be served upon a

8Call Reports, December 31, 2025. 9 December 31, 2025, FR Y–9C and FR Y–9SP data. 10See FDIC Annual Freedom of Information Act Report for Fiscal Year 2025, Table V.A., at https:// www.fdic.gov/foia/annual-freedom-information-actreport-fiscal-year-2025.pdf. 11For example, the FDIC may be served in connection with a lawsuit brought by a current or former employee, or may receive service of process as part of a legal challenge to the FDIC’s regulations. The FDIC does not have specific figures on the number of times the FDIC receives service of process in a typical year. person. Process includes both physical documents and electronic documents to the extent authorized by the law applicable to the legal proceeding. Serve or service would mean delivery of process in accordance with the rules applicable to the particular jurisdiction, type of legal proceeding, stage of the legal proceeding, and type of process. The applicable rules may specify methods for delivery of process; persons or representatives authorized to accept delivery; delivery to multiple recipients; time limitations for effecting service; and other requirements. Question 29: Would the definitions provided under proposed section 306.2 help to address areas of ambiguity in the FDIC’s current service of process provisions? Are there additional defined terms that should be included? If so, what are they, and how would they help to address an ambiguity under the current service of process provisions?
C. Service of Process Requirements and
Processes
Proposed section 306.3 would describe the procedures to serve process on the FDIC, an FDIC director, officer, or employee in an official capacity, and the procedures to service process on an FDIC director, officer, or employee in an individual capacity. Relative to the current service of process provisions in 12 CFR 309.7, proposed section 306.3 would clarify the service procedures by providing, in a more organized and streamlined format, details on how and whom to serve at the FDIC, as well as a listing of the FDIC’s agents for service of process, by geographic area. When serving a director, officer, or employee in an individual capacity, section 306.3(b) would provide that service of process must be made to the United States as well as the officer or employee, and requires a copy of such service of process to be sent to an FDIC agent for service of process. This provision would help to ensure the FDIC remains apprised of process served on its directors, officers, or employees that may require disclosure of the FDIC’s confidential information. Question 30: Would proposed section
306.3 improve the clarity of the FDIC’s
current service of process provisions under section 309.7? Are there additional revisions that could be made to address areas of ambiguity in the current rule?
IV. Technical Amendments to Other
Parts of the FDIC’s Regulations Certain sections of parts 303, 327, and 337 of the FDIC’s regulations include cross-references to various provisions of
part 309. If part 309 is amended as
proposed, these references would refer to sections of part 309 that either no longer exist or have been recodified at a different section of part 309. The proposal would, therefore, amend those sections of parts 303, 327, and 337 to incorporate references to the appropriate sections of part 309, as would be amended under the proposal.
V. Expected Effects
The proposed rule would revise the FDIC’s regulations related to the processing of FDIC records under FOIA, as well as the FDIC’s restrictions on the disclosure of confidential information not subject to release under FOIA (confidential information). Specifically, the proposed rule would authorize insured depository institutions, their bank holding companies, and certain other entities to share confidential information with certain parties enumerated in the rule for business purposes without the prior approval of the FDIC. The proposed rule would also relocate the FDIC’s procedures on the service of process to a new part 306. This section summarizes the analysis performed by the FDIC to estimate the economic impact of the proposed rule. For this purpose, the FDIC compares estimated economic outcomes under the proposed rule to outcomes under a baseline that resembles a world in which the proposed rule is not promulgated. A. Scope of Affected Entities The proposed rule would generally apply to any person that possesses or comes to possess confidential information; however, the FDIC expects that the typical holder of such information would be an insured depository institution or an insured depository institution holding company. As of the quarter ending December 31, 2025, the FDIC insured 4,345 depository institutions 8 and there were 3,600 active holding companies according to FR Y–9C and FR Y–9SP filings.9 The proposed rule would also impact FDICexamined service providers, of which there are 108 as of May 2026. Certain provisions of the proposed rule would apply to any person that files a FOIA request with the FDIC or serves legal process on the FDIC. The FDIC received 1,536 FOIA requests in the fiscal year ending September 30,
2025.10 The FDIC is unable to estimate
the number of persons that may be involved in litigation that requires service of process on the FDIC.11 Finally, the proposed rule would apply to any insured depository institution that would seek to disclose certain confidential information to certain categories of third-party recipients without prior authorization from the FDIC. To estimate this population, the FDIC reviewed requests to disclose confidential information that it received pursuant to part 309 over approximately the past ten years. Based on a review of internal FDIC data, the FDIC received approximately 2,900 requests between the second quarter of 2016 and the second quarter of 2026, for an average of approximately 300 requests per year. Under a conservative assumption that each request is made by a unique institution, this provision of the proposed rule would affect nearly 300 insured depository institutions each year. B. Expected Benefits If finalized, the proposed rule would update and clarify the FDIC’s regulations regarding the process for submitting FOIA requests, the service of process on the FDIC, as well as the disclosure of FDIC records and other confidential information. The FDIC expects considerable benefits would relate to the proposed changes to part 309 that would allow insured depository institutions to disclose confidential information to certain third parties in certain circumstances without seeking prior FDIC approval. The proposed rule’s other changes to the FDIC’s regulations would also produce benefits, such as improved ease of use and enhanced understanding by the public.

Discretionary Requests To Disclose
Confidential Information Certain benefits of the proposed rule would accrue to insured depository institutions seeking to share confidential information with third parties for business purposes. Presently and under the baseline, for an insured depository institution to disclose confidential information to a prospective recipient who is not a director, officer, or employee of the insured depository institution, the insured depository institution must seek the prior approval of the FDIC. Thus,

12 12 CFR 309.6(b)(7)(i). The FDIC’s regulations also permit disclosure requests to be made by the party seeking the record. See id. In practice, however, the vast majority of disclosure requests are submitted by an agent of the insured depository institution in possession of the record. 13A non-merger transaction would also be within the scope of this provision if subject to 12 U.S.C. 1817(j), 1842, 1828(c), or 1467a. 14The requests received by the FDIC are stored in two separate repositories depending on the business unit of the FDIC that received the request. The FDIC performed a keyword search of 1,299 requests in one of the repositories received from insured depository institutions received over a period of 9.167 years and identified 360 that would not be necessary under the proposed rule (359 of which came from insured depository institutions and one from an entity other than an insured depository institution). The FDIC reviewed a random sample of 48 requests out of a total of 1,576 requests in the other repository received over 10 years and identified 9 requests from insured depository institutions out of the sample of 48 that would not be necessary under the proposed rule. Thus, the FDIC estimates that (9/48) * 1,576 = 296 of this group of requests would not be necessary under the proposed rule, for a total of 655 requests from insured depository institutions that would not be necessary under the proposed rule. 15Subject matter experts at the FDIC estimated that the reduction in volume of disclosure requests as a result of the proposed rule would save affected institutions 135 hours per year on average. Subject matter experts also estimated that, of the time spent on requests, 31 percent is made up of time spent by an institution’s executives and/or managers, 45 percent is made up of time spent by lawyers, 14 percent by compliance officers, and 11 percent by clerical staff. Using the following data on wage estimates and employee benefits costs, the FDIC estimated an hourly cost of compensation of $146.72: Bureau of Labor Statistics: ’National Industry-Specific Occupational Employment and Wage Estimates: Industry: Credit Intermediation and Related Activities (5221 And 5223 only)’ (May 2024), Employer Cost of Employee Compensation (March 2024), and Employment Cost Index (March 2024 and December 2025). Standard Occupational Classification (SOC) Codes: Exec. And Mgr = 11– 0000 Management Occupations; Lawyer = 23–0000 Legal Occupations; Compl. Ofc. = 13–1040 Compliance Officers; IT = 15–0000 Computer and Mathematical Occupations; Fin. Anlst. = 13–2051 Financial and Investment Analysts; Clerical = 43– 0000 Office and Administrative Support Occupations. This composite hourly cost of compensation, multiplied by 135 hours per year, yields a total estimated annual savings of $19,807. Dividing this figure by 69 requests per year results in an estimated savings per request of $287. 16 655 requests no longer needed under the proposed rule/2,875 total
requests = 23 percent, when rounded to the nearest integer. 17The FDIC expects that the proposed rule would provide similar benefits to the parent holding companies and service providers of insured depository institutions, in connection with the proposed expanded authority for those entities to disclose certain confidential information. These entities would realize efficiencies from improved information sharing and faster decision making relative to the current part 309 process. whenever an insured depository institution wishes to share confidential information with a prospective recipient such as an accountant, auditor, consultant, or other service provider, it must first submit a written request to the FDIC that describes the information to be shared, the prospective recipient’s interest in the information, and the prospective recipient’s relationship to the insured depository institution that is requesting to disclose the information.12 Preparing such a request entails a meaningful degree of time and effort by an insured depository institution’s directors, officers, and/or employees. Beyond this direct burden—estimated below in section V.C of this Supplemental Information—the insured depository institution must then wait for a decision on its request, which impedes the institution’s ability to promptly communicate necessary information to third parties. Under the proposed rule, insured depository institutions would be authorized to disclose confidential information without prior FDIC approval to certain categories of thirdparty recipients—such as affiliates; external legal counsel, accountants, and auditors; shareholders holding more than 50 percent of the institution’s voting stock; service providers; and potential senior executive officers to whom an offer of employment has been made—where necessary or appropriate to meet a business purpose and if they comply with certain confidentiality safeguards (as applicable). Insured depository institutions would also be authorized to disclose confidential information to directors, officers, employees, affiliates, auditors, and legal counsel of a potential counterparty with which the institution is contemplating a merger or other transaction,13 subject to certain limitations. Finally, insured depository institutions generally would be authorized to disclose confidential information after twenty-five years has elapsed since its creation. The proposed rule would also provide parent holding companies of insured depository institutions with similar authority to disclose confidential information. This authority would be available for the same categories of recipient for the holding company as provided in section 309.37(a) for insured depository institutions. In addition, the proposed rule would provide service providers subject to FDIC examination with a limited authority to disclose confidential information to their insured depository institution partners. Of the approximately 2,900 requests to disclose
confidential information received by the FDIC between the second quarter of 2016 and the second quarter of 2026, the FDIC estimates 655 would no longer be needed under the proposed rule.14 However, the number of requests not needed under the proposed rule may be greater than 665, because the FDIC’s review may not have identified every request that would no longer be required. The reduced volume of disclosure requests, representing approximately 69 fewer requests per year, would result in cost savings for insured depository institutions and their parent holding companies. The FDIC estimates that this reduction equates to an annual savings of at least $19,807, or about $290 per request.15 In addition, there may be instances in which insured depository institutions have a need to share confidential information with certain third parties but choose not to due to the process for obtaining FDIC prior approval, but would share such information under the proposed rule. For this reason and others, the amount of savings may be greater than estimated given that the number of requests no longer needed under the proposed rule may be greater than estimated. The figures above do not reflect the indirect benefits that may be realized from the proposed rule, namely that insured depository institutions would no longer be required to await the FDIC’s approval before disclosing confidential information to certain entities, a process that can take up to two weeks on average. During this time, institutions currently are unable to promptly share confidential information that may be needed to inform critical, time-sensitive business decisions. Under the proposed rule, the delay associated with the current part 309 process would be eliminated for an estimated 23 percent of disclosure requests that would no longer require prior FDIC approval.16 The FDIC does not have the data necessary to quantify the benefits of this aspect of the proposed rule, however, they could be substantial depending on the business purpose for the disclosure.17 Additionally, the ability to share confidential information with certain potential senior executive officers to whom an offer of employment has been made could benefit both an insured depository institution and prospective officer by improving the ability of each party to make a more fully informed employment decision. Separately, the ability to share confidential information with a potential counterparty to a merger or other transaction would facilitate more robust due diligence. In aggregate, the changes under the proposed rule could produce considerable efficiencies for insured depository institutions and related entities. Although the FDIC does not have the necessary data to quantify

