OCC Rules Regarding the Availability of OCC Information

DEPARTMENT OF THE TREASURY Office of the Comptroller of the Currency 12 CFR Parts 4, 5, 7, 21, and 163 [Docket ID OCC-2026-0133] RIN 1557-AF50 OCC Rules Regarding the Availability of OCC Information AGENCY: Office of the Comptroller of the Currency, Treasury. ACTION: Notice of proposed rulemaking. SUMMARY: The Office of the Comptroller of the Currency (OCC) is proposing changes to its rules on information disclosure. The proposal would clarify the process for obtaining OCC approval to disclose non-public OCC information and allow for the disclosure of confidential supervisory information without OCC approval in certain circumstances, provided that applicable safeguards are observed. It also refines the OCC’s process for requesting records under the Freedom of Information Act (FOIA), amends the rules to provide for expedited process of FOIA requests, and makes other structural and conforming changes. DATES: Comments must be received on or before [INSERT DATE 60 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. ADDRESS: Commenters are encouraged to submit comments through the Federal eRulemaking Portal. Please use the title “OCC Rules Regarding the Availability of OCC Information” to facilitate the organization and distribution of the comments. You may submit comments by any of the following methods:

2 • Federal eRulemaking Portal – Regulations.gov: Go to https://regulations.gov/. Enter Docket ID “OCC-2026-0133” in the Search Box and click “Search.” Public comments can be submitted via the “Comment” box below the displayed document information or by clicking on the document title and then clicking the “Comment” box on the top-left side of the screen. For help with submitting effective comments, please click on “Commenter’s Checklist.” For assistance with the Regulations.gov site, please call 1-866-498-2945 (toll free) Monday-Friday, 9 a.m.-5 p.m. ET, or e-mail regulationshelpdesk@gsa.gov. • Mail: Chief Counsel’s Office, Attention: Comment Processing, Office of the Comptroller of the Currency, 400 7th Street, SW, Suite 1E-216, Washington, DC 20219. • Hand Delivery/Courier: 400 7th Street, SW, Suite 1E-216, Washington, DC 20219. Instructions: You must include “OCC” as the agency name and Docket ID “OCC-2026-0133” in your comment. In general, the OCC will enter all comments received into the docket and publish the comments on the Regulations.gov website without change, including any business or personal information provided such as name and address information, e-mail addresses, or phone numbers. Comments received, including attachments and other supporting materials, are part of the public record and subject to public disclosure. Do not include any information in your comment or supporting materials that you consider confidential or inappropriate for public disclosure. You may review comments and other related materials that pertain to this action by the following method:

3 • Viewing Comments Electronically – Regulations.gov: Go to https://regulations.gov/. Enter Docket ID “OCC-2026-0133” in the Search Box and click “Search.” Click on the “Documents” tab and then the document’s title. After clicking the document’s title, click the “Document Comments” tab. Comments can be viewed and filtered by clicking on the “Sort By” drop-down on the right side of the screen or the “Refine Results” options on the left side of the screen. Supporting materials can be viewed by clicking on the “Documents” tab. Click on the “Sort By” drop-down on the right side of the screen or the “Refine Documents Results” options on the left side of the screen by checking the “Supporting & Related Material” checkbox. For assistance with the Regulations.gov site, please call 1-866-498-2945 (toll free) Monday-Friday, 9 a.m.-5 p.m. ET, or e-mail regulationshelpdesk@gsa.gov. The docket may be viewed after the close of the comment period in the same manner as during the comment period. FOR FURTHER INFORMATION CONTACT: Sadia A. Chaudhary, Special Counsel, or Joanne Phillips, Special Counsel, Chief Counsel’s Office, (202) 649-5490, Office of the Comptroller of the Currency, 400 7th Street, SW, Washington, DC 20219. If you are deaf, hard of hearing or have a speech disability, please dial 7-1-1 to access telecommunications relay services. SUPPLEMENTARY INFORMATION: I. Background and Policy Objectives A. Background The Office of the Comptroller of the Currency (OCC) creates and obtains a wide range of information in connection with the performance of its responsibilities to charter,

4 regulate, and supervise national banks, Federal savings associations, and Federal branches and agencies of foreign banks (collectively, banks). Under the Freedom of Information Act (FOIA)1 and the agency’s current implementing rule found in subpart B of 12 CFR part 4, some of this information is required to be disclosed to the public upon request. Other information is generally exempt from disclosure, such as the supervisory conclusions that the agency reaches about the banks it supervises. To ensure that this exempt information is protected, the OCC’s current regulatory framework in subpart C of 12 CFR part 4 governs its disclosure by the agency, its supervised entities, and others. 2 Currently, subpart C applies to non-public OCC information (NPOI), which is information created or obtained by the OCC in the performance of its duties, such as reports of examination (ROE), supervisory correspondence, and information related to enforcement actions. Under the current subpart C, a supervised entity may disclose NPOI only with OCC prior approval, subject to specified exceptions.3 Moreover, the current subpart C suggests that a person who engages in the unauthorized disclosure or use of NPOI may be subject to criminal penalties. B. 2024 FOIA Proposal In 2024, the OCC issued a notice of proposed rulemaking to amend the agency’s current subpart B.4 The proposal would have provided for expedited processing of FOIA requests and established procedures for a requestor to appeal a denial of an expedited processing or fee waiver request. The proposal also would have removed the competitive 1 5 U.S.C. 552. 2 For purposes of this rulemaking, a supervised entity includes a bank, bank subsidiary, Federal branch or agency of a foreign bank, and any other entity supervised by the OCC. 3 The exceptions can be found at 12 CFR 4.37(b)(2). 4 89 FR 13289 (Feb. 22, 2024).

5 harm standard for information provided to the government on an involuntary basis and made a conforming amendment to ensure that the OCC’s regulations were consistent with the FOIA and authoritative case law. The OCC received and reviewed five comments on the 2024 proposal but did not finalize it. Some of the changes proposed herein address amendments included in the 2024 proposal. 5 C. Overview of Proposal Based on its supervisory experience, the OCC believes that the current NPOI disclosure framework in subpart C hampers a supervised entity’s ability to effectively manage its operations by significantly limiting its ability to share information in legitimate situations, such as in negotiating a business combination or with an affiliate. Subpart C’s restrictive and one-size-fits-all approach to categorizing information and controlling its disclosure fails to account for the type of NPOI at issue, the context in which disclosure is sought, and the intended recipients of the information. Further, it hinders government accountability by limiting the public’s access to information that is necessary to understand how the OCC supervises and ensures supervised entities’ safe and sound operations. In addition, the OCC has observed that the current framework, including the broad definition of NPOI and reference to criminal penalties, has had a chilling effect on supervised entities’ willingness to make independent determinations about what is covered by subpart C and to seek the OCC’s approval to disclose NPOI. Moreover, the reference to criminal penalties may be contrary to controlling legal 5 See the discussion below of proposed § 4.16(d) and (e) and § 4.20.

6 authorities and plainly falls outside of the OCC’s enforcement authorities. To address these concerns, the OCC proposes substantive changes to establish a more nuanced approach to the agency’s NPOI disclosure framework that allows for greater disclosure of NPOI, particularly as it relates to supervised entities and government agencies, while continuing to provide appropriate safeguards to protect the information. Specifically, the proposal codifies and incorporates a definition of “confidential supervisory information” (CSI) as a subset of NPOI.6 It would permit a supervised entity to disclose CSI without OCC prior approval in six situations, each of which describes (1) to whom the CSI would be disclosed to (e.g., an affiliate or counterparty); (2) the context of the disclosure (e.g., negotiating a business combination transaction or hiring a new senior executive officer); and (3) any applicable safeguards (e.g., the recipient has signed a qualified confidentiality agreement or the CSI is used only for purposes of due diligence). The proposal also clarifies when a supervised entity can share CSI with Federal agencies. For CSI not covered by the six situations and NPOI that is not CSI (non-CSI NPOI), the proposal clarifies that the current disclosure framework, under which the OCC decides on a case-by-case basis whether to permit disclosure and, if so, any applicable safeguards. The proposal would also remove the reference in current part 4 to criminal penalties, add expedited processing procedures for information requests under the FOIA, and make technical, streamlining, and conforming changes. As a whole, this rulemaking would represent a significant change to the current information disclosure 6 References to NPOI in the proposal include both non-CSI NPOI and CSI, unless the context indicates otherwise.

7 framework for CSI, which the OCC believes is necessary and appropriate for the reasons discussed below, as well as an effort to streamline and clarify the OCC’s overall information disclosure framework. D. Major Policy Considerations One of the OCC’s primary goals in this rulemaking is to adjust the relative weight that the current disclosure rules accord to the goals of maintaining the confidentiality of NPOI and permitting its disclosure in a variety of situations. The current framework generally over prioritizes confidentiality relative to other interests, including a supervised entity’s business need to disclose information and to whom. It also accords insufficient weight to the compelling supervisory and governmental goals that a more permissive disclosure framework would advance, such as engendering confidence in the financial system and providing the transparency necessary to hold the agency accountable. In considering a recalibration of the balance between confidentiality and limited disclosure, however, the OCC recognizes that its effective supervision requires a candid exchange of information with and between supervised entities and others. To create an environment conducive to these exchanges, all parties must be confident that NPOI will be protected from inappropriate disclosure. Unfettered or inadequately controlled disclosure could present a wide range of risks. Those risks include implicating a supervised entity’s financial condition, including by driving away customers, investors, and business partners and potentially leading to bank runs, and the OCC’s ability to ensure its safety and soundness. This concern would chill the OCC’s ability to provide meaningful criticism to its supervised entities that is crucial for remediation of weaknesses and would make supervised entities apprehensive about openly sharing

8 information with the OCC that could be led to a negative reaction by the public were it to become widely known. To help address the challenges associated with the current disclosure rule, the OCC proposes a two-tiered disclosure framework. This framework would recognize that CSI and non-CSI NPOI are materially different types of information and the situations in which a supervised entity or government agency may want to disclose them may materially differ. Specifically, the proposed framework would provide supervised entities with greater flexibility to disclose CSI in a variety of situations, subject to tailored safeguards. The agency believes that this flexibility would more appropriately balance the costs and benefits of protecting the confidentiality of NPOI and permitting its limited disclosure, while also advancing important supervisory and governmental objectives. Another important goal of this proposal is to align the OCC’s NPOI disclosure framework with relevant case law developments and the Administration’s policy against the overcriminalization of Federal laws7 (particularly for regulatory offenses). The OCC is concerned that the reference in current subpart C to the criminal penalties for the unlawful use or disclosure of NPOI in violation of 18 U.S.C. 641 (i.e., a fine or prison) inappropriately chills lawful disclosure.8 Among other things, the OCC is hopeful that by removing the reference to potential criminal liability, supervised entities’ disclosure 7 See, e.g., Executive Order 14294, “Fighting Overcriminalization in Federal Statutes” (May 9, 2025). 8 Section 641 states that a person (1) who embezzles, steals, purloins, or knowingly converts to his use or the use of another, or without authority, sells, conveys or disposes of (A) any record, voucher, money, or thing of value of the United States (or department or agency thereof); or (B) any property made or being made under contract for the United States (or department or agency thereof); or (2) who receives, conceals, or retains the same with intent to convert it to his use or gain, knowing it to have been embezzled, stolen, purloined or converted, shall be subject to fine or imprisonment.

9 will no longer be inappropriately chilled. In addition, the U.S. Department of Justice (DOJ) has jurisdiction for violations of section 641 (not the OCC), and recent case law calls into question when misappropriation of NPOI would be prosecuted by the DOJ under section 641.9 In light of these developments, the OCC does not want to create or perpetuate a misimpression about the depth or breadth of criminality for unauthorized disclosure of NPOI and, thus, proposes to remove this reference from the rule. Nevertheless, while the OCC would not expect to refer the unauthorized disclosure of NPOI to the DOJ for criminal prosecution absent extraordinary circumstances, removing the section 641 reference would not preclude the OCC from referring a matter to the DOJ where appropriate, after which the DOJ would decide whether to pursue a criminal matter. 10 E. Feedback on Current Regulatory Framework In addition to the insight that the OCC has gained through its supervisory experience, the agency has received feedback directly from stakeholders about the current NPOI disclosure framework, including through the Economic Growth and Regulatory 9 See Kelly v. United States, 590 U.S. 391 (2020); United States v. Blaszczak, 56 F.4th 230 (2d Cir. 2022). See also Br. on Remand for the Unites States at 7, Blaszczak, supra, Dkt. No. 453 (“In light of the Supreme Court’s holding in Kelly, it is now the position of the [DOJ] that in a case involving confidential government information, that information typically must have economic value in the hands of the relevant government entity to constitute ‘property’ for purposes of 18 U.S.C. §§ 1343 and 1348. . . . A related, though not necessarily identical, analysis applies when determining what confidential information is a ‘thing of value’ under 18 U.S.C. 641.”); Resp. to Letter Br. at 7, Blaszczak, supra, Dkt. No. 497 (“Although ‘[c]onfidential business information has long been recognized as property, Kelly and Cleveland make clear that information cannot be deemed ‘business’ information when the ‘business’ is a regulatory function . . . that is governmental in nature and has no private analogue. Unlike confidential news material or stock￾trading statistics, which have inherent market value to their owners. . . . [t]he [property] at issue here [has] value to the government only as a regulator, not ‘as a property holder.’” (internal citations omitted)). 10 By removing the reference to section 641, the OCC does not intend to augment or modify its use of its enforcement mechanisms, under 12 U.S.C. 1818 or otherwise. Furthermore, removing this reference would not obviate the agency’s obligation to report certain matters to the U.S. Department of the Treasury (Treasury) or the Office of the Inspector General (e.g., unauthorized disclosure of NPOI by an OCC employee). The OCC also will remove references to section 641 from other agency issuances, such as bulletins and ROEs.

10 Paperwork Reduction Act of 1996 (EGRPRA) process.11 For example, two EGRPRA commenters discussed the need for supervised entities to share CSI during the due diligence process for certain corporate transactions, subject to confidentiality safeguards. One commenter supported allowing supervised entities in formal negotiations regarding a business combination to share CSI with its proposed counterparties and their advisors on a “need to know” basis, subject to confidentiality safeguards. Another commenter supported a framework that would require OCC prior approval to disclose CSI, if approval were readily obtainable through an established, uniform, and expeditious process. Stakeholders have also provided feedback directly to the OCC, Board of Governors of the Federal Reserve System (Board), and Federal Deposit Insurance Corporation (FDIC) to convey that the current CSI framework makes it difficult for supervised entities to address regulators’ supervisory concerns. They also noted its negative impact on bank partnerships, particularly for community banks, and explained that these partnerships can provide consumers and small businesses in rural and underserved markets with access to digital tools, lower-cost loans, and tailored products that might not otherwise be available. This feedback provided to the OCC through its outreach and stakeholder engagement during the supervisory process helped to inform this proposal. II. Description of Proposal The proposed rule combines current subparts B and C into a new subpart B and includes revisions to the disclosure of both NPOI and information under the FOIA. 11 12 U.S.C. 3311.

11 Proposed §§ 4.10 through 4.14 generally replace components of current subpart C and incorporate a clearer more detailed approach to the agency’s NPOI disclosure. Proposed §§ 4.15 through 4.24 (1) replace current subpart B, while also streamlining, conforming, and clarifying the agency’s administration of the FOIA rule; and (2) include certain process-related provisions in current subpart C. The OCC also proposes to make conforming edits to 12 CFR parts 5, 7, 21, and 163 by revising section references within those parts that would change as a result of this proposed rule. Section-by-Section Discussion

1. Proposed § 4.10, Purpose and Scope. Proposed § 4.10 sets out the purpose and scope of the new subpart. The proposed purpose statement is based on the purpose statements in current subparts B and C (§§ 4.11(a) and 4.31(a), respectively). The proposed purpose statement includes substantive revisions to reflect the new NPOI disclosure framework, along with certain other non-substantive and conforming changes. The proposed purpose statement would recognize additional considerations that the subpart is attempting to weigh. For example, the proposed purpose statement would recognize supervised entities’ interest in efficient disclosure of CSI without a request when necessary or appropriate for a business purpose or other purpose enumerated in the purpose statement. The proposed scope provision is based on the scope provisions in current subparts B and C (§§ 4.11(b) and 4.31(b), respectively). It describes the types of information that are not within the new subpart’s scope and, therefore, to which the new subpart does not

12 apply. 12 The OCC believes that by clarifying the information that is not subject to the new subpart, the agency facilitates stakeholders’ ability to determine the appropriate disclosure framework for any information. 2. Proposed § 4.11, Definitions. Proposed § 4.11 defines certain terms used in new subpart B, setting forth a common lexicon and promoting consistency and clarity.13 It includes (1) newly defined terms; (2) revisions to definitions of terms defined in current § 4.32; and (3) defined terms where the OCC is not proposing any substantive changes. This section-by-section discussion focuses on the newly defined terms and revisions to current definitions; existing definitions that are substantively unchanged are not discussed below. Affiliate and control. The OCC proposes to define both of these terms in a manner substantively consistent with their meanings in the Bank Holding Company Act (12 U.S.C. 1841(k)).14 Accordingly, affiliate would mean a person that controls, is controlled by, or is under common control with another company and includes any employee, officer, director, or agent thereof. An affiliate of a branch or agency of a foreign bank would include the foreign bank. Control would mean (1) the person directly or indirectly or acting through one or more other persons owns, controls, or has power to vote 25 percent or more of any class of voting securities of the supervised entity; (2) the 12 Under the proposal, suspicious activity reports (SAR) information would continue to be excluded from Part 4. 13 However, certain terms defined in current subpart B (e.g., at 12 CFR 4.17) are included in proposed § 4.23 (fees for requesting information under the FOIA). 14 While the proposed definitions of affiliate and control are consistent with their definitions in the Bank Holding Company Act, the OCC would retain interpretive authority with respect to these definitions for purposes of proposed 12 CFR part 4. The OCC would generally expect to interpret the meaning of these terms consistent with their meanings in 12 CFR part 225 as of the date of this issuance.

13 person controls in any manner the election of a majority of the directors or trustees of the supervised entity; or (3) the OCC determines, after notice and an opportunity for a hearing, that the person directly or indirectly exercises a controlling influence over the management or policies of the supervised entity. This definition provides internal consistency because the proposed definition of affiliate uses the term and concept of control. The OCC believes these proposed definitions are well understood and appropriate for the scope and content of this proposal.15 Confidential supervisory information (CSI). The OCC proposes to define this term by cross-reference to proposed § 4.12(b), which sets forth a complete description of CSI and its disclosure under the new subpart. Demand. The OCC proposes to define this term as a written request, subpoena, order, motion to compel, civil investigative demand, search warrant, or other judicial or administrative process to provide information covered by proposed subpart B. This term is intended to not require a formalistic request but operate functionally and include, for example, a supervisory request from another Federal banking agency or a State banking regulator. Disclose. The OCC proposes to define this term as directly or indirectly making information available in any manner, including any action or inaction that causes or permits access to the information. The OCC expects that this definition would provide clarity and consistency about what constitutes a disclosure and prevent evasion of the limitations on disclosure set forth in the new subpart. 15 See the discussion below of proposed § 4.14(b)(1)(i) for an additional explanation of the use of the term “affiliates.”

14 Government agency. The OCC proposes to define this term as an agency of the Federal government (other than the OCC or the Office of Thrift Supervision (OTS)) or of any State, Tribal, or foreign government and any person officially connected with the agency, such as its employee, officer, director, or agent. This definition includes Federal agencies with which the OCC has historically shared information, as well as other Federal or State government agencies with which the OCC may share information, including under its rule implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act) (12 U.S.C. 5901 et seq.). 16 Nonexempt information. Whereas the FOIA uses the term “exempt” to identify information that may be withheld from disclosure under that statute, the OCC proposes to define the term “nonexempt” as information that the agency would not withhold under the FOIA. This would distinguish (1) NPOI, which falls within a FOIA exemption and is therefore “exempt” from disclosure under FOIA; and (2) information that does not fall within a FOIA exemption and is therefore not exempt from disclosure under FOIA (i.e., “nonexempt” information). Non-public OCC information (NPOI). The OCC proposes to define this term as a record (or portion thereof) that the OCC may withhold under the FOIA. This definition of NPOI is substantively consistent with the definition of this term in the current rule at § 4.32(b)(1) and reflects documents that the OCC would generally withhold from disclosure. In addition, the proposal would state that notwithstanding the above, NPOI does not include final orders, amendments, or modifications of final orders or other actions or documents that are specifically required to be published or disclosed to the 16 The OCC’s proposal to implement the GENIUS Act can be found at 91 FR 10202 (Mar. 2, 2026).

15 public pursuant to 12 U.S.C. 1818(u) or 12 U.S.C. 2906 or that the OCC is specifically required to publish, publicly disclose, or otherwise make available to the public pursuant to other applicable laws or rules. For example, a consent order not yet fully executed by the OCC and a supervised entity is NPOI and may not be released by the supervised entity until the order is executed, at which point the public consent order would no longer be NPOI. Finally, whereas § 4.32(b)(2) states that NPOI is the property of the OCC, proposed § 4.13(d) states that NPOI is the OCC’s property only to the extent that it is in the agency’s possession. This distinction is addressed more fully below in the discussion of proposed § 4.13(d)(1)(i). By proposing to define CSI, nonexempt information, and NPOI, the rule would enable a stakeholder to readily identify the disclosure provisions that apply to any piece of information. In addition, the proposed definition of NPOI is intended to serve as a counterpoint to the proposed definition of nonexempt information. By specifically referencing the FOIA, the NPOI definition would incorporate the exemptions and exclusions in the FOIA, as interpreted by the agency and the courts. The OCC is soliciting comment regarding whether the proposed definitions of CSI and NPOI are appropriate. Person. The OCC proposes to define this term as an individual, company, trust, joint venture, pool, syndicate, sole proprietorship, unincorporated organization, or any other form of entity (but to not include the OCC or OTS). This proposed definition is intended to provide clarity and consistency in the new subpart B. In the proposal, the agency sometimes uses a more specific term than person when it either intends to limit or

16 emphasize the applicability of a provision to a subset of persons. The reference to any other form of entity in conjunction with the term person is intended to ensure that the definition has an expansive reach. Predecessor agency. The OCC proposes to define this term with respect to the OCC to mean the OTS, Federal Home Loan Bank Board, or any other predecessor to these agencies. Qualifying confidentiality agreement. The OCC proposes to define this term by cross-reference to the more complete description and discussion of the term in proposed § 4.14(c). Record. The OCC proposes to define this term by cross-reference to the definition in the FOIA at 5 U.S.C. 552(f)(2). Service provider. The OCC proposes to define this term as an unaffiliated person (including an employee, officer, director, or agent of the person) that is hired by or partnered with a supervised entity to perform specific, specialized functions for or on behalf of the entity related to the supervised entity’s operations or provision of services. This term would include persons performing consulting, legal, and auditing services if the elements of the definition are satisfied. This definition would not include customers or financial counterparties. This is because, in the OCC’s experience, these general contractual relationships typically do not involve persons that (1) perform specific, specialized functions for or on behalf of a supervised entity that are related to the entity’s operations or otherwise provide services to the supervised entity; and (2) have historically demonstrated a business need for NPOI. This definition is informed by the OCC’s supervisory experience with respect to banks’ service providers, including its review of

17 corporate transactions and application of the third-party risk management guidance. 17 Based on that experience, the OCC concluded that the current provisions that address the concept of “service provider” are too narrow to capture the appropriate range of service providers. 18 Disclosure of CSI to service providers is described below in the section-by￾section discussion of proposed § 4.14(b)(1)(ii). The OCC is seeking comment on the proposed definition of service provider and is considering alternative definitions, as described below. Supervised entity. The OCC is proposing to revise the current definition of this term to include any permitted stablecoin issuer or foreign payment stablecoin issuer for which the OCC has regulatory or enforcement authority pursuant to the GENIUS Act. Under the GENIUS Act, Congress expanded the OCC’s regulatory or enforcement authority to include these entities, and the proposed revisions would ensure that new subpart B applies to these entities. The proposed definition would also incorporate any individual officially connected with a supervised entity, such as its employee, officer, director, or agent thereof. The proposed revisions would also streamline new subpart B by negating the need to repeatedly reference the individuals officially connected to a supervised entity when discussing the entity. The definition of “supervised entity” is intended to be read broadly, as evidence by the inclusion of the phrase “any other entity supervised by the OCC,” and to include 17 Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023). 18 The current rule does not define the term “service provider,” but instead includes within certain substantive provisions persons that would meet the definition under the proposed subpart.

