Office of the Comptroller of the Currency Issues Final Report on Debanking: Reputation Risk, Industry Restrictions, and an Expanding Fair-Banking Agenda

On October 14, 2026, the Office of the Comptroller of the Currency (OCC) released Guaranteeing Fair Banking for All Americans (the Report), presenting the findings of its supervisory review of “debanking” practices at the nine largest national banks it supervises (the Review).¹ The OCC concluded that during the period from September 2020 through September 2025 (the Review Period), each of the nine banks maintained reputation risk and industry-specific policies, practices, and procedures that the OCC characterized as lacking sufficiently clear standards and objective, risk-based criteria and thus presenting an elevated risk of denying access to financial services. The OCC contends that these policies “disadvantaged certain Americans based on their political, religious or social views or based on their lawful business activities.”²

Despite its framing, the Report alleges no clear violations of law, finds none of the systematic political or religious discrimination the review initially set out to identify, and acknowledges that — despite the sheer depth of its review — the OCC could not quantify the extent of even the debanking it alleged. There are nevertheless important risk-management considerations from the Report for banks and other financial services providers, both those under the OCC’s jurisdiction and those supervised by other regulators or subject to the enforcement authority of the Consumer Financial Protection Bureau (CFPB) or the Federal Trade Commission (FTC).

The OCC commenced the Review on September 5, 2025, as directed by Executive Order 14331, Guaranteeing Fair Banking for All Americans (the Executive Order),³ and the Report follows the OCC’s December 10, 2025, Preliminary Findings from the OCC’s Review of Large Banks’ Debanking Activities” (the Preliminary Report).⁴ The OCC describes the Review as “nearing completion,” not complete, but presents the Report as reflecting the agency’s findings.⁵

The Report does not identify a violation of law and does not announce any enforcement actions. It arrives, however, during a flurry of fair-access activity. Over the past three months, the Federal Deposit Insurance Corporation (FDIC) has proposed a “fair banking” review for larger bank mergers; the Financial Crimes Enforcement Network (FinCEN) and the federal banking agencies have clarified that Suspicious Activity Report (SAR) confidentiality does not bar many customer communications about account closures; the OCC and FDIC have adopted a final rule narrowing the supervisory concept of an “unsafe or unsound practice”; and, one day before the Report, the Department of the Treasury (Treasury), FinCEN, the OCC, and the Office of Foreign Assets Control (OFAC) announced one of the largest-ever anti-money-laundering (AML) and sanctions penalties against a large national bank. Hours after the Report was issued, the CFPB announced that it will investigate whether the institutions featured in the Report, and others, complied with federal consumer financial laws.

This Update (i) analyzes the Report; (ii) highlights what is notably absent from the Report, particularly by contrast to the Preliminary Report; (iii) situates the Report within these other developments; and (iv) identifies practical considerations for banks and other financial services providers.

Key aspects of the Report, and of the related developments discussed below, include the following:

• A set of characterizations without a developed legal theory. Executive Order 14331 grounded itself in the unfairness doctrine under Section 5 of the FTC Act and Section 1031 of the Consumer Financial Protection Act (CFPA) as well as the prohibition on discrimination in credit on the basis of religion in the Equal Credit Opportunity Act (ECOA). By contrast, the Report vaguely cites the OCC’s statutory charge to assure “fair access to financial services” and the statement of purposes of the Community Reinvestment Act (CRA). It identifies no violation of law and announces no penalties, referrals, or supervisory directives. It does, however, compile the OCC’s characterizations of customer-level documents, identifying each with specific banks, that the OCC, other agencies, state authorities, or private litigants may seek to use. And the OCC states that it intends to ensure there are no “unreasonable barriers” to sharing appropriate information in debanking-related litigation.
• Reputation risk remains the organizing concept. The OCC is skeptical that reputation risk can be assessed objectively at all and equally skeptical of the new and more heavily governed approaches that banks have adopted in recent years, questioning whether those changes will amount to “more than a mere reframing.” This concern from the OCC remains despite its own recent steps to remove reputational risk as a supervisory risk category in its examinations or consider reputation risk as part of nonfinancial risks that may qualify as “unsafe or unsound” practices.
• The enumerated industry list narrowed from nine sectors to six but is expressly nonexhaustive. Certain affected industries from the Preliminary Report (i.e., adult entertainment, high-cost consumer lending and debt collection, and political action committees) are not discussed in the Report, but the Report does reiterate prior concerns regarding “partisan activity” and highlights a bank’s procedures that list several of the previously enumerated industry sectors.
• BSA/AML exposure runs in both directions. The OCC warns against “pretextual reliance” on the Bank Secrecy Act (BSA) for account terminations and states that it will work with its regulatory partners to assess the issue, even as recent AML penalties underscore that regulators expect banks to act on red flags.
• Customer communications are the most pressing area of focus. The Report criticizes vague closure and declination communications, asserts that SAR confidentiality concerns “alone do not account for” them, and says the OCC will consider guidance or regulation on closure notices.⁶ This focus is consistent with the joint statement from the federal banking regulators and FinCEN on SAR filing obligations, specifically to narrow the SAR-confidentiality rationale for vague consumer notices. The CFPB has likewise pointed to insufficient adverse action notice requirements.
• Exposure is multiagency, transactional, and potentially private. The CFPB, the Department of Justice (DOJ), state authorities, OCC licensing practices, the FDIC’s proposed merger framework, and private litigation supported by OCC information-sharing are the channels through which the Report’s characterizations may carry consequences even absent OCC enforcement.