18This provision would also apply to non-merger transactions subject to 12 U.S.C. 1817(j), 1842, 1828(c), or 1467a. 19The same analysis would apply to the potential costs for expanded disclosure authority for parent holding companies of insured depository institutions and service providers, which would be similarly subject to a confidentiality agreement requirement. 20See https://www.fdic.gov/community-bankingresearch-program/community-banking-structurereference-data-fourth-quarter-2025. 21While mergers may involve fewer than three counterparties, the FDIC is using three as an estimate given the proposed rule’s provision at proposed section 309.37(a)(1)(vii) limiting the disclosure of confidential information to three potential merger counterparties over a five-year period. Also, although many mergers may be completed without sharing confidential information with three counterparties, there are likely also potential mergers for which confidential information is shared, but which do not ultimately result in a merger. Accordingly, the estimate of three disclosures per completed merger attempts to account for both of these considerations. 22The FDIC estimated that each waiver submission would take one hour and be completed by a lawyer at an estimated hourly compensation cost of $180.27. See note 17 for information on the data underlying the estimation of hourly compensation by occupation. 330 waivers per year multiplied by 1 hour per waiver at an estimated hourly cost of $180.27 equals about $59,489 per year. $180.27 per waiver equals $59,489 divided by 330 waivers. these benefits, the FDIC believes these efficiencies would be meaningful.
2. Other Changes
The proposed rule also updates and clarifies the FDIC’s regulations governing its handling of requests under FOIA. Under the proposed rule, several provisions would be revised to more clearly describe the documents the FDIC makes available to the public and the process for submitting FOIA requests. The proposed rule also would add provisions describing the FDIC’s administrative appeals process under FOIA and supplemental procedures for the submission and disclosure of confidential commercial information. In particular, the latter provision would require entities submitting confidential commercial information to the FDIC to designate the portions of its submissions that it considers to be protected from disclosure under Exemption 4 of FOIA, and provides that such protection would ordinarily expire 10 years from the date of submission unless the submitter requests and provides justification for a longer designation period. This provision would also provide submitters of confidential commercial information with notice and an opportunity to object when the FDIC determines that it may need to disclose that information. To the extent the improved clarity of the FDIC’s FOIA regulations facilitates the submission of complete and compliant FOIA requests, it may expedite the FDIC’s processing of such requests, resulting in more prompt disclosure of responsive information. The proposed changes may also reduce the costs of preparing and submitting FOIA requests, thereby reducing an impediment to submitting a request. These benefits, in turn, may support a more informed public as well as improved accountability and transparency with respect to the FDIC’s operations. Each of these outcomes would advance the public policy of openness that underlies the FOIA. Additionally, the proposed rule would relocate the FDIC’s service of process provisions from part 309 to a new part 306, because the service of process provisions are generally unrelated to those regarding the disclosure of information. The proposed rule would clarify the procedures to serve process on the FDIC in any capacity or an FDIC director, officer, or employee in their official capacity or otherwise in connection with acts or omissions occurring in connection with their FDIC duties. For example, the proposed rule would identify the FDIC’s executive secretary or designee as agents for service and would emphasize that service of process must be effected in accordance with the rules of the applicable jurisdiction in which the legal proceeding is taking place. The FDIC does not have the necessary information to quantify the effects of this aspect of the proposed rule on insured depository institutions, but expects the changes would improve the clarity and efficiency of the FDIC’s service of process procedures. In general, the proposed rule, if finalized, would clarify aspects of the FDIC’s information disclosure regulations that are ambiguous, codify current practices to improve the public’s
understanding of the FDIC’s information sharing processes, and harmonize the FDIC’s regulations with those of the other federal banking agencies to the extent appropriate. In doing so, the proposed rule, if finalized, would enhance the public’s understanding of the FDIC’s information disclosure processes and improve the public’s ability to engage and interface with those processes.
C. Expected Costs
The proposed rule would provide insured depository institutions with additional latitude to disclose confidential information when doing so is necessary and appropriate for a business purpose, and would require insured depository institutions disclosing confidential information to certain recipients to enter into a qualifying confidentiality agreement with the prospective recipient prior to or concurrent with the disclosure of such information. For purposes of the proposed rule, a ‘‘qualifying confidentiality agreement’’ is one that includes the provisions set forth in the proposed definition for this term. In addition, for an insured depository institution to disclose confidential information to a potential counterparty in a merger transaction,18 the proposed rule would require a written waiver from the counterparty of any claims against the FDIC arising from the confidential information. Finally, a party that wishes to use confidential information in a legal proceeding to which the FDIC is not a party must submit a request to the FDIC general counsel or designee. The FDIC expects that any costs associated with the proposal would be small. First, while part 309 currently does not require an insured depository institution to enter into a confidentiality agreement to obtain authorization to disclose confidential information, as a matter of practice the FDIC routinely imposes such a requirement as a condition of its authorization. Accordingly, the requirement to enter into a confidentiality agreement typically would not represent a new cost for insured depository institutions relative to the baseline.19 Second, the FDIC expects that there would be only minimal costs associated with requiring merger counterparties receiving confidential information to submit a written waiver of any claims against the FDIC that may otherwise arise from receipt of confidential information. There were 110 voluntary mergers per year on average between insured depository institutions over the three-year period ending December 31,
2025.20 If each merger involved three
potential counterparties 21 for whom a written waiver was submitted, then 330 waivers per year would have been submitted if the proposed rule had been in place, at an estimated cost of only about $180 per waiver submission.22 The proposed rule also could increase the risk that confidential information may be disclosed to unintended recipients not authorized to receive such information. However, the FDIC does not expect this risk to increase materially as a result of the proposal. The FDIC’s longstanding practice has been to routinely approve the types of disclosures that would no longer require prior FDIC authorization under the proposed rule. Moreover, while the proposed rule would facilitate more

23 5 U.S.C. 601 et seq.
24The SBA defines a small banking organization as having $850 million or less in assets and determines an organization’s assets by averaging the assets reported on its four quarterly financial statements for the preceding year. See 13 CFR
121.201 (as amended by 87 FR 69118, effective
December 19, 2022). Following these regulations, the FDIC uses an FDIC-supervised institution’s affiliated and acquired assets, averaged over the preceding four quarters, to determine whether the FDIC-supervised institution is ‘‘small’’ for the purposes of the RFA. 25Call Reports, December 31, 2025. 26 December 31, 2025, FR Y–9C and FR Y–9SP data. 27Based on average assets reported in FR Y–9C data from March 31, June 30, and December 31, 2025, and in FR Y–9SP data from December 31, 2024, June 30, 2025, and December 31, 2025. 28 1,262 requests over ten years * 38% from small entities/10 years = 48.0 requests from small entities per year. 29 5 U.S.C. 605(b). timely disclosure of confidential information, the persons authorized to receive such information under the proposed rule typically have significant connections to the insured depository institution making the disclosure and an interest in protecting confidential information regarding the institution. To share confidential information with persons who typically have less of an interest in or incentive to protect confidential information regarding an insured depository institution, the proposal would continue to require the FDIC’s prior approval. Finally, the proposal would generally remove restrictions on the disclosure of confidential information more than 25 years after its creation or last modification. This provision could help mitigate other costs associated with the proposal. This proposed change would recognize that the passage of time tends to diminish the need to maintain the confidentiality of sensitive information, under most circumstances. D. Conclusion Given the economic effects discussed in section V.A through V.C of this Supplemental Information, the FDIC expects that the benefits of the proposed rule would justify its costs. The FDIC invites comments on all aspects of the supporting information provided in the Expected Effects
section. The FDIC is particularly
interested in comments on any material economic effects that the agency has not identified.
VI. Matters of Regulatory Procedure
A. Regulatory Flexibility Act The Regulatory Flexibility Act (RFA) generally requires an agency, in connection with a proposed rule, to prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of the proposed rule on small entities.23 However, an initial regulatory flexibility analysis is not required if the agency certifies that the proposed rule would not, if promulgated, have a significant economic impact on a substantial number of small entities. The Small Business Administration (SBA) has defined ‘‘small entities’’ to include banking organizations with total assets of less than or equal to $850 million.24 As detailed in the following statement of factual basis, the FDIC certifies that the proposed rule would not, if promulgated, have a significant economic impact on a substantial number of small entities. Generally, the FDIC considers a significant economic impact to be a quantified effect in excess of 5 percent of total annual salaries and benefits or
2.5 percent of total noninterest
expenses. To estimate the economic impact of the proposed rule on each small entity, the FDIC compares expected outcomes under the proposed rule to expected outcomes under a baseline absent the proposed rule. The proposed rule would apply to all FDIC-insured institutions, parent holding companies of insured depository institutions, persons and entities requesting information from the FDIC under FOIA, persons and entities requesting information from the FDIC in connection with legal proceedings, and persons and entities serving legal process on the FDIC. As of the quarter ending December 31, 2025, the FDIC insures 4,345 depository institutions, of which 2,996 are small.25 In addition, 3,600 holding companies were active as of December 31, 2025 and filed a Y–9C or Y–9SP.26 Of these, 2,253 are small entities for purposes of RFA.27 The FDIC does not possess the data to estimate the population of the persons and entities other than insured depository institutions that are potentially affected by the proposed rule. However, the FDIC reviewed a random sample of 50 discretionary disclosure requests (requests) received over the last ten years from a full population of 1,262 DDRs. Of these requests, 19 were made by banks, 17 by government entities, and two by law and accounting firms, neither of which was a small entity. For 12 requests, it was not possible based on the data drawn to identify who made the request. For the 31 requests that were potentially made by small entities (19 banks and 12 unknown), 12 were identified as being made by large banks, leaving an upper bound of 19 possible requests by small entities in the sample of 50, a proportion of 38 percent. Extrapolating this to the full population of 1262 requests over ten years gives an upper-bound estimate of 48 for the annual number of requests from small entities.28 The largest effect of this rule on small entities is likely to be a reduction in the number of requests made by small insured depository institutions due to the change in regulation. Of the 19 requests submitted by potential small entities that were reviewed for this analysis, the FDIC estimates that eight would be rendered unnecessary by the proposed rule, a proportion of 42.1 percent. Applying this to the upper bound estimate (48 annual requests) yields an upper bound reduction of approximately 20 requests from small entities, so that at most 20 small entities will be affected each year. The FDIC does not consider 20 to be a substantial number of small entities, even under the extremely conservative assumption that making a single request in a year constitutes a significant economic impact. The other effects of the rule which could impact small entities that are not contingent on filing a request are: (1) the benefit from reduced uncertainty about the FDIC’s regulations governing disclosure of information; and (2) the potential risk of increased unauthorized sharing of confidential information. As discussed above, neither of these
effects are material, particularly for small entities. Based on the preceding statement of factual basis, the FDIC certifies that the proposed rule will not, if promulgated, have a significant economic impact on a substantial number of small entities. Accordingly, an initial regulatory flexibility analysis is not required.29 The FDIC invites comments on all aspects of the supporting information provided in this RFA section. The FDIC is particularly interested in comments on any significant effects on small entities that the agency has not identified. B. Paperwork Reduction Act This notice of proposed rulemaking has been reviewed for compliance with the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.). In accordance with the PRA, the FDIC may not conduct or sponsor, and an organization is not required to respond to, an information collection unless the information collection displays a currently valid Office of Management and Budget (OMB) control number. The