18 such entities as service providers subject to OCC examination authority under the Bank Service Company Act. 19 Testimony. The OCC is proposing to revise the definition of “testimony” to mean a transcribed interview or a sworn statement regardless of it being provided orally or in writing and regardless of it being provided before a court, another tribunal, or another officer (e.g., at a deposition). The proposed definition would clarify the meaning of the term, which does not depend on the location of an activity. In addition, the proposed definition would include certain technical and conforming changes. Unusual circumstances. The OCC is proposing to add a definition of this term and defined it by cross reference to its definition in the FOIA at 5 U.S.C. 552(a)(6)(B)(iii). The proposed definition would clarify when, in order to reasonably and properly process a FOIA request, it is necessary (1) to search for and collect the requested records from field facilities or other establishments that are separate from the office processing the request; (2) to search for, collect, and appropriately examine a voluminous amount of separate and distinct records which are demanded in a single request; or (3) for a consultation, which shall be conducted with all practicable speed, with another agency having a substantial interest in the determination of the request or among two or more components of the agency having substantial subject-matter interest therein. This proposed definition would (1) ensure that this term of art is used in a manner that is consistent with its use in the FOIA; and (2) provide internal consistency in the NPOI disclosure provisions that address similar considerations. 19 12 U.S.C. 1867.

19 In addition to the definitions discussed above, the proposal would carry forward two definitions in current § 4.32 with technical and conforming revisions: (1) “complete request;” and (2) “show a compelling need.” 3. Proposed § 4.12, Disclosure of OCC information in general; categories of OCC information. Proposed § 4.12 addresses information disclosure in general and discusses the categories of information addressed in the proposal. a. General Proposed § 4.12(a) provides that the OCC (1) will disclose nonexempt information as provided in proposed § 4.16 and the FOIA; and (2) will not disclose NPOI except as provided in this subpart or as otherwise required by law.20 b. Confidential supervisory information Proposed § 4.12(b) discusses CSI. Section 4.12(b)(1) explains that CSI is a subset of NPOI that is exempt from disclosure under either (1) FOIA Exemption 5 (5 U.S.C. 552(b)(5)) (privileged interagency or intra-agency memoranda or letters) in connection with the bank examination privilege; or (2) FOIA Exemption 8 (5 U.S.C. 552(b)(8)) (information contained in or related to certain examination, operating, or condition reports concerning financial institutions, which is commonly known as the bank examination exemption).21 Proposed § 4.12(b)(2) sets out four examples of CSI: (1) a 20 Information disclosure is also subject to other applicable law, including the Gramm–Leach–Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, Pub. L. 106–102, 113 Stat. 1338 (Nov. 1999) and the Right to Financial Privacy Act (RFPA), Pub. L. 95–630, 92 Stat. 3697 (Nov. 10, 1978). For example, the disclosure of CSI that contains a customer’s personally identifiable information (PII) would be subject to applicable laws, including GLBA and RFPA, on the disclosure of PII. 21 Courts have identified two purposes underlying the application of the FOIA bank examination exemption. The first purpose is to “ensure the security of financial institutions” by preventing runs on

20 record created or obtained by the OCC or OTS in connection with the performance of its responsibilities (e.g., a record concerning supervision, licensing, regulation, and examination of a supervised entity); (2) a record compiled by either agency in connection with its enforcement responsibilities; (3) an ROE, supervisory correspondence, agency investigatory file, and any internal agency memorandum (whether in the possession of the OCC or any other person); and (4) sworn statement or deposition testimony from a current or former employee, officer, or agent of the OCC or OTS concerning information acquired by that person in the course of his or her performance of official agency duties or due to his or her official status at the agency. These four examples are listed in current § 4.32(b)(1) as examples of NPOI but are referred to colloquially as CSI. There are two other examples of NPOI in the current rule that the OCC does not include in the proposed description of CSI. First, § 4.32(b)(1)(iv) of the current rule states that confidential OCC information obtained by or incorporated into the records of a third party (including a government agency) is an example of NPOI. The OCC did not include this example in the proposed definition of CSI because this type of information does not always meet the definition of CSI and, therefore, it should be assessed on a case￾banks from the disclosure of sensitive exam-related information. Leopold v. Dep’t of Just., 628 F. Supp. 3d 275, 286 (D.D.C. 2022) (noting that main purpose of FOIA exemption (b)(8) is to prevent “release of examination reports [that] ‘might undermine public confidence and cause unwarranted run on banks’”). The second purpose is “to safeguard the relationship between the banks and their supervising agencies.” Fagot v. FDIC, 584 F. Supp. 1168, 1173 (D.P.R. 1984) (recognizing as a secondary purpose the need “to provide banks and financial institutions supervised by the federal government sufficient assurance of confidentiality to promote full cooperation with the regulatory agencies”). See also Consumers Union of U.S., Inc. v. Heimann, 589 F.2d 531, 533 (D.C. Cir. 1978). Further, matters that are “related to” ROEs have been found to include real-time information about the status of financial institutions. Williams & Connolly LLP v. Off. of the Comptroller of the Currency, 39 F. Supp. 3d 82, 90 (D.D.C. 2014) (concluding that the “related to” language in FOIA exemption (b)(8) “casts a wide net of non-disclosure over any documents that are logically connected to an ‘examination, operating, or condition report”).

21 by-case basis. For instance, confidential information disclosed by the OCC to another government agency about the OCC’s financial condition is NPOI but not CSI. Second, § 4.32(b)(1)(vi) of the current rule describes confidential information related to operating and no longer operating banks and related persons as an example of NPOI. The OCC did not include this provision because it is not an example of a type of information but rather establishes that the status of information (e.g., whether certain information is CSI, non-CSI NPOI, or nonexempt under FOIA) does not depend on the operating status of the entity to which it relates. For example, an ROE about a bank is CSI regardless of whether the bank is still in operation. (The concept that the status of information is not tied to the operating status of an entity is addressed below in the discussion of proposed § 4.13(d)(2)(ii)). The proposal also describes types of information that would be excluded from the definition of CSI. Proposed § 4.12(b)(3) states that, notwithstanding proposed § 4.12(b)(1), CSI does not include information created or collected by a supervised entity for its own business purposes if the information (1) is in the supervised entity’s own possession; (2) was not prepared for the OCC, Board, FDIC, or the Consumer Financial Protection Bureau (CFPB) in response to the applicable agency’s supervisory or enforcement activities; and (3) is not supervisory feedback from the OCC, Board, FDIC, or CFPB or information on the enforcement activities of these agencies or a summary of such information. This exclusion is intended to clarify that the supervised entity’s mere sharing of its business information with the OCC does not impose on the supervised entity the OCC’s CSI restrictions on the information. For example, a national bank’s business plan located on the bank’s computer system would likely satisfy the three

22 elements above and, therefore, the bank computer system-stored business plan would not be CSI. But, if the bank shares a copy of the business plan with the OCC in connection with a supervisory activity, the business plan would be CSI because of the context in which the supervised entity shared the information. 22 This means that the same business plan can be both CSI, when in the possession of the OCC, and not CSI, when in the possession of the supervised entity. The proposed exclusion from the meaning of CSI also includes provisions focused on the purpose for which the information was created or collected and whether it reflects certain supervisory feedback. These proposed provisions are intended to ensure that information that is created or collected in connection with the regulatory or supervisory activities of the Federal banking agencies and the CFPB is CSI even though similar information created or collected for a supervised entity’s own business purposes is not. The OCC included the Board, FDIC, and CFPB in the exclusion because, in the OCC’s experience, information may be prepared in response to the supervisory or enforcement activities or contain supervisory feedback from more than one of these agencies.23 The OCC invites comment on whether this exclusion should be limited to the OCC or expanded to include other regulators (e.g., the U.S. Securities and Exchange Commission (SEC)). c. Non-public OCC information and confidential supervisory information obtained by third parties 22 See, e.g., proposed 12 CFR 4.13(d)(1)(i). 23 This proposed provision would apply to an agency as defined in 5 U.S.C. 551(1), other than the Board.

23 Proposed § 4.12(c) confirms that NPOI, including CSI, that is obtained by or incorporated into the records of a third party (including a government agency) remains NPOI or CSI, as applicable, regardless of how the information was obtained. This provision would ensure that information covered by proposed subpart B remains covered regardless of whether it is incorporated or disclosed by another person. 4. Proposed § 4.13, Disclosure of non-public OCC information or confidential supervisory information, in general. Proposed § 4.13 addresses the disclosure of all NPOI: CSI and non-CSI NPOI. 24 a. Unauthorized disclosure of non-public OCC information prohibited Under § 4.37(b) of the current rule, national banks, Federal savings associations, or holding companies (and any director, officer, or employee thereof) are prohibited from sharing NPOI without OCC approval, subject to limited exceptions in § 4.37(b)(2) for sharing, when necessary and appropriate for business purposes, with a person or organization officially connected with the bank or holding company as officer, director, employee, attorney, auditor, independent auditor, or (in some cases) a consultant. 25 Proposed § 4.13(a)(1)(i) sets forth the general rule, derived from the current rule, that CSI may not be disclosed except (1) when otherwise permitted by new subpart B; (2) with prior OCC approval; or (3) when the disclosure is in published statistical material or an anonymized anecdote that does not disclose, either directly or indirectly, the affairs of any person. By qualifying the general prohibition on the disclosure of CSI with these three exceptions, this proposed provision clarifies and increases the disclosure of CSI 24 Proposed § 4.13 is based on provisions in current §§ 4.36, 4.37, and 4.38, with substantive revisions. See e.g., current § 4.36(a), (c), and (d); § 4.37(a)(2) and (d); and § 4.38. 25 The exceptions can be found at 12 CFR 4.37(b)(2).

24 compared to the current framework, while continuing to protect its confidentiality as appropriate. The details of how the agency proposes to strike this balance are set forth below. Proposed § 4.13(a)(1)(ii) makes clear that non-CSI NPOI is not subject to restrictions on disclosure unless and to the extent that the OCC imposes conditions on further disclosure.26 This provision would ensure that conditions or limitations that the OCC imposes when it discloses NPOI are not lost simply because the information is further disclosed.27 (The OCC’s authority to apply conditions and limitations on disclosure of NPOI is described in the discussion of proposed § 4.13(c)(1).) Proposed § 4.13(a)(1)(iii) provides that, notwithstanding (a)(1)(i) and (a)(1)(ii), further disclosure of NPOI is permissible in response to a Federal court order in a judicial proceeding in which the OCC had the opportunity to appear and oppose the disclosure. The applicability of this provision would not be contingent on whether the agency availed itself of the opportunity to oppose disclosure. 26 The OCC retains, however, its authority to control or impose limitations on the subsequent use and disclosure of NPOI in the possession of another person under proposed § 4.13(f). Should the OCC subsequently exercise its authority to condition further disclosure of NPOI, future disclosures would be subject to applicable conditions. Further, if the OCC imposes conditions or limitations on NPOI after the initial disclosure because it determines that the person with access to or disclosing the information was doing so for reasons other than the purpose provided in the relevant provision or otherwise in contravention of the objectives of this subpart, the OCC may order the cessation of use of the NPOI, or its return to the OCC or destruction pursuant to proposed § 4.13(a)(3). 27 This provision would also mean that a supervised entity is permitted to share information that is excluded from the meaning of CSI under proposed § 4.12(b)(3) (i.e., information in a supervised entity’s possession and created for its own business purposes, provided the information meets the other requirements) even if that information continues to be NPOI because it may be withheld under another FOIA exemption. A supervised entity’s ability to further disclose NPOI under the proposal is only restricted if the OCC prohibits disclosure of the NPOI as a condition of its disclosure. When a supervised entity is in possession of information excluded from CSI but that remains NPOI, the requirements of § 4.13(a)(2)(ii) would not be met, and, therefore, the supervised entity is not prohibited from further disclosing the information.

25 Proposed § 4.13(a)(2) addresses the disclosure of NPOI by recipients of the information. First, under proposed § 4.13(a)(2)(i), a supervised entity, government agency, or other person with access to NPOI that is subject to a condition on disclosure may not disclose the information except as authorized by the subpart or the OCC. This provision would clarify that NPOI that is subject to conditions on disclosure remains subject to those conditions regardless of who seeks to disclose it: the conditions on disclosure attach to and travel with the NPOI itself. Second, under proposed § 4.13(a)(2)(ii), a supervised entity, government agency, or other person that obtains unauthorized access to NPOI may not further disclose or make a copy of the information. For example, if the disclosure of NPOI is subject to a condition, an unauthorized recipient may not further disclose the NPOI even in observance of the condition, except as otherwise authorized by this subpart or the OCC. This provision would foreclose a potential claim that a person with unauthorized access to NPOI can disclose the information at will. Both of these provisions are meant to clarify aspects of the current framework. Under proposed § 4.13(a)(3), if the OCC determines that a supervised entity, government agency, or other person is disclosing NPOI for reasons other than the purpose provided in the relevant provision of this subpart or in contravention of the objectives of this subpart, the OCC can order that (1) use of the disclosed information cease; and (2) the disclosed information to be returned to the OCC or destroyed such that the person no longer has access to the NPOI. This provision would ensure that the OCC can retain appropriate control over NPOI that is disclosed in contravention of the purpose or objectives of the subpart. A person that wishes to disclose NPOI, including CSI, for a

26 purpose other than those addressed in the proposal should seek approval under proposed § 4.17. 28 Proposed §§ 4.13(a)(2) and (a)(3) are intended to preserve the OCC’s discretion to prevent further disclosure of NPOI or to require the return or destruction of disclosed information in the event that a person inappropriately obtain or misuse NPOI, including under false pretexts, to the detriment of the OCC or supervised entities. b. Discretionary disclosure of non-public OCC information by the OCC Proposed § 4.13(b) addresses the OCC’s disclosure of NPOI. Proposed § 4.13(b)(1) permits the OCC to disclose NPOI whenever it determines that disclosure may be necessary or appropriate. Proposed § 4.13(b)(2) addresses disclosing NPOI that is over a certain age, in response to a FOIA request. Specifically, this provision would provide that, in responding to a FOIA request for a record that was created or received 25 or more years before the request, the OCC will not withhold the record on the grounds that it contains NPOI unless the agency determines that a FOIA exemption is applicable and there is good cause to withhold it. Under the proposal, good cause may exist if the OCC determines that disclosure conflicts with the purposes of the subpart or is otherwise prohibited by law. For example, if 30-year old NPOI contains PII, the OCC may determine that good cause exists to withhold disclosure or condition disclosure (under proposed § 4.13(c), discussed below) on redaction of the PII. This provision is an example of the OCC’s recalibration of the appropriate balance between allowing for the limited disclosure of NPOI while protecting its 28 The OCC notes, however, that its authority to require the cessation of use, return, or destruction of NPOI under proposed § 4.13(a)(3) also applies to requests for NPOI under proposed § 4.17, if the NPOI is not used for the approved purpose.

27 confidentiality. The OCC’s rationale for permitting disclosure in this situation is that, after such a long period of time (25 or more years), there is a very low risk that disclosure of the NPOI would chill the necessary candid discussions between, for example, OCC bank examiners and supervised entities. In contrast, as discussed below, disclosure will provide greater transparency about the agency’s supervisory approach, which increases trust in the process and is good government. Disclosure of older CSI also would allow the public, and academics, to better understand the U.S. banking system and the OCC’s role in governance of that system. The disclosure of this information to the public would enhance the public’s ability to provide meaningful feedback to the agency on its regulatory and governance initiatives and to hold the agency accountable for having a strong, efficient regulatory framework. Increasing public knowledge of the U.S. banking system would further the public’s ability to participate in the regulation of that system. Since the information is aged 25 years or more, the disclosure would not implicate the same types of privacy considerations because, after 25 years, most personnel involved in the communications would no longer be employed at their respective entities and most of the concerns, criticisms, and other information shared would no longer be applicable to the institution. Information 25 years old or more should generally not provide potentially insight into the current operations or conditions of a supervised entity such that its competitors could gain unfair advantage or the public would be discouraged from doing business with it. Thus, the OCC believes that disclosure of this aged information would generally not dissuade open communication in the same way that disclosure of current information

28 could. As always, the OCC can place conditions or limitations on any disclosure or prohibit it on a case-by-case basis, under proposed §§ 4.13 and 4.17, respectively. The OCC is seeking comment on whether it should adopt proposed § 4.13(b)(2). The agency is considering whether the data should be aggregated or anonymized before it is released. The OCC also seeks comment on whether the 25-year age limit is appropriate or whether a different age limit would strike a better balance between protection and transparency. c. Conditions and Limitations This provision addresses conditions or limitations on the disclosure of NPOI. Proposed § 4.13(c)(1) states that the OCC may condition or limit the disclosure of NPOI in any way necessary to give effect to the purposes of this subpart. This would enable the agency to more appropriately balance the equities of confidentiality and limited disclosure, including on a case-by-case basis. Proposed §§ 4.13(c)(2) through 4.13(c)(4) set forth three examples of conditions the OCC may impose, and they carry forward provisions in the current § 4.38 with conforming and technical changes. First, the OCC may condition approval for the disclosure of NPOI on the entry of a protective order in an adversarial matter or a confidentiality agreement in a non-adversarial matter. Second, in a case where a protective order has been entered, the OCC may condition the disclosure of NPOI on the inclusion of additional or amended provisions in the protective order. Third, the OCC may (1) condition its authorization of deposition testimony on the parties’ agreement to appropriate limitations, such as keeping a transcript of the testimony under seal or limiting its availability; (2) allow use of a transcript in other litigation; and (3) require

29 that a person who requests to use the transcript in other litigation provide the OCC with a copy of the transcript at his or her personal expense. This example further provides that an OCC employee whose deposition is transcribed does not waive his or her right to review the transcript and note errors. These examples are intended to provide clarity with respect to specific situations. d. Nature of non-public OCC information. Proposed § 4.13(d) addresses the nature of NPOI in different circumstances: (1) when NPOI is in the OCC’s possession; (2) when NPOI is disclosed despite a restriction on disclosure; (3) when CSI is both subject to the bank examination privilege and disclosed; and (4) when CSI pertains to a supervised entity that is no longer operating. First, proposed § 4.13(d)(1)(i) states that NPOI is the property of the OCC to the extent that it is in the OCC’s possession. Among other things, this provision would resolve potential confusion about whether the information exempted from the definition of CSI in proposed § 4.12(b)(3) – because (among other things) it is not in the OCC’s possession – is the OCC’s property: it is not.29 This provision would also support the Administration’s policy against the overcriminalization of Federal law and is consistent with related case law. Second, § 4.13(d)(1)(ii) would clarify that NPOI remains the OCC’s property to the extent the information is restricted from further disclosure under this subpart, regardless of whether it is disclosed to another person. Thus, the OCC would not lose its 29 As discussed above, proposed § 4.12(b)(3) states that, notwithstanding proposed § 4.12(b)(1), CSI does not include information created or collected by a supervised entity for its own business purposes if the information (1) is in the supervised entity’s own possession; (2) was not prepared for the OCC, Board, FDIC, or CFPB in response to the applicable agency’s supervisory or enforcement activities; and (3) is not supervisory feedback from the OCC, Board, FDIC, or CFPB or information on the enforcement activities of these agencies or a summary of such information.

30 property rights because a disclosure not in compliance with this subpart occurs. This provision also ensures that the OCC’s property rights with respect to particular NPOI are coextensive with the OCC’s restrictions on sharing the information, which (as discussed above) may change depending on who is in possession of the NPOI. For example, if the OCC has disclosed CSI (e.g., an ROE) to a supervised entity without conditions limiting the entity’s ability to disclose the CSI as permitted under the subpart, then the OCC’s property interest in the CSI when in the possession of the supervised entity to which it was disclosed only extends to the OCC’s ability to prohibit further disclosure (consistent with proposed subpart B). In that instance, the supervised entity may disclose the CSI to its affiliate, as permitted under proposed § 4.14(b)(1)(i), but not generally. The OCC invites comment on whether the proposal’s approach on the extent to which the OCC may assert property rights over NPOI, including CSI, strikes the proper balance between permitting appropriate disclosures and ensuring the OCC has the ability to protect the confidentiality of the information. Are there alternative approaches that would more appropriately strike this balance, such as maintaining OCC property rights (1) for NPOI except when disclosed pursuant to proposed § 4.14; or (2) for all NPOI unless expressly released in response to a request for NPOI under proposed § 4.17? Third, proposed § 4.13(d)(2)(i) states that, with respect to CSI that is subject to the bank examination privilege, only the OCC can waive that privilege. Therefore, the OCC’s or another person’s disclosure of CSI is not and should not be interpreted as a waiver of the privilege. Finally, proposed § 4.13(d)(2)(ii) clarifies that CSI remains CSI

31 regardless of whether the supervised entity it relates to is operating or no longer operating.30 e. Duty of person served In this section, the proposal incorporates certain provisions from current § 4.37 that address the duties of a person (other than a current or former OCC or OTS employee) served with a demand for NPOI, with technical and conforming revisions. See the discussion below on proposed § 4.15 for information about the duties of and restrictions on current or former OCC or OTS employees or agents. f. Intention of OCC not to waive rights Proposed § 4.13(f) addresses the OCC’s rights with respect to NPOI when it is in the possession of another person. Specifically, as proposed, the OCC does not waive its right to control or impose limitations on the use and disclosure of NPOI regardless of the fact that (1) the NPOI is in the possession of a supervised entity, government agency, or other person, and (2) their possession is in compliance with the new subpart B. As an example, under the proposal, even if the OCC permits disclosure of CSI, meaning the OCC has disclosed information it has a basis for withholding under FOIA Exemption 5 in connection with the bank examination privilege or FOIA exemption 8, this disclosure does not constitute a waiver of the examination privilege related to the information disclosed. This provision was added to clarify the rule, particularly in light of the additional flexibility that the OCC is proposing for supervised entities to share CSI with certain 30 As noted above, this provision is based on § 4.32(b)(1)(vi) of the current rule.