The Review and the Report

The OCC publicly announced the initiation of the Review on September 5, 2025, when it issued an initial information request to the nine banks, which it supplemented with requests tailored to each institution’s policies. The OCC states that it examined policies and practices in place during the Review Period; reviewed nearly 100,000 complaints made between January 1, 2020, and December 31, 2025, relating to the banks and other OCC-regulated institutions; conducted transaction testing of hundreds of individual onboarding, relationship-expansion, and termination decisions; reviewed hundreds of account-closure letters; and received approximately 50,000 documents comprising approximately 420,000 pages. The Report identifies two categories of practices that in the OCC’s view presented an elevated risk of debanking: (1) reputation risk management practices, which the OCC describes as “restricting entering or maintaining customer relationships to manage ‘reputation risk’” (a term the OCC uses to refer to “the potential for adverse economic or brand impact to an institution resulting from negative public perception associated with a particular customer relationship”) and (2) industry-specific practices, which the Report describes as restricting sectors’ access “for reasons unrelated to financial or operational concerns” and ranged from categorical prohibitions to escalated reviews and approvals.⁷

The Report is a supervisory narrative rather than an adjudication, and three features of its framing are contextually important. First, its examples are excerpts the OCC selected from approximately 420,000 pages of bank documents, presented without the surrounding context, the banks’ explanations, or any indication of whether the banks dispute the OCC’s characterizations; the OCC also acknowledges that its observations reflect the limitations of the banks’ responses, tracking systems, and contemporaneous documentation. The Report’s statements are best read as the OCC’s characterizations rather than adjudicated findings. Second, the Report’s formal conclusion tracks the Executive Order’s language: The OCC contends that the policies at issue presented an elevated risk of “encouraging” or “otherwise influencing” institutions to deny or limit access. The Report does not find that any particular denial or closure was unlawful, and the OCC states that it “was unable to quantify on a comprehensive basis the full extent of debanking or alleged debanking actions or the costs to customers and prospective customers across the nine banks.”⁸ The Comptroller’s public characterization of the findings as “irrefutable evidence that the nation’s largest banks have denied, debanked and discriminated against customers and lawful businesses” is considerably stronger than the Report’s own formulation.⁹ Although the Comptroller’s remarks and the Executive Order, either directly or implicitly, focus on risk to retail customers and individuals, the Report’s findings almost exclusively cite examples involving corporate clients. Third, the Report draws more specific examples from certain banks “in part due to the thoroughness of their responses, the extent of their cooperation, or the organization of their data systems” and states that the number of references to any particular bank “does not reflect its relative volume of problematic decisions or the relative extent of its overall debanking practices.”¹⁰ The distribution of examples across the nine banks therefore should not be read as a ranking.

The Report did not announce penalties, referrals, or other enforcement or supervisory action against any of the nine banks, but it did not foreclose them. The OCC states that its fair-access work is continuing, including with respect to the complex interaction between fair-access and AML requirements and that the agency is considering further rulemaking, supervisory changes, and additional BSA guidance, as discussed below.¹¹ Comptroller Jonathan Gould stated in his public comments about the Report that the OCC has eliminated reputation risk from its own supervisory framework but that “there is more work to do.”¹²

The Report’s Legal Footing

The Report’s legal analysis is very limited. Its foreword invokes the OCC’s statutory charge to assure “fair access to financial services, and fair treatment of customers” by the institutions it supervises,¹³ and the CRA’s statement that national banks have a “continuing and affirmative obligation to help meet the credit needs of the local communities in which they are chartered.”¹⁴ Beyond those provisions, the Report’s legal citations are confined to the BSA’s SAR-confidentiality provisions, Anti-Money Laundering Act of 2020, federal banking agency issuances, and the state fair-access statutes of Florida, Tennessee, Idaho, and Texas — as to which the Report states that “[w]hether and to what extent the banks in fact complied with state fair access laws is beyond the scope of this report.”¹⁵ The Executive Order, by contrast, identifies Section 5 of the FTC Act, Section 1031 of the CFPA, and ECOA as potential bases for remedial action. ¹⁶ The Report cites none of those statutes.

As a result, the OCC may find it difficult to convert the Report into binding consequences absent new statutes or regulations. If it pursues that path, a new rulemaking would not be the OCC’s first effort: The agency finalized a fair-access rule on January 14, 2021, that would have required covered large banks to make access decisions based on individualized risk assessments, but it paused publication two weeks later, after President Joe Biden took office, and the rule never took effect.¹⁷

Principal Findings

Reputation Risk and Environmental and Social Considerations

Reputation risk is the Report’s central subject. According to the OCC, each bank maintained broad reputation risk policies built on “a wide variety of non-financial triggers or red flags”: potential controversy or protest, negative media or “headline” risk, the perceived controversy of particular categories of clients, and the anticipated reactions of “stakeholders” ranging from customers and shareholders to the media, advocacy and activist groups, elected officials, and regulators.¹⁸ The Report states that decisions were informed by negative-news screening and by what it calls “non-traditional sources,” including the designations of advocacy organizations, third-party environmental and social governance reports, and complaint data. The OCC concludes that the banks “appear no better than bank regulators at meaningfully and fairly evaluating reputation risk,” that the banks themselves acknowledged the subjective nature of the assessment, and that the risk scores, ratings, and decision matrices some banks adopted did not supply workable standards, including for how a bank might be compensated for the risk through pricing “as banks often do with respect to more established and quantifiable measurements of risk.”¹⁹ In the OCC’s view, speculative attempts to predict public opinion diverted attention from financial risks and placed banks “in a quasi-legislative position” of limiting services to lawful businesses disfavored by activists and political leaders. The Report also observes, without elaboration, that this occurred “[w]hether instigated by regulators or the banks themselves” and that the “stakeholders” whose views banks weighed included “the banks’ own regulators” — in many cases, the OCC itself.²⁰