30 12 U.S.C. 4802(a).
31 12 U.S.C. 4802(b). 32 12 U.S.C. 4809. FDIC has reviewed the notice of proposed rulemaking and determined that it would introduce new information collection requirements pursuant to the PRA. The FDIC is seeking a new control number for these information collection requirements and will submit them to OMB for review and approval. Proposed Information Collection:
Title: Disclosure of Information. OMB Control No.: 3064–NEW. Type of Review: Regular. Affected Public: Businesses or other for-profit. Description: The proposed rule would update, clarify, and supplement the FDIC’s regulations regarding the disclosure of confidential information by the FDIC and other parties. The information collection requirements in the proposed rule are as follows:
Section 309.34 would require requests
for discretionary disclosure of confidential information to be submitted to the FDIC.
Section 309.37(a)(1)(vii)(C) would
require potential counterparties to submit a written waiver to the FDIC.
Section 309.52(b) and (c) and section
309.53 would require a party in a legal
proceeding, or any person substantially involved in the legal proceeding, to submit a request to the FDIC general counsel or designee.
TABLE 1—SUMMARY OF ESTIMATED ANNUAL BURDEN
[OMB No. 3064–NEW]
Information collection (IC) (obligation to respond) Type of burden (frequency of response) Number of respondents Number of responses per respondent Time per response (HH:MM) Annual burden (hours)

Request for discretionary disclosure of confidential information related to resolution plans—Section 309.34 (Required to
obtain or retain a benefit).
Reporting (On Occasion) ......... 91 1 01:00 91
Request for discretionary disclosure of confidential information other than information related to resolution plans—Section 309.34 (Required to obtain or retain a benefit).
Reporting (On Occasion) ......... 139 1 03:00 417
Written waiver—Section 309.37(a)(1)(vii)(C) (Required to
obtain or retain a benefit).
Reporting (On Occasion) ......... 330 1 01:00 330
Request to use FDIC information in a non-party legal proceeding—Section 309.52(b) and (c), Section 309.53 (Required to obtain or retain a benefit).
Reporting (On Occasion) ......... 254 1 2:30 635 Total Annual Burden (Hours) .............................................. .................................................. ........................ ........................ ........................ 1,473 Comments are invited on:
(a) Whether the collection of information is necessary for the proper performance of the FDIC’s functions, including whether the information has practical utility; (b) The accuracy of the estimate of the burden of the information collection, including the validity of the methodology and assumptions used; (c) Ways to enhance the quality, utility, and clarity of the information to be collected; and (d) Ways to minimize the burden of the information collection on respondents, including through the use of automated collection techniques or other forms of information technology. All comments will become a matter of public record. Comments on aspects of this proposed rule that may affect reporting, recordkeeping, or disclosure requirements and burden estimates should be sent to the address listed in the ADDRESSES section. Written comments and recommendations for this information collection also should be sent within 60 days of publication of this document to www.reginfo.gov/ public/do/PRAMain. Find this particular information collection by selecting ‘‘Currently under 60-day Review—Open for Public Comments’’ or by using the search function.
C. Riegle Community Development and
Regulatory Improvement Act Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act of 1994 (RCDRIA),30 in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, each Federal banking agency must consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on affected depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations. In addition,
section 302(b) of the RCDRIA requires
new regulations and amendments to regulations that impose additional reporting, disclosures, or other new requirements on insured depository institutions generally to take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form. The FDIC invites comments that further will inform its consideration of the RCDRIA.31 D. Plain Language
Section 722 of the Gramm-LeachBliley Act 32 requires the Federal
banking agencies to use plain language in all proposed and final rulemakings published in the Federal Register after January 1, 2000. The FDIC sought to present the proposed rule in a simple and straightforward manner. The FDIC invites your comments on how to make this proposal easier to understand. For example:

Has the FDIC organized the material
to suit your needs? If not, how could the material be better organized?
Are the requirements in the
proposed rule clearly stated? If not, how could the proposed rule be stated more clearly?
Does the proposed rule contain
language or jargon that is unclear? If so, which language requires clarification?
Would a different format (grouping
and order of sections, use of headings, paragraphing) make the rule easier to understand?
What else could the FDIC do to
make the proposed rule easier to understand? E. Executive Orders 12866 and 14192 Executive Order 12866, as amended, directs agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is

necessary, to select regulatory approaches that maximize net benefits. This proposed rule was drafted and reviewed in accordance with Executive Order 12866. Within OMB, the Office of Information and Regulatory Affairs (OIRA) has determined that this rulemaking is not a ‘‘significant regulatory action’’ for the purposes of Executive Order 12866. Executive Order 14192, titled ‘‘Unleashing Prosperity Through Deregulation,’’ was issued on January 31, 2025. Section 3(a) of Executive Order 14192 requires an agency, unless prohibited by law, to identify at least ten existing regulations to be repealed when the agency publicly proposes for notice and comment or otherwise promulgates a new regulation. In furtherance of this standard, section 3(c) of Executive Order 14192 requires that the new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least ten prior regulations. This proposed rule, if finalized as proposed, is expected to be a deregulatory action under Executive Order 14192. List of Subjects 12 CFR Part 303 Administrative practice and procedure, Bank deposit insurance, Banks, Banking, Reporting and recordkeeping requirements, Savings associations. 12 CFR Part 306 Administrative practice and procedure, Banks, Banking. 12 CFR Part 309 Banks, Banking, Credit, Freedom of information, Privacy. 12 CFR Part 327 Bank deposit insurance, Banks, Banking, Savings associations. 12 CFR Part 337 Banks, Banking, Reporting and recordkeeping requirements, Savings associations, Securities. Authority and Issuance For the reasons set forth in the preamble, the Federal Deposit Insurance Corporation proposes to amend 12 CFR
chapter III as follows:
PART 303—FILING PROCEDURES

1. The authority citation for part 303
  continues to read as follows:
  Authority: 12 U.S.C. 378, 1464, 1813, 1815, 1817, 1818, 1819(a) (Seventh and Tenth), 1820, 1823, 1828, 1829, 1831a, 1831e, 1831o, 1831p–1, 1831w, 1835a, 1843(l), 3104, 3105, 3108, 3207, 5414, 5415, and 15 U.S.C. 1601–1607. § 303.8 [Amended]
1. Amend § 303.8(a) by, in the last
  sentence, removing ‘‘in accordance with § 309.5(f) of this chapter’’ and adding ‘‘in accordance with § 309.18(c) of this
  chapter’’ in its place.
  § 303.41 [Amended]
1. Amend § 303.41(b) by, in the last
  sentence, removing ‘‘; see § 309.4(a) and (b) of this chapter for availability’’. § 303.60 [Amended]
1. Amend § 303.60 by removing ‘‘; see
  § 309.4(a) and (b) of this chapter for availability’’. § 303.62 [Amended]
1. Amend § 303.62(b)(3) by, in the last
  sentence, removing ‘‘; see § 309.4(a) and (b) of this chapter for availability’’.
1. Add part 306 to read as follows:
  PART 306—SERVICE OF PROCESS
  Sec.
  306.1 Scope.
  306.2 Definitions.
  306.3 Service of process.
  306.4 Reporting receipt of process to the
  FDIC General Counsel.
  PART 306—SERVICE OF PROCESS
  Authority: 12 U.S.C. 1819 Seventh and Tenth. § 306.1 Scope. This part applies to service of process directed to any of the following, whether as a party or as a non-party to a legal proceeding:
  (a) the FDIC;
  (b) any FDIC director, officer, or employee in an official capacity; (c) any FDIC director, officer, or employee in an individual capacity for an act or omission occurring in connection with duties performed on the FDIC’s behalf (whether or not the director, officer, or employee is also sued in an official capacity); and (d) the FDIC in any capacity and any FDIC director, officer, or employee in connection with process in a non-party proceeding requiring: attendance and testimony concerning duties performed on the FDIC’s behalf or knowledge or information acquired in the course of performing such duties or related to such duties; or production of designated documents, electronically stored information, or tangible things or the inspection of premises in the FDIC’s possession, custody, or control. § 306.2 Definitions. FDIC means the Federal Deposit Insurance Corporation in any capacity, including as receiver, as conservator, and in its corporate capacity. FDIC’s agent for service of process means a person authorized by the FDIC to accept delivery of process on behalf of the FDIC in any capacity or on behalf of an FDIC director, officer, or employee in their official capacity, and includes:
  (1) the FDIC’s agent for service of process for the appropriate geographic area, as listed on the FDIC’s website; and (2) the FDIC executive secretary or designee at FDIC, 550 17th Street NW, Washington, DC 20429. Legal proceeding means a judicial or administrative adjudication, action, case, matter, hearing, trial, arbitration, formal inquiry, formal investigation, or similar proceeding initiated before or subject to a court, agency or agency members, commission, board, grand jury, arbitrator, administrative law judge, hearing officer, or other authorized official or body, whether criminal, civil, or administrative in nature, under federal, state, local, or foreign law. Party means a person that is asserting claims or defending against claims in a legal proceeding. For purposes of this
  part, party does not include a person
  who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery. Person means an individual or an entity in any form, including a governmental organization. Process means a summons, complaint, pleading, motion, subpoena, writ, discovery demand, or other notice or order issued in a legal proceeding and required to be served upon a person. Process includes both physical documents and electronic documents to the extent authorized by the law applicable to the legal proceeding. Serve or service means delivery of process in accordance with the rules applicable to the particular jurisdiction, type of legal proceeding, stage of the legal proceeding, and type of process. The applicable rules may specify methods for delivery of process; persons or representatives authorized to accept delivery; delivery to multiple recipients; time limitations for effecting service; and other requirements. § 306.3 Service of process. (a) Service on the FDIC in any capacity or an FDIC director, officer, or employee in an official capacity. Any person or party desiring to properly