32 persons. As discussed in more detail below,31 the proposal allows a supervised entity to share CSI with certain persons closely associated with it, including certain government agencies, subject to specified safeguards. These persons and the OCC have a common interest in ensuring the efficacy of the supervision process, including the implementation of safe and sound banking practices.32 For example, affiliates, service providers, and incoming senior executive officers share a supervised entity’s interest in ensuring the efficacy of the supervision process, including implementing effective and timely corrective actions to address concerns identified by the OCC. Enabling a potential counterparty to understand the OCC’s supervisory concerns will allow the counterparty to plan to continue effective and timely corrective actions if a transaction will be consummated, promoting the goals of the supervisory process. Further, sharing of CSI also promotes a supervised entity’s and its potential counterparties’ common legal interest in ensuring that the entity’s operations comply with Federal law. As for non-profits, including trade associations, sharing CSI would allow these persons to, among other activities, advocate on behalf of supervised entities or engage in academic research regarding bank activities, which can provide benefits to supervised entities such as promoting consistent bank supervision and remedial efforts to address supervisory concerns as well as allowing new analyses and insights into the banking sector. Maintaining a robust and effective bank supervisory 31 See the discussion below of proposed § 4.14(b). 32 The law governing common law privileges recognizes that a privilege is not waived when the holder of the privilege authorizes privileged information to be shared with a party having a common interest in the subject matter. Notably, some courts have extended common law privileges to potential business partners through common interest concepts. Through this proposed provision, the OCC applies this same rule to the bank examination privilege—i.e., to further a common interest in the bank supervisory process, disclosure by a supervised entity of CSI to a potential counterparty in a business combination would not be a waiver of the OCC’s privilege.

33 scheme depends not just on communication between the OCC and each supervised entity. The OCC and supervised entities have a need to understand the larger landscape, including evaluating market risks and concentrations of credit in specific industries or investments. Allowing the sharing of CSI in the circumstances discussed above through frank discussions of issues and potential improvements using specific facts confronting supervised entities, furthering the purpose of the privilege. Lastly, the common interest shared between the OCC and supervised entities extends to the sharing of CSI with government agencies engaged in supervisory or examination activities. By creating a framework that allows for sharing without the loss of important rights, this rulemaking advances these goals. 5. Proposed § 4.14, Disclosure of confidential supervisory information by recipient. This section addresses the circumstances under which the OCC and a supervised entity can disclose CSI. a. OCC’s disclosure of confidential supervisory information Proposed § 4.14(a) states that the OCC may disclose CSI (1) about a supervised entity to that entity or (2) to a government agency, unless prohibited by law. b. Supervised entity’s disclosure of confidential supervisory information While the current framework permits the disclosure of NPOI by persons other than the OCC in limited circumstances and generally requires OCC prior approval, proposed § 4.14(b) provides increased flexibility by allowing a supervised entity to disclose CSI without OCC approval in six circumstances. Disclosure in this circumstance does not constitute a waiver of OCC legal privileges or the agency’s ability to assert applicable FOIA exemptions. Moreover, the supervised entities must still

34 comply with any applicable information disclosure restrictions of other financial regulators notwithstanding the OCC’s exemptions. Based on its supervisory experience, the agency believes that the costs and benefits of confidentiality and limited disclosure of CSI favor disclosure in these circumstances, provided the proposed safeguards are observed. It is intended to address stakeholders’ longstanding concerns about the costs and consequences associated with the current restrictive disclosure framework, including those referenced above in the context of EGRPRA and other stakeholder feedback. 33 For each of these six, the disclosure is only permissible if necessary or appropriate for the efficacy of the supervision process, as stated in proposed § 4.14(b)(1). The OCC considered making the exceptions in § 4.14(b)(1) of the proposed rule also available to a parent holding company that is lawfully in possession if its subsidiary supervised entity’s CSI. This exception would allow the parent holding company to disclose such CSI without the prior approval of the OCC to the same extent, subject to the same conditions, and to the same categories of recipients for the parent holding company to which the supervised entity could disclose such information under § 4.14(b). This would allow the parent holding company to, for example, disclose CSI to affiliates, lawyers, auditors, accountants, and service providers of the parent holding company, when necessary or appropriate for business purposes, without a request to the OCC. The OCC observes that supervisory matters at a supervised entity are often intertwined with supervisory matters at the parent holding company and that actions related to such matters are often joint efforts between the supervised entity and its holding company. However, the OCC is concerned that allowing the parent holding company to further 33 See discussion above regarding EGRPRA comments.

35 disclose CSI to the same extent as the supervised entity would cause the OCC’s CSI to be disseminated broadly and to a wide range of entities with which the OCC has limited engagement. Since the OCC does not supervise the parent holding company, the OCC would have less visibility into whether the requirements attached to some of the disclosure exceptions such as qualifying confidentiality agreements and logs of disclosed information are being adhered to. Thus, the OCC decided not to adopt such an exception in the proposed rule. However, the OCC is still considering adopting this exception in the final rule and is seeking comment on whether allowing parent holding companies to use this exception would strike the proper balance between reducing unnecessary procedural hurdles with maintaining the confidentiality of the information. If adopted, the OCC would define “parent holding company” as a company that has control of an insured depository institution with “control” defined consistently as in 12 U.S.C. 1841(a)(2). Proposed § 4.14(b)(1)(i), Disclosure to an Affiliate As proposed, a supervised entity can disclose CSI to an affiliate under the standard discussed above. 34 In the OCC’s experience, it is important for a supervised entity’s affiliates to understand the entity’s business operations because the affiliates often make decisions that have a direct effect on the supervised entity. The OCC has not proposed any specific conditions or limitations on sharing in these circumstances. This is 34 As defined in proposed § 4.11, an affiliate includes any company that a supervised entity controls, is controlled by, or is under common control with, such as its holding company and any employee, officer, director, or agent of the affiliate. For a branch or agency of a foreign bank, affiliate would include the foreign bank. See also 12 CFR 261.21(b)(1) for Board rules that allow sharing with affiliates.

36 because the interests of the entity and its affiliates are generally so aligned that the agency does not believe that any specific safeguards are needed.35 In considering the scope of this proposed change, the OCC notes that it has historically limited or placed controls on disclosures of information to certain foreign holding companies or other foreign affiliates based on the different levels of protection accorded to information in foreign legal regimes, challenges with enforcing confidentiality agreements in foreign jurisdictions, and the possibility of conflict between U.S. and foreign privacy laws. The OCC has not, however, included any such limits or controls in this provision. The agency has not observed these types of risks with respect to sharing with foreign affiliates and believes that the benefits of disclosure outweigh any risks. In addition, the agency is concerned that such restrictions would interfere with the ability of a foreign affiliate, such as a foreign holding company, to properly oversee and support a supervised entity. Nevertheless, the OCC invites comment on whether it should limit disclosure to only domestic affiliates. Proposed § 4.14(b)(1)(ii), Disclosure to a Service Provider As noted above, § 4.37(b)(2) of the current rule allows a supervised entity to disclose NPOI to a limited category of service providers (attorneys, auditors, and independent auditors). The OCC is proposing to expand this exception to a broader group of service providers, as defined in proposed § 4.11, subject to certain safeguards. Specifically, the service provider must 35 The OCC notes, however, that a supervised entity’s use of affiliates to perform functions for the entity or achieve the entity’s strategic goals does not diminish the responsibility of the board of directors and management to ensure that both the relationship between the affiliate and the supervised entity and all functions of the entity are conducted in a safe and sound manner and serve the entity’s best interests. To the extent a conflict were to arise with respect to the interests of a supervised entity and its affiliate, under proposed § 4.13(c), the OCC can, on a case-by-case basis, impose conditions or limitations on or prohibit any disclosure of NPOI. Further, proposed § 4.13(f) affirms that nothing in the subpart constitutes a waiver by the OCC of its right to control or impose conditions or limitations on the subsequent use and disclosure of the NPOI.

37 (1) be incorporated in the United States or a U.S. territory; (2) have a business need for the information (such as assisting the supervised entity with remediating supervisory concerns or fulfilling supervisory expectations); (3) have a formal agreement with or be under a written contact to provide services to the supervised entity; and (4) have a qualifying confidentiality agreement, 36 as defined and described in proposed § 4.14(c). In addition, the supervised entity must keep a log of the general categories of information being disclosed to its service providers pursuant to this exception. The OCC proposes this expanded ability to share CSI with certain service providers based on the agency’s understanding of the important role that these service providers play in a supervised entity’s business and its appreciation that a service provider’s ability to fulfill this role may be impeded if relevant CSI cannot be shared in a timely fashion. Current § 4.37(b)(2) originated in 1995 and is not limited to domestic service providers.37 The OCC proposes, however, to include this limit in the new subpart B based on concerns that have developed during the intervening period about data security, challenges with enforcing data confidentiality contracts in foreign jurisdictions, and the increasing volume and role of data in business operations. 38 The OCC is soliciting comments about this limit, as well as whether the other proposed safeguards are sufficient to prevent the disclosed information from being used for unintended purposes, such as 36 As discussed in greater detail in below, the OCC would be an intended third-party beneficiary of any qualifying confidentiality agreement and permitted to enforce the terms of the agreement through a civil action. 37 See 60 FR 57315. 38 See, e.g., How big is Big Data? A comprehensive survey of data production, storage, and streaming in science and industry - PMC, National Library of Medicine: National Center for Biotechnology Information, October 19, 2023.

38 coercing a supervised entity to provide CSI as a condition of providing services, or from otherwise being misappropriated. Proposed § 4.14(b)(1)(iii), Disclosure to a Senior Executive Officer Candidate The current rule does not allow a supervised entity to share NPOI with candidates for senior executive officer positions of the supervised entity or its top-tier holding company. The OCC is proposing to allow the disclosure of CSI in these situations when necessary or appropriate for a supervisory, business or other purpose identified in § 4.10(a), provided that the candidate has a qualifying confidentiality agreement. In addition, as proposed, the supervised entity (1) cannot disclose the information to more than one potential candidate at a time per open position; (2) must have formally ended discussions with a potential senior executive officer before it can make a disclosure to another potential candidate for the same position; and (3) must have board of directors’ approval to share the information with a potential candidate. The OCC would consider an individual to be a candidate once the supervised entity or its top-tier holding company, as applicable, has begun interviewing the individual and the board of directors of the supervised entity has approved the disclosure of the CSI to the individual. Disclosing CSI to the potential senior executive officer at this point would allow the individual and banking organization to better assess whether the employment opportunity is appropriate for the individual before the supervised entity undergoes the effort and time of onboarding the individual, thus permitting the supervised entity to more quickly turn to another potential candidate to fill the open position if the opportunity is not appropriate for the candidate.

39 The proposal would describe senior executive officer in proposed § 4.14(b)(1)(iii) by incorporating the positions listed in the definition of that term in 12 CFR 5.51(c)(4) as well as any other individual the OCC identifies in writing. Under the proposal, senior executive officers would include a supervised entity’s president, chief operating officer, chief financial officer, chief lending officer, chief investment officer, and chief risk officer. The OCC proposes this change because senior executive officers of the supervised entity are generally involved in managing all aspects of a supervised entity, including remediating supervisory issues. Therefore, a person considering a senior executive officer position at a supervised entity should be fully apprised of the issues that a supervised entity is facing, including supervisory issues, in order to accurately assess his or her suitability for the position. Conversely, a supervised entity must be able to assess a candidate’s ability to understand and manage the supervised entity, including any supervisory issues. Otherwise, the supervised entity may expend the time and effort to hire a new senior executive officer only for the person to quickly leave the position because he or she was unable to handle the scope of issues requiring remediation. Thus, the exchange of relevant CSI is necessary for both parties to ensure that the correct person is selected for the position. The proposal would also extend the permission for a supervised entity to disclose CSI to the senior executive officer candidates of the supervised entity’s top-tier holding company. Top-tier parent companies control the supervised entities and make decisions that have material and direct effects on the supervised entity. Additionally, the interests of supervised entities and their affiliates are generally aligned—this is particularly true

40 for a supervised entity’s top-tier holding company. 39 The OCC invites comment on whether this extension of authority to share CSI is appropriate. Should there be any additional safeguards, such as (1) limiting the authority to domestic candidates; (2) requiring documentation of the role of the top-tier holding company’s senior executive officer in decision making and other relevant responsibilities related to the supervised entity; or (3) limiting the disclosed CSI to information directly connected to those responsibilities? As proposed, the OCC does not include candidates for a supervised entity’s board of directors in the scope of the provision. The agency does not believe that board candidates would have the same need for CSI as senior executive officer candidates, due to nature and scope of a board member’s role in the operations of a supervised entity. For example, a board member would typically be less involved in addressing supervisory issues than a senior executive officer. For this reason, the proposal does not extend this exception to board candidates but invites public comment on whether this distinction is appropriate. Nevertheless, the OCC invites comment on whether the rule should expressly extend to board candidates. If so, should the sharing be limited to certain categories of CSI? In addition, the agency invite comment on whether the rule should expressly extend to candidates for positions not covered by the proposed definition of “senior executive officer,” such the chief compliance officer or chief Bank Secrecy Act officer, both of which are often directly involved in and responsible for the remediation of supervisory concerns expressed by the OCC and for other positions? 39 See supra note 35.

41 Proposed § 4.14(b)(1)(iv), Disclosure to a Potential Counterparty in a Business or Other Combination The current rule does not specifically allow a supervised entity to share NPOI with potential counterparties in business combinations or other combinations. Stakeholders have shared with the OCC that this limitation is very problematic, as it severely limits the ability to conduct due diligence of potential counterparties, and they have encouraged the OCC to allow supervised entities to share CSI in these situations. 40 Moreover, the OCC is aware that the strong need for CSI as part of the due diligence process creates incentives to skirt the OCC’s restrictions on CSI, which can negatively impact the OCC’s interests in CSI and adherence to its rules as well as make the OCC less able to control the sharing of information. The OCC considered this and other feedback it received from stakeholders over the years and intends for certain of the proposed revisions to be responsive to these concerns. If the counterparty does not have the resources or expertise to remediate the supervised entity’s problems, the transaction could lead to a situation where the issues with the supervised entity remain unaddressed for an unacceptably long period of time, a situation that both regulators and supervised institutions seek to avoid.41 Therefore, the OCC is proposing to allow a supervised entity to share CSI without OCC approval with a potential counterparty in connection with certain business combinations or other combination, 42 subject to the safeguards discussed 40 See discussion above regarding EGRPRA comments. 41 For this reason, the OCC has historically allowed the disclosure of CSI to potential counterparties in certain transactions involving troubled institutions. 42 A “business combination” is defined in 12 CFR 5.33 (d)(2)(i)-(iv) as: (1) any merger or consolidation between a national bank or a Federal savings association and one or more depository institutions or State trust companies, in which the resulting institution is a national bank or Federal savings association; (2) in the case of a Federal savings association, any merger or consolidation with a credit union in which the resulting institution is a Federal savings association; (3) in the case of a national bank, any merger between a national bank and one or more of its nonbank affiliates; (4) the acquisition by a national bank or a Federal

42 below. The OCC seeks comment on whether business combination, as defined in 12 CFR 5.33 (d)(2)(i)-(iv), and other combinations, as defined in 5.33(d)(10)(i)-(ii), is sufficiently broad or whether additional types of business combinations or other combinations as defined in 12 CFR 5.33 should be included? Alternatively, should the scope of transaction covered by this provision be expanded to include other types of corporate transactions, such as the purchase or sale of assets or other transactions? The OCC proposes to allow a supervised entity to share CSI without OCC approval with a potential counterparty to a single transaction or a series of transactions involving a business combination or other combination if (1) the potential counterparty is engaged in good faith negotiations regarding the potential transaction or series of transactions with the supervised entity; (2) the supervised entity provides the CSI to the potential counterparty solely to enable the person to perform the person’s own reasonable due diligence or other duties related to the transaction or series of transactions; (3) the potential counterparty to which the supervised entity discloses CSI has a qualifying confidentiality agreement (as defined in proposed § 4.11 and discussed below) with the supervised entity; (4) the OCC receives written acknowledgement from the potential counterparty that the CSI was not created for the purpose of aiding in due diligence of the potential counterparty and the potential counterparty will perform its own diligence and make its own financial decisions regarding the transaction or series of transactions; (5) the OCC receives a written waiver from the potential counterparty of any and all potential savings association of all, or substantially all, of the assets of another depository institution. “Other combination” is defined in § 5.33(d)(10)(i)-(ii) as any merger or consolidation between a national bank or a Federal savings association and one or more depository institutions or State trust companies, in which the resulting institution is not a national bank or Federal savings association; and in the case of a Federal stock savings association, any merger or consolidation with a credit union in which the resulting institution is a credit union.

43 claims the potential counterparty may have against the OCC arising from the CSI, including the accuracy and completeness thereof; (6) the supervised entity has not disclosed CSI under this paragraph to three or more other potential counterparties to the transaction or series of transactions; and (7) the potential counterparty to which the supervised entity discloses the CSI agrees in writing that it will not reference the CSI in any agreement with the supervised entity or an affiliate of the supervised entity. These proposed safeguards are based on the OCC supervisory experience in the context of requests for CSI in the context of proposed business combinations and are intended to complement each other. The first proposed safeguard (requiring that the potential counterparty be engaged in good faith negotiations about the transaction(s)) is intended to ensure that a supervised institution shares CSI only when the potential counterparty has demonstrated its commitment through good faith negotiations, not simply based on the possibility of a business or other combination. The OCC considered requiring a finalized purchase or similar agreement but was concerned that this would largely defeat the purpose of the provision to facilitate counterparty due diligence. For such due diligence to occur, the parties need to exchange complete and accurate information during the diligence phase. Without this information, each counterparty cannot know the other’s condition and may be reluctant to enter into the business or other combination. Alternatively, the parties may enter into a business or other combination that should not and would not have occurred had fulsome due diligence, enabled by the disclosure of CSI, been allowed The second proposed safeguard (requiring that the CSI be disclosed solely to enable each person in a potential transaction to perform reasonable due diligence) is

44 intended to ensure sharing is conducted consistent with the purpose of the exception. The disclosure has to be for the purpose of due diligence, and due diligence cannot be a pretext to obtain the CSI. Importantly, by enabling more effective due diligence, the act of sharing CSI also supports the ability of the acquirer to make a fulsome assessment of whether they have the capabilities necessary to handle any supervisory issues prior consummating a business combination. As a result, the proposal enables acquirers to be better prepared to remediate any supervisory issues at the target. 43 The purpose of the third proposed safeguard (requiring a potential counterparty to which the supervised entity discloses CSI to have a qualifying confidentiality agreement with the supervised entity) is self-evident: to ensure that the counterparty maintains confidentiality regarding the CSI. The proposed disclosure of CSI under this provision is for the specific purpose of aiding with the reasonable due diligence or other activities or tasks related to potential transaction(s); it is not a vehicle for the unfettered release of CSI. To this end, the counterparty to whom the information is disclosed must agree to appropriate confidentiality safeguards. The purpose of the fourth proposed safeguard (requiring the potential counterparty provide the OCC with written acknowledgement that (1) the CSI was not created to aid its due diligence; and (2) it will perform its own due diligence and make its own decisions regarding the transaction(s)) is to ensure that the potential counterparty independently conducts its own due diligence with respect to the potential transaction(s). This safeguard also serves as notice to the potential counterparty that it may not use the 43 Arguably, using the need to conduct due diligence in a potential business or other combination as a pretext for gaining access to CSI would likely mean that the entity was unable to demonstrate a legitimate necessity for the information. Disclosing CSI in that circumstance would run counter to the purpose of proposed subpart.

45 CSI to supplant or as a proxy for this independent conduct and judgment. The OCC believes that this will promote more successful business and other combinations, as well as address concerns that OCC examiners will feel pressure (or be pressured) to tailor their supervisory findings to accommodate, for example, due diligence for an on-going or future transaction. The purpose of the fifth proposed safeguard (requiring the potential counterparty to waive potential claims against the OCC arising from the CSI, including its accuracy and completeness) is to mitigate the risk that a counterparty asserts a claim against the OCC if the CSI affects the outcome of a business or other combination(s). It would effectively require a potential counterparty to acknowledge that (1) the CSI reflects, in whole or in part, the OCC’s judgment in the exercise of its supervisory and regulatory responsibilities; and (2) it has no legal interests or duties owed to it based on the CSI. The sixth proposed safeguard (limiting the disclosure of CSI without OCC approval to no more than three potential counterparties) is intended both (1) to facilitate a competitive environment with multiple potential counterparties that leads to a consummated transaction; and (2) to maintain control over the disclosed information. The OCC believes that limiting supervised entities’ authority to disclosure CSI without OCC approval to no more than three counterparties would strike the appropriate balance. The OCC is seeking comment on whether it is clear what is meant by counterparties “to the transaction or series of transactions” in this limitation. Does the OCC need to clarify what would be considered a discreet “transaction” or “series of transactions” for the purposes of this limitation?

46 The OCC considered further limiting this disclosure by stating that the CSI could only be disclosed to a potential counterparty’s senior executive officers or members of its board of directors. The agency decided, however, that a supervised entity should use its business judgement about the persons at the counterparty with which to disclose the CSI, that said, the disclosure must be limited to those persons with a need to know, such as the decision makers and the staff performing the due diligence and those engaging in the negotiations or integration planning. Nevertheless, the agency invites comment on whether this provision should be limited to a specific group of persons at the counterparty and, if so, how to define the group. Finally, the seventh proposed safeguard (prohibiting any agreement between parties to reference the CSI) is intended to ensure that CSI shared by a supervised entity is used for the intended purpose of enabling the counterparty to engage in reasonable due diligence or other activities or tasks related to the transaction or series of transactions. Requiring this safeguard to be agreed to in writing helps to remove incentive for a counterparty to use this provision to obtain a flow of CSI over time or to condition the transaction on changes to information contained in CSI, such as ROEs and ratings. For example, a potential counterparty would be contractually prohibited from obtaining CSI to determine where CSI-based contractual conditions to a merger consummation are met. The OCC is concerned that such CSI-based contractual conditions could create adverse impacts and pressures on the supervisory process. Accordingly, the OCC believes that inclusion of this safeguard would help to appropriately balance the need for confidentiality of the supervisory process, the appropriate separation between the

47 supervisory process and active corporate transactions, and access to the information for due diligence. The OCC believes that these proposed safeguards appropriately balance the costs and benefits of confidentiality and limited disclosure of CSI and will lead to more well￾informed business and other combination decisions – a goal that is shared by the OCC, supervised entities, and potential counterparties. Importantly, by enabling more effective due diligence, the act of sharing CSI also supports the ability of the acquirer to make a fulsome assessment of whether they have the capabilities necessary to handle any supervisory issues prior consummating a business combination. As a result, the proposal enables acquirers to be better prepared to remediate any supervisory issues at the target. The OCC invites comments on these proposed safeguards, as well as on whether (1) alternative or additional safeguards would be appropriate; (2) the rule should specify what constitutes a good faith negotiation; and (3) the proposal strikes the correct balance by not requiring a definitive agreement before sharing is permitted. Proposed § 4.14(b)(1)(v), Disclosure to a U.S.-Based Consultant and U.S.-Based Attorney of a Potential Counterparty Proposed § 4.14(b)(1)(v) would allow a supervised entity to disclose CSI to the U.S.-based consultants and U.S.-based attorneys of a potential counterparty, provided that the requirements in proposed § 4.14(b)(1)(iv) (sharing with a counterparty) are satisfied. This proposed provision is intended to recognize the business realities of the complex business and other combinations referenced in proposed § 4.14(b)(1)(iv). Based on its supervisory experience, the OCC understands that if a supervised entity can share CSI with a potential counterparty but not with that counterparty’s consultants or attorneys, then individuals who are critical to

48 evaluating the potential transaction and have a business need to know the information would not have access to relevant CSI. The OCC proposes, however, to limit this provision to U.S.-based consultants and U.S.-based attorneys. As discussed above, the OCC declined to propose this geographic location limitation when sharing CSI with affiliates. (See the discussion about proposed § 4.14(b)(1)(i)). The agency has reached a different conclusion here, however, because a supervised entity has control over whom it hires as a consultant or attorney (and there are many U.S.-based options). In contrast, a supervised entity’s affiliates are oftentimes established by a parent entity, not the supervised entity itself. When the OCC considered this fact in the context to the different levels of protection accorded to information in foreign legal regimes, challenges with enforcing confidentiality agreements in foreign jurisdictions, and the possibility of conflict between U.S. and foreign privacy laws, the agency determined that the potential risks of disclosing CSI to a foreign-based consultant or attorney outweighed the benefits. A supervised entity that wants to share CSI with a foreign-based consultant or foreign￾based attorney of a potential counterparty could seek approval, however, under proposed § 4.17, which would be assessed on a case-by-case basis. Proposed § 4.14(b)(1)(vi), Disclosure to a Not-for-Profit Entity Under this proposed provision, a supervised entity can disclose CSI to a not-for-profit entity (including a not-for-profit trade association)44 when necessary or appropriate for a supervisory purpose, if the purpose of the disclosure is to enable the not-for-profit to: (1) 44 A “trade association” is an association of tradesmen, businessmen, or manufacturers in a particular trade or industry for the protection and advancement of their common interests. See Definition of Trade Association by Merriam-Webster, https://www.merriam-webster.com/dictionary/trade%20association, last accessed June 12, 2026. For example, a banking trade association would be an organization comprised of banks for the purpose of protecting and advancing the banking industry’s common interests.