The Report treats certain environmental and social commitments, including sector restrictions adopted as part of public climate commitments, as “reputation” decisions.²¹  But many environmental considerations implicate credit, transition, or legal and compliance risk, including non-U.S. regulatory requirements, more than reputation risks — yet the Report does not address that interaction. The examples nonetheless illustrate how the OCC interprets banks’ internal records on this topic: Where contemporaneous documents frame a decision in terms of public perception, advocacy pressure, or peer practice, the OCC treated the decision as reputation-driven.

The Report also criticizes decisions that it says tracked shifting political conditions in either direction, an effect it calls a “whipsaw.”²² The standard the OCC appears from the Report to prefer is studied neutrality, however unrealistic: In its view the propriety of a decision turns on whether it rests on individualized, objective, risk-based analysis rather than anticipated political reaction. These records that the OCC characterized as mixed-motive appeared to receive little benefit of the doubt. The Report warns that industries “may continue to suffer this whipsaw effect with the change of each administration or Congress, even in the absence of statutory changes.”²³

Industry-Specific Restrictions

Consistent with the Preliminary Report, the Report identifies industry exclusions, and escalated approvals for particular industries, as an area of particular concern. The Report enumerates six categories, stating that categories subject to restrictions “included, but were not limited to,” the following:²⁴

• oil and gas exploration, development, or production in the Arctic
• coal mining or coal-powered plants
• firearms, firearms accessories, or ammunition manufacturing or distribution
• construction or operation of detention facilities
• tobacco or e-cigarette manufacturing, distribution, or online retail
• digital asset activities, which the Report notes were “often attributed to financial crime considerations”

The OCC asserts that these restrictions rested on anticipated public reaction, “congressional oversight, shareholder resolutions, activist campaigns, and scrutiny from state and local officials” as well as investor pressure and peer practice, which the Report says can create “a snowball effect” as banks seek to avoid appearing outside the “mainstream.”²⁵

The OCC also asserts that the policies may have disproportionately affected smaller businesses while exceptions preserved lucrative relationships, describing instances in which a large client in a restricted sector received an exception or an endorsement of substantial credit support while small businesses in the same sector, with clean screening results, were declined with citation of little more than a heightened-risk list.²⁶ The Report notes that relationship economics figured in some of these decisions, such as an exception justified by “the depth of the relationship and economics,” but does not analyze whether such factors properly explained the disparity in treatment, nor does it articulate how they could.

The Report credits state fair-access laws, including Florida Statute § 655.0323 (2024), with prompting many banks in late 2023 and 2024 to replace categorical prohibitions with “heightened” risk designations and enhanced individualized review, and it describes banks citing state attestation requirements and “associated concerns of ‘debanking’” as reasons to retain relationships.²⁷ The OCC states, however, that it “cannot rule out the risk that industry status continues to weigh heavily on bank decision making,” which suggests that it may view escalated-approval regimes lacking objective criteria as problematic even when they stop short of prohibition.

Political and Religious Findings

The OCC asserts that employees escalated customers holding views outside the perceived “mainstream,” that “those views were often equated with higher potential reputation risk,” and that outcomes were inconsistent, even within a single bank, for customers with similar views. The Report states that its examples “oftentimes involved small companies or small nonprofits” and span the political spectrum.²⁸ Rather than repeat the OCC’s account of particular decisions, we summarize the categories of conduct the Report describes:

• Content-based screening in merchant services. The Report describes scenarios where merchants with political and religious content lost access to a bank’s payment processing services allegedly as a result of subjective risk reviews by the bank’s reputation risk personnel that included an assessment of consistency with the bank’s values.²⁹
• Declinations tied to owners’ or organizations’ political profile. The Report describes bank policies that treated “partisan activity” as presumptively high reputation risk and that, by the OCC’s account, led to declinations of organizations on both sides of the political spectrum while organizations regarded as bipartisan were served.³⁰
• Third-party sources and unverified allegations. The Report identifies closures and declinations prompted by allegations in a nongovernmental report, a past arrest with no evidence in the bank’s file that it resulted in charges, negative media and lawsuits involving a customer, advocacy-group designations, and government quality ratings applied outside the purpose for which they were designed, in some cases despite a customer’s explanation.³¹
• Disparate treatment of high-value relationships. The Report contrasts the closure of ordinary customers’ accounts on the basis of allegations with the retention, under conditions, of lucrative relationships involving more significant negative publicity and suggests that a customer’s ability to bring additional funds to the bank factored into banks’ decisions.³²
• Altered records. The Report asserts that internal tracking-system entries describing customers’ or prospective customers’ political or religious orientation were retrospectively edited so that the language appeared more neutral. The Report does not describe the bank’s explanation.³³