initiate process upon the FDIC or an FDIC director, officer, or employee in an official capacity as a party must serve the United States and the FDIC in the manner specified by Rule 4(i) of the Federal Rules of Civil Procedure. For all other process, the only authorized recipients of service directed to the FDIC in any capacity or an FDIC director, officer, or employee in an official capacity are the following:
(1) the FDIC’s agent for service of process; or (2) when authorized by the rules applicable to the particular legal proceeding, counsel for the FDIC or counsel for the FDIC director, officer, or employee in an official capacity. (b) Service on an FDIC director, officer, or employee in an individual capacity. Any person or party desiring to properly initiate process upon an FDIC director, officer, or employee as a party for an act or omission occurring in connection with duties performed on the FDIC’s behalf (whether or not the director, officer, or employee is also sued in an official capacity) must serve the United States and the director, officer, or employee in the manner specified by Rule 4(i) of the Federal Rules of Civil Procedure. A copy of such process must also be sent to the FDIC’s agent for service of process.

7. Revise part 309 to read as follows:
PART 309—DISCLOSURE OF
INFORMATION
Sec.
Subpart A—General
309.1 Purpose and Scope.
Subpart B—Freedom of Information Act
309.10 Scope.
309.11 Definitions.
309.12 FDIC information that may be made
available on request.
309.13 Making a request for records.
309.14 Processing requests—in general.
309.15 Processing requests—expedited
processing.
309.16 Consultations and referrals.
309.17 Fees in general.
309.18 Types of fees.
309.19 Charging fees.
309.20 Payment of fees.
309.21 Waiver or reduction of fees.
309.22 Dispute resolution.
309.23 Administrative appeals.
309.24 Supplemental procedures for
confidential commercial information. Subpart C—Discretionary Disclosure of Confidential Information
309.30 Purpose and Scope.
309.31 Definitions.
309.32 Disclosure prohibited.
309.33 Disclosure authorized; limitations.
309.34 Procedure for requesting
discretionary disclosure.
309.35 Standard for discretionary
disclosure.
309.36 Disclosure by the FDIC.
309.37 Disclosure by insured depository
institutions and certain other entities.
309.38 Disclosure by other persons.
309.39 Conditions and limitations.
Subpart D—Disclosure of Confidential Information in Legal Proceedings in Which the FDIC Is Not a Party
309.50 Scope.
309.51 Definitions.
309.52 Use of FDIC information in a nonparty legal proceeding.
309.53 Submitting a request.
309.54 Decisions on requests.
309.55 Waiver and exemption of
requirement for requests.
Authority: 5 U.S.C. 552, 12 U.S.C. 1819 ‘‘Seventh and Tenth.’’ Subpart A—General § 309.1 Purpose and Scope. (a) Scope. (1) This part sets forth the policies of the FDIC regarding information it maintains and the procedures for obtaining access to such information. Subpart B of this part contains regulations concerning the FDIC’s implementation of the Freedom of Information Act, 5 U.S.C. 552. Subpart C of this part provides procedures for disclosure of confidential FDIC information in the discretion of authorized FDIC officials. Subpart D of this part provides procedures for requesting FDIC records or testimony of FDIC directors, officers, employees, or agents for use in legal proceedings in which the FDIC is not a party. (2) This part does not include the FDIC’s regulations concerning the Privacy Act of 1974, 5 U.S.C. 552a (Privacy Act) or the Government in the Sunshine Act, 5 U.S.C. 552b. FDIC regulations concerning the Privacy Act may be found at 12 CFR part 310. FDIC regulations concerning the Government in the Sunshine Act may be found at 12 CFR part 311. (3) Requests made by an individual for records about that individual under the Privacy Act of 1974, 5 U.S.C. 552a, are processed in accordance with the FDIC’s Privacy Act regulations, 12 CFR
part 310, as well as under subpart B, C,
or D of this part, as applicable. (b) For purposes of this part, the term FDIC means the Federal Deposit Insurance Corporation in any capacity, including as receiver, as conservator, and in its corporate capacity. Subpart B—Freedom of Information Act § 309.10 Scope. This subpart contains the FDIC’s published rules concerning the FDIC’s implementation of the Freedom of Information Act, 5 U.S.C. 552 (FOIA). § 309.11 Definitions. For purposes of this subpart:
Commercial use request means a request that seeks information for a use or purpose that furthers commercial, trade, or profit interests of the requester or the person on whose behalf the request is made, which can include furthering those interests through litigation. In deciding whether to place a request in this category, the FDIC will make a determination on the requester’s intended use of the records and seek additional information as it deems necessary. Confidential commercial information means trade secrets and commercial or financial information obtained by the FDIC from a submitter that may contain material exempt from disclosure under Exemption 4 of the FOIA, 5 U.S.C. 552(b)(4). Defective request means a request that does not reasonably describe the information requested or that does not otherwise comply with the requirements of this subpart, including those related to fees. Direct costs means expenditures the FDIC incurs in searching for, duplicating, and, in the case of commercial requesters, reviewing records in response to a request for records. Duplication means the process of making a copy of a record, or of information contained in the record, for purposes of responding to a request. Educational institution means any school that operates a program of scholarly research. A requester in this category must show that the request is made in connection with the requester’s role at an educational institution and that the records are not sought for a commercial use, but rather are sought to further scholarly research. FOIA public liaison means the FDIC official responsible for assisting requesters by explaining the FOIA process, providing information on the status of requests, and resolving any disputes. Contact information for the FDIC FOIA public liaison is available on the FDIC’s website located at: https:// www.fdic.gov. Non-commercial scientific institution means an institution that is not operated on a ‘‘commercial’’ basis as that term is used in paragraph (b) of this section, and that is operated solely for the purpose of conducting scientific research, the results of which are not intended to promote any particular product or industry. A requester in this category must show that the request is

authorized by and is made under the auspices of a qualifying institution and that the records are not sought for a commercial use, but rather are sought to further scientific research. Representative of the news media means any person or entity that gathers information about current events or of potential current interest to a segment of the public, uses its editorial skills to turn the raw materials into a distinct work, and distributes that work to an audience. Review means the examination of a record located in response to a request to determine whether any portion of it is exempt from disclosure. Review includes processing any record for disclosure, such as doing all that is necessary to prepare the record for disclosure, including redacting the record and marking the appropriate exemptions. Review also includes both obtaining and considering any formal objection to disclosure made by a confidential commercial information submitter under 12 CFR 309.24. Search means the process of locating and retrieving records responsive to a request. Search includes all time spent by FDIC staff conducting a search. Submitter means any person or entity that provides confidential commercial information to the FDIC. The term ‘‘submitter’’ includes, but is not limited to, corporations, state governments, and foreign governments. § 309.12 FDIC information that may be made available on request. (a) In general. (1) Any person may make a request to the FDIC pursuant to FOIA for any FDIC record. Requests for information under FOIA are submitted to and processed by the FDIC’s Freedom of Information Act/ Privacy Act Group (FOIA/PA Group). (2) The FDIC’s time to respond to a request begins when the FDIC receives a request that satisfies the requirements of this subpart. The FDIC will conduct a search of records that are in existence as of the date the search begins, and any responsive records that are located will be reviewed to determine if the records may be disclosed or withheld under one or more FOIA exemptions, 5 U.S.C. 552(b). (3) If all or part of the request is granted, the FDIC will provide copies of the requested records. The FDIC may charge fees for searching for responsive records, reviewing records, and duplicating records to provide to a requester. (4) If a request for records is denied in full or in part, the FDIC will notify the requester of the FDIC’s decision, the reasons for the decision, the right of the requester to appeal the denial, and how to seek assistance from the FDIC’s FOIA public liaison and the Office of Government Information Services of the National Archives and Records Administration (OGIS). § 309.13 Making a request for records. (a) Where to send a request. All requests for records must be submitted in writing to the FOIA/PA Group. A request may be made by:
(1) completing the online request form in the FDIC’s Freedom of Information Act Service Center (‘‘FOIA Service Center’’) portal found at https:// www.fdic.gov; (2) completing the online request form located on the U.S. government central portal for FOIA requests at www.FOIA.gov; (3) sending an email to the FDIC at efoia@fdic.gov, clearly marked ‘‘Freedom of Information Act request’’ or ‘‘FOIA request’’; or (4) sending a letter to: Legal Division, FDIC, ATTN: FOIA/PA Group, 550 17th Street NW, Washington, DC 20429. (b) Contents of a request— administrative information. The request must contain the following information:
(1) The name and street address of the requester, an email address, if available, and the telephone number at which the requester may be reached during normal business hours; (2) Whether the requester is an educational institution, non-commercial scientific institution, or a representative of the news media and, as applicable, the content requirements provided in the definitions of the terms ‘‘educational institution’’ and ‘‘non-commercial scientific institution’’ in § 309.11; and (3) A statement identifying a maximum fee, if any, that is acceptable to the requester, or a request for a waiver or reduction of fees that satisfies § 309.21. (c) Contents of a request—description of records sought. A request for records must describe the records in a way that enables FDIC staff to identify and produce the records with reasonable effort and without unduly burdening the FDIC or significantly interfering with the operation of the FDIC’s automated information systems. (1) Requesters should include details about the specific records or the types of records that the requesters are seeking, such as the date, title or name of the record; author of the record; recipient of the record; name and location of the financial institution to which the record pertains, if applicable; and subject matter of the record so that the FDIC can locate the records with a reasonable amount of effort. (2) Requests that lack specific information about the records sought, contain very general topics, do not include date ranges, or have no limitations (such as seeking ‘‘any’’ or ‘‘all’’ records) are likely to be considered ‘‘defective requests,’’ as defined in § 309.11. Upon receipt of a defective request, the FDIC shall inform the requester what additional information is needed or why the request is otherwise insufficient. (d) Contents of a request—records about the requester. An individual requesting records pertaining to themselves must comply with the verification of identity provisions set forth in 12 CFR 310.4(c). (e) Contents of a request—records about third parties. (1) Where a request for records pertains to a third party, a requester may receive greater access by submitting a written authorization signed by the individual who is the subject of the record. The written authorization should be notarized, or should be in the form of a declaration made in compliance with 28 U.S.C. 1746. (2) When the records concern a deceased individual, a requester must submit proof that the individual is deceased (e.g., a copy of a death certificate or an obituary). The FDIC may require a requester to supply additional information or documentation, if necessary, for verification purposes. § 309.14 Processing requests—in general. (a) Receipt of requests. Upon receipt of a request, the FOIA/PA Group will acknowledge receipt of the request in writing to the requester and provide the requester with an individualized tracking number for the request and the telephone number to obtain information
about the status of request. (b) Multitrack processing. The FDIC places FOIA requests in simple or complex queues. (1) In making the determination as to whether a request will be placed in the complex processing queue, the FDIC will consider whether it will need to:
(A) search for and collect records from one or more divisions or offices outside of the FOIA/PA Group; (B) search for, collect, and review a voluminous number of records that are
part of a single request; or
(C) consult with another Federal agency before releasing records. (2) Most other requests will be placed in the simple processing queue. (3) Requesters may seek expedited processing under § 309.15. (c) Priority of processing. The FDIC processes requests in the order the