49 aggregate the anonymized CSI of entities supervised by the OCC, Board, or FDIC; and (2) either make the aggregated information publicly available or, in the case of a trade association, advocate for the best interests of its members, including with respect to the fairness, effectiveness, and efficiency of the OCC’s regulatory and supervisory processes. In addition, the supervised entity would be required to (1) have a qualifying confidentiality agreement with the not-for-profit entity; (2) have a written agreement with the entity describing in detail a discrete and time-limited information collection for purposes of either the specific information aggregation or advocacy activities; and (3) disclose no more CSI than described in the written agreement. The not-for-profit entity could not further disclose the non-anonymized CSI without OCC prior approval under proposed § 4.13(a)(1)(i)(B). Through its supervisory experience, the OCC has seen the value of aggregated data to supervised entities and other stakeholders (e.g., aggregated data public welfare investments). This information can allow interested persons to identify emerging trends, thereby directly or indirectly helping supervised entities avoid problems or lessen their effects. The OCC is, however, proposing to limit this disclosure-for-aggregation provision to not-for-profit entities for two main reasons. First, these entities are more commonly established for analysis and, particularly in the case of banking trade associations, for advocacy in support of consistent, efficient, and effective treatment of certain supervised entities, and they use this data in the service of their important role in the financial services ecosystem. For example, under this provision, supervised entities could share CSI with a not-for-profit university or think-tank that uses anonymized, aggregated data to identify, evaluate, and publish research about emerging risks

50 associated with novel technologies. This research would benefit not only individual supervised entities but the financial system and national economy as a whole. Second, a not-for-profit entity may be less likely to use the CSI in contravention of the subpart than a for-profit entity, which could use the data for its own financial benefit at the expense of the supervised entity. The OCC seeks comment on whether the provision should contain additional safeguards. For example, should the supervised entity be required to specify a particular purpose for sharing the CSI, beyond what would be required under the proposal? Should the provision expressly state that the OCC can require that the CSI be destroyed or returned if the agency determines that the specific purpose does not further the broader purpose? Are there entities not covered by this provision that should be added because of the nature of their work or their interests? The agency invites the public to comment on these issues. Other possible exceptions: The OCC is also considering other exceptions that it could add to § 4.14(b). One such exception that OCC is considering would permit a supervised entity to disclose CSI to a shareholder that owns greater than 50 percent of the voting shares of the supervised entity. The OCC believes that this type of disclosure is often important for the prompt remediation of supervisory concerns because shareholders owning the majority of the shares of a supervised entity are often intimately involved in efforts at the institution to remediate supervisory concerns. In the OCC’s experience, open, direct, and timely communication about the problems at the supervised entity is often important for the majority shareholder to provide remediation support. Moreover, understanding significant OCC concerns at the supervised entity could also be important

51 for the majority shareholder to choose directors for the supervised entity that have the proper qualifications and expertise to provide the leadership necessary to address the concerns. If the OCC did decide to include such an exception, it might require the majority shareholder to have a qualifying confidentiality agreement in place and to have a business need for the information. The OCC is seeking comment on whether it should include this exception and, if so, whether it should place additional controls on the disclosure of information to majority shareholders. Another possible exception that the OCC is considering adopting would allow a supervised entity to share CSI with another supervised entity or, possibly, with the holding company of another supervised entity, for the purpose of promoting the best interests of the financial institutions, including informing best practices or promoting government accountability. If the OCC does implement such an exception, it might require that the receiving party have a signed qualifying confidentiality agreement in place and that the supervised entity making the disclosure provides notice to the OCC after the disclosure and a copy of the CSI disclosed under this provision within 15 calendar days of making the disclosure. The OCC is seeking comment on whether such an exception would be helpful or whether it would be overly broad and permit supervised entities to pressure each other into disclosing CSI in situations that could chill candid information exchange between the OCC and its institutions. The OCC further seeks comment on whether there are other exceptions that it should adopt. Proposed § 4.14(b)(2), Disclosure of CSI to Government Agencies Proposed § 4.14(b)(2) sets forth a supervised entity’s authority to disclose CSI to certain government agencies, with three sets of requirements based on the recipient of the

52 disclosure. Specifically, the proposal would include separate requirements for a supervised entity’s disclosure of CSI to (1) the Board (which includes the Federal Reserve Banks); (2) the FDIC; and (3) an agency other than the Board or the FDIC. 45 With respect to the Board, under proposed § 4.14(b)(2)(i), a supervised entity would be permitted to disclose CSI if necessary for the Board’s performance of its statutory duties, provided the supervised entity notifies the OCC in writing of the proposed disclosure and includes a copy of the CSI it proposes to disclose.46 The OCC would have 15 calendar days after acknowledging receipt of the notice to object to the proposed disclosure. The supervised entity may disclose the CSI if the OCC does not object within 15 days or sooner or if expressly permitted to do so in writing by the OCC. The OCC could always waive the 15-day period or share the CSI itself, if appropriate, in the case of an imminent receivership or other circumstances. The proposal provides that disclosure of CSI to the Board under this provision is done with the understanding that the Board will not further disclose the information, except as otherwise permissible under this subpart. (If the Board wants to further disclose the CSI, the provisions in proposed § 4.17 would apply.) The OCC has included this provision to ensure that the current requirement for agency approval prior to sharing NPOI with the Board does not interfere with supervisory communications between the supervised entity’s Board-regulated holding company (if any) and the Board’s supervision of such holding company. The OCC recognizes the importance of timely communication with the Board, including for the Board’s 45 For the purposes of this provision, agency is defined in 5 U.S.C. 551(1) and includes “each authority of the Government of the United States.” 46 As discussed below, proposed § 4.18 describes where to send a notice of proposed disclosure.

53 compliance with section 5(c) of the Bank Holding Company and section 10(b) of the Home Owners’ Loan Act. For example, supervised entities are often asked questions by the Board for information that cannot be answered without providing CSI. Although the OCC generally approves a supervised entity’s request to disclose this information to the Board, this provision would allow for more efficient disclosure. Based on its supervisory experience, the OCC believes that the proposed 15-day period described above is appropriate. For disclosure of CSI to the FDIC, § 4.14(b)(2)(ii) of the proposal provides that a supervised entity may disclose CSI if four conditions are met. First, the supervised entity must receive a demand from the FDIC for the information. Second, the information is necessary for performance of the FDIC’s statutory duties related to its authority to carry out resolution-related activities, deposit insurance assessments, or backup supervisory activities. Third, the supervised entity notifies the OCC in writing of the demand and provides the OCC with a copy of the information disclosed. Fourth, the supervised entity may disclose the CSI if the OCC does not object within 15 days or sooner or if expressly permitted to do so in writing by the OCC. The OCC can always waive the 15-day period or share the information itself, in the case of an imminent receivership or other circumstances. Lastly, the supervised entity makes the disclosure with the understanding that the FDIC will not further disclose the information without authorization from the OCC. As with CSI disclosed to the Board, if the FDIC wants to further disclose the CSI, the provisions in proposed § 4.17 would apply. The OCC also notes that records or other information provided to the FDIC in a failing bank or other resolution-related context is

54 typically a supervised entity’s own records or other information and not CSI as defined in § 4.12(b). The OCC believes that these requirements would strike the appropriate balance between the FDIC’s need for access to CSI in the specified circumstances and the OCC’s obligation to protect the information. In making this determination, the OCC recognized that it would often know that the FDIC would need this information and why (e.g., the pending receivership of a supervised entity). For any other Federal agency,47 under proposed § 4.14(b)(2)(iii), a supervised entity can disclose CSI to an agency (1) only in response to a demand from the agency; and (2) if the supervised entity notifies the OCC in writing of the proposed disclosure and includes a copy of the CSI it proposes to disclose. The notification must include a copy of a written agreement between the supervised entity and the agency in which the agency agrees to not disclose the CSI and expressly provides that the OCC is (1) an intended third-party beneficiary of the agreement; and (b) permitted to enforce its terms through a civil action in the U.S. District Court for the District of Columbia or any other court with jurisdiction and in which venue is appropriate. The OCC would have 30 calendar days after acknowledging receipt of the notice to object to the proposed disclosure. If the OCC does not object within 30 days, the supervised entity may disclose the CSI (or sooner if expressly permitted by the OCC). If an agency wants to further disclose the CSI, the provisions in proposed § 4.17 would apply. 47 This proposed provision would apply to an agency as defined in 5 U.S.C. 551(1), other than the Board or the FDIC.

55 The OCC has included this provision in recognition that sharing CSI with a Federal agency (other than the Board and FDIC) can be necessary and appropriate and the current requirement for OCC prior approval can result in unnecessary delays. That said, the OCC proposes to include additional safeguards because the reasons for which a supervisory entity would want to share with an agency other than the Board are less obvious and more infrequent. For these reasons, the OCC believes that the proposed 30- day period described above is appropriate to provide the agency with additional time to consider the demand. The OCC is seeking comment on whether this exception should be expanded to include other circumstances or to include demands from State agencies. c. Qualifying confidentiality agreement This subsection would set out the requirements for a qualifying confidentiality agreement, as that term is used in proposed § 4.14. Specifically, a qualifying confidentiality agreement would be an agreement between a supervised entity and a person that receives CSI pursuant to § 4.14 that (1) is written; (2) states the recipient’s awareness of and agreement to abide by the prohibitions on the disclosure of CSI in § 4.13 (including the prohibition on further disclosure of the information without OCC approval); (3) is governed by the laws of the United States or a State of the United States; (4) prohibits the use of the information by the recipient for any purpose other than as permitted by the relevant provision of proposed § 4.14 (b) as expressly identified in the confidentiality agreement; (5) for recipients that are not individuals, limits access to the information at the recipient to directors, officers, or employees with a business need to know the information; (6) requires the information to be destroyed or returned to the supervised entity either at the end of the relevant relationship with the supervised entity

56 (e.g., consultancy, service provider) or at the conclusion of the purpose for which it was shared; (7) expressly provides that the OCC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action filed in the U.S. District Court for the District of Columbia and any other court having jurisdiction and venue over disputes arising from the agreement; (8) expressly provides that the OCC must be informed of any violation of the agreement by either party; and (9) for a qualifying confidentiality agreement required when CSI is disclosed to a supervised entity’s service provider, the agreement provides that the person performing the service (A) acknowledges and consents to regulation and enforcement by the OCC to the same extent as if the service was being performed by the supervised entity itself; and (B) acknowledges itself to be an institution-affiliated party as defined in 12 U.S.C. 1813(u)(4). The first criteria (in writing), third criteria (governed by domestic laws), and seventh criteria (enforceable by the OCC) would help ensure that the agreement is judicially enforceable in the event of breach. The second criteria (awareness of prohibitions on disclosure and further disclosure) and fourth criteria (limitation on use of the disclosed CSI) would help ensure that the parties to the agreement understand the purpose of and limitations on the CSI disclosure. The fifth criteria (access limited to those with need to know), sixth criteria (treatment of CSI at end of relevant relationship), eighth criteria (inform the OCC of violations of the agreement), and ninth criteria (service providers)48 would help the OCC to ensure control over the disclosed CSI, including 48 If the CSI is being disclosed by a supervised entity to allow a service provider to assist in remediating an OCC supervisory concern, only those individuals associated with the service provider who are directly involved in remediating the concern and who need to know the information to assist in the remediation may

57 when disclosed to a service provider, the purpose for which it was disclosed has ended, or the agreement is breached. In addition to inviting public comment generally on this provision, the OCC seeks feedback on whether to require that all individuals with access to the disclosed information be listed in an appendix to the agreement. The OCC also seeks comment on whether the ninth criteria is too burdensome on service providers and whether this requirement would interfere with supervised entities receiving outside assistance from service providers for remediation efforts. 6. Proposed § 4.15, Restrictions on current and former OCC employees or agents; former OTS employees or agents. Proposed § 4.15 incorporates provisions from current § 4.37(a), which set out the restrictions on current OCC and former OCC and OTS employees disclosing NPOI other than to OCC employees or agents for use in the performance of their duties, along with clarifying, conforming, and technical revisions. For example, current § 4.37(a)(2) addresses certain individuals who are “subpoenaed” for NPOI. Proposed § 4.15(b)(1) uses the defined term “demand” to clarify that the section applies to a broader category of legal processes that require information to be provided. Current § 4.37(a)(2) also states that if an individual receives a subpoena and is required to appear or produce NPOI, that individual must appear “[i]f necessary.” To address any confusion about when the individual must appear, proposed § 4.15(b)(2) replaces “[i]f necessary with “[i]f ordered by a court or otherwise compelled by law.” The changes in this proposed section are not intended to substantively alter the provisions addressed. have access to the information. The OCC intends this provision, as proposed, to prevent the release of CSI to subcontractors without OCC approval.

58 7. Proposed § 4.16, Requesting nonexempt information under the FOIA and available nonpublic information. Proposed § 4.16 primarily addresses the process for requesting the disclosure of records under the FOIA and NPOI. The provisions on disclosure under FOIA are based primarily on current § 4.15 but include the substantive changes discussed below, as well as technical and conforming edits. As proposed, § 4.16(a) explains that the disclosure of nonexempt information will be governed by the FOIA and in accordance with proposed § 4.18 (where to submit a request.) Proposed § 4.16(b) explains that NPOI that is authorized to be disclosed pursuant to proposed § 4.13(b) will be disclosed in accordance with this section. Section 4.16(c) carries forward the current rule’s exceptions for requests to disclose FDIC and other agency’s records. Proposed § 4.16(d)(1) carries over from the current rule the provisions on what a records request must include. Proposed § 4.16(d)(2) addresses the OCC’s initial determination to grant a request for information, clarifying the current rule by stating that in making this determination, the agency will only withhold information if, (1) it reasonably foresees that disclosure would harm an interest protected by an applicable exemption described in 5 U.S.C. 552(b) of the FOIA; or (2) the disclosure is prohibited by law. For consistency with other proposed provisions, § 4.16(d)(2)(iii) also provides that the OCC has the discretion to make disclosures of NPOI on a case-by-case basis. Sections 4.16(d)(3) and (4) carry over provisions from the current rule about when the OCC grants and denies a request.

59 Section 4.16(d)(5) memorializes a process for the expedited processing of requests for information that the OCC has previously followed, consistent with statutory requirements. The FOIA provides that, in connection with a request for nonexempt information, a person may request expedited processing or a waiver of the fees associated with the request.49 The statute also establishes the timeframes that apply to expedited processing, addresses appeals rights, and defines “compelling need.”50 The FOIA also directs the OCC to promulgate an implementing rule on expedited records requests and fee waivers, 51 specifying that the rule should provide for expedited processing when the requestor demonstrates a compelling need or in other cases determined by the agency.52 The OCC’s current FOIA rule does not address expedited review, although it is OCC policy to comply with the statutory time frames. 53 To comply with these provisions in the FOIA, the OCC is proposing to memorialize its expedited processing framework.54 By setting out this process in a rule, stakeholders will have a clear understanding of how the process works. Proposed § 4.16(d)(5) would codify the OCC’s existing practices for handling expeditated processing requests, and proposed § 4.16(d)(5)(ii) explains the three 49 Fees are discussed in greater detail below under proposed § 4.23. 50 5 U.S.C. 552(a)(6)(E). 51 5 U.S.C. 552(a)(6)(E)(i) and (a)(4)(A)(i). 52 5 U.S.C. 552(a)(6)(E). 53 5 U.S.C. 552(a)(6)(E)(i)(I). As noted above, the OCC proposed to amend its FOIA regulations in 2024 but the proposal was not finalized. Those amendments would have incorporated this requirement. 54 The OCC currently grants requests for expedited processing when a requestor submits a certified statement demonstrating compelling need by showing that (1) the request involves circumstances in which the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual; (2) the records requested pertain to a matter of current exigency to the public; or (3) the request involves the loss of substantial due process rights. The OCC evaluates requests against the established criteria, notifies requestors of its determination, and, when expedited processing is granted, the OCC processes the request as soon as practicable.

60 scenarios in which the OCC will grant a request. First, it will grant the request if the requestor sufficiently demonstrates that the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual. Second, it will grant the request if the requestor sufficiently demonstrates that (1) the requested records pertain to a matter of current exigency to the public; (2) a processing delay would compromise a significant recognized interest to and throughout the general public; (3) the request involves an actual or alleged Federal government activity; and (4) the requestor is primarily engaged in disseminating information. Third, it will grant a request if the requestor demonstrates that expedited review is necessary to prevent the loss of substantial due process rights, such as when delayed access to the requested records could impair the requestor’s ability to participate in an administrative or judicial proceeding. The proposed provision also explains that the OCC will (1) notify the requestor of its decision on the expediated processing request within 10 calendar days of receiving the request; (2) base its decision solely on the information in the initial request; and (3) process grants of expedited processing as soon as practicable. Finally, the proposal provides in § 4.16(d)(5)(v) and (vi) that the requestor may appeal a denial and the OCC will expeditiously consider the appeal and notify the requestor of its determination. Proposed § 4.16(e) would clarify a person’s right to appeal a denial of a request, including denials of requests for records, expedited processing, and fee waivers. Proposed §§ 4.16(f) (judicial review), 4.16(g) (time limits for responding to FOIA requests), 4.16(h) (date of receipt of request or appeal), 4.16(i) (dispute resolution

61 services), and 4.16(j) (segregability) are carried over from the current subpart B, with limited conforming, streamlining, and clarifying changes.55 8. Proposed § 4.17, Requesting non-public OCC information. Proposed § 4.17 consolidates and clarifies current §§ 4.33; 4.35(a)(3); and 4.40(b). These provisions set out the current rules for seeking disclosure of NPOI from the OCC and address form requests, expedited requests, requests arising from adversarial matters, records requests, additional information that the OCC may require, and testimony requests. The proposal also includes clarifying, conforming, and technical edits. 9. Proposed § 4.18, Where to submit a request for nonexempt information under the FOIA, a request for non-public OCC information, or a notice under this subpart. Proposed § 4.18 combines and streamlines the provisions in §§ 4.15(b) and 4.34 of current rule. The section (1) specifies where to submit a request for nonexempt information under the FOIA or a request for NPOI (including a combination of NPOI and nonexempt information); and (2) address requests for authentication of a record or notice under this subpart. These revisions are intended to reduce duplication by consolidating provisions in current subparts B and C on where to send requests and notices and make the provisions easier to use; they are not intended to include substantive changes. 10. Proposed § 4.19, Disclosing and using OCC records in litigation. Proposed § 4.19 would republish current § 4.39, which addresses disclosing and using OCC records in litigation, with minor technical and conforming changes. 55 The provisions related to the denial of fee waiver requests are addressed in the discussion of proposed § 4.23.

62 11. Proposed § 4.20, Predisclosure notice for confidential commercial information. Proposed § 4.20 incorporates the current § 4.16 provisions on predisclosure notice for confidential commercial information, specifying when the OCC would be required to notify submitters of records containing confidential commercial information that the agency received a FOIA request for the information and may be required to disclose it. The changes to this section are technical and conforming, except with respect to the definition of “confidential commercial information.” The OCC proposes to define this term as commercial or financial information obtained by the OCC from a submitter that may be exempt from disclosure under FOIA Exemption 4 (5 U.S.C. 552(b)(4)).56 This definition reflects two substantive changes from the current rule. First, it does not reference the competitive harm standard, thereby reflecting the Supreme Court’s 2019 decision the Food Marketing Institute v. Argus Leader Media (Argus). 57 In Argus, the Court overruled the longstanding substantial competitive harm standard for information provided to the government on an involuntary basis, holding that commercial or financial information submitted to the government will be considered “confidential” for purposes of FOIA Exemption 4 at least where the information is “both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy.”58 To conform the definition to Argus, the OCC is proposing to remove the requirement that disclosure of the information reasonably could cause substantial competitive harm to the submitter. Second, the 56 FOIA Exemption 4 protects trade secrets and commercial or financial information obtained from a person and privileged or confidential. 57 588 U.S. 427. 58 Id. at 440.

63 proposal replaces the term “record” in the current definition with “commercial or financial information obtained from a [submitter].”59 This change would provide a clear link between the rule and the FOIA. As a conforming amendment, the OCC also proposes to replace the term “person” (which is used in the FOIA) with the term “submitter.” 12. Proposed § 4.21, Consideration of requests for non-public OCC information. Proposed § 4.21 carries forward the provisions in current § 4.35 which address the OCC’s consideration of requests to disclose NPOI, including (1) decisions on requests; (2) the timeframe and process for responding to requests; (3) OCC employee testimony in private matters; and (4) the authorization of others to disclose the NPOI. The proposal includes conforming and clarifying changes that are not intended to be substantive. 13. Proposed § 4.22, Public inspection in an electronic format under the FOIA. Proposed § 4.22 incorporates the provisions in current § 4.14, which address the public inspection of information that the OCC makes available in an electronic format under the FOIA. The changes to this section are technical in nature and not intended to be substantive, except for the update to the address where the information discussed herein is located. 14. Proposed § 4.23, Fees for requesting nonexempt information under the FOIA. Proposed § 4.23 addresses fees for requesting nonexempt information under FOIA and carries forward the provisions in current § 4.17, with certain technical, 59 The proposed definition of “submitter” is consistent with the current rule with certain technical revisions. Specifically, “submitter” would mean a state agency, tribal agency, Federal agency, foreign government, or other person that provides confidential commercial information to the OCC.

