On August 3, the OCC announced that it has issued a notice of proposed rulemaking aiming to overhaul its rules governing the disclosure of non-public OCC information (NPOI) — which includes examination reports, supervisory correspondence and information related to enforcement actions — under 12 CFR Part 4.

The proposal would create a new subcategory of NPOI called “confidential supervisory information” (CSI) and establish a two-tiered disclosure framework that allows supervised entities to disclose CSI without prior OCC approval in six circumstances: (i) to affiliates; (ii) to U.S.-based service providers with qualifying confidentiality agreements; (iii) to candidates for senior executive officer positions; (iv) to potential counterparties in business combinations, subject to multiple safeguards including written waivers and confidentiality agreements; (v) to U.S.-based consultants and attorneys of potential counterparties; and (vi) to not-for-profit entities, including trade associations, for data aggregation or advocacy purposes. The OCC stated the current framework “over prioritizes confidentiality relative to other interests” and has had a “chilling effect” on supervised entities’ willingness to seek approval for legitimate disclosures.

The proposal would also remove references to criminal penalties under 18 U.S.C. § 641 for unauthorized disclosure, which the OCC said may be “contrary to controlling legal authorities” and falls outside its enforcement authority. The OCC stated it does not anticipate referring unauthorized disclosure of NPOI to DOJ for criminal prosecution “absent extraordinary circumstances,” but noted removing the criminal reference would not preclude such referrals “where appropriate.” Other changes include provisions for expedited processing of Freedom of Information Act requests, procedures for appealing denials of expedited processing or fee waiver requests, and the release of certain aged CSI through FOIA requests for records created or received 25 or more years before a request. The proposal also clarifies when a supervised entity can share CSI with federal agencies, including the Fed and the FDIC, subject to written notice to the OCC and specified waiting periods. The OCC is also seeking comment on whether to extend disclosure exceptions to parent holding companies and majority shareholders. Comments are due by October 5.