requests are received in the separate processing tracks. However, in the FDIC’s discretion, or upon receipt of an order issued by a court, tribunal, or other forum having compulsory jurisdiction over the FDIC, a particular request may be processed out of turn. (d) Status of a request. A requester may check on the status of a request using the tracking number assigned to obtain information including the date of the FDIC’s receipt and an estimated date for a response. The status of a request may be obtained online at the FDIC’s FOIA Service Center, at https:// www.fdic.gov, if the request was submitted electronically using the FDIC’s online FOIA request portal, by calling the FDIC’s FOIA Service Center at (202) 898–7021, by email at efoia@ fdic.gov, or by regular mail. (e) Statutory time period for processing. The time for response to requests is twenty business days after the date of receipt of the request by the FOIA/PA Group. The date of receipt for such request, including one that is addressed incorrectly or that is referred by another agency, is the date the FOIA/ PA Group actually receives the request. (f) Extension of time in unusual circumstances. (1) Whenever the statutory time limits for processing a request cannot be met because of unusual circumstances, as defined in 5 U.S.C. 552(a)(6)(B), the FDIC will, before the expiration of the twenty-day period to respond, notify the requester in writing of the unusual circumstances involved and of the date by which processing of the request can be expected to be completed. (2) If this extension exceeds ten working days, the FDIC will, as described by the FOIA, provide the requester with an opportunity to modify the request or agree to an alternative time period for processing the original or modified request. (3) The FDIC will make available its FOIA Public Liaison to assist in the resolution of any disputes with the requester, and will also notify the requester of the right to seek dispute resolution services from the OGIS. (g) Aggregation of requests. The FDIC may aggregate requests in cases where it reasonably believes that multiple requests, submitted by the same requester or by a group of requesters acting in concert, constitute a single request that would otherwise involve unusual circumstances and involve clearly related matters. § 309.15 Processing requests—expedited processing. (a) Processing requests on an expedited basis. A request will be processed on an expedited basis only when the FDIC determines that the request involves:
(1) circumstances in which the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual; (2) an urgency to inform the public about an actual or alleged Federal Government activity, if made by a person who is primarily engaged in disseminating information; (3) the loss of substantial due process rights; or (4) a matter of widespread and exceptional media interest in which there exists possible questions about the Federal Government’s integrity which affect public confidence. (b) Making a request for expedited processing. A request for expedited processing must be made at the time the initial request for one or more records is made, and must include a statement certified to be true and correct, explaining in detail the basis for making the request for expedited processing, consistent with the considerations set forth in § 309.15(a). (c) Notice of determination of request for expedited processing. A requester seeking expedited processing will be notified whether expedited processing has been granted or denied within ten calendar days of the receipt of the request by the FOIA/PA Group. If the request for expedited processing is denied, the requester may file an appeal pursuant to the procedures set forth in § 309.23. § 309.16 Consultations and referrals. (a) In general. If the FDIC determines that another agency of the Federal Government is subject to the FOIA and is in a better position to process records responsive to a request, then it will either:
(1) consult with the agency that has a substantial interest in the responsive records before responding to the request; or (2) refer the responsive records to the agency that created or initially acquired the records. Whenever the FDIC refers any part of the responsibility for responding to a request to another agency, it will notify the requester of the referral and inform the requester of the name of each agency to which the records were referred, unless such disclosure, in itself, would be exempt from disclosure. (b) Timing of responses to consultations and referrals. All consultations and referrals received by the FDIC will be handled according to the date that the first agency received the perfected FOIA request. (c) Agreements regarding consultations and referrals. The FDIC may establish agreements with other agencies to eliminate the need for consultations or referrals with respect to particular types of records. § 309.17 Fees in general. (a) Fee schedule. The FDIC’s Records Fee Schedule is available at https:// www.fdic.gov/foia/fees. The Fee
Schedule should be read in conjunction
with the text of the FOIA and the Uniform Freedom of Information Fee
Schedule and Guidelines published by
the Office of Management and Budget. The FDIC may charge the full allowable direct costs it incurs. In order to resolve any fee issues that arise under this subpart, the FDIC may contact a requester for additional information. The FDIC shall ensure that searches, review, and duplication are conducted in the most efficient and the least expensive manner. (b) Fees by category of requester. (1) Commercial use requesters will be charged search, duplication and review costs. (2) Educational institutions, noncommercial scientific institutions and any representative of the news media will be charged duplication costs beyond the first 100 pages. (3) All other requesters will be charged the full reasonable direct cost of search and duplication, except for the first two hours of search time and the first 100 pages of duplication. § 309.18 Types of fees. (a) Search fees. Search fees will be charged to any requester who is not an educational institution, a noncommercial scientific institution, or a representative of the news media. The FDIC will charge for manual searches for records at the hourly labor rates set forth in the FDIC’s Records Fee
Schedule. The fee for a search of
electronic records will be the actual direct cost of the search, including computer search time and the time spent by the operator in conducting the search. Search costs are assessed even if responsive records are not located or are determined to be exempt from disclosure. (b) Review fees. The FDIC will charge commercial use requesters for the review of records at the hourly labor rates set forth in the FDIC’s Records Fee
Schedule. The FDIC will not charge at
the administrative appeal level for review of an exemption already applied. Requesters will be charged for review costs even if responsive records are

determined to be exempt from disclosure. (c) Duplication fees. The FDIC will charge for paper copies of records on a per-page basis at the rate set forth in the FDIC’s Records Fee Schedule. If paper documents must be scanned in order to comply with a requester’s preference to receive the records in an electronic format, the requester will pay the direct costs associated with scanning those documents. For methods of duplication other than paper copies, the FDIC will charge the actual direct costs of duplicating the documents, including the operator’s time at the hourly labor rates set forth in the FDIC’s Records Fee
Schedule.
§ 309.19 Charging fees.
(a) Multiple requests. Multiple requests from the same requester or group of requesters seeking similar or related records will be aggregated for the purposes of charging fees. (b) Estimated fees. If the FDIC determines that the estimated fees for search, duplication, or review of requested records will exceed the dollar amount specified in the request, or if no dollar amount is specified, the FDIC will advise the requester of the estimated fees. The time for the processing of the request will be tolled when the FDIC notifies the requester of the estimated fees. The requester will then be given the opportunity to agree to pay the estimated amount or modify the request. Upon receipt of the requester’s response, the FDIC’s time to respond will resume. If the FDIC does not receive a response from the requester within thirty calendar days, the request will be closed. (c) Advance payments. (1) If the FDIC determines that the estimated fees for search, duplication, and review will exceed $250.00, the FDIC will advise the requester that the requester must pay an amount equal to 20 percent of the estimated fees before the FDIC will continue processing the request. The time for the processing of the request will be tolled when the FDIC notifies the requester of the amount due. The requester will then be given the opportunity to pay the amount due. Upon receipt of the requester’s payment, the FDIC’s time to respond will resume. (2) Where a requester previously failed to pay a properly charged FOIA fee within 30 calendar days of the billing date, the FDIC may require that the requester pay the full amount due, plus any applicable interest on that prior request, and may require that the requester make an advance payment of the full amount of any anticipated fee before beginning to process a new request or continuing to process a pending request or any pending appeal. (d) Restrictions on charging fees. (1) No search fees will be charged for requests by educational institutions, noncommercial scientific institutions, or representatives of the news media, unless the records are sought for a commercial use. (2) If the FDIC fails to comply with the FOIA’s time limits in which to respond to a request, it may not charge search fees, or for requests from requesters described in paragraph (d)(1) of this section, it may not charge duplication fees, except as described in paragraphs (d)(3) through (5) of this
section.
(3) If the FDIC determines that unusual circumstances exist, as defined by the FOIA and § 309.14(f), and provides timely written notice to the requester in accordance with the FOIA, a failure to comply with the time limit shall be excused for an additional 10 days. (4) If the FDIC determines that unusual circumstances as defined by the FOIA and § 309.14(f) apply, and more than 5,000 pages are necessary to respond to the request, the FDIC may charge search fees, or, in the case of requesters described in paragraph (d)(1) of this section, may charge duplication fees if the FDIC has:
(i) Provided timely written notice of unusual circumstances to the requester in accordance with the FOIA and § 309.14(d); and (ii) Discussed with the requester via written mail, email, or telephone (or made not less than three good-faith attempts to do so) how the requester could effectively limit the scope of the request in accordance with 5 U.S.C. 552(a)(6)(B)(ii). If this exception is satisfied, the FDIC may charge all applicable fees incurred in the processing of the request. (5) If a court has determined that exceptional circumstances exist, as defined by the FOIA and § 309.14(f), a failure to comply with the time limits shall be excused for the length of time provided by the court order. (6) Except for requesters seeking records for a commercial use, the FDIC shall provide without charge:
(i) The first 100 pages of duplication (or the cost equivalent for other media); and (ii) The first two hours of search. (7) No fee will be charged when the total fee, after deducting the 100 free pages (or its cost equivalent) and the first two hours of search, is equal to or less than $25. § 309.20 Payment of fees. (a) Payment prior to release of records. The FDIC reserves the right to collect all applicable fees before releasing copies of requested records to the requester. (b) Payment prior to processing. At its election, the FDIC may require payment in full of any amounts outstanding, plus interest, or advance payment of the full amount of any estimated fee, before the FDIC begins to process a new request or new appeal. The FDIC may also require a requester to demonstrate that any previously invoiced fees have been paid in full, before any further processing of a request occurs. If the FDIC requires advance payment, the request will not be considered received until the required payment is received. If an advance payment is not received within thirty calendar days of a demand for payment, the request will be closed. (c) Interest on unpaid fees. Interest charges on unpaid fees will begin to accrue on the 31st day following the day on which the invoice was sent, at the rate prescribed in 31 U.S.C. 3717. § 309.21 Waiver or reduction of fees. (a) Request for waiver or reduction of fees. A requester may request that the FDIC waive or reduce fees if disclosure of the records is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government and is not primarily in the commercial interest of the requester. (b) Public interest. In deciding whether disclosure of the requested records is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government, the FDIC will consider the following factors:
(1) The subject of the request must concern identifiable operations or activities of the government. (2) Disclosure of the requested information would be likely to contribute significantly to public understanding of those operations or activities. This factor is satisfied if the disclosure of the requested records would: be meaningfully informative about government operations or activities and would contribute to the understanding of a reasonably broad audience of persons interested in the subject, as opposed to the individual understanding of the requester. The FDIC will presume that a request from a representative of the news media will satisfy the latter consideration. (3) The disclosure must not be primarily in the commercial interest of the requester. To determine whether disclosure of the requested information