64 conforming, and clarifying changes. For example, proposed § 4.23(b)(2) clarifies that the OCC may charge reasonable standard fees for a document search, duplication, or review to requestors of nonexempt information under the FOIA. In addition, the proposal would clarify the mandatory nature of fee waivers under the FOIA. The FOIA requires that records subject to disclosure be furnished to a requestor either at a cost below the agency’s fee schedule or free of charge when the applicable standard is met.60 However, current § 4.17(b)(4) states that the OCC “may” waive or reduce a fee when it determines the standard is met. The history of this provision is informative. In 1992, the OCC amended its FOIA rules to implement the FOIA amendments in the Freedom of Information Reform Act of 1986 (FOIRA)61 and stated in the new rule that the “[t]he OCC will waive or reduce fees” when the required standard was met. In 1995, the OCC again revised its FOIA rules, this time stating that the agency “may” waive or reduce fees.62 This change was described, however, as reorganizing and streamlining in nature and not intended to materially affect the OCC standards, policies, or procedures.63 Notably, the OCC’s practices with respect 60 Under 5 U.S.C. 552(a)(4)(A)(iii), a fee waiver must be granted when disclosure of the information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government and is not primarily in the commercial interest of the requestor. 61 See 57 FR 32415 (July 22, 1992). The preamble to the rule implementing the FOIRA stated that “the FOIRA amended the FOIA with respect to waiver or reduction of fees. Under FOIRA, documents are to be furnished without a fee or with a reduced fee if disclosure of the information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government and is not primarily in the commercial interest of the requestor. Prior to the FOIRA, the waiver or reduction of fees occurred when an agency determined that such waiver or reduction was in the public interest because furnishing the information can be considered as primarily benefiting the general public. Section 4.17(h) incorporates the OCCs new schedule for charging and waiving fees.” (internal quotes omitted). 62 See 60 FR 15705, 15708 (Mar. 27, 1995). 63 Id.

65 to fee waivers did not change in 1995, and it continued to waive fees as required by the FOIA. To address any confusion that the 1995 change caused, the OCC is now proposing to clarify the rule by aligning it with the statutory standard and the agency’s practice. Thus, proposed § 4.23(b)(4) states that the OCC “must” grant a request for a fee waiver if the applicable standard is met. The proposal would also address the right to appeal an OCC decision regarding a request for a fee waiver or reduction, which is not addressed in the agency’s current FOIA rules. While the statute does not specifically state that a fee decision can be appealed, it allows persons requesting records to appeal “adverse determinations.” 64 And, although the FOIA does not detail what constitutes an adverse determination, it specifies that in any action involving a fee waiver request, “a court shall determine the matter de novo,” which suggests that a fee decision is appealable.65 Taken together, these provisions are generally understood to provide a person with the right to appeal the denial of a fee waiver or reduction request. In fact, the FDIC, Treasury, and DOJ have rules expressly granting the right to appeal a fee waiver denial.66 In addition, the DOJ’s Office of Information Policy’s model FOIA rule provides that agencies should include in their FOIA rules an affirmative statement that the denial of a “request” – which would include a records, expedited processing, or fee waiver request – can be appealed and sets out the appeal requirements.67 64 See 5 U.S.C. 552(a)(6)(A)(i)(III)(aa). 65 5 U.S.C. 552(a)(4)(A)(vii). 66 See 12 CFR 309.5(f)(x) (FDIC); 31 CFR 1.4(h)–(i), 1.6(a) (Treasury); 28 CFR 16.6(d)–(e), 16.8(a) (DOJ). 67 See DOJ, Office of Information Policy, Template for Agency FOIA Regulations, section VI. Responses to Requests, https://www.justice.gov/oip/template-agency-foia-regulations#Responses%20to%20Requests (last updated Dec. 2, 2022).

66 After considering the statutory language and how other government agencies have interpreted it, the OCC proposes to state in § 4.23(b)(4)(iii) that a requestor may appeal the OCC's determination not to grant a request for a fee waiver or reduction. The appeal procedure would be in proposed § 4.16(e), which would (1) state that the denial of a fee waiver constitutes an adverse determination that can be appealed; and (2) set forth the OCC’s administrative appeal procedures. 15. Proposed § 4.24, Tracking requests for nonexempt information under the FOIA. Lastly, proposed § 4.24 carries forward the provisions in current § 4.18, which addresses tracking requests for nonexempt information under the FOIA. The proposed section includes technical and conforming changes, as well as updated contact information for checking the status of a request. III. Request for Comments The OCC invites the public to comment on all aspects of the proposed rule, including the following: Question 1: Are there additional considerations that the OCC should consider in determining whether or when to allow the disclosure of NPOI? Question 2: Should any of the content from the current regulation that the proposed regulation omits be reconsidered for inclusion? Question 3: Is the organization of subpart B straightforward and does it facilitate finding information? Are there any sections that are proposed to be combined that would be better separated? Are the sections in logical order, and do any provisions need to be moved from their proposed section to a different, more appropriate section?

67 Question 4: The OCC is seeking comment on its proposed definition of “service provider.” As an alternative to the proposed definition, the OCC is considering defining service provider as an entity that: (1) has a contractual relationship with a depository institution and (2) provides: (i) products or services to the institution that are used in connection with the provision of financial products or services to the depository institution’s customers; (ii) advisory or consulting services related to the management or operations of the depository institution; or (iii) technological infrastructure to the depository institution. The OCC seeks comment on which definition would be clearer. Question 5: Are the proposed definitions of CSI and NPOI appropriate? Does the proposal’s approach regarding the extent to which the OCC may assert property rights over NPOI, including CSI, strike the proper balance between permitting appropriate disclosures and ensuring the OCC has the ability to protect the confidentiality of the information? Are there alternative approaches that would more appropriately strike this balance, such as maintaining OCC property rights (1) for NPOI except when disclosed pursuant to proposed § 4.14; or (2) for all NPOI unless expressly released in response to a request for NPOI under proposed § 4.17? Question 6: Are the existing bases for denying a request for release of non-public OCC information, as reflected in proposed 12 CFR 4.21(a)(2), appropriate? Should additional bases be added or the existing bases clarified?

68 Question 7: Are the controls on the exception for disclosing CSI to service providers sufficient to prevent the disclosed information from being used for purposes not intended by the exception, such as the potential risk that service providers with greater leverage over supervised entities could force the supervised entities to provide CSI as a condition of providing services? Question 8: Should the exception for disclosing information to potential incoming senior executive officers be extended to potential board candidates or to candidates for positions not covered by the proposed definition of “senior executive officer” but which are often directly involved in and responsible for the remediation of supervisory concerns, such the chief compliance officer or chief Bank Secrecy Act officer? Should the disclosure be limited to certain categories of CSI? Question 9: Should the OCC adopt different or additional restrictions on the exception for disclosure to a potential counterparty to a business combination? For instance, should the OCC limit such authorization to three potential counterparties over a five-year period or require that the disclosure be made only to directors, officers, employees and legal counsel with a need to know the confidential information for the purposes of performing their own reasonable due diligence or other duties related to the transaction or series of transactions? Question 10: Should the OCC extend the business counterparty exception to additional types of business combinations beyond those covered by the proposed exception or to other types of corporate transactions, such as the purchase or sale of assets or other acquisitions?

69 Question 11: Should the OCC adopt an exception allowing the parent holding company of a supervised entity to disclose CSI to the same extent as the supervised entity can under the exceptions in 12 CFR 4.14(b)? For instance, should the parent holding company be allowed to disclose OCC CSI to its own service providers, affiliates, potential merger partners, etc. without prior OCC approval? Question 12: Should the OCC permit a supervised entity to disclose CSI without prior approval to another supervised entity or that entity’s holding company? If so, what safeguards should be placed on the disclosure? For example, should the OCC permit such disclosure if (1) it is for the purpose of promoting the best interests of the financial institution entities, including by informing best practices and promoting government accountability; (2) the recipient of the CSI has signed a qualifying confidentiality agreement; and (3) the disclosing entity provides the OCC with after-the-fact notice of the disclosure and a copy of the disclosed CSI? Question 13: Is it appropriate that a “qualifying confidentiality agreement” required pursuant to proposed 12 CFR § 4.14(b)(2) provide that any person performing a service for a supervised entity acknowledges and consents to regulation and examination by the OCC to the same extent as if the service was being performed by the supervised entity itself? Is this requirement too burdensome on service providers such that it would interfere with supervised entities receiving outside assistance from service providers for remediation efforts? Question 14: Should the requirements for a qualifying confidentiality agreement include that all individuals with access to the disclosed information be listed in an appendix to the agreement?

70 Question 15: Should the proposed exception allowing for disclosure of CSI by supervised entities to other agencies as defined in 5 U.S.C. 551(1) with prior notice and opportunity for the OCC to object to such disclosure be expanded to include other circumstances? Should it include demands from State agencies? Question 16: Are the exceptions for when supervised entities can disclose CSI without prior approval appropriate and useful? Should any of the exceptions be expanded? Are there other situations for which the OCC should permit supervised entities to disclose CSI without prior notice or approval? For instance, should the OCC include an exception for the disclosure of information to a shareholder that owns in excess of 50 percent of the voting stock of the institution or for supervised entities to share CSI with other supervised entities and their holding companies when necessary for reasons of government accountability? Question 17: Should the OCC require approval by the supervised entity’s board for all disclosures of CSI under the exceptions in 12 CFR 4.14(b)? Question 18: Does the proposed rule provide adequate controls to prevent its abuse? What other controls should be added that are also consistent with the balance the agency is seeking to achieve between protecting confidentiality and permitted limited disclosure? Question 19: Should the OCC publicly disclose certain CSI (e.g., matters requiring attention or ratings) once it has reached a certain age? Should this data be aggregated or anonymized before it is released? What would be the appropriate age for such data to be released? Should this disclosure be in addition to or in place of

71 permitting supervised entities’ disclosure to trade associations? Are there other types of information that the OCC should publicly disclose? Question 20: The OCC recognizes the inherent tension between the part 4 restrictions on the release of NPOI and the requirements for the disclosure of certain information in the securities laws and regulations. What changes, if any, to proposed subpart B would better reconcile this tension? Should the OCC allow banks to disclose NPOI to the SEC in the course of their regular reporting to investors and, if so, what categories of CSI should banks be able to disclose? Question 21: Should the OCC make any changes to proposed part B with respect to its treatment of NPOI from when the OTS had supervisory responsibility for Federal savings associations? IV. Regulatory Analysis A. Paperwork Reduction Act This notice of proposed rulemaking has been reviewed for compliance with the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.). In accordance with the PRA, the OCC may not conduct or sponsor, and an organization is not required to respond to, an information collection unless the information collection displays a currently valid Office of Management and Budget (OMB) control number. The OCC has reviewed the notice of proposed rulemaking and determined the action contains the following proposed amendments to the existing information collection requirements previously approved under OMB Control Number 1557-0200 as well as new information collection requirements. Pursuant to the PRA, the OCC has submitted these information collection requirements to OMB for review and approval.

72 Title: Release of Non-Public OCC Information. OMB Control No.: 1557-0200. Type of Review: Regular. Affected Public: Businesses or other for-profit, not-for-profit. Description: This information collection pertains to the reporting and recordkeeping requirements for OCC-supervised institutions and other entities subject to the requirements of 12 CFR part 4 when seeking to obtain or disclose OCC non-public information. As indicated in the Section-by-Section Discussion, the framework for the proposed rule was derived from the current rule. Information collection requirements subject to the PRA in proposed §§ 4.13(a), (c), and (e), 4.15(b), 4.17(a), (b), and (d), 4.19(d), and 4.21, are codified in current §§ 4.33(a), (b), and (d), 4.37(a) and (b), 4.38(a) and (b), and 4.39(d), and approved under OMB Control No. 1557-0200. New or amended information requirements under this proposed rule are associated with proposed modifications that would expand the ability of OCC￾supervised institutions to share CSI without prior OCC approval. Recordkeeping Requirements Proposed § 4.14(b)(1)(ii), Exceptions for supervised entities – Service provider: A supervised entity may disclose CSI without OCC approval to a service provider that has a qualifying confidentiality agreement, and for which the supervised entity keeps a log of the general categories of information being disclosed. Proposed § 4.14(b)(1)(iii), Exceptions for supervised entities – Prospective senior executive officer: A supervised entity may disclose confidential supervisory information without OCC approval to an individual that is not yet employed by the

73 supervised entity but is under consideration to serve as a senior executive officer if the individual has a qualifying confidentiality agreement. Proposed § 4.14(b)(1)(iv), Exceptions for supervised entities – Potential Counterparty: A supervised entity may disclose confidential supervisory information without OCC approval to a potential counterparty to a transaction or series of transactions involving a business combination or other combination: Agreement. If the potential counterparty agrees in writing not to reference the confidential supervisory information in any agreement with the supervised entity. Proposed § 4.14(b)(1)(v), Exceptions for supervised entities – Potential Counterparty: A supervised entity may disclose confidential supervisory information without OCC approval to the U.S.-based consultant or U.S.-based attorney of a potential counterparty: Agreement. If the U.S.-based consultant or U.S.-based attorney to which the supervised entity discloses confidential supervisory information has a qualifying confidentiality agreement with the supervised entity. Proposed § 4.14(b)(1)(vi), Exceptions for supervised entities – Not-for￾Profit/Trade Association: A supervised entity may disclose confidential supervisory information without OCC approval to a not-for-profit entity, including a trade association: Agreement. If the receiving not-for-profit entity has signed a qualifying confidentiality agreement, and the supervised entity and the not-for-profit entity have a written agreement describing in detail a discrete and time-limited (not to exceed three months) collection of information for purposes of the specific aggregation of information or advocacy activities. Reporting Requirements

74 Proposed § 4.14(b)(1)(iv), Exceptions for supervised entities – Potential Counterparty: A supervised entity may disclose confidential supervisory information without OCC approval to a potential counterparty to a transaction or series of transactions involving a business combination or other combination: Acknowledgement. If the OCC receives written acknowledgement from the potential counterparty regarding the purpose and use of the confidential supervisory information. Waiver. If the OCC receives a written waiver from the potential counterparty of any and all potential claims the potential counterparty may have against the OCC arising from the confidential supervisory information. Proposed § 4.14(b)(2)(i), Disclosure to a government agency – Federal Reserve: A supervised entity may disclose confidential supervisory information to the Federal Reserve if the supervised entity notifies the OCC in writing of its proposed disclosure of confidential supervisory information and the notification includes a copy of the confidential supervisory information proposed to be disclosed. Proposed § 4.14(b)(2)(ii), Disclosure to a government agency – Federal Deposit Insurance Corporation (FDIC): A supervised entity may disclose confidential supervisory information to the FDIC if the supervised entity receives a demand and notifies the OCC in writing of its proposed disclosure of confidential supervisory information and the notification includes a copy of the confidential supervisory information proposed to be disclosed. Proposed § 4.14(b)(2)(iii), Disclosure to an agency – Other than the Federal Reserve or FDIC: A supervised entity may disclose confidential supervisory information to an agency as defined in 5 U.S.C. 551(1) if the supervised entity notifies the OCC in

75 writing of its proposed disclosure of confidential supervisory information; the notification includes a copy of the confidential supervisory information proposed to be disclosed; and the notification includes a copy of a written agreement between the supervised entity and the agency in which the agency agrees to not disclose the confidential supervisory information and expressly provides that the OCC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action. The OCC’s estimated burden hours reflect total hours associated with retained information collection requirements in part 4, as well as the proposed requirements. In calendar year 2025, the OCC received 102 CSI-related requests. The estimated burden hours are based on those historical requests received, along with a slight increase in anticipated respondents due to the proposed expanded exceptions. The OCC seeks comments on the proposed information collection. Estimated Frequency of Response: On occasion. Estimated Number of Respondents: 114. Estimated Total Annual Burden: 442 hours. Comments submitted in response to this notice will be summarized and included in the request for OMB approval. All comments will become a matter of public record. Comments are invited on: (a) Whether the collection of information is necessary for the proper performance of the functions of the OCC, including whether the information has practical utility; (b) The accuracy of the OCC's estimate of the burden of the collection of information;

76 (c) Ways to enhance the quality, utility, and clarity of the information to be collected; (d) Ways to minimize the burden of the collection on respondents, including through the use of automated collection techniques or other forms of information technology; and (e) Estimates of capital or start-up costs and costs of operation, maintenance, and purchase of services to provide information. B. Regulatory Flexibility Act As part of our analysis, the OCC considers whether the proposed rule would have a significant economic impact on a substantial number of small entities, pursuant to the Regulatory Flexibility Act. The OCC currently supervises approximately 602 small entities, all of which would be subject to the proposed rule.68 In general, the OCC classifies the economic impact on an individual small entity as significant if the total estimated impact in one year is greater than 5 percent of the small entity’s total annual salaries and benefits or greater than 2.5 percent of the small entity’s total non-interest expense. Furthermore, the OCC considers 5 percent or more of OCC-supervised small entities to be a substantial number. Thus, at present, 30 OCC￾supervised small entities would constitute a substantial number. Though all small OCC-supervised institutions would be subject to the rule, we 68 The OCC bases its estimate of the number of small entities on the Small Business Administration’s size thresholds for commercial banks and savings institutions, and trust companies, which are $850 million and $47 million, respectively. Consistent with the General Principles of Affiliation 13 CFR 121.103(a), we count the assets of affiliated financial institutions when determining if we should classify an OCC￾supervised institution as a small entity. The OCC uses December 31, 2025, to determine size because a “financial institution’s assets are determined by averaging the assets reported on its four quarterly financial statements for the preceding year.” See footnote 8 of the U.S. Small Business Administration’s Table of Size Standards.

77 believe the rule would be a potential net cost savings to small OCC-supervised banks, not a net cost.69 Therefore, the OCC believes that, if implemented, the proposed rule would not have a significant economic impact on a substantial number of OCC-supervised small entities. The OCC also considers the potential impacts of the rulemaking on small non￾OCC-bank entities that may be a recipient of CSI shared by an OCC bank. Service providers, potential incoming senior executive officers, potential merger and consolidation counterparties, and OCC-supervised bank holding companies would be subject to additional costs under the proposed rule. Given the number of entities this may include, it is possible that the rule would impact a substantial number of small non-bank entities. Costs on these small non-bank entities include those pertaining to reviewing and signing a QCA for all four categories; a written contract requirement for service providers; and a written acknowledgement regarding due diligence, a written waiver of claims against the OCC, and a written confirmation not to reference the CSI in transaction agreements from each potential counterparty. Not-for-profits would also incur costs to review and sign a written agreement with an OCC bank for each CSI sharing instance. However, the OCC expects the costs associated with these collective requirements would be, at most, a few hours to several days’ worth of time and resources. 69 5 U.S.C. 603(b) describes the elements that are to be considered when conducting an initial regulatory flexibility analysis (IRFA). Particularly relevant is 5 U.S.C. 603(b)(4), which specifies the type of impacts that agencies should account for in any IRFA include “…projected reporting, recordkeeping and other compliance requirements of the proposed rule, including an estimate of the classes of small entities which will be subject to the requirement and the type of professional skills necessary for preparation of the report or record.” A narrow economic understanding of this language is to only account for administrative costs related to ensuring compliance with a rulemaking. A broader economic understanding of this language is to account for any and all direct costs that may be incurred to ensure compliance with a rulemaking. We use the broader understanding here and believe RFA impact to mean any and all direct costs of ensuring compliance with a given rulemaking.

78 Therefore, the OCC believes the proposed rule would not have a significant economic impact on a substantial number of small non-OCC entities. Last, the OCC consider the implications of the proposed changes to FOIA processes on the general public. The public incurs compliance costs if they elect to appeal a denied expedited processing request or a fee waiver denial. However, the OCC expects that these compliance costs to submit an appeal would be low. Furthermore, OCC FOIA data from the last five calendar years suggests the counts of potential denials are extremely low. Therefore, the OCC expects that the proposed rule would not have a significant economic impact on a substantial number of small entities of the general public. C. Unfunded Mandates Reform Act The OCC has analyzed the proposed rule under the factors in the Unfunded Mandates Reform Act of 1995 (UMRA).70 Under this analysis, the OCC considered whether the proposed rule includes a Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year, ($193 million as adjusted annually for inflation). Pursuant to section 202 of the UMRA,71 if a proposed rule meets this UMRA threshold, the OCC would need to prepare a written statement that includes, among other things, a cost-benefit analysis of the proposal. There are no mandated costs associated with the proposed rule. Therefore, there are no UMRA costs associated with the proposed rule, as it would not result in an 70 2 U.S.C. 1531 et seq. 71 2 U.S.C. 1532.

79 expenditure of $193 million or more annually by state, local, and tribal governments, or by the private sector. D. Riegle Community Development and Regulatory Improvement Act of 1994 Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act of 1994, 12 U.S.C. 4802(a), in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, the agencies will consider, consistent with principles of safety and soundness and the public interest: (1) any administrative burdens that the proposed rule would place on depository institutions, including small depository institutions and customers of depository institutions; and (2) the benefits of the proposed rule. The OCC requests comment on any administrative burdens that the proposed rule would place on depository institutions, including small depository institutions, and their customers, and the benefits of the proposed rule that the agencies should consider in determining the effective date and administrative compliance requirements for a final rule. E. Providing Accountability Through Transparency Act of 2023 The Providing Accountability Through Transparency Act of 202372 requires that a notice of proposed rulemaking include the internet address of a summary of not more than 100 words in length of a proposed rule, in plain language, that shall be posted on the internet website www.regulations.gov. The OCC is proposing to amend its regulations governing the disclosure of OCC information to streamline the regulation, provide for more efficient business operations 72 5 U.S.C. 553(b)(4).

80 by OCC supervised entities, and promote government transparency and accountability, as well as other minor amendments. The proposal and the required summary can be found for the OCC at https://www.regulations.gov by searching for Docket ID OCC-2026-0133 and https://occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/index￾proposed-issuances.html. F. Executive Order 12866 (as amended) Executive Order 12866, titled “Regulatory Planning and Review,” as amended, requires the Office of Information and Regulatory Affairs (OIRA), OMB, to determine whether a proposed rule is a “significant regulatory action” prior to the disclosure of the proposed rule to the public. If OIRA finds the proposed rule to be a “significant regulatory action,” Executive Order 12866 requires the OCC to conduct a cost-benefit analysis of the proposed rule and for OIRA to conduct a review of the proposed rule prior to publication in the Federal Register. Executive Order 12866 defines a “significant regulatory action” to mean a regulatory action that is likely to (1) have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, the President’s priorities, or the principles set forth in Executive Order 12866.

81 OIRA has determined that this proposed rule is not a significant regulatory action under section 3(f)(1) of Executive Order 12866 and, therefore, is not subject to review under Executive Order 12866. G. Executive Order 14192 Executive Order 14192, titled ‘‘Unleashing Prosperity Through Deregulation,’’ was issued on January 31, 2025. Section 3(a) of Executive Order 14192 requires an agency, unless prohibited by law, to identify at least ten existing regulations to be repealed when the agency publicly proposes for notice and comment or otherwise promulgates a new regulation. In furtherance of this standard, section 3(c) of Executive Order 14192 requires that the new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least ten prior regulations. The OCC expects the proposal, if finalized, will be a deregulatory action under Executive Order 14192 because it would result in potential cost savings for OCC￾supervised banks. List of Subjects 12 CFR Part 4 Administrative practice and procedure, Freedom of information, Individuals with disabilities, Minority businesses, organization and functions (Government agencies), Reporting and recordkeeping requirements, Women. 12 CFR Part 5 Administrative practice and procedure, National banks, Reporting and recordkeeping requirements, Savings associations, Securities.

