Cybersecurity Policy Report, FDIC proposes prior-approval relief for confidential supervisory information disclosure, (Jun 26, 2026)

By Charles A. Menke, J.D.

The agency says delays of up to two weeks would be eliminated for an estimated 23 percent of disclosure requests that would no longer require prior approval.

The Federal Deposit Insurance Corporation announced its Board of Directors approved a notice of proposed rulemaking that would let insured depository institutions share confidential supervisory information with affiliates and certain other entities for appropriate business purposes without seeking FDIC authorization (FIL-32-2026). According to the FDIC, the proposal will allow faster access to information needed by counsel, auditors, service providers, merger counterparties, and senior-executive candidates while keeping confidentiality safeguards in place. Comments are due 60 days after publication of the proposal in the Federal Register. FDIC staff recommended the FDIC’s Board of Directors approve the proposal and authorize its publication.

Disclosure flexibility. The core disclosure provision would permit insured depository institutions and certain other entities to disclose FDIC confidential information without prior approval in specified circumstances, subject to safeguards that include qualifying confidentiality agreements in some cases. With those agreements, insured depository institutions could disclose confidential information to external legal counsel, accountants, auditors, majority shareholders owning more than 50 percent of voting stock, qualifying service providers, and individuals offered employment as senior executive officers. The proposal also would permit disclosures to specified personnel, affiliates, auditors, and legal counsel of an insured depository institution that is a potential merger or similar transaction counterparty. Parent holding companies lawfully possessing FDIC confidential information could disclose it to the same extent and under the same conditions as insured depository institutions, and FDIC-examined service providers could share confidential information with partner insured depository institutions, subject to limitations.

The FDIC noted its disclosure regulations have not been significantly revised in approximately 30 years and that current rules fail to accommodate business relationships, include burdensome administrative impediments, rely on outdated or vague terms, and impose limits on insured depository institutions not imposed by other federal banking agencies. The proposal establishes “good cause” as the general standard for authorizing disclosure of confidential information, while the broader changes are designed to reduce procedural barriers and preserve safeguards. FDIC Chairman Travis Hill said the current approval process can be “time consuming and burdensome” and that routine sharing with listed partners would present “minimal risk” to institutions or the banking system.

Process cleanup. The proposal also would update and simplify rules for Freedom of Information Act (FOIA)-required disclosures and clarify when FDIC information may be disclosed in legal proceedings or after service of process on the FDIC or its personnel. For confidential commercial information, the proposal establishes notice to submitters, an opportunity to object, FDIC response procedures, and requester notification. In non-party legal proceedings, the FDIC General Counsel or designee would consider the request, confidentiality and public-disclosure risks, interference with FDIC operations, and the public interest, and could waive the request process. The proposal would also cover service of process directed to the FDIC, FDIC officials, and FDIC personnel in specified official- or duty-related capacities.

The FDIC estimated 655 of about 2,900 disclosure requests received from the second quarter of 2016 through the second quarter of 2026 would no longer be needed, producing about 69 fewer requests per year and at least $19,807 in annual savings. For time-sensitive decisions, the agency said its current prior-approval process can take up to two weeks on average and that delay would be eliminated for an estimated 23 percent of requests no longer requiring approval.

OCC statement. Comptroller of the Currency Jonathan V. Gould issued a statement saying that while he voted for the proposal he “believe[s] that the final rule should go further.” Gould further “encourage[d] commenters to address other ways in which the FDIC could reasonably expand access to confidential supervisory information, including by addressing the many specific questions in the preamble.” According to Gould, “[t]he regulatory framework should facilitate the disclosure of confidential information not only in furtherance of an institution’s business purposes but also in the service of accountability and transparency. These objectives help to ensure that the public understands and has confidence in our supervision and are essential to the proper functioning of our financial system and good government.”

AFC statement. The American Fintech Council (AFC) released a statement supporting the proposal saying it “would clarify the use and disclosure of nonpublic supervisory information, establish a more structured framework for information sharing, and update longstanding agency procedures.” AFC CEO Phil Goldfeder added that “[g]reater clarity around the appropriate sharing of supervisory information will help institutions address regulatory concerns more efficiently and improve coordination between banks and the fintech partners responsible for remediation.”

Companies: American Fintech Council

MainStory: TopStory BankingOperations CyberPrivacyFeed DataPrivacy DataSecurity DepositInsurance FinTech GCNNews Privacy PrudentialRegulation