is primarily in the commercial interest of the requester, the FDIC will consider whether the requester has any commercial, trade, or profit interest that would be furthered by the requested disclosure. Requesters will be given an opportunity to explain why a requested disclosure of records is not primarily in the requester’s commercial interest. The FDIC ordinarily will presume that when a news media requester has satisfied the factors listed in this paragraph, the request is not primarily in the commercial interest of the requester. Disclosure to data brokers or others that merely compile and market government information for direct economic return, however, will not be presumed to primarily serve the public interest. § 309.22 Dispute resolution. A requester seeking to engage in dispute resolution, may make a request to the FOIA public liaison and/or the OGIS by following the procedures set forth online in the FDIC’s FOIA Service Center at https://www.fdic.gov. Dispute resolution is a voluntary process. § 309.23 Administrative appeals. (a) Basis for an appeal. A person who has received an adverse determination on a FOIA request has the right to appeal the denial to the FDIC general counsel or designee. For purposes of this section, an adverse determination includes a determination that:
(1) the requested records cannot be located; (2) the requested records have been withheld in whole or in part; (3) a request for expedited processing has been denied; or (4) a request for a waiver or reduction of fees has been denied in whole or in
part.
(b) Submitting an appeal.
(1) Form. An appeal of the adverse determination must be submitted in writing or electronically. Appeals submitted in writing must be submitted by mail addressed to the FOIA/PA Group, Legal Division, FDIC, 550 17th Street NW, Washington, DC 20429. Appeals submitted electronically must be by email clearly marked ‘‘Freedom of Information Act Appeal’’ or ‘‘FOIA Appeal,’’ to efoia@fdic.gov; submitted through the FDIC’s FOIA request portal. (2) Content. The appeal must include any information relevant to the consideration of the appeal and must clearly identify the adverse determination that is being appealed and the request number. (3) Timing. Appeals must be received within ninety calendar days of the adverse determination. Appeals submitted in writing must be postmarked within ninety calendar days after the date of the response of the adverse determination to be considered timely. Any appeal that has not been submitted electronically or postmarked within the specified timeframe will be considered untimely and will be closed administratively with notice to the requester. (4) Outstanding fees. Complete payment of any outstanding fee invoice will be required before an appeal is processed. (c) Time period for response. Except as provided in 309.23(c)(1) and (2), below, the FDIC will notify the appellant of the appeal determination within twenty business days after the date of receipt of the appeal. Notification of the appeal determination shall be in writing. (1) This time period may be extended in the event of unusual circumstances as defined in 5 U.S.C. 552(a)(6)(B). (2) If a requester is appealing an adverse determination involving the denial of expedited treatment under § 309.15, the FDIC will determine the appeal and notify the appellant of the appeal determination as soon as practicable. (d) Appeal determinations. (1) Where an appeal is granted in whole or in part, the FDIC will then further process the request in accordance with that appeal determination and will notify the requester of the determination on appeal. (2) An appeal determination that upholds the FDIC’s initial response to a FOIA request in whole or in part will:
(i) contain a statement that identifies the reasons for the appeal determination, including any FOIA exemptions applied; (ii) contain a notification of the requester’s statutory right to file a lawsuit; and (iii) inform the requester of the dispute resolution services offered by the OGIS as a non-exclusive alternative to litigation. (e) Litigation. Before seeking judicial review of an adverse determination by the FDIC, a requester must first exhaust administrative remedies by submitting a timely administrative appeal and allowing the FDIC to determine the appeal within the statutory time period. § 309.24 Supplemental procedures for confidential commercial information. (a) Designation of confidential commercial information. At the time of submission to the FDIC, a submitter of confidential commercial information (‘‘submitter’’) must use good faith efforts to designate by appropriate markings any portion of its submission that it considers to be protected from disclosure under Exemption 4 of FOIA (5 U.S.C. 552(b)(4)), which protects trade secrets and commercial or financial information obtained from a person that is privileged or confidential. These designations expire 10 years after the date of the submission unless the submitter requests and provides justification for a longer designation period. (b) Notice to submitter. Whenever records containing confidential commercial information are requested from the FDIC under FOIA, the FDIC will determine whether it may be required to disclose the records under FOIA. If the FDIC determines that disclosure may be required, the FDIC will provide prompt written notice to the submitter of the confidential commercial information requested (notice to submitter), provided:
(1) The submitter in good faith designated the information as protected from disclosure under Exemption 4; or (2) The FDIC has a reason to believe that the requested information may be protected from disclosure under Exemption 4, but has not yet determined whether the information is protected from disclosure. (c) Contents of a notice to submitter. (1) The notice to submitter must either describe the confidential commercial information requested or include a copy of the requested records or portions of records containing the information. (2) In cases involving a voluminous number of submitters, the FDIC may post or publish a notice to submitter in a place or manner reasonably likely to inform the submitters of the proposed disclosure, instead of sending individual notifications. (3) The notice to submitter must provide a reasonable time period in which a submitter must respond to the FDIC as provided in paragraph (e) of this section. (d) Exceptions to notice to submitter requirement. (1) The notice to submitter requirements of this section do not apply if:
(i) The FDIC determines that the information is exempt under the FOIA, and therefore will not be disclosed; (ii) The information has been lawfully published or has been officially made available to the public; (iii) Disclosure of the information is required by a statute other than the FOIA or by a regulation issued in accordance with the requirements of Executive Order 12,600 of June 23, 1987; or

(iv) The designation made by the submitter under paragraph (a) of this
section is frivolous.
(e) Opportunity to object to disclosure. (1) The submitter must respond to the notice to submitter referenced in paragraph (b) within the time period specified in the notice to submitter. (2) If a submitter has any objections to disclosure, it should provide the FDIC a detailed written statement that specifies all grounds for withholding the particular information under any exemption of the FOIA. To rely on Exemption 4 as a basis for nondisclosure, the submitter must explain why the information constitutes a trade secret or commercial or financial information that is customarily and actually treated as confidential by the submitter of the information. Any information provided by a submitter under this paragraph may itself be subject to disclosure under the FOIA. (3) A submitter who fails to respond within the time period specified in the notice to submitter will be considered to have no objection to disclosure of the information. The FDIC is not required to consider any information received after the time period specified in the notice to submitter. (f) Notice of intent to disclose. Whenever the FDIC decides to disclose information over the objection of a submitter, the FDIC will provide the submitter written notice of intent to disclose (notice of intent), which will include:
(1) A statement of the reasons why each of the submitter’s disclosure objections was not sustained; (2) A description of the information to be disclosed or copies of the records in the form that they would be provided to the requester; and (3) A specified disclosure date, which will be a reasonable time after the notice. (g) Notice of FOIA lawsuit. Whenever a requester files a lawsuit seeking to compel the disclosure of confidential commercial information, the FDIC will promptly notify the submitter. (h) Requester notification. The FDIC will notify the requester whenever it provides the submitter with a notice to submitter or notice of intent and whenever a submitter files a lawsuit to prevent the disclosure of the information. Subpart C—Discretionary Disclosure of Confidential Information § 309.30 Purpose and scope. (a) This subpart describes categories of information that the FDIC is authorized by law to maintain as confidential. (See the full definition of confidential information at § 309.31 below.) In the discretion of the FDIC and subject to any conditions and limitations that the FDIC may require, such confidential information may be disclosed to other agencies, entities, or individuals that have shown good cause for the disclosure. This subpart describes the procedures, conditions, and limitations applicable to such disclosures. (b) This subpart does not apply to disclosure of FDIC records or information:
(1) when disclosure is required under the Freedom of Information Act (see subpart B of this part), including proactive publication or public availability under 5 U.S.C. 552(a), or when disclosure is required by other law; (2) subject to the Privacy Act of 1974, 5 U.S.C. 552a (see 12 CFR part 310); (3) subject to the Government in the Sunshine Act, 5 U.S.C. 552b (see 12 CFR
part 311);
(4) for use in a legal proceeding (as defined in subpart D of this part); or (5) when disclosure is prohibited by law. (c) Applicability of the Right to Financial Privacy Act. This subpart does not authorize disclosure of copies of the financial records of any customer, as defined in the Right to Financial Privacy Act, 12 U.S.C. 3401 et seq., of a financial institution, or the information contained in such financial records, except in accordance with the provisions of said Act. § 309.31 Definitions. Affiliate means any company that controls, is controlled by, or is under common control with another company as defined in 12 U.S.C. 1841(k). Control for purposes of this subpart is defined in 12 U.S.C. 1841(a)(2). Authorized director means any of the directors of FDIC divisions and offices, or their designees, who have primary responsibility for FDIC records or information; and deputies to the chairperson of the FDIC Board of Directors, to the extent such officials have primary responsibility for FDIC records or information. Confidential information means any FDIC record or other FDIC information in any form that is exempt from disclosure under the Freedom of Information Act, 5 U.S.C. 552, and any information derived from or related to such FDIC record or information. Confidential information includes but is not limited to information about FDIC’s supervision or resolution of depository institutions and financial companies; information about FDIC’s enforcement of laws and regulations; and information about consumer complaints received by the FDIC. Confidential information does not include:
(1) Documents prepared by or for an insured depository institution, or any other party, for its own business purposes that are in its own possession, even though copies of such documents in the FDIC’s possession otherwise would constitute confidential information; or (2) Final orders, amendments, or modifications of final orders, or other actions or documents that are specifically required to be published or made available to the public pursuant to 12 U.S.C. 1818(u), the Community Reinvestment Act, or other applicable law. Parent holding company means a company that has control of an insured depository institution. Control for purposes of this subpart is defined in 12 U.S.C. 1841(a)(2). Person means an individual, or an entity in any form, including a government agency. Qualifying confidentiality agreement means an agreement that:
(1) Is written;
(2) Is governed by the laws of the United States or a State of the United States; (3) Prohibits the use of the information by the recipient for purposes other than that for which it is provided and provides that the recipient will not further disclose or make public in any manner the information; (4) Limits access to the information at a recipient entity to those directors, officers, or employees who have a business need to know the information and are bound by the qualifying confidentiality agreement; and (5) Expressly provides that the FDIC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action filed in the U.S. District Court for the District of Columbia and any other court having jurisdiction and venue over disputes arising from the agreement. Qualifying service provider means an entity that:
(1) has a contractual relationship with a depository institution and (2) provides:
(i) products or services to the institution that are used in connection with the provision of financial products or services to the depository institution’s customers; (ii) advisory or consulting services related to the management or operations of the depository institution; or