82 12 CFR Part 7 Bonds, Computer technology, Credit, Insurance, Investments, Metals, National banks, Reporting and recordkeeping requirements, Savings associations, Securities, Surety bonds, Usury. 12 CFR Part 21 Crime, Currency, National banks, Reporting and recordkeeping requirements, Security measures. 12 CFR Part 163 Accounting, Administrative practice and procedure, Advertising, Conflicts of interest, Crime, Currency, Investments, Mortgages, Reporting and recordkeeping requirements, Savings associations, Surety bonds. Authority and Issuance For the reasons set forth in the preamble, the OCC proposes to amend chapter I of title 12 of the Code of Federal Regulations as follows: PART 4—ORGANIZATION AND FUNCTIONS, AVAILABILITY AND RELEASE OF INFORMATION, CONTRACTING OUTREACH PROGRAM, POST-EMPLOYMENT RESTRICTIONS FOR SENIOR EXAMINERS

1. The authority citation for part 4 is revised to read as follows: Authority: 5 U.S.C. 301, 552; 12 U.S.C. 1, 93a, 161, 481, 482, 484(a), 1442, 1462a, 1463, 1464 1817(a), 1818, 1820, 1821, 1831m, 1831p-1, 1831o, 1833e, 1867, 1951 et seq., 2601 et seq., 2801 et seq., 2901 et seq., 3101 et seq., 3401 et seq., 4806, 5321, 5412, 5414; 15 U.S.C. 77uu(b), 78q(c)(3); 18 U.S.C. 641, 1905, 1906; 29 U.S.C. 1204; 31 U.S.C. 5318(g)(2), 9701; 42 U.S.C. 3601; 44 U.S.C. 3506, 3510; E.O. 12600 (3 CFR, 1987 Comp., p. 235).
2. Revise subpart B to read as follows: Subpart B—Availability of OCC Information Sec.

83 4.10 Purpose and scope. 4.11 Definitions. 4.12 Disclosure of OCC information in general; categories of OCC information. 4.13 Disclosure of non-public OCC information or confidential supervisory information, in general. 4.14 Disclosure of confidential supervisory information by recipient. 4.15 Restrictions on current and former OCC employees or agents; former OTS employees or agents. 4.16 Requesting nonexempt information under the FOIA and available non-public information. 4.17 Requesting non-public OCC information. 4.18 Where to submit a request for nonexempt information under the FOIA, a request for non-public OCC information, or a notice under this subpart. 4.19 Disclosing and using OCC records in litigation. 4.20 Predisclosure notice for confidential commercial information. 4.21 Consideration of requests for non-public OCC information. 4.22 Public inspection in an electronic format under the FOIA. 4.23 Fees for requesting nonexempt information under the FOIA. 4.24 Tracking requests for nonexempt information under the FOIA. § 4.10 Purpose and scope. (a) Purpose. The purposes of this subpart are to: (1) Set forth the standards, policies, and procedures that the OCC applies in administering the Freedom of Information Act (FOIA) (5 U.S.C. 552) to facilitate the OCC’s interaction with supervised entities and the public. (2) Afford an orderly mechanism for the OCC to: (i) Process expeditiously requests for limited disclosure of non-public OCC information to specific entities; (ii) Address the disclosure of non-public OCC information without a request; and (iii) When appropriate, assert evidentiary privileges in litigation. (3) Recognize the public’s interest:

84 (i) In obtaining access to relevant and necessary information, including to allow greater insight into the supervisory process and, in turn, greater government accountability; and (ii) Of maintaining the effectiveness of the OCC supervisory process through appropriate confidentiality of OCC supervisory information. (4) Recognize supervised entities’ interest in efficient disclosure of confidential supervisory information without a request when necessary or appropriate for a business purpose or other purpose listed in this paragraph (a). (5) Ensure that OCC information is used in a manner that supports the public interest and the interests of the OCC. (6) Ensure that OCC resources are used in the most efficient manner consistent with the OCC’s statutory mission. (7) Minimize burden on supervised entities, the public, and the OCC. (8) Limit the expenditure of government resources for private purposes. (9) Maintain the OCC’s impartiality among private litigants. (10) Recognize the importance of confidentiality to supervised entities and the OCC’s supervisory process. (11) Further the common interest in frank discussions of supervisory concerns regarding a supervised entity between it, the OCC, and potential counterparties to business combinations. (12) Further the common interest in the iterative and informal supervisory process of comment by the OCC and response by a supervised entity that exists on a general level

85 between the OCC and all its supervised entities, and in certain circumstances, those representing the interests of those entities. (b) Exclusions from scope. This subpart does not apply to: (1) A request for records pursuant to the Privacy Act of 1974 (5 U.S.C. 552a). A person requesting records from the OCC pursuant to the Privacy Act should refer to 31 CFR part 1, subpart C, and appendix J of subpart C of this part. (2) A request for a record or testimony in a proceeding in which the OCC is a party. (3) The OCC’s decision to disclose records or testimony involving a Suspicious Activity Report (SAR) filed pursuant to the rules implementing 12 U.S.C. 5318(g), or any information that would reveal the existence of a SAR. (4) A request outside of the FOIA for a record from Congressional committees or current members of Congress, including pursuant to a congressional subpoena and any other formal or informal process for requesting records. (5) Requests for non-public OCC information filed with the Office of Thrift Supervision (OTS) before July 21, 2011. These requests are subject to the rules of the OTS in effect on July 20, 2011. § 4.11 Definitions. For purposes of this subpart: Affiliate means any person that controls, is controlled by, or is under common control with another company, and includes any employee, officer, director, or agent thereof. An affiliate of a branch or agency of a foreign bank also includes the foreign bank.

86 Confidential supervisory information has the meaning set forth in § 4.12(b). Control means: (1) The person directly or indirectly or acting through one or more other persons owns, controls, or has power to vote 25 percent or more of any class of voting securities of the supervised entity; (2) The person controls in any manner the election of a majority of the directors or trustees of the supervised entity; or (3) The OCC determines, after notice and opportunity for hearing, that the person directly or indirectly exercises a controlling influence over the management or policies of the supervised entity. Complete request means a request containing sufficient information to allow the OCC to make an informed decision. Demand means a written request, subpoena, order, motion to compel, civil investigative demand, search warrant, or other judicial or administrative process to provide information covered by this subpart. Disclose, with respect to information, means to directly or indirectly make information available in any manner, including any action or inaction that causes or permits access to the information. Government agency means an agency, other than the OCC or OTS, of the federal, a state, a tribal, or a foreign government and any person officially connected with the agency, such as employee, officer, director, or agent thereof. Nonexempt information means information, including a record or a portion of a record, that does not meet the definition of non-public OCC information.

87 Non-public OCC information (1) means a record, or portion of a record, that the OCC may withhold from disclosure under the FOIA (5 U.S.C. 552(b)). (2) Notwithstanding paragraph (1), non-public OCC information does not include final orders, amendments, or modifications of final orders, or other actions or documents that (i) are specifically required to be published or disclosed to the public pursuant to 12 U.S.C. 1818(u) or 12 U.S.C. 2906 or (ii) the OCC is specifically required to publish, publicly disclose, or otherwise make available to the public pursuant to other applicable laws or rules. Person means an individual, company, trust, joint venture, pool, syndicate, sole proprietorship, unincorporated organization, or any other form of entity (other than the OCC or OTS), and any person officially connected with the person (other than the OCC or OTS), such as employee, officer, director, or agent thereof. Predecessor agency means, with respect to the OCC, the Office of Thrift Supervision (OTS), or Federal Home Loan Bank Board or any other predecessor to these agencies. Qualifying confidentiality agreement has the meaning set forth in § 4.14(c). Record has the meaning provided at 5 U.S.C. 552(f)(2). Relevant means could contribute substantially to the resolution of one or more specifically identified issues in the case or matter. Service provider means an unaffiliated person, and includes any employee, officer, director, or agent thereof, hired by or partnered with the supervised entity to perform specific, specialized functions for or on behalf of the supervised entity related to the supervised entity’s operations or provision of services. This includes persons

88 performing consulting services, legal services, and auditing services. This does not include customers or financial counterparties. Show a compelling need means, in support of a request for testimony, demonstrate with as much detail as is necessary under the circumstances, that the requested information is relevant and that the relevant information contained in the testimony is not available from any other source. Sources, without limitation, include the books and records of other persons or entities and non-public OCC information that have been, or might be, disclosed. Supervised entity means: (1) A national bank or Federal savings association, a subsidiary of a national bank or Federal savings association, or a Federal branch or agency of a foreign bank licensed by the OCC as defined under 12 CFR 28.11(g) and (h), any permitted payment stablecoin issuer or foreign payment stablecoin issuer for whom the OCC has regulatory or enforcement authority pursuant to the Guiding and Establishing National Innovation for U.S. Stablecoins Act (12 U.S.C. 5901 et seq.), or any other entity supervised by the OCC; and (2) Any individual officially connected with the entity, such as employee, officer, director, or agent thereof. Testimony means a transcribed interview or a sworn statement regardless of it being provided orally or in writing and regardless of it being provided before a court, another tribunal, or another officer (e.g., at a deposition). Unusual circumstances has the meaning provided at 5 U.S.C. 552(a)(6)(B)(iii).

89 § 4.12 Disclosure of OCC information, in general; categories of OCC information. (a) General. The OCC will disclose an OCC record to a supervised entity, government agency, or other person in accordance with this subpart. (1) The OCC will disclose nonexempt information contained in an OCC record to a supervised entity, government agency, or other person upon specific request in accordance with § 4.16 of this subpart and the FOIA. (2) The OCC will not disclose non-public OCC information, including confidential supervisory information, other than as provided in this subpart or otherwise required by law. (b) Confidential supervisory information. (1) Confidential supervisory information is non-public OCC information that is exempt from disclosure under: (i) FOIA Exemption 5 (5 U.S.C. 552(b)(5)) in connection with the bank examination privilege; or (ii) FOIA Exemption 8 (5 U.S.C. 552(b)(8)). (2) Confidential supervisory information includes: (i) A record created or obtained: (A) By the OCC in connection with the OCC’s performance of its responsibilities, such as a record concerning supervision, licensing, regulation, and examination of a supervised entity; or (B) By the OTS in connection with the OTS’s performance of its responsibilities, such as a record concerning supervision, licensing, regulation, and examination of a Federal savings association, a savings and loan holding company, or an affiliate of either of the foregoing;

90 (ii) A record compiled by the OCC or the OTS in connection with either agency’s enforcement responsibilities; (iii) A report of examination, supervisory correspondence, an investigatory file compiled by the OCC or OTS in connection with an investigation, and any internal agency memorandum, whether the information is in the possession of the OCC or another person; and (iv) A sworn statement or deposition testimony from a current or former OCC employee, officer, or agent or a former OTS employee, officer, or agent concerning information acquired by that person in the course of his or her performance of official duties with the OCC or OTS or due to that person’s official status at the OCC or OTS. (3) Notwithstanding paragraph (b)(1) of this section, confidential supervisory information does not include information created or collected by a supervised entity for its own business purposes that is: (i) In its own possession; (ii) Not prepared for the OCC, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, or Consumer Financial Protection Bureau in response to the applicable agency’s supervisory or enforcement activities; and (iii) Not supervisory feedback from the OCC, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, or Consumer Financial Protection Bureau or information on enforcement activities of any of these agencies, including summaries of such information; (c) Non-public OCC information and confidential supervisory information obtained by third parties.

91 (1) Non-public OCC information obtained by a third party or otherwise incorporated in the records of a third party, including another government agency, remains non-public OCC information. (2) Confidential supervisory information obtained by a third party or otherwise incorporated in the records of a third party, including another government agency, remains confidential supervisory information. § 4.13 Disclosure of non-public OCC information or confidential supervisory information, in general. (a) Unauthorized disclosure of non-public OCC information prohibited. (1) A supervised entity, government agency, or other person to whom non-public OCC information is disclosed may not further disclose— (i) Confidential supervisory information unless (A) The disclosure is otherwise permitted by this subpart; (B) The supervised entity, government agency, or other person has received the prior written permission of the OCC to disclose the confidential supervisory information; or (C) The disclosure is in published statistical material or an anonymized anecdote that does not disclose, either directly or when used in conjunction with other publicly available information, the affairs of any person. (ii) Non-public OCC information that is not confidential supervisory information, to the extent the OCC prohibited the further disclosure as a condition of disclosing the non-public OCC information.

92 (iii) Notwithstanding paragraphs (a)(1)(i) and (ii) of this section, a supervised entity, government agency, or other person to whom non-public OCC information is disclosed may further disclose the non-public OCC information when ordered by a federal court in a judicial proceeding in which the OCC has had the opportunity to appear and oppose the disclosure. (2) No supervised entity, government agency, or other person that (i) Obtains access to non-public OCC information that is prohibited from further disclosure under this paragraph may disclose the information to another person except as authorized by the subpart or otherwise by the OCC. (ii) Obtains access to non-public OCC information that is not authorized either by this subpart or otherwise by the OCC may further disclose or make a copy of the information. (3) If the OCC determines that a supervised entity, government agency, or other person has obtained access to, as provided in paragraph (a)(2), or is disclosing non-public OCC information, including confidential supervisory information, pursuant to this subpart for reasons other than the purpose provided in the relevant provision or otherwise in contravention of the objectives of this subpart, the OCC maintains the discretion to (i) Order the cessation of use of the disclosed non-public OCC information; and (ii) Require that all of the disclosed non-public OCC information is returned to the OCC or require the disclosed non-public OCC information to be destroyed. (b) Discretionary disclosure of non-public OCC information by the OCC. (1) Notwithstanding any other provisions in this subpart, the OCC may disclose or permit the further disclosure of non-public OCC information to a supervised entity,

93 government agency, or other person if, in the sole discretion of the OCC, disclosure may be necessary or appropriate, with or without a request for information under § 4.17. (2) In responding to a request for information under § 4.16, the OCC will not withhold from release records that were created or received 25 years or more before the date on which the records were requested on the grounds that they contain non-public OCC information unless the OCC determines there is good cause to withhold the record. The OCC may determine that good cause exists if disclosure conflicts with the purposes of this subpart as set out in § 4.10 or is otherwise prohibited by law. (3) The OCC’s decision to make a disclosure under paragraph (b)(1) of this section has no precedential significance to any other record or request. (c) Conditions and limitations. (1) The OCC may impose any conditions or limitations, including those described in paragraphs (c)(2) through (c)(4) of this section, on disclosures of non-public OCC information that it determines are necessary to give effect to the purposes of this subpart. (2) The OCC may condition approval for disclosure of non-public OCC information on the entry of a protective order by the court or administrative tribunal presiding in the particular case or, in non-adversarial matters, on a written agreement of confidentiality. (3) In a case in which a protective order has already been entered, the OCC may condition approval for disclosure of non-public OCC information on the inclusion of additional or amended provisions in the protective order. (4)(i) Whenever the OCC authorizes a deposition testimony, the OCC may

94 (A) Condition its authorization of deposition testimony on an agreement of the parties to appropriate limitations, such as an agreement to keep the transcript of the testimony under seal or to make the transcript available only to the parties, the court, and the jury. (B) Upon request or on its own initiative, allow use of a transcript in other litigation. (C) Require the person making the request under (c)(4)(i)(B) to furnish the OCC with a copy of a transcript, at the person’s expense. (ii) The OCC employee whose deposition was transcribed does not waive his or her right to review the transcript and to note errors. (d) Nature of non-public OCC information. (1) Non-public OCC information, in general. (i) All non-public OCC information is the property of the OCC to the extent that the OCC is in possession of the information. (ii) All non-public OCC information that a supervised entity, government agency or other person receives, regardless of whether such disclosure is authorized by this subpart, is the property of the OCC to the extent that the information is restricted from further disclosure under this subpart. (2) Confidential supervisory information. (i) For confidential supervisory information subject to the bank examination privilege, only the OCC can waive that privilege. (ii) Confidential supervisory information remains confidential supervisory information whether the supervised entity is operating or no longer operating.

95 (e) Duty of person served. Any person, other than a current or former OCC or OTS employee as discussed in § 4.15, served with a demand must: (1) Immediately notify the OCC as set forth in § 4.18(b) and inform the OCC of all relevant facts, including the documents and information requested, so that the OCC may intervene in the judicial or administrative action if appropriate; (2) Inform the requester of the substance of these rules and, in particular, of the obligation to follow the request procedures in § 4.17; and (3) At the appropriate time, inform the court or tribunal that issued the process of the substance of these rules. (f) Intention of OCC not to waive rights. The possession by any supervised entity, government agency, or other person of non-public OCC information as permitted by this subpart does not constitute a waiver by the OCC of its right to control, or impose limitations on, the subsequent use and disclosure of the information. § 4.14 Disclosure of confidential supervisory information by recipient. (a) OCC’s disclosure of confidential supervisory information. The OCC may disclose confidential supervisory information: (1) About a supervised entity to that supervised entity; (2) To a government agency, unless prohibited by law; or (3) As otherwise permitted under this subpart. (b) Supervised entity’s disclosure of confidential supervisory information. (1) Disclosure to persons other than government agencies. When necessary or appropriate for the efficacy of the supervision process, a supervised entity may disclose confidential supervisory information without OCC approval to:

96 (i) An affiliate of the supervised entity. (ii) A service provider: (A) That is incorporated in the United States, including any territory of the United States; (B) That has a business need for the information; (C) That has a formal agreement with, or is under a written contract to provide services to, the supervised entity; (D) That has a qualifying confidentiality agreement; and (E) For which the supervised entity keeps a log of the general categories of information being disclosed under (b)(ii) of this section. (iii) A person that is not yet employed by the supervised entity or the supervised entity’s top-tier holding company but that is under consideration to serve as a senior executive officer (i.e., the president, chief executive officer, chief operating officer, chief financial officer, chief lending officer, chief investment officer, chief risk officer, and any other individual the OCC identifies in writing) of the supervised entity or the supervised entity’s top-tier holding company, if all of the following three conditions are met: (A) The individual has a qualifying confidentiality agreement. (B) The supervised entity does not disclose information under this subsection with more than one potential candidate at a time per open position. The supervised entity or the supervised entity’s top-tier holding company must have formally terminated hiring discussions with a potential senior executive officer before the supervised entity can make a disclosure under this subsection to another potential candidate for the same position.

97 (C) The Board of the supervised entity has approved the sharing of the information with the potential candidate. (iv) A potential counterparty to a transaction or series of transactions involving a business combination or other combination described in 12 CFR 5.33(d)(2)(i), (ii), (iii), or (iv) or (d)(10)(i) or (ii) if the: (A) Potential counterparty is engaged in good faith negotiations regarding the potential transaction or series of transactions with the supervised entity; (B) Supervised entity provides the confidential supervisory information to the potential counterparty solely to enable each person to perform reasonable due diligence or other duties related to the transaction or series of transactions; (C) Potential counterparty to which the supervised entity discloses confidential supervisory information has a qualifying confidentiality agreement with the supervised entity; (D) OCC receives written acknowledgement from the potential counterparty that the confidential supervisory information was not created for the purpose of aiding in due diligence of the potential counterparty and that the potential counterparty will perform its own diligence and make its own financial decisions regarding the transaction or series of transactions; (E) OCC receives a written waiver from the potential counterparty of any and all potential claims the potential counterparty may have against the OCC arising from the confidential supervisory information, including the accuracy and completeness thereof;

98 (F) Supervised entity has not disclosed confidential supervisory information under this paragraph to three or more other potential counterparties to the transaction or series of transactions; and (G) Potential counterparty agrees in writing not to reference the confidential supervisory information in any agreement with the supervised entity or any affiliate of the supervised entity. (v) U.S.-based consultants and U.S.-based attorneys of a potential counterparty identified in paragraph (b)(iv) of this section if: (A) The supervised entity is permitted to share the confidential supervisory information with the potential counterparty pursuant to paragraph (b)(iv) of this section; and (B) The U.S.-based consultant or U.S.-based attorney of the potential counterparty to which the supervised entity discloses confidential supervisory information has a qualifying confidentiality agreement with the supervised entity. (vi) A not-for-profit entity, including a trade association, if: (A) The disclosure is for the purpose of enabling the not-for-profit entity to anonymize and aggregate confidential supervisory information about the supervised entity with confidential supervisory information about other entities supervised by the OCC, Board of Governors of the Federal Reserve System, or Federal Deposit Insurance Corporation and making such aggregated information publicly available or, in the case of a trade association, advocating for the best interests of the members of the trade association, including with respect to the fairness, effectiveness, and efficiency of the OCC’s regulatory and supervisory processes;

99 (B) The supervised entity has a qualifying confidentiality agreement with the not￾for-profit entity; (C) The supervised entity and the not-for-profit entity have a written agreement describing in detail a discrete and time-limited (not to exceed three months) collection of information for purposes of the specific aggregation of information or advocacy activities; and (D) The confidential supervisory information disclosed is no more than what is described in the written agreement. (2) Disclosure of confidential supervisory information to government agencies. (i) A supervised entity may disclose confidential supervisory information to the Federal Reserve (i.e., the Board of Governors of the Federal Reserve System and the Reserve Banks) if: (A) The disclosure is necessary for performance of the statutory duties of the Board of Governors of the Federal Reserve System; (B) The supervised entity notifies the OCC in writing of its proposed disclosure of confidential supervisory information as provided in § 4.18(b); (C) The notification includes a copy of the confidential supervisory information proposed to be disclosed; (D) The supervised entity has not received the OCC’s objection to the proposed disclosure within 15 calendar days of the OCC’s acknowledgement of receipt of the proposed disclosure or such shorter period as specified in writing by the OCC; and (E) The disclosure is made with the understanding that the Federal Reserve will not further disclose the confidential supervisory information outside of the Federal

100 Reserve, other than as permitted under this subpart. (ii) A supervised entity may disclose confidential supervisory information to the Federal Deposit Insurance Corporation if: (A) The supervised entity receives a demand from the Federal Deposit Insurance Corporation for the confidential supervisory information; (B) The confidential supervisory information is necessary for performance of the Federal Deposit Insurance Corporation’s statutory duties related to its authority to carry out resolution-related activities, deposit insurance assessments, or backup supervisory activities; (C) The supervised entity notifies the OCC in writing of the demand for disclosure of the confidential supervisory information as provided in § 4.18(b); (D) The notification includes a copy of the confidential supervisory information disclosed to the Federal Deposit Insurance Corporation; (E) (1) The supervised entity has not received the OCC’s objection to the proposed disclosure within 15 calendar days of the OCC’s acknowledgement of receipt of the proposed disclosure, or (2) The OCC has provided blanket approval or has waived this requirement and communicated such approval or waiver in writing to the supervised entity; and (F) The supervised entity makes the disclosure with the understanding that the Federal Deposit Insurance Corporation will not further disclose the confidential supervisory information without authorization from the OCC. (iii) A supervised entity may disclose confidential supervisory information to an agency as defined in 5 U.S.C. 551(1) other than as provided in paragraph 4.14(b)(2)(i)