Customer Communications and BSA/AML

The Report devotes a section to the “customer experience.” According to the OCC, customers across the nine banks “frequently received vague account closure letters, often without forewarning,” that cited the bank’s contractual right to close an account, misaligned risk profiles, or “business decisions.” The OCC contends that customer-service scripts provided no meaningful explanation, and “[i]n several cases, the OCC found that if a bank had been more transparent with the customer regarding the reason for its decision prior to closure, the account could likely have remained open.”³⁴ The OCC acknowledges that SAR confidentiality and restrictions on disclosing law-enforcement requests “may have influenced” banks to say less but states that those concerns “alone do not account for the banks’ poor communication,” pointing to limited explanations in matters unrelated to money laundering. It attributes customer confusion in part to “[o]verstated concerns” about SAR confidentiality and to employee misstatements of policy, such as attributing fraud-model declines to a nonexistent bank policy.³⁵ The OCC states that closure-notice practices were not the focus of the Report and that it “has not formed conclusions regarding the adequacy of account termination notices generally” but that it “will continue to evaluate account termination practices and consider issuing additional guidance or regulations.”³⁶

The Report’s discussion of BSA/AML is limited but consequential. The OCC states that it “continues to evaluate” whether banks’ BSA compliance policies present similar debanking risks, that BSA requirements “involve subjective evaluations” that are “potentially susceptible to being used as a pretext,” and that the risk is compounded because banks “are not required to, and often do not, explain the basis for an account termination.” It identifies possible future actions including guidance clarifying the risk-based application of BSA requirements to categories of customers (specifically mentioning “domestic politically exposed persons”) or specific business activities, reforms reinforcing risk-based BSA supervision, and regulatory or supervisory changes “to prevent pretextual reliance on the BSA for account terminations unrelated to legitimate money laundering or terrorist financing concerns.”³⁷ The Report makes no finding that any bank in fact used the BSA pretextually. In practice, BSA/AML considerations may account for a larger share of terminations and declinations than reputation risk, particularly at the retail level, which may help explain the Report’s heavier focus on businesses and nonprofits than on individuals.

Bank Responses and the OCC’s Assessment

The Report describes the steps the banks reported taking, which it says began around 2023 and accelerated after the Executive Order. According to the Report, all nine banks affirmed that customers should not be denied services on the basis of political or religious beliefs and reported adopting or revising fair-access policies, codes of conduct, and training. It added that several banks now provide that reputation risk cannot be the sole basis for an adverse decision or may be considered only after credit, compliance, and financial-crime risks; many restrict frontline personnel from making unilateral reputation-based decisions and require escalation to senior or cross-functional bodies. Further, according to the Report, some banks eliminated reputation risk committees or replaced them with more broadly focused committees or recharacterized the risk as part of “franchise” or “brand” risk. In addition, the OCC found that many banks narrowed or eliminated prohibited-business classifications, including for firearms, tobacco, and digital assets, and enhanced their monitoring, testing, complaint handling, and closure letters.³⁸

The OCC’s assessment of these steps is skeptical: “Few, if any banks,” it asserts, “could articulate when pressed what objective, measurable, or quantifiable standards authorized employees would use to assess the nature and scope of reputation risk or how that risk should be weighed against more quantifiable measures of risk to the banks.” The OCC stated that few banks would wholly disclaim reputation risk; most left open consideration of “the risk of financial loss” from the perception of a customer by shareholders or other customers without identifying measurable thresholds; it is “too uncertain at this early stage to say whether the changes ... will amount to more than a mere reframing”; and “no bank has fully and publicly acknowledged its past debanking decisions or implemented a comprehensive program to provide remediation to affected customers where appropriate.” The Report also notes that some banks told the OCC they would need “only minimal policy revisions” to comply with any new regulatory restrictions.³⁹ In a footnote relevant to institutions with product or geographic limits, the OCC acknowledges that some banks retained restrictions grounded in illegality, sanctions, or financial-crime concerns as legal and compliance controls but cautions that business-line limitations based on a lack of expertise or controls “may raise concerns” where they categorically deny access to small and medium-size businesses or where “operational” limitations “entrench industry restrictions, especially when the institution has not properly considered the financial justification.”⁴⁰

The OCC’s Stated Next Steps

The Report closes with a list of actions the OCC has taken or is considering: (1) continued consideration of debanking in licensing filings and CRA examinations under Bulletin 2025-22; (2) the April 2026 rule eliminating reputation risk from supervision, which the Report notes also “removed a prior regulatory requirement that certain large insured national banks affirmatively consider reputation risk in their risk governance frameworks”; (3) “further rulemaking options” to prevent discrimination based on political or religious beliefs and to address reputation risk, “including the reliance on or incorporation of third-party opinions”; (4) a process to identify debanking-related complaint trends; (5) the September 2 SAR-confidentiality statement; coordination with Congress and with “the reviews of other federal and state partners” and encouragement of statutory change; (6) BSA modernization, including possible guidance on domestic politically exposed persons; and (7) continued evaluation of account-termination practices.⁴¹

Two of these items stand out. First, under the heading “Promoting Increased Transparency,” the OCC states that “[p]rivate litigants may play a role in depoliticizing the federal banking system” and that it “remains committed to exercising its discretion under current and proposed changes to its authorities governing disclosure of non-public OCC information ... to ensure that there are no unreasonable barriers to sharing appropriate information in connection with debanking-related litigation,” citing its August 3, 2026, proposal to amend its own information and public disclosure regulations, including those governing confidential supervisory information (CSI).⁴² Second, the reference to “third-party opinions” signals that a future rule may address banks’ use of advocacy-group designations and similar sources directly.

What Is Notable by Its Absence

For a report that Comptroller Gould describes as providing “irrefutable evidence,”⁴³ several matters that the Executive Order, the Preliminary Report, or the OCC’s own public statements led readers to expect do not appear in the Report. Those omissions bear on the weight the Report will carry and on where the next steps are likely to come from.