(iii) technological infrastructure to the depository institution. § 309.32 Disclosure prohibited. (a) In general. Except as provided in this part or as otherwise required by law, no person may disclose or permit the disclosure of confidential information to any person other than those directors, officers, employees, or agents of the FDIC who have a bona fide need for such information in the performance of their official duties. (b) Confidential information held by others. Any confidential information in the possession, custody, or control of any person remains the property of the FDIC and may not be disclosed except as provided in this part. § 309.33 Disclosure authorized; limitations. (a) In general. Confidential information may be disclosed only in accordance with the requirements of and subject to the conditions set forth in this part. (b) Discretion of authorized director. Disclosure under this subpart is discretionary. Nothing in this subpart shall be construed as:
(1) requiring the disclosure of confidential information; or (2) restricting in any manner the authority of the chairperson of the FDIC, or the authorized director, to deny or limit the form, manner, and extent of any disclosure of confidential information. § 309.34 Procedure for requesting discretionary disclosure. (a) Form of requests. Requests for discretionary disclosure of confidential information must be submitted to the FDIC by one of the methods listed in (b) below. A request must:
(1) be in writing;
(2) indicate that it seeks discretionary disclosure of confidential information; (3) identify the information sought with reasonable particularity; and (4) provide sufficient information for the FDIC to evaluate whether there is good cause for disclosure under § 309.35. (b) Where to submit requests for discretionary disclosure. Requests must be submitted by:
(1) email, U.S. Mail, or equivalent service to the address provided in the FDIC organizational directory on the FDIC’s official website at https:// www.fdic.gov/contact; or (2) using the online request form on the web page of the FDIC Information and Support Center, https://ask.fdic.gov. (c) Procedural waiver. An authorized director may, in the authorized director’s sole discretion, waive any one or more of the requirements in paragraphs (a) or (b) of this section. (d) Disclosure without a request. An authorized director may disclose confidential information on the authorized director’s own initiative and without a request, provided that the good cause requirement of § 309.35 is satisfied. § 309.35 Standard for discretionary disclosure. (a) Good cause standard. An authorized director may disclose or authorize disclosure of confidential information when, in the authorized director’s sole discretion, there is good cause for disclosure. Pursuant to § 309.39, the authorized director may require such other terms and conditions in writing in connection with and for purposes of the disclosure as the authorized director deems appropriate. (b) Good cause considerations. An authorized director may consider the following, among other factors, when making a good cause determination:
(1) Whether disclosure will serve a legitimate regulatory, supervisory, resolution, or law enforcement purpose; (2) Whether there is another source for the confidential information; (3) Whether disclosure of the confidential information is unduly burdensome or otherwise may adversely affect or prejudice the FDIC, its mission, or its operations; (4) The scope and nature of the confidential information; (5) The recipient’s intended use of the confidential information; (6) Whether disclosure is lawful; (7) Whether the confidential information includes privileged information, trade secrets, or confidential commercial or financial information; and (8) Whether disclosure would present safety and soundness or financial stability risks. § 309.36 Disclosure by the FDIC. (a) Disclosure to insured depository institutions. The authorized director may, for good cause and subject to § 309.39, disclose confidential information concerning an insured depository institution to the directors, officers, and employees of that insured depository institution. (b) Disclosure to affiliates of insured depository institutions. The authorized director may, for good cause and subject to § 309.39, disclose confidential information concerning an insured depository institution to the affiliate(s) of an insured depository institution. (c) Disclosure to federal and state agencies. The authorized director may, for good cause and subject to § 309.39, disclose confidential information to federal and state agencies. (d) Disclosure to foreign financial authorities. The authorized director may, for good cause and subject to § 309.39, disclose confidential information to any foreign financial regulatory or supervisory authority as provided, and to the extent permitted, by section 206 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (12 U.S.C. 3109) and 12 CFR 347.207. (e) Disclosure to civil investigatory agencies or authorities. The authorized director may, for good cause and subject to § 309.39, disclose to a federal or state civil investigatory authority, or to any authorized officer or employee of such authority, confidential information relating to actual or potential violations of any federal or state civil law, unsafe or unsound banking practices, or breach of fiduciary duty. (f) Disclosure to criminal law enforcement agencies or authorities. The authorized director may, for good cause and subject to § 309.39, disclose to any federal or state criminal law enforcement authority, or to any authorized officer or employee of such authority, confidential information relating to actual or potential violations of criminal law. (g) Disclosures related to service providers subject to FDIC examination. The authorized director may, for good cause and subject to § 309.39, disclose confidential information to:
(1) a service provider that is subject to examination by the FDIC; (2) Any insured depository institution or credit union that receives services from such a service provider; (3) Any state agency or authority that exercises supervision over a financial institution serviced by such a service provider; and (4) Any federal financial institution supervisory agency that exercises supervision over a financial institution serviced by such a service provider. The federal financial institution supervisory agency may disclose any such confidential information received from the FDIC to an insured depository institution or credit union over which it exercises general supervision, and which is serviced by that service provider. (h) Disclosure to other persons. The authorized director may, for good cause and subject to § 309.39, disclose confidential information to any person not covered by paragraphs (a) through (g). (i) Authorization for disclosure by the FDIC chairperson. The chairperson of

the FDIC Board of Directors may, for good cause and subject to § 309.39, disclose or authorize disclosure of any confidential information. § 309.37 Disclosure by insured depository institutions and certain other entities. (a) Disclosure by insured depository institutions. (1) An insured depository institution may disclose confidential information to the following persons where necessary or appropriate for business purposes:
(i) The insured depository institution’s own directors, officers, or employees; (ii) Affiliates of the insured depository institution and the directors, officers, or employees of the insured depository institution’s affiliates; (iii) The insured depository institution’s external legal counsel, accountant, or auditor; (iv) A shareholder that owns in excess of 50 percent of the voting stock of the insured depository institution; (v) A qualifying service provider to the insured depository institution; (vi) An individual to whom an offer of employment has been made for that individual to serve as a senior executive officer, as defined in 12 CFR 303.101, of the insured depository institution; or (vii) Directors, officers, employees, affiliates (including directors, officers, and employees of affiliates), auditors, and legal counsel of an insured depository institution that is a potential counterparty with which the insured depository institution is contemplating a merger or other transaction subject to 12 U.S.C. 1817(j), 1842, 1828(c), or 1467a. Such authorization is limited to three potential counterparties over a five-year period and the information disclosed must not be otherwise available in the course of due diligence nor used as a substitute for a counterparty’s due diligence. (A) Notwithstanding the numerical limitations set forth in 12 CFR 309.37(a)(1)(vii), an insured depository institution may disclose confidential information to directors, officers, employees, affiliates, auditors, and legal counsel of a potential counterparty with which it has a written agreement to enter into a merger or other transaction subject to 12 U.S.C. 1817(j), 1842, 1828(c), or 1467a. (B) Any disclosures made under this paragraph (a)(vii) must be limited to directors, officers, employees and legal counsel with a need to know the confidential information for the purposes of performing their own reasonable due diligence or other duties related to the transaction or series of transactions. (C) The FDIC must receive a written waiver from the potential counterparty, and any affiliate of the potential counterparty to which confidential information has been disclosed under this paragraph (a)(vii), of any and all potential claims the potential counterparty or any such affiliate of the potential counterparty may have against the FDIC arising from the confidential information, including the accuracy and completeness thereof. (2) Prior to or concurrently with any disclosure under 309.37(a)(1)(iii) through (vii), the insured depository institution must enter into a qualifying confidentiality agreement with the intended recipient of the information. (b) Disclosure by insured depository institutions of confidential information created over twenty-five years ago. Unless otherwise notified by an authorized director, an insured depository institution may disclose confidential information if at least 25 years have elapsed since that confidential information was created or last
modified and such disclosure does not include information otherwise subject to other disclosure restrictions, such as consumer privacy or trade secret laws. (c) Disclosure by parent holding companies. A parent holding company of an insured depository institution lawfully in possession of confidential information may disclose such information to the same extent and subject to the same conditions, and to the same categories of recipients for the parent holding company, to which an insured depository institution could disclose confidential information under § 309.37(a) or 309.37(b). (d) Disclosure by insured depository institutions and parent holding companies to other persons. The authorized director may, for good cause and subject to § 309.39, authorize an insured depository institution or a parent holding company to disclose confidential information to any person not covered by paragraphs (a) through (c). (e) Disclosure by service providers to insured depository institutions partners. A service provider subject to examination by the FDIC and in possession of confidential information may share such confidential information with an insured depository institution to which they are providing services provided that:
(1) any such disclosure must be necessary or appropriate to meet a business purpose; (2) prior to or concurrently with any disclosure under this paragraph (e), the service provider must enter into a qualifying confidentiality agreement with the intended recipient of the information. § 309.38 Disclosure by other persons. The authorized director may, for good cause and subject to § 309.39, authorize any person that has received confidential information, including a federal or state agency, to disclose such confidential information to another person. § 309.39 Conditions and limitations. (a) Limitations on disclosure. Prior to any disclosure, the authorized director may require such other terms and conditions in writing as the authorized director deems necessary, including those necessary to protect the confidential nature of the information, the financial integrity of any depository institution to which the information relates, the legitimate privacy interests of any individual named in such information, and any other interests that could be affected by the disclosure. (b) Disclosure of confidential information not intended as waiver. The disclosure of any confidential information pursuant to this subpart is not, unless otherwise stated, intended to waive or otherwise affect any privilege or protection the FDIC may claim with respect to such confidential information under applicable law. (c) Revocation of authorization. An authorized director or FDIC chairperson may, in their sole discretion, revoke their authorization to disclose confidential information. As soon as practicable, a person in possession of confidential information for which authorization has been revoked must destroy or return the confidential information to the FDIC. Subpart D—Disclosure of Confidential Information in Legal Proceedings in Which the FDIC Is Not a Party § 309.50 Scope. (a) In general. The FDIC by statute acts in separate legal capacities, including as receiver or conservator for a depository institution or financial company, and as supervisor or insurer of deposits for depository institutions. The FDIC may be a party in a legal proceeding in one capacity but not a party to that legal proceeding in a separate capacity. (b) Applicability of this subpart. This subpart applies to requests and discovery demands for FDIC information for use in a legal proceeding in which neither the FDIC (in the capacity to which the request or discovery demand is directed) nor an