101 and (ii), under a demand from the agency if: (A) The supervised entity notifies the OCC in writing of its proposed disclosure of confidential supervisory information as provided in § 4.18(b); (B) The notification includes a copy of the confidential supervisory information proposed to be disclosed; (C) The notification includes a copy of a written agreement between the supervised entity and the agency in which the agency agrees to not disclose the confidential supervisory information and expressly provides that the OCC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action filed in the U.S. District Court for the District of Columbia and any other court having jurisdiction and venue over disputes arising from the agreement; and (D) The supervised entity has not received the OCC’s objection to the proposed disclosure within 30 calendar days of the OCC’s acknowledgement of receipt of the proposed disclosure or such shorter period as specified in writing by the OCC regarding the specific demand. (c) Qualifying confidentiality agreement. Qualifying confidentiality agreement means an agreement between a supervised entity and a person that receives confidential supervisory information pursuant to § 4.14(b) that:

102 (1) Is written; (2) States the recipient’s awareness of, and agreement to abide by, the prohibition on the disclosure of confidential supervisory information contained in § 4.13, including the prohibition on further disclosure of the information without OCC approval in § 4.13(a)(1); (3) Is governed by the laws of the United States or a State of the United States; (4) Prohibits the use of the information by the recipient for any purpose other than as permitted by the relevant provision of paragraph (b) of this section, as expressly identified in the confidentiality agreement; (5) For recipients that are not individuals, limits access to the information at the recipient to those directors, officers, or employees who have a business need to know the information; (6) Requires the information to be destroyed or returned to the supervised entity at the earlier of the end of the consultant, service provider, or other relevant relationship with the supervised entity or at the conclusion of the purpose for which it was shared; (7) Expressly provides that the OCC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action filed in the U.S. District Court for the District of Columbia and any other court having jurisdiction and venue over disputes arising from the agreement; (8) Expressly provides that the OCC must be informed of any violation of the agreement by either party; and (9) For qualifying confidentiality agreements required pursuant to § 4.14(b)(1)(ii), provides that any person performing a service for a supervised entity

103 (A) Acknowledges and consents to regulation and enforcement by the OCC to the same extent as if the service was being performed by the supervised entity itself; and (B) Acknowledges itself to be an institution-affiliated party as defined in 12 U.S.C. 1813(u)(4). § 4.15 Restrictions on current and former OCC employees or agents; former OTS employees or agents. (a) Generally. Except as authorized by this subpart or otherwise by the OCC, no current or former OCC employee or agent or former OTS employee or agent, may, in any manner, disclose or permit the disclosure of any non-public OCC information to anyone other than an employee or agent of the OCC for use in the performance of OCC duties. (b) Duty of person served and potential OCC actions. (1) Any current or former OCC employee or agent or former OTS employee or agent that receives a demand must immediately notify the OCC if they receive a demand for non-public OCC information by notifying the OCC’s Chief Counsel by mail at the following address: Chief Counsel, Office of the Comptroller of the Currency, 400 Seventh Street, SW, Washington, DC 20219 or other method of notification to which the Chief Counsel’s Office has agreed. (2) If ordered by a court or otherwise compelled by law, the current or former employee or agent must appear as required and respectfully decline to produce the information sought, citing this subpart as authority and United States ex rel. Touhy v. Ragen, 340 U.S. 462 (1951). (3) The OCC may, among other actions, intervene, attempt to have the demand withdrawn, and register appropriate objections when a current or former OCC employee

104 or agent or former OTS employee or agent receives a demand that requires the current or former employee or agent to appear or produce OCC information. § 4.16 Requesting nonexempt information under the FOIA and available non-public information. (a) Available nonexempt information. The OCC will disclose a record, or portion of a record, containing nonexempt information to a person upon specific request under FOIA in accordance with this section and § 4.18(a). (b) Available non-public information. The OCC will disclose a record, or portion of a record, containing non-public information that is authorized for disclosure under § 4.13(b) in accordance with this section. (c) Exceptions — (1) Records at the Federal Deposit Insurance Corporation. A person requesting any of the following records, other than blank forms (see § 4.22(a)(7)), must submit the request to the Federal Deposit Insurance Corporation, Legal Division, FOIA/PA Group, 550-17th Street NW, Washington, DC 20429, or fax to (703) 562-2797: (i) Consolidated Report of Condition and Income (FFIEC 031, 032, 033, 034); (ii) Annual Report of Trust Assets (FFIEC 001); (iii) Uniform Bank Performance Report; and (iv) Special Report. (2) Records of another agency. When the OCC receives a request for records in its possession that another government agency either generated or provided to the OCC, the OCC promptly informs the requester and forwards the request to that government agency for processing in accordance with that government agency’s rules.

105 (d) Request for records — (1) Contact information and what the request for records must include. A person requesting records under this section must state, in writing: (i) The requester’s full name, address, telephone number, and, at the requester’s option, electronic mail address; (ii) A reasonable description of the records sought (including sufficient detail to enable OCC employees who are familiar with the subject matter of the request to locate the records with a reasonable amount of effort); (iii) A statement agreeing to pay all fees that the OCC assesses under § 4.23; (iv) A description of how the requester intends to use the records, if a requester seeks placement in a lower fee category (i.e., a fee category other than “commercial use requester”) under § 4.23; and (v) Whether the requester prefers the OCC to deliver a copy of the records or to allow the requester to inspect the records at the appropriate OCC office. (2) Initial determination and discretionary disclosure of records. (i) The OCC initially determines whether to grant a request for OCC records and notifies the requester, in accordance with the time limits set forth in paragraph (f) of this section, of the determination and the reasons therefore and of the right to seek assistance from the OCC’s FOIA Public Liaison. (ii) In making its determination, the OCC will only withhold information if: (A) it reasonably foresees that disclosure would harm an interest protected by an applicable exemption described in 5 U.S.C. 552(b); or (B) disclosure is prohibited by law.

106 (iii) Except where disclosure is prohibited by law, the OCC may, on a case-by￾case basis and in its discretion, disclose information where an arguable basis for withholding is available. The OCC’s decision to make a discretionary disclosure has no precedential significance to any other record. (3) If request is granted. If the OCC grants a request for records, in whole or in part, the OCC promptly discloses the records in one of two ways, depending on the requester’s stated preference: (i) The OCC may deliver a copy of the records to the requester. If the OCC delivers a copy of the records to the requester, the OCC duplicates the records at reasonable and proper times that do not interfere with their use by the OCC or preclude other persons from making inspections; or (ii) The OCC may allow the requester to inspect the records at reasonable and proper times that do not interfere with their use by the OCC or preclude other persons from making inspections. If the OCC allows the requester to inspect the records, the OCC may place a reasonable limit on the number of records that a person may inspect during a day. (4) If request is denied. If the OCC denies a request for records, in whole or in part, the OCC will notify the requester in writing. The notification is dated and contains a brief statement of the reasons for the denial, sets forth the name and title or position of the official making the decision, advises the requester of the right to seek dispute resolution services from the OCC’s FOIA Public Liaison or the Office of Government Information Services, and advises the requester of the right to appeal to the Comptroller of the Currency in accordance with paragraph (d) of this section.

107 (5) Expedited processing requests. (i) A person may submit a request for expedited processing, either with the request for records or at any time thereafter, if: (A) The request is submitted in writing; and (B) In cases where the request is submitted on paper, both the envelope and the request itself must be clearly marked, “Expedited Processing Requested.” (ii) The OCC will grant a request for expedited processing when it determines that: (A) The request involves circumstances in which the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual; (B) (1) The records requested pertain to a matter of current exigency to the public; (2) Delaying a response to a request for the records would compromise a significant recognized interest to and throughout the general public; (3) The request involves an actual or alleged federal government activity; and (4) The individual that made the request is primarily engaged in disseminating information; or (C) The request involves the loss of substantial due process rights. (iii) A requester who seeks expedited processing must submit a statement, certified to be true and correct, demonstrating the compelling need for expedited processing that meets at least one criterion identified in paragraph (5)(ii) of this section unless the OCC waives this certification requirement as a matter of administrative discretion.

108 (iv) (A) The OCC will notify the requester of the determination to grant or deny the request within 10 calendar days after the date of receipt of the request for expedited processing. (B) The OCC will grant or deny a request for expedited processing solely on the information contained in the initial letter requesting expedited treatment. (C) When the OCC grants a request for expedited processing, the OCC will process the request as soon as practicable. (v) If the OCC denies a request for expedited processing, the requester may appeal the denial in accordance with this section. If the requester submits an appeal on paper, both the envelope and the appeal itself must be clearly marked, “Appeal for Expedited Processing.” (vi) The OCC will expeditiously consider the appeal and notify the requester of the determination. (e) Administrative appeal of a denial — (1) Procedure. (i) A requester may appeal an adverse determination, including denials of requests for records, requests for expedited processing, and requests for fee waivers or reductions, pursuant to the requirements of this paragraph (e)(1). (ii) The appeal must be submitted in writing within 90 calendar days after the date of the initial determination. (iii) The appeal must include the circumstances and arguments supporting disclosure of the requested records.

109 (iv) An appeal of an initial determination to deny expedited processing must also follow the procedure set forth in paragraph (d)(5)(v) of this section. (2) Appellate determination. The OCC determines whether to grant an appeal of a denial of: (i) A request for OCC records; (ii) A request for expedited processing; or (iii) A waiver or reduction of fees. (3) If appeal is granted. If the OCC grants an appeal, in whole or in part, the OCC treats the request as if it were originally granted, in whole or in part, by the OCC in accordance with paragraph (d)(3) of this section. (4) If appeal is denied. If the OCC denies an appeal, in whole or in part, the OCC notifies the requester in writing. The notification contains a brief statement of the reasons for the denial, sets forth the name and title or position of the official making the decision, and advises the requester of the right to judicial review of the denial under 5 U.S.C. 552(a)(4)(B). (f) Judicial review — (1) General. If the OCC denies an appeal pursuant to paragraph (e) of this section, or if the OCC fails to make a determination within the time limits specified in paragraph (g) of this section, the requester may commence an action to compel disclosure of records, pursuant to 5 U.S.C. 552(a)(4)(B), in the United States district court in the: (i) District where the requester resides; (ii) District where the requester's principal place of business is located; (iii) District where the records are located; or

110 (iv) the District of Columbia. (2) Service of process. In commencing an action described in paragraph (f)(1) of this section, the requester, in addition to serving the United States as described in Federal Rule of Civil Procedure 4(i)(1) must send a copy of the summons and of the complaint by registered or certified mail to: Chief Counsel, Office of the Comptroller of the Currency, 400 Seventh Street, SW, Washington, DC 20219. (g) Time limits for responding to FOIA requests – (1) Initial determinations. The OCC makes an initial determination to grant or deny a request for records within 20 business days after the date of receipt of the request, as described in paragraph (h) of this section, except as stated in paragraph (g)(3) of this section. (2) Appeal. The OCC makes a determination to grant or deny an administrative appeal within 20 business days after the date of receipt of the appeal, as described in paragraph (h) of this section, except as stated in paragraph (g)(3) of this section. (3) Extension of time. The time limits set forth in paragraphs (g)(1) and (2) of this section may be extended as follows: (i) In unusual circumstances. The OCC may extend the time limits as described in paragraph (g)(4) of this section when the OCC requires additional time due to unusual circumstances; (ii) By agreement. A requester may agree to extend the time limits for any amount of time; (iii) By judicial action. If a requester commences an action pursuant to paragraph (f) of this section for failure to comply with the time limits set forth in this paragraph (g),

111 a court with jurisdiction may, pursuant to 5 U.S.C. 552(a)(6)(C), allow the OCC additional time to complete the review of the records requested; or (iv) Tolling of time limits. (A) The OCC may toll the 20 business-day time period in paragraph (g)(1) of this section to: (1) Make one request for additional information from the requester; or (2) Clarify the applicability or amount of any fees, if necessary, with the requester. (B) The tolling period ends upon the OCC’s receipt of requested information from the requester or resolution of the fee issue. (4) Time of extensions for unusual circumstances. If the OCC determines additional time is necessary pursuant to paragraph (g)(3)(i) of this section, the OCC will (i) Provide written notice to the person making the request or appeal, containing the reason for the extension and the date on which the OCC expects to make a determination; and (ii) If the OCC determines it cannot respond to the request within 10 business days, the OCC will: (A) Notify the requester that the request cannot be processed within the time limit set forth in paragraph (g)(3)(i) of this section; (B) Provide the requester with an opportunity to limit the scope of the request so that it may be processed within that 10 business day period or to arrange with the OCC an alternative time frame for processing the request or a modified request;

112 (C) Make available the FOIA Public Liaison, who shall assist in the resolution of any disputes between the requester and the OCC; and (D) Notify the requester of the right of the requester to seek dispute resolution services from the Office of Government Information Services. (h) Date of receipt of request or appeal. The date of receipt of a request for records or an appeal is the date that the OCC receives a request that satisfies the requirements of paragraph (d)(1) or (e)(1) of this section, except as provided in 4.23(d). (i) Dispute resolution services. Requesters with concerns about the handling of their FOIA requests may contact the FOIA Public Liaison or the Office of Government Information Services for dispute resolution services. (1) To apply for dispute resolution assistance from the FOIA Public Liaison, requesters should submit a written request to the FOIA Public Liaison, Office of the Comptroller of the Currency, 400 Seventh Street SW, Washington, DC 20219. (2) For dispute resolution services through the Office of Government Services, requesters should contact the Office of Government Services as set forth at 36 CFR 1250.32. (i) Segregability – (1) If, in responding to a request under this section, the OCC determines that a requested record contains non-public OCC information, the OCC will consider whether partial disclosure of the record is possible and take reasonable steps necessary to segregate and disclose nonexempt information.

113 (2) The OCC will note the location, basis, and extent of any redaction and identify the categories of non-public OCC information redacted from the disclosed record unless doing so would harm an interest protected by this subpart or the FOIA. § 4.17 Requesting non-public OCC information. (a) Generally — (1) Form of request. A person seeking non-public OCC information, including confidential supervisory information, must submit a request in writing to the OCC explaining, in as detailed a description as is necessary under the circumstances, the bases for the request and how the requested non-public OCC information relates to the issues in the matter. (2) Expedited request. A requester seeking a response in less than 60 days must explain in writing why the request was not submitted earlier and why the OCC should expedite the request. (3) Request arising from adversarial matters. Where the requested information is to be used in connection with a lawsuit or other adversarial matter: (i) The OCC generally will require that the lawsuit or an administrative action related to the matter has been filed before it will consider the request; (ii) The request must include: (A) A copy of the complaint or other pleading setting forth the assertions in the case; (B) The caption and docket number of the case; (C) The name, address, and phone number of counsel to each party in the case; and

114 (D) A description of any prior judicial decisions or pending motions in the case that may bear on the asserted relevance of the requested information; (iii) The request must also: (A) Show that the information is relevant to the purpose for which it is sought; (B) Show that other evidence reasonably suited to the requester’s needs is not available from any other source; (C) Show that the need for the information outweighs the public interest considerations in maintaining the confidentiality of the OCC information and outweighs the burden on the OCC to produce the information; (D) Explain how the issues in the case and the status of the case warrant that the OCC allow disclosure; and (E) Identify any other issue that may bear on the question of waiver of privilege by the OCC. (b) Request for records. If the request is for a record, the requester must adequately describe the record or records sought by type and date. (c) Additional information. (1) A requester must submit a complete request. (2) The OCC may: (i) Require the requester to provide additional information to complete a request; and (ii) Consistent with the purposes stated in § 4.10, inquire into the circumstances of any case underlying the request and rely on sources of information other than the requester, including other parties. (d) Request for testimony —

115 (1) Generally. A requester seeking testimony: (i) Must show a compelling need for the requested information; and (ii) Should request OCC testimony with sufficient time to obtain the testimony in deposition form. (2) Trial or hearing testimony. A requester seeking testimony at a trial or hearing must show that a deposition would not suffice. (3) Witness fees and mileage. A person whose request for testimony of a current OCC employee is approved must, upon completion of the testimonial appearance, tender promptly to the OCC payment for the witness fees and mileage. The litigant must compute these amounts in accordance with 28 U.S.C. 1821. A litigant whose request for testimony of a former OCC employee is approved must tender promptly to the witness any witness fees or mileage due in accordance with 28 U.S.C. 1821. § 4.18 Where to submit a request for nonexempt information under the FOIA, a request for non-public OCC information, or a notice under this subpart. (a) Request for nonexempt information. Except as provided in § 4.16(c)(1), a person requesting nonexempt information through the FOIA or filing an administrative appeal described in § 4.16 must submit the request or appeal: (1) Through the OCC’s FOIA Web portal at https://www.occ.gov/about/connect￾with-us/foia/index-foia.html; (2) Through the consolidated online request portal maintained by the Office of Management and Budget pursuant to 5 U.S.C. 552(m)(1); or

116 (3) Through registered or certified mail to the OCC’s FOIA Officer and, separately, the OCC’s Chief Counsel, both located at Office of the Comptroller of the Currency, 400 Seventh Street SW, Washington, DC 20219. (b) Request for non-public OCC information. A person requesting non-public OCC information under this subpart (including a combination of nonexempt and non￾public OCC information), requesting authentication of a record under § 4.19(d), or submitting a notification of a demand under § 4.13, shall send the request or notification to: Chief Counsel, Office of the Comptroller of the Currency, 400 Seventh Street, SW, Washington, DC 20219. § 4.19 Disclosing and using OCC records in litigation. (a) Responsibility of litigants to notify parties of a request for testimony. Upon submitting a request to the OCC for the testimony of an OCC employee or former OCC or OTS employee, the requester must notify all other parties to the case that a request has been submitted. (b) Responsibility of litigants regarding disclosed records. The requester must promptly notify other parties to a case of the disclosure of non-public OCC information obtained pursuant to this subpart, and, upon entry of a protective order, must provide copies of OCC information, including OCC information obtained pursuant to § 4.16, to the other parties. (c) Retrieval and destruction of disclosed records. At the conclusion of an action: (1) The requester must retrieve any non-public OCC information from the court’s file as soon as the court no longer requires the information;

117 (2) Each party must destroy the non-public OCC information covered by the protective order; and (3) Each party must certify to the OCC that the non-public OCC information covered by the protective order has been destroyed. (d) Authentication for use as evidence. Upon request, the OCC authenticates disclosed records to facilitate their use as evidence. Requesters who require authenticated records or certificates of nonexistence of records should, as early as possible, request certificates from the OCC, pursuant to § 4.18. § 4.20 Predisclosure notice for confidential commercial information. (a) Definitions. For purposes of this section, the following definitions apply: (1) Confidential commercial information means commercial or financial information obtained by the OCC from a submitter that may be exempt from disclosure under FOIA Exemption 4, 5 U.S.C. 552(b)(4). (2) Submitter means any state agency, tribal agency, Federal agency, foreign government, or other person that provides confidential commercial information to the OCC. (b) Notice to submitter — (1) When provided. When the OCC receives a request under § 4.16(d) or an appeal under § 4.16(e) for disclosure of confidential commercial information, the OCC provides a submitter with prompt written notice of the receipt of that request (except as provided in paragraphs (b)(2) and (b)(4) of this section) in the following circumstances:

118 (i) With respect to confidential commercial information submitted to the OCC or to a predecessor agency prior to January 1, 1988, if the information is subject to a prior express commitment of confidentiality from the OCC or the predecessor agency; and (ii) With respect to confidential commercial information submitted to the OCC or a predecessor agency on or after January 1, 1988, if: (A) The submitter in good faith designated the information as confidential commercial information; or (B) The OCC or the predecessor agency, designated the class of information to which the requested information belongs as confidential commercial information. (2) Exceptions. Notwithstanding paragraph (b)(1) of this section, the OCC generally does not provide notice thereunder if the OCC determines that: (i) It will not disclose the information; (ii) The information already has been disclosed officially to the public; (iii) The OCC is required by law (other than the FOIA) to disclose the information; (iv) The OCC or a predecessor agency acquired the information in the course of a lawful investigation of a possible violation of criminal law; (v) The submitter had an opportunity to designate the requested information as confidential commercial information at the time of submission of the information or a reasonable time thereafter and did not do so; or (vi) The OCC determines that the submitter’s designation under paragraph (b)(1)(ii)(A) of this section is frivolous; in such case, however, the OCC will provide the submitter with written notice of any final administrative determination to disclose the

119 information at least 10 business days prior to the date that the OCC intends to disclose the information. (3) Content of notice. The OCC either describes in the notice the exact nature of the confidential commercial information requested or includes with the notice copies of the records or portions of records containing that information. (4) Expiration of notice period. The OCC provides notice under this paragraph (b) with respect to information that the submitter designated as confidential commercial information under paragraph (b)(1)(ii)(A) of this section for the longer of: (i) A period of 10 years after the date of the submitter’s designation; and (ii) Any period of time requested by the submitter and approved by the OCC. (5) Certification of confidentiality. The submitter should support the claim of confidentiality with a statement or certification that: (i) States the requested information is confidential commercial information that the submitter has not disclosed to the public and (ii) Is prepared by an officer or authorized representative if the submitter is a corporation or other entity. (c) Notice to requester. If the OCC provides notice to a submitter under paragraph (b) of this section, the OCC: (1) Notifies the requester that it has provided notice to the submitter. (2) Advises the requester that, if there is a delay in its decision whether to grant or deny access to the information sought, the delay may be considered a denial of access to the information and that the requester may proceed with an administrative appeal or seek judicial review.

120 (d) Voluntary extension. The requester may agree to a voluntary extension of time to allow the OCC to review the submitter’s disclosure as provided by § 4.16(g)(3)(ii). (e) Opportunity to object to disclosure. Within 10 business days after receiving notice under paragraph (b) of this section, the submitter may provide the OCC with a detailed statement of objection to disclosure of the information. That statement must specify the grounds for withholding any of the information under any FOIA exemption. Any statement that the submitter provides under this paragraph (e) may be subject to disclosure under the FOIA. (f) Notice of intent to disclose. The OCC considers a submitter’s objection and specific grounds for nondisclosure prior to determining whether to disclose the requested information. If the OCC decides to disclose information over the objection of the submitter, the OCC provides to the submitter, with a copy to the requester, a written notice that includes: (1) A statement of the OCC’s reasons for not sustaining the submitter’s objections to disclosure; (2) A description of the information to be disclosed; (3) The anticipated disclosure date, which is not less than 10 business days after the OCC mails the written notice required under this paragraph (f); and (4) A statement that the submitter must notify the OCC immediately if the submitter intends to seek injunctive relief. (f) Notice of requester’s lawsuit. Whenever the OCC receives service of process indicating that a requester has brought suit seeking to compel the OCC to disclose

121 information covered by paragraph (b)(1) of this section, the OCC promptly notifies the submitter. § 4.21 Consideration of requests for non-public OCC information. (a) In general — (1) OCC discretion. The OCC decides whether to disclose non-public OCC information based on its weighing of all appropriate factors including the requester’s fulfilling of the requirements enumerated in § 4.17. (2) Bases for denial. The OCC may deny a request for non-public OCC information for reasons that include the following: (i) The requester was unsuccessful in showing that the information is relevant to the pending matter; (ii) The requester seeks testimony and the requester did not show a compelling need for the information; (iii) The request arises from an adversarial matter and other evidence suited to the requester’s need is available from another source; (iv) A lawsuit or administrative action has not yet been filed and the request was made in connection with potential litigation; (v) The production of the information would be contrary to the public interest or unduly burdensome to the OCC; or (vi) When prohibited by law. (3) Final agency decision. OCC action on a request for non-public OCC information is a final agency decision and exhausts administrative remedies for discovery of the information.