• No finding of a violation of law and no enforcement. The Report does not state that any bank violated any statute or regulation. Its operative statements are that policies “disadvantaged” customers and “presented an elevated risk” of debanking; as discussed above, it does not cite ECOA, the FTC Act, or the CFPA, the statutes the Executive Order identifies; it does not characterize any practices as “unsafe or unsound”; and it places state-law compliance outside its scope. It announces no penalty or consent order and does not say whether supervisory findings were communicated to the banks.
• No bank perspective. The Report quotes excerpts selected by the OCC from internal communications without the surrounding context, the banks’ explanations, or any indication of whether the banks dispute the characterizations. Several examples the OCC presents as reputation-driven are ones in which, by the Report’s own account, the bank ultimately declined for credit or revenue reasons, retained the customer, or reversed the decision.
• No referrals to the DOJ and limited assessment of religious debanking. Section 5(c) of the Executive Order directs the banking regulators to review complaint data for religion-based debanking and to refer matters to the DOJ where compliance cannot be obtained, and the Preliminary Report promised referrals “as required,” presumably referencing ECOA’s statutory requirement, cited in the Executive Order, that the banking agencies refer pattern-or-practice cases to the DOJ.⁴⁴ The Report does not mention referrals, does not report separately on the religious-debanking complaint review, and states only that the OCC has “coordinated its Debanking Review with the reviews of other federal and state partners.”⁴⁵
• No findings on bank cooperation with government surveillance. The Executive Order’s statement of purpose and the Preliminary Report’s description of the Review focused on allegations that banks flagged and shared customer transactions associated with political activity at the government’s suggestion. The Report does not address whether that conduct occurred, what regulators or law enforcement requested of banks during the Review Period, or the conduct of the OCC’s own examiners.
• No quantification, complaint outcomes, or bank-by-bank conclusions. The OCC reviewed nearly 100,000 complaints but does not report how many involved alleged political or religious debanking or how many it substantiated. It reports no counts of customers affected, accounts closed, or applications declined; offers no institution-level assessment; and cautions that the frequency of references to a bank is not a measure of its conduct.
• No standards for what is permissible. The Report describes conduct that present concerns for the OCC but not what would be satisfactory to prevent debanking. It does not define acceptable “objective, risk-based” criteria; does not say whether or how a bank may account for reputational concerns that have measurable financial consequences; does not say when a bank may decline a sector for BSA/AML, legal, or capability reasons (beyond noting that “operational” limits may “entrench industry restrictions”); and expressly defers any conclusion on the adequacy of account-closure notices. As noted above, the Report does not find that the BSA was in fact used pretextually, a question that is deferred to continued work with the OCC’s regulatory partners.
• The regulators’ own role. The Report acknowledges in passing that the practices it criticizes arose “[w]hether instigated by regulators or the banks themselves,” that banks weighed “the views of government entities (including the banks’ own regulators),” and that the April 2026 rule removed a longstanding regulatory requirement that large national banks “affirmatively consider reputation risk in their risk governance frameworks.” It does not otherwise examine the extent to which the frameworks it criticizes were built to satisfy the OCC’s own heightened-standards guidelines, which listed reputation risk among the risks a covered bank’s risk governance framework was required to address throughout the Review Period, or what supervisory communications the banks received on these subjects.⁴⁶
• Digital assets, payment intermediaries, and individuals. Digital assets, the sector most associated with the “Operation Chokepoint 2.0” allegations that animated much of the debanking debate, receive a single sentence in the industry discussion attributing restrictions “often” to financial-crime considerations, with no supporting examples, and otherwise appear only in passing references to banks’ recent policy changes. Although the Executive Order speaks of individuals and families, nearly every example in the Report involves a business or nonprofit, and the Report contains no example of an individual’s personal account closed because of the individual’s beliefs.
• No timetable. The Report gives no date for completing the Review, no schedule for the rulemakings it contemplates, and no information on the status of the parallel reviews by the FDIC, the Federal Reserve, and the National Credit Union Administration (NCUA) that the Executive Order also directed.

The Report in Context: Fair-Access Developments of the Past Three Months

The Report is the most detailed product of the Executive Order to date, but it is one of several fair-access developments since August 2026, summarized in the table below. The Report and these actions build on earlier steps, including the OCC’s September 2025 bulletins on licensing, CRA, and customer financial records;⁴⁷ the OCC and FDIC April 2026 final rule prohibiting the use of reputation risk by regulators;⁴⁸ and the Federal Reserve’s proposed rule prohibiting the use of reputational risk by regulators.⁴⁹ We discuss the developments most relevant to the Report below.

Date (2026)	Action	Relevance to the Report
Aug. 3	OCC Bulletin 2026-37 proposing amendments to OCC regulations on availability of nonpublic OCC information, including CSI	Cited in the Report as supporting information-sharing in debanking-related litigation
Aug. 27	OCC and FDIC final rule defining “unsafe or unsound practice” and limiting matters requiring attention; OCC proposal on violations of law	Narrows supervisory levers; excludes reputational risk unrelated to financial condition
Sept. 2	FinCEN, Federal Reserve, FDIC, NCUA, and OCC joint statement on SAR confidentiality and customer communications	Removes SAR confidentiality as rationale for vague customer notices; listed in the Report among OCC fair-access actions
Sept. 17 (published Sept.22)	FDIC proposal on merger transactions, including “fair banking” review for resulting institutions above $50 billion	Embeds fair access in merger review; comments due Nov. 23, 2026
Sept. 24	Federal Reserve updated Statement of Supervisory Operating Principles	Aligned on financial-risk focus; reputation risk rule still only proposed
Oct. 1	CFPB Fair Lending Report for 2025	Debanking identified as priority; ECOA and Fair Credit Reporting Act (FCRA) adverse action notices emphasized
Oct. 13	Treasury, OCC, FinCEN, and OFAC BSA/AML and sanctions actions against a large national bank (more than $1.21 billion)	Reflects countervailing BSA compliance considerations
Oct. 14	Report; CFPB announces investigations	Potential follow-on enforcement under ECOA, FCRA, and CFPA

The FDIC’s Proposed “Fair Banking” Review in Bank Mergers

On September 17, 2026, the FDIC Board approved a notice of proposed rulemaking that would comprehensively reform the FDIC’s review of transactions under the Bank Merger Act, including tailored filing and processing tracks, codified competition and financial-stability safe harbors, and greater weight for remediation plans addressing supervisory deficiencies. The proposal was published in the Federal Register on September 22, 2026, and comments are due November 23, 2026.⁵⁰

As part of that overhaul, the proposal would add “fair banking” considerations to the FDIC’s evaluation of the convenience and needs of the community for any merger transaction that would result in an institution with more than $50 billion in assets (a threshold the FDIC proposes to index). For those transactions, the FDIC would review the parties’ supervisory records to determine whether either party has treated existing or potential customers less favorably than other existing or potential customers based on political, social, cultural, or religious considerations rather than individualized, objective, and risk-based analysis and would consider any plan to remediate identified fair banking concerns. The FDIC’s preamble ties the provision to the Executive Order and describes it as a means of deterring and combating politicized or unlawful debanking.⁵¹

Several aspects of the proposed rule bear on the Report. First, the proposal’s direct reach is limited. It applies only to transactions subject to the FDIC’s approval under the Bank Merger Act, principally those involving state nonmember banks, whereas the nine banks reviewed in the Report are national banks whose mergers are reviewed by the OCC (and, for holding company transactions, by the Federal Reserve). The OCC, however, already has a practice of considering debanking in licensing filings, including business combinations, and the Report itself notes that one bank represented in “a recent merger application” that it would not restrict access except on an individualized, objective, risk-based basis, so the agencies are converging on a common approach through different instruments.⁵² Second, the “supervisory records” formulation means that characterizations of the type in the Report, along with matters requiring attention, consent orders, and complaint data, can feed directly into the FDIC’s transaction review. Third, the proposal leaves several questions open that commenters may wish to address: Its formulation (“political, social, cultural, or religious considerations” and “less favorably”) is broader than the Executive Order’s definition of politicized or unlawful debanking, which turns on political or religious beliefs and lawful business activities the provider disfavors for political reasons;⁵³ it does not state whether industrywide policies of the kind the Report criticizes would be considered as treating “customers” less favorably; and it does not define what supervisory record would constitute a fair banking concern or what remediation would suffice. Fourth, by crediting remediation plans, the FDIC’s proposal suggests that identified fair banking concerns need not be disqualifying if remediated credibly, which sits alongside the OCC’s skepticism, expressed in the Report, that bank self-reform will be sustainable.

The Joint Statement on SAR Confidentiality and Customer Communications

On September 2, 2026, FinCEN, the Federal Reserve, the FDIC, the NCUA, and the OCC issued a joint statement clarifying how SAR confidentiality requirements apply when banks communicate with customers about potentially fraudulent transactions, other suspicious activity, or account closures; the Report lists the statement among the OCC’s fair-access actions.⁵⁴ The statement does not alter existing BSA requirements or establish new supervisory expectations. It rests on FinCEN’s existing rule, under which “a SAR or any information that would reveal the existence of a SAR” does not include “the underlying facts, transactions, and documents upon which a SAR is based.”⁵⁵ The agencies therefore state that the BSA does not prohibit a bank from communicating with a customer who may be the subject of a SAR about potentially suspicious transactions, or from notifying the customer of its intention to close the account for potentially suspicious activity, so long as the communication does not reveal the existence of a SAR.⁵⁶

The statement gives a nonexhaustive list of communications that would typically not reveal a SAR, including requesting customer due diligence information; notifying a customer that a delay, limitation, restriction, or closure of an account may be related to suspected fraud or other suspicious activity; asking about the purpose of a transaction or the source of funds; and communicating policies or decisions on account maintenance, such as declining a transaction or closing an account. It also states that banks may discuss the transactions in question, their remediation efforts, and the mitigation steps available to the customer and that factual information such as transaction dates, amounts, and parties may be discussed even though a reasonable and prudent person might deduce that a SAR was or may have been filed. The statement expressly recognizes the concerns underlying the Executive Order and states that its purpose includes giving customers greater assurance of fair access.⁵⁷

The statement is guidance rather than a rule, and it permits rather than requires communication. Its significance lies in timing and context. Issued six weeks before the Report, it substantially narrows SAR confidentiality as a justification for declining to explain closures, and the Report’s statement that SAR confidentiality concerns “alone do not account for” the banks’ communications practices indicates that examiners may not accept it as such. Banks should expect examiners and the CFPB to ask why a given closure was not accompanied by an explanation that the statement would have permitted. The statement also retains the core prohibition and urges case-by-case judgment, so banks must continue to guard against inadvertent disclosure. That calls for standardized scripts and nonconfirming responses to the predictable question whether a SAR was filed, escalation protocols involving the BSA officer and legal, and training for frontline personnel. Because any AML-based explanation must be supportable, banks should ensure that the basis for an AML-related exit is documented contemporaneously rather than reconstructed later.

Supervisory-Framework Actions

Three supervisory developments shape the OCC’s ability to act on the Report. First, the OCC and FDIC reputation risk rule, published in April 2026 and effective in June, eliminates reputation risk as a supervisory risk category and bars the agencies from requiring, instructing, or encouraging institutions to terminate or modify customer relationships on the basis of political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of politically disfavored but lawful business activities; the NCUA adopted a parallel rule in June.⁵⁸ Second, on August 27, 2026, the OCC and FDIC adopted a final rule defining “unsafe or unsound practice” as conduct contrary to generally accepted standards of prudent operation that is likely to materially harm an institution’s financial condition or present a material risk of loss to the Deposit Insurance Fund (or that has done so) and limiting matters requiring attention to such practices and to actual violations of law. The agencies stated that the nonfinancial risks that may qualify do not include reputational risks unrelated to financial condition. The OCC simultaneously proposed to codify that matters requiring attention for violations of law will be reserved for substantive violations, which include those that are systemic or part of a pattern or that have more than a minimal adverse impact on customers.⁵⁹ Third, on September 24, 2026, the Federal Reserve updated its Statement of Supervisory Operating Principles to focus on significant financial harm, but the Federal Reserve’s proposal to codify the elimination of reputation risk remains pending, so the framework applicable to Federal Reserve–supervised institutions is not yet aligned with the OCC’s and FDIC’s.⁶⁰

These actions have two implications for the Report. They narrow the supervisory tools the OCC could use against debanking-type practices that cause no financial harm, which reinforces the importance of the CFPB, state law, licensing, and private-litigation channels discussed above. Further, the August 27 rule’s distinction between reputational concerns “unrelated to financial condition” and those that are related raises a question the Report does not answer: how a bank may document that a customer relationship poses a genuine, measurable financial risk through reputational channels, such as deposit attrition or counterparty loss, without that analysis’ being characterized as reputation-based debanking. As a result, banks will have to navigate the competing tensions of the public reports and statements by regulators on debanking-type practices focused on reputational risk, the confidential examinations in which reputational risk largely has been removed as a supervisory focus, and the risk of public enforcement actions involving BSA/AML and other areas of law involving negative customer interactions that could be cast in the light of potential debanking.

Enforcement and Litigation

BSA enforcement. On October 13, 2026, the day before the Report, Treasury, FinCEN, the OCC, and OFAC announced coordinated actions against one of the banks covered by the Review with penalties totaling more than $1.21 billion: a $750 million civil money penalty from the OCC, the largest in its history; a $1.2 billion civil money penalty from FinCEN, against which the OCC penalty is credited, accompanied by the bank’s admission that it willfully violated the BSA; and an approximately $11.6 million settlement with OFAC.⁶¹ FinCEN found that the bank failed to timely report more than $5 billion in suspicious transactions and failed to respond timely to red flags involving certain customers after compliance personnel escalated concerns. The FinCEN consent order emphasizes priorities including cartels and narcotics trafficking, Chinese money laundering networks, Iran, and Russia. Treasury’s accompanying statement cautions that institutions may not disregard mounting red flags and that documenting concerns or engaging in prolonged internal review without corrective action does not satisfy BSA obligations.⁶² Read together with the Report, these actions present two-sided exposure: The OCC cautions against pretextual BSA-based exits, while the OCC and its Treasury counterparts simultaneously send a strong signal that banks should act decisively on customer red flags.

CFPB. On October 14, shortly after the OCC released the Report, the CFPB announced that it will investigate whether the institutions featured in the Report, and other financial services institutions under its jurisdiction, complied with federal consumer financial laws, citing ECOA, the FCRA, particularly its adverse action notice requirements, and its authority over unfair, deceptive, or abusive acts or practices (UDAAP). The CFPB noted that it holds primary supervisory and enforcement authority over banks with more than $10 billion in assets, including the banks named in the Report, to assess their compliance with federal consumer financial laws.⁶³ The CFPB’s October 1 Fair Lending Report for 2025 likewise identifies debanking as a key priority, emphasizes adverse action notices under ECOA and FCRA in that context, and describes coordination with DOJ’s Equal Access to Banking Task Force.⁶⁴ The scope of these theories is unsettled. ECOA reaches credit but not deposit accounts and does not list political beliefs as a prohibited basis. FCRA adverse action notices by contrast are triggered by the use of information in a consumer report, and how that trigger would apply to AML-related closures and declinations is complex. Institutions should nonetheless expect the CFPB to test notice content and timing and to scrutinize the stated reasons for adverse actions.

DOJ and the states. The Executive Order contemplates referral to the Attorney General of religion-based debanking that is not resolved through compliance efforts. DOJ’s Civil Rights Division and the U.S. Attorney’s Office for the Eastern District of Virginia, together with the Virginia Attorney General, formed an Equal Access to Banking Task Force in April 2025,⁶⁵ and the U.S. Attorney’s Office for the District of Columbia was reported in June 2026 to have opened its own inquiry into debanking by large banks.⁶⁶ Neither has reported any public results. State fair-access laws, which the Report identifies as an influence on bank policy, provide additional enforcement vehicles, and the Report’s account of a bank weighing exposure to state investigation and loss of state business illustrates their practical weight.

Private litigation. The pretext question is also being litigated privately. Regardless of their merits, several ongoing cases illustrate the exposure faced by banks whose AML-based rationales are challenged as post hoc. The OCC’s stated willingness to share nonpublic information with debanking litigants and express encouragement of more private litigation may increase this exposure.

Key Takeaways

Reputation-driven financial impact remains an open question. The OCC disfavors reputation risk–based decisions but offers no guidance on how banks should address the very real reputational concerns that translate into financial loss and are not captured by other risk categories. The Report’s observation that banks lack standards for being “adequately compensated for that risk (e.g., through pricing),” and the August 27 rule’s focus on reputational risks “unrelated to financial condition,” together suggest that the line the agencies may draw is between reputation as perception and reputation as measured, priced, and documented financial consequence. Neither document describes the evidence that would suffice.

Balancing BSA/AML and fair access will be difficult, and both risks are serious. Nothing in the Report suggests that the OCC will be less stringent about money laundering violations, particularly those that relate to national security priorities such as cartels, narcotics trafficking, Chinese money laundering networks, Iran, and Russia, as the October 13 actions confirm. Any adjustment of standards to mitigate debanking risk should be matched with a rigorous assessment of whether those changes increase AML risk and with investment in the resources needed to mitigate that risk.

Practical steps. Whatever the merits of the OCC’s characterizations, the Report signals how the OCC, and likely other agencies and litigants, will read a bank’s internal record. Banks should consider the following:

• Inventory and rebaseline policies. Review reputation risk, “franchise” or “brand” risk, escalation, and industry-restriction provisions, including nonpublic tiered protocols and commitments embedded in sustainability reporting, and replace nonfinancial criteria with measurable credit, market, liquidity, operational, and legal and compliance criteria, applied consistently and with documented thresholds.
• Govern third-party inputs and escalations. Adopt written standards for the use of adverse media, advocacy-organization designations, and third-party ratings; test for consistent treatment of similarly situated customers across the political spectrum and across relationship size; and document the financial or operational justification for any retained sector or business-line limitation.
• Review financing conditions. Reassess covenants and conditions that require customers to adopt environmental or social standards, and confirm that any retained conditions are tied to credit, legal, or regulatory risk.
• Update customer-communication practices. Reassess account-closure and declination letters and scripts in light of the September 2 joint statement and the Report’s criticisms, analyze adverse action notice obligations under ECOA and FCRA, and train frontline personnel on what may and may not be said about suspicious activity and about fraud-model declines.
• Document AML-based exits contemporaneously. Ensure that the BSA/AML basis for an exit is individualized and recorded at the time of decision, with BSA officer and legal involvement, so that it can withstand a pretext challenge without weakening AML controls.
• Integrate fair banking into mergers and acquisitions and licensing. Consider commenting on the FDIC merger proposal by November 23, 2026.

Outlook

The OCC states that the Review is nearing completion; that its fair-access work is ongoing; and that it is considering further rulemaking on reputation risk and third-party opinions, additional BSA guidance, and guidance or regulation on account-closure notices. The near-term calendar includes the November 23 comment deadline on the FDIC merger proposal, the CFPB’s announced investigations, and any final action on the OCC’s proposed amendments to its rules on the availability of nonpublic information. The FDIC, the Federal Reserve, and the NCUA conducted reviews of supervised institutions under the Executive Order but have not published their findings, and the OCC’s Report may increase pressure on those agencies to do so. Legislation to codify fair-access principles, including the Fair Access to Banking Act and the FIRM Act, has also been introduced in Congress. Other regulators continue to operate on separate tracks, and the October 13 actions demonstrate that BSA/AML and sanctions enforcement continues in parallel. Institutions should expect continued examination, investigative, and litigation attention to these issues.

 

---

 

¹ Off. of the Comptroller of the Currency, Guaranteeing Fair Banking for All Americans (Oct. 14, 2026) (the Report), https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-90a.pdf; see also Press Release, Off. of the Comptroller of the Currency, News Release 2026-90, OCC Releases Report on Large Banks’ Debanking Activities (Oct. 14, 2026), https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-90.html. Pin cites are to the Report’s printed page numbers.
² Report, supra note 1, at 1, 12.
³ Exec. Order No. 14,331, Guaranteeing Fair Banking for All Americans, 90 Fed. Reg. 38,925 (Aug. 12, 2025), https://www.whitehouse.gov/presidential-actions/2025/08/guaranteeing-fair-banking-for-all-americans/; Report, supra note 1, at 10.
⁴ Off. of the Comptroller of the Currency, Preliminary Findings from the OCC’s Review of Large Banks’ Debanking Activities (Dec. 10, 2025) (the Preliminary Report), https://www.occ.gov/news-issuances/news-releases/2025/nr-occ-2025-123a.pdf; see Report, supra note 1, at 11.
⁵ Report, supra note 1, at 45.
⁶ See Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Financial Crimes Enforcement Network, National Credit Union Administration, and Office of the Comptroller of the Currency, Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers (Sept. 2, 2026) (the Joint Statement), https://www.fincen.gov/system/files/2026-09/Joint-Statement-on-SAR-Confidentiality.pdf.
⁷ Report, supra note 1, at 10-12 and n.7, 36.
⁸ Report, supra note 1, at 1, 7, 11–12; see Exec. Order No. 14,331, supra note 3, § 5(b).
⁹ OCC News Release 2026-90, supra note 1 (statement of Comptroller Gould).
¹⁰ Report, supra note 1, at 7, 11, 13.
¹¹ Report, supra note 1, at 43–45; OCC News Release 2026-90, supra note 1.
¹² OCC News Release 2026-91, Comptroller Gould Discusses Findings of Debanking Report (Oct. 14, 2026), https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-91.html.
¹³ 12 U.S.C. § 1(a)
¹⁴