FDIC director, officer, or employee (in the capacity to which the request or discovery demand is directed) is a party. (c) Does not apply to FDIC as a party to a legal proceeding. This subpart does not apply to:
(1) Requests or discovery demands directed to the FDIC in a capacity in which the FDIC is a party to the legal proceeding; (2) Requests or discovery demands directed to an FDIC director, officer, or employee who is a party to the legal proceeding. (d) Does not apply to matters outside a legal proceeding. This Subpart D does not apply to:
(1) Requests seeking FDIC information under other statutory or regulatory processes, including, but not limited to, the Freedom of Information Act (FOIA), 5 U.S.C. 552 and subpart B of this part; the Privacy Act, 5 U.S.C. 552a and 12 CFR part 310; and public access to applications, notices, and other filings under 12 CFR 303.8. (2) Requests seeking discretionary disclosure of confidential information of the FDIC pursuant to subpart C of this
part.
(3) Requests seeking FDIC information made by persons who are not parties to or otherwise substantially involved with a legal proceeding. § 309.51 Definitions. Access to FDIC documents or property means to produce, provide, or allow examination of FDIC documents or property. Discovery demand means a subpoena, court order, request for production of documents, interrogatories, notice of deposition, motion to compel, or other notice or order in a legal proceeding requiring the FDIC or any other person in possession, custody, or control of FDIC information to provide FDIC information for use or possible use in the legal proceeding. FDIC documents or property means documents, electronically stored information, tangible things, and premises that are owned by or were created by the FDIC except documents or property of a depository institution or financial company in FDIC receivership or conservatorship that the FDIC has transferred to the custody of a contractor, servicer, acquiring institution, bridge bank or other successor institution, or other third party in the course of the FDIC’s depository institution or financial company resolution activities. FDIC information means any FDIC documents, property, or FDIC testimony. FDIC testimony means testimony by a current or former director, officer, employee, agent, or contractor of the FDIC concerning:
(1) FDIC documents or property; or (2) knowledge or experience acquired, or communications or activities engaged in, as part of their official duties or otherwise related thereto or because of their official status while such individuals were employed by or acted as agent, contractor, or otherwise on behalf of the FDIC. Legal proceeding means a judicial or administrative adjudication, action, case, matter, hearing, trial, arbitration, formal inquiry, formal investigation, or similar proceeding initiated before or subject to a court, agency or agency members, commission, board, grand jury, arbitrator, administrative law judge, hearing officer, or other authorized official or body, whether criminal, civil, or administrative in nature, under federal, state, local, or foreign law. Non-party legal proceeding means a legal proceeding in which neither the FDIC (in the capacity to which the process is directed) nor an FDIC director, officer, or employee (in the capacity to which the process is directed) is a party. Party means a person that is asserting claims or defending against claims in a legal proceeding. For purposes of this subpart, party does not include a person who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery. Person means an individual or an entity in any form, including a governmental organization. Request means a written statement in which a party or other person involved in a legal proceeding asks the FDIC to provide or authorize access to FDIC documents or property or authorize FDIC testimony for use in a legal proceeding. Testimony means a sworn or unsworn statement made by an individual for use or possible use by a party in a legal proceeding. Testimony may include, but is not limited to, live statements at a deposition, hearing, trial, or interview in person or by audio or visual communication; written or recorded responses to questions; or an affidavit, declaration, sworn statement, certification, or attestation. Use, with respect to FDIC information provided in accordance with this subpart, means that, subject to conditions and limitations required by the FDIC general counsel or designee, authorized parties or other persons involved in a legal proceeding may disclose FDIC information in the legal proceeding in the same manner and with the same protections as information obtained in discovery in the legal proceeding. § 309.52 Use of FDIC information in a nonparty legal proceeding. (a) Prohibition. No party or other person may obtain access to FDIC documents or property, obtain FDIC testimony, or use FDIC information in connection with a non-party legal proceeding without express authorization by the FDIC general counsel or designee, except as provided in this subpart or otherwise required by law. (b) Requests to use FDIC information in a non-party legal proceeding. Except where the request process has been waived or
the request is exempt pursuant to § 309.55, a party in a legal proceeding, or any other person involved in the legal proceeding, must submit a request to the FDIC general counsel or designee for:
(1) access to FDIC documents or property in the possession, custody, or control of the FDIC, for use in the legal proceeding; (2) FDIC testimony for use in the legal proceeding; (3) authorization to use FDIC documents or property in the legal proceeding when the FDIC documents or property are in the possession, custody, or control of the requesting party or person; or (4) access to and authorization to use FDIC documents or property in the legal proceeding when a person in possession, custody, or control of FDIC documents or property has not had a request for use approved by the FDIC. (c) Subpoenas and other discovery demands. Except where the request process has been waived or the request is exempt pursuant to § 309.55, a party seeking FDIC information for use in a non-party legal proceeding must submit a request to the FDIC general counsel and receive a decision prior to serving a subpoena or other discovery demand. (1) Subpoenas or other discovery demands in a non-party legal proceeding will be processed in accordance with applicable law, rules, regulations, and privileges. (2) The FDIC may object to, move to quash, or otherwise oppose a subpoena or other discovery demand on any appropriate basis, including failure to exhaust administrative remedies. § 309.53 Submitting a request. (a) Where to submit a request. A party or other person should submit a request

directly to the FDIC general counsel or designee at the address provided on the FDIC’s website. (b) Contents of a request. A request must be in writing and should state, or attach documents containing, the following information:
(1) Information about the legal proceeding, current status, and
schedule, and copies of pertinent
pleadings and other filings.
(2) A detailed description of the FDIC documents or property sought; information about any person whose testimony is being requested and a summary of the anticipated FDIC testimony; why the FDIC information is relevant to the issues in the legal proceeding; and whether other evidence on those issues is available from nonFDIC sources. (3) An agreement to reimburse the FDIC’s reasonable costs for (A) locating, reviewing, and providing access to FDIC documents or property; and (B) providing FDIC testimony; and (4) An agreement to comply with conditions or limitations on the FDIC information and its use that the FDIC general counsel or designee may require. § 309.54 Decisions on requests. (a) Consideration of requests. The FDIC general counsel or designee will consider the contents of the written request; whether confidential, personal, financial, commercial, or supervisory information is being requested and, if so, the risk that such information could be publicly disclosed; whether fulfilling all or part of the request will materially interfere with FDIC operations; and the public interest. The FDIC general counsel or designee may discuss the request with the requester to obtain more information or to modify the request. (b) Decision. The FDIC general counsel or designee will issue a written decision granting or denying the request in full or in part, stating the reasons for the decision, and if appropriate, placing conditions or limitations on access to and use of FDIC information. (c) Reconsideration. Within ten business days after the date of the written decision, the requesting party may submit a request to the FDIC general counsel for reconsideration of any aspect of the written decision. The FDIC general counsel or designee will review and decide the request for reconsideration within ten business days after receipt. Failure to submit a timely request for reconsideration constitutes the requesting party’s concurrence with the written decision. (d) Final decision. The written determination of a timely request for reconsideration is a final decision and exhausts the requesting party’s administrative remedies with respect to the request for FDIC information. (e) Judicial review. A party may seek judicial review of the final decision under the Administrative Procedure Act, 5 U.S.C. 702. § 309.55 Waiver and exemption of requirement for requests. (a) Waiver. The FDIC general counsel or designee may, at any time, dispense with the requirement for a party or other person to submit a request prior to serving a subpoena or other discovery demand in a legal proceeding. (b) Exemption of requests for failed depository institution records. The administrative requirements set forth in this subpart do not apply to subpoenas, court orders, or other legal process for records of failed depository institutions in the possession of the FDIC as receiver or conservator. Subpoenas, court orders, or other legal process issued for such records will be evaluated in
accordance with state and federal law, regulations, rules, and privileges applicable to the FDIC as receiver or conservator.
PART 327—ASSESSMENTS

8. The authority citation for part 327
continues to read as follows:
Authority: 12 U.S.C. 1813, 1815, 1817–19, 1821, 1823. § 327.4 [Amended]
1. Amend § 327.4(d) by removing
  ‘‘exempt information within the scope of § 309.5(g)(8) of this chapter’’ and adding ‘‘confidential information as defined at § 309.31 of this chapter’’ and by removing ‘‘the disclosure restrictions set out at § 309.6 of this chapter’’ and adding ‘‘the disclosure restrictions set out at § 309.32 of this chapter’’.
  PART 337—UNSAFE AND UNSOUND
  BANKING PRACTICES
1. The authority citation for part 337
  continues to read as follows:
  Authority: 12 U.S.C. 375a(4), 375b, 1463, 1464, 1468, 1816, 1818(a), 1818(b), 1819, 1820(d), 1821(f), 1828(j)(2), 1831, 1831f, 1831g, 5412. § 337.12 [Amended]
1. Amend § 337.12(b)(3)(ii) by
  removing ‘‘(copies of which are available at the addresses specified in § 309.4 of this chapter)’’. Federal Deposit Insurance Corporation. By order of the Board of Directors. Dated at Washington, DC, on June 25, 2026. Jennifer M. Jones, Deputy Executive Secretary. [FR Doc. 2026–13123 Filed 6–29–26; 8:45 am] BILLING CODE 6714–01–P

FDIC Proposed Rule on Disclosure of Information

Similar documents from other regulators