122 (4) Decision in writing. The OCC will notify the requester in writing of the final decision. (5) Time required by the OCC to respond. (i) The OCC generally will process requests in the order in which they are received. (ii) Absent unusual circumstances as defined in § 4.11, the OCC will respond to a request within 60 days from the date that the OCC receives a request that it deems a complete request. (iii) Consistent with § 4.17(a)(2), the OCC weighs a request to respond to provide information in less than 60 days against the unfairness to other requesters whose pending requests may be delayed and the burden imposed on the OCC by the expedited processing. (6) Notice to subject supervised entities. (i) Following receipt of a request for non-public OCC information, the OCC generally notifies the supervised entity that is the subject of the requested information, unless the OCC, in its discretion, determines that to do so would advantage or prejudice any of the parties in the matter at issue. (ii) Notification under paragraph (a)(7)(i) of this section does not apply to disclosures governed by § 4.20. (b) Testimony. (1) The OCC generally will not authorize a current OCC employee to provide expert or opinion evidence for a private party.

123 (2) The OCC may restrict the scope of any authorized testimony and may act to ensure that the scope of testimony given by the OCC employee adheres to the scope authorized by the OCC. (3) Once a request for testimony has been submitted, and before the requested testimony occurs, a party to the relevant case, who did not join in the request and who wishes to question the witness beyond the scope of testimony sought by the request, must timely submit the party’s own request for OCC information pursuant to this subpart. (4) The OCC may offer the requester the employee’s written declaration in lieu of testimony. (c) Disclosure of non-public OCC information by others. (1) In appropriate cases, the OCC may respond to a request for information by authorizing a party that is in possession of non-public OCC information to disclose the information to the requester. (2) An OCC authorization to disclose records does not preclude the party in possession from: (i) Asserting its own privilege, (ii) Arguing that the records are not relevant, or (iii) Asserting any other argument for which it has standing to protect the records from disclosure. § 4.22 Public inspection in an electronic format under the FOIA. (a) Available information. Subject to the provisions on the disclosure of non￾public OCC information provided in this subpart or otherwise required by law, the OCC makes the following information available for public inspection in an electronic format:

124 (1) Any final order, agreement, or other enforceable document issued in the adjudication of an OCC enforcement case, including a final order published pursuant to 12 U.S.C. 1818(u); (2) Any final opinion issued in the adjudication of an OCC enforcement case; (3) Any statement of general policy or interpretation of general applicability not published in the Federal Register; (4) Any administrative staff manual or instruction to staff that may affect a member of the public as such; (5) A current index identifying the information referred to in paragraphs (a)(1) through (a)(4) of this section issued, adopted, or promulgated after July 4, 1967; (6) A list of available OCC publications; (7) A list of forms available from the OCC, and specific forms and instructions, except that some forms and instructions that supervised entities use are not available from the OCC. The OCC will provide information on where to obtain these forms and instructions upon request; (8) Any public Community Reinvestment Act performance evaluation; (9) Any public securities-related filing required under part 11 or 16 of this chapter; (10) Any public comment letter regarding a proposed rule; (11) Any records, regardless of form or format, that have been disclosed to any person under 5 U.S.C. 552(a)(3) provided that:

125 (i) The OCC determines that, because of the nature of their subject matter, the records are or are likely to become the subject of subsequent requests for substantially the same records; or (ii) The records have been requested three or more times; (12) Reference materials or a guide for requesting records or information from the OCC, including an index of all major OCC information systems, a description of major information and record locator systems maintained by the OCC, and a handbook for obtaining various types and categories of public information from the OCC pursuant to the FOIA and chapter 35 of title 44; (13) The public file (as defined in 12 CFR 5.9) with respect to a pending application described in part 5 of this chapter; and (14) Any OTS information similar to that listed in paragraphs (a)(1) through (a)(13) of this section, to the extent this information is in the possession of the OCC. (b) Redaction of identifying details. To the extent necessary to prevent an invasion of personal privacy, the OCC may redact identifying details from any information described in paragraph (a) of this section before making the information available for public inspection in an electronic format. (c) Addresses. The information described in paragraphs (a)(1) through (14) of this section is available from: FOIA Officer, Office of the Comptroller of the Currency, 400 Seventh Street SW, Washington, DC 20219. § 4.23 Fees for requesting nonexempt information under the FOIA. (a) Definitions. For purposes of this section, the following definitions apply:

126 (1) Actual costs means those expenditures that the OCC incurs in providing services (including searching for, reviewing, and duplicating records) in response to a request for records under §§ 4.16 and 4.17. (2) Search means the process of locating a record in response to a request, including page-by-page or line-by-line identification of material within a record. The OCC may perform a search manually or by electronic means. (3) Review means the process of examining a record located in response to a request to determine which portions of that record should be disclosed. It also includes processing a record for disclosure. (4) Duplication means the process of copying a record in response to a request. A copy may take the form of a paper copy, microform, audiovisual materials, or machine￾readable material (e.g., magnetic tape or disk), among others. (5) Commercial use requester means a person who seeks records for a use or purpose that furthers the commercial, trade, or profit interests of the requester or the person on whose behalf the request is made. (6) Educational institution requester means a person who seeks records on behalf of a public or private educational institution, including a preschool, an elementary or secondary school, an institution of undergraduate or graduate higher education, an institution of professional education, or an institution of vocational education that operates a program of scholarly research. (7) Noncommercial scientific institution requester means a person who is not a “commercial use requester,” as that term is defined in paragraph (a)(5) of this section, and who seeks records on behalf of an institution operated solely for the purpose of

127 conducting scientific research, the results of which are not intended to promote any particular product or industry. (8) Requester who is a representative of the news media means any person who, or entity that, gathers information of potential interest to a segment of the public, uses editorial skills to turn the raw materials into a distinct work, and distributes that work to an audience. A freelance journalist will be regarded as working for a news media entity if the person can demonstrate a solid basis for expecting publication through that entity, whether or not the journalist is actually employed by that entity. A publication contract is one example of a basis for expecting publication that ordinarily would satisfy this standard. The OCC also may consider the past publication record of the requester in determining whether she or he qualifies as a “representative of the news media.” (b) Fees — (1) Fees authorized. The OCC may charge fees to requesters of nonexempt information under the FOIA representing reasonable standard charges for document search, duplication, or review as applicable. (2) General. The hourly and per page rate that the OCC generally charges requesters is set forth in the “Notice of Comptroller of the Currency Fees” (Notice) described in 12 CFR 8.8. Any interested person may request a copy of the Notice from the OCC by mail or may obtain a copy at the location described in § 4.22(c). The OCC may contract with a commercial service to search for, duplicate, or disseminate records, provided that the OCC determines that the fee assessed upon a requester is no greater than if the OCC performed the tasks itself. The OCC does not contract out

128 responsibilities that the FOIA provides that the OCC alone may discharge, such as determining the applicability of an exemption or whether to waive or reduce a fee. (3) Fee categories. The OCC assesses a fee based on the fee category in which the OCC places the requester. If the request states how the requester intends to use the requested records pursuant to § 4.16(d)(1)(iv), the OCC may place the requester in a lower fee category; otherwise, the OCC categorizes the requester as a “commercial use requester.” If the OCC reasonably doubts the requester’s stated intended use, or if that use is not clear from the request, the OCC may place the requester in the “commercial use” category or may seek additional clarification. The fee categories are as follows: (i) Commercial use requesters. The OCC assesses a fee for a requester in this category for the actual cost of search, review, and duplication. A requester in this category does not receive any free search, review, or duplication services. (ii) Educational institution requesters, noncommercial scientific institution requesters, and requesters who are representatives of the news media. The OCC assesses a fee for a requester in this category for the actual cost of duplication. A requester in this category receives 100 free pages. (iii) All other requesters. The OCC assesses a fee for a requester who does not fit into either of the above categories for the actual cost of search and duplication. A requester in this category receives 100 free pages and two hours of free search time. (3) Special services. The OCC may, in its discretion, accommodate a request for special services. The OCC may recover the actual cost of providing any special services.

129 (4) Waiving or reducing a fee. The OCC must waive or reduce a fee under this section whenever, in its opinion, disclosure of records is in the public interest because the disclosure: (i) Is likely to contribute significantly to public understanding of the operations or activities of the government; and (ii) Is not primarily in the commercial interest of the requester. (iii) A requester may appeal the OCC's determination not to grant a request for a waiver or reduction of fees under the procedure set forth in § 4.16(e). (5) Fee for unsuccessful search. The OCC may assess a fee for time spent searching for records, even if the OCC does not locate the records requested. (6) No fee if the time limit passes and the OCC has not responded to the request. The OCC will not assess search or duplication fees, as applicable, if it fails to respond to a requester's FOIA request within the time limits specified under 5 U.S.C. 552(a)(6) and § 4.16(g) of this subpart, except as follows: (i) Unusual circumstances — (A) General. The OCC may assess search or duplication fees, as applicable, for an additional 10 business days if: (1) the OCC has determined that unusual circumstances apply, (2) the OCC provides timely written notice to the requester in accordance with 5 U.S.C. 552(a)(6)(B), and (3) the OCC complies with the extended 10 business-day time limit. (B) Voluminous Requests. The OCC may assess search or duplication fees, as appropriate, for more than 10 additional business days if:

130 (1) the OCC has determined that unusual circumstances (as defined in § 4.11 of this subpart) apply, (2) the OCC has determined that more than 5,000 pages are necessary to respond to the request, (3) the OCC provides a timely written notice to the requester in accordance with 5 U.S.C. 552(a)(6)(B), and (4) the OCC discusses with the requester via written mail, electronic mail, or telephone (or makes not less than three good-faith attempts to do so) how the requester could effectively limit the scope of the request in accordance with 5 U.S.C. 552(a)(6)(B)(ii). (ii) In exceptional circumstances. If a court has determined that exceptional circumstances apply to the processing of a request for purposes of 5 U.S.C. 552(a)(6)(C) (i.e., a delay that does not result from a predictable agency workload of requests under this section, unless the agency demonstrates reasonable progress in reducing its backlog of pending requests), the OCC may assess search or duplication fees, as applicable, for the length of time provided by the court order. (c) Payment of fees — (1) General. The OCC generally assesses a fee when it delivers the records in response to the request, if any. A requester must send payment within 30 calendar days of the billing date to: Financial Management, Accounts Receivable, Office of the Comptroller of the Currency, 400 Seventh Street, SW, Washington, DC 20219. (2) Fee likely to exceed $25. If the OCC estimates that a fee is likely to exceed $25, the OCC notifies the requester of the estimated fee, unless the requester has

131 indicated in advance a willingness to pay a fee as high as the estimated fee. If so notified by the OCC, the requester may confer with OCC employees to revise the request to reflect a lower fee. (3) Fee likely to exceed $250. If the OCC estimates that a fee is likely to exceed $250, the OCC notifies the requester of the estimated fee. In this circumstance, the OCC may require, as a condition to processing the request, that the requester: (i) Provide satisfactory assurance of full payment, if the requester has a history of prompt payment; or (ii) Pay the estimated fee in full, if the requester does not have a history of prompt payment. (4) Failure to pay a fee. If the requester fails to pay a fee within 30 days of the date of the billing, the OCC may require, as a condition to processing any further request, that the requester pay any unpaid fee, plus interest (as provided in paragraph (c)(5) of this section), and any estimated fee in full for that further request. (5) Interest on unpaid fee. The OCC may assess interest charges on an unpaid fee beginning on the 31st day following the billing date. The OCC charges interest at the rate prescribed in 31 U.S.C. 3717. (d) Tolling of time limits. Under the circumstances described in paragraphs (c) (2), (3), and (4) of this section, the time limits set forth in § 4.16(g) begin only after the OCC receives a revised request under paragraph (c)(2) of this section, an assurance of payment under paragraph (c)(3)(i) of this section, or the required payments under paragraph (c)(3)(ii) or (c)(4) of this section.

132 (e) Aggregating requests. When the OCC reasonably believes that a requester or group of requesters is attempting to break a request into a series of requests for the purpose of evading the assessment of a fee, the OCC may aggregate the requests and assess a fee accordingly. § 4.24 Tracking requests for nonexempt information under the FOIA. (a) Tracking number — (1) Internet requests. The OCC will issue a tracking number to all FOIA requests automatically upon receipt of the request (as described in § 4.16(h)) by the OCC via the OCC’s Freedom of Information Request Portal, https://www.occ.gov/about/connect-with￾us/foia/index-foia.html. (2) If a requester does not have Internet access. If a requester specifically states in their request that they have no means to access the OCC’s Freedom of Information Request Portal, the OCC will manually issue a tracking number to such FOIA request within 5 days of the OCC receipt of the request (as described in § 4.16(h)). The OCC will mail the tracking number to the requester's physical address as provided in the FOIA request. (b) Status of request. FOIA requesters may track the progress of their requests via the OCC’s Freedom of Information Request Portal, https://www.occ.gov/about/connect￾with-us/foia/index-foia.html. Requesters with no means to access the OCC’s Freedom of Information Request Portal may continue to contact the OCC’s FOIA Officer at (202) 649-6700 to check the status of their FOIA request(s). APPENDIX A TO SUBPART B OF PART 4 I. Model Stipulation

133 CASE CAPTION Model Stipulation for Protective Order Whereas, counsel for ______ have applied to the Comptroller of the Currency (hereinafter “Comptroller”) pursuant to 12 CFR part 4, Subpart B, for permission to have made available, in connection with the captioned action, certain records; and Whereas, such records are deemed by the Comptroller to be confidential and privileged, pursuant to 12 U.S.C. 481, 1463(a)(1), 1464(a)(1) and 1464(d)(1)(B)(i); 5 U.S.C. 552(b)(8); 18 U.S.C. 641, 1906; and 12 CFR 4.11 and 4.12, and part 4, Subpart B; and Whereas, following consideration by the Comptroller of the application of the above described party, the Comptroller has determined that the particular circumstances of the captioned action warrant making certain possibly relevant records as denoted in appendix “A” to this Stipulation [records to be specified by type and date] available to the parties in this action, provided that appropriate protection of their confidentiality can be secured; Therefore, it is hereby stipulated by and between the parties hereto, through their respective attorneys that they will be bound by the following protective order which may be entered by the Court without further notice. Dated this ______ day of _____, 19.

134 Attorney for Plaintiff Attorney for Defendant II. Model Protective Order CASE CAPTION Model Protective Order Whereas, counsel for ______ have applied to the Comptroller of the Currency (hereinafter Comptroller”) pursuant to 12 CFR part 4, Subpart B, for permission to have made available, in connection with the captioned action, certain records; and Whereas, such records are deemed by the Comptroller to be confidential and privileged, pursuant to 12 U.S.C. 481, 1463(a)(1), 1464(a)(1) and 1464(d)(1)(B)(i); 5 U.S.C. 552(b)(8); 18 U.S.C. 1906; 12 CFR 4.11, and 12 CFR 4.12, and part 4, Subpart B; Whereas, following consideration by the Comptroller of the application of the above described party, the Comptroller has determined that the particular circumstances of the captioned action warrant making certain possibly relevant records available to the parties in this action, provided that appropriate protection of their confidentiality can be secured; Now, Therefore, it is Ordered That:

135

1. The records, as denoted in appendix “A” to the Stipulation for this Protective Order, upon being furnished [or released for use] by the Comptroller, shall be disclosed only to the parties to this action, their counsel, and the court [and the jury].
2. The parties to this action and their counsel shall keep such records and any information contained in such records confidential and shall in no way divulge the same to any person or entity, except to such experts, consultants and non-party witnesses to whom the records and their contents shall be disclosed, solely for the purpose of properly preparing for and trying the action.
3. No person to whom information and records covered by this Order are disclosed shall make any copies or otherwise use such information or records or their contents for any purpose whatsoever, except in connection with this action.
4. Any party or other person who wishes to use the information or records or their contents in any other action shall make a separate application to the Comptroller pursuant to 12 CFR part 4, Subpart B.
5. Should any records covered by this Order be filed with the Court or utilized as exhibits at depositions in the captioned action, or should information or records or their contents covered by this Order be disclosed in the transcripts of depositions or the trial in the captioned action, such records, exhibits and transcripts shall be filed in sealed envelopes or other sealed containers marked with the title of this action, identifying each document and article therein and bearing a statement substantially in the following form:

136 CONFIDENTIAL Pursuant to the Order of the Court dated ______ this envelope containing the above-identified papers filed by (the name of the party) is not to be opened nor the contents thereof displayed or revealed except to the parties to this action or their counsel or by further Order of the Court. 6. FOR JURY TRIAL: Any party offering any of the records into evidence shall offer only those pages, or portions thereof, that are relevant and material to the issues to be decided in the action and shall block out any portion of any page that contains information not relevant or material. Furthermore, the name of any person or entity contained on any page of the records who is not a party to this action, or whose name is not otherwise relevant or material to the action, shall be blocked out prior to the admission of such page into evidence. Any disagreement regarding what portion of any page that should be blocked out in this manner shall be resolved by the Court in camera, and the Court shall decide its admissibility into evidence. 7. At the conclusion of this action, all parties shall certify to the Comptroller that the records covered by this Order have been destroyed. Furthermore, counsel for ______, pursuant to 12 CFR 4.19(c), shall retrieve any records covered by this Order that may have been filed with the Court. So Ordered:

137 Judge Date 3. Remove and reserve Subpart C. Subpart C — [RESERVED] PART 5 — RULES, POLICIES, AND PROCEDURES FOR CORPORATE ACTIVITIES 4. The authority citation for part 5 continues to read as follows: Authority: 12 U.S.C. 1 et seq., 24a, 35, 93a, 214a, 215, 215a, 215a-1, 215a-2, 215a-3, 215c, 371d, 481, 1462a, 1463, 1464, 1817(j), 1831i, 1831u, 2901 et seq., 3101 et seq., 3907, and 5412(b)(2)(B). 5. In § 5.9: a. Amend paragraph (a) by removing “12 CFR 4.17” and adding in its place “12 CFR 4.23”. b. Amend paragraph (c) by removing “12 CFR 4.12(b)” and adding in its place “12 CFR part 4”. c. Amend paragraph (c) by removing “12 CFR 4.16” and adding in its place “12 CFR 4.20”. The revision reads as follows: § 5.9 Public availability. (a) In general. The OCC provides a copy of the public file to any person who requests it. A requestor should submit a written request for the public file concerning a pending filing to the appropriate OCC licensing office. A requestor should submit a

138 written request for the public file concerning a decided or closed filing to the OCC's Freedom of Information Act Officer, Communications Division, at the address listed on www.occ.gov. The OCC may impose a fee in accordance with 12 CFR 4.23 and at the rate the OCC publishes in the “Notice of Comptroller of the Currency Fees,” described in 12 CFR 8.8. (b) * * * (c) Confidential treatment. The filer or an interested person submitting information may request that specific information be treated as confidential under the Freedom of Information Act, 5 U.S.C. 552 (see 12 CFR part 4). A submitter should draft its request for confidential treatment narrowly to extend only to those portions of a document it considers confidential. If a submitter requests confidential treatment for information that the OCC does not consider to be confidential, the OCC may include that information in the public file after providing notice to the submitter. Moreover, at its own initiative, the OCC may determine that certain information should be treated as confidential and withhold that information from the public file. A person requesting information withheld from the public file should submit the request to the OCC's Freedom of Information Act Officer, Communications Division, under the procedures described in 12 CFR part 4, subpart B. That request may be subject to the predisclosure notice procedures of 12 CFR 4.20. PART 7—ACTIVITIES AND OPERATIONS 6. The authority citation for part 7 continues to read as follows: Authority: 12 U.S.C. 1 et seq., 25b, 29, 71, 71a, 92, 92a, 93, 93a, 95(b)(1), 371, 371d, 481, 484, 1462a, 1463, 1464, 1465, 1818, 1828, 3102(b), and 5412(b)(2)(B).

139 7. Amend § 7.4000 by removing “subpart C” after “12 CFR part 4” in paragraph (a) and adding in its place “subpart B”. The revision reads as follows: § 7.4000 Visitorial powers with respect to national banks. (a) General rule. (1) Under 12 U.S.C. 484, only the OCC or an authorized representative of the OCC may exercise visitorial powers with respect to national banks. State officials may not exercise visitorial powers with respect to national banks, such as conducting examinations, inspecting or requiring the production of books or records of national banks, or prosecuting enforcement actions, except in limited circumstances authorized by federal law. However, production of a bank's records (other than non￾public OCC information under 12 CFR part 4, subpart B) may be required under normal judicial procedures.

---

PART 21—MINIMUM SECURITY DEVICES AND PROCEDURES, REPORTS OF SUSPICIOUS ACTIVITIES, AND BANK SECRECY ACT COMPLIANCE PROGRAM 8. The authority citation for part 21 continues to read as follows: Authority: 12 U.S.C. 1, 93a, 161, 1462a, 1463, 1464, 1818, 1881-1884, and 3401-3422; 31 U.S.C. 5318.9. Amend § 21.11(k)(2) by removing “12 CFR 4.33” after “non-public OCC information under” and adding in its place “12 CFR 4.17”. The revision reads as follows: § 21.11 Suspicious Activity Report.

---

140 (k) * * * (2) Prohibition on disclosure by the OCC. The OCC will not, and no officer, employee or agent of the OCC, shall disclose a SAR, or any information that would reveal the existence of a SAR, except as necessary to fulfill official duties consistent with title II of the Bank Secrecy Act. For purposes of this section, official duties shall not include the disclosure of a SAR, or any information that would reveal the existence of a SAR, in response to a request for use in a private legal proceeding or in response to a request for disclosure of non-public OCC information under 12 CFR 4.17.

---

PART 163—SAVINGS ASSOCIATIONS—OPERATIONS 10. The authority citation for part 163 continues to read as follows: Authority: 12 U.S.C. 1, 93a, 1462a, 1463, 1464, 1467a, 1817, 1820, 1828, 1831o, 3806, 5101 et seq., 5412(b)(2)(B); 31 U.S.C. 5318; 42 U.S.C. 4106. 11. Amend § 163.180 by removing “12 CFR 4.33” after “non-public OCC information under” and adding “12 CFR 4.17”. The revision reads as follows: § 163.180 Suspicious Activity Reports and other reports and statements.

---

(d) * * * (12) * * * (iii) Prohibition on disclosure by the appropriate Federal banking agency. The appropriate Federal banking agency will not, and no officer, employee or agent of appropriate Federal banking agency shall disclose a SAR, or any information that would

141 reveal the existence of a SAR, except as necessary to fulfill official duties consistent with title II of the Bank Secrecy Act. For purposes of this section, “official duties” shall not include the disclosure of a SAR, or any information that would reveal the existence of a SAR, in response to a request for use in a private legal proceeding or in response to a request for disclosure of non-public information under 12 CFR 4.17 or 12 CFR part 309, as appropriate.

---

Jonathan V. Gould, Comptroller of the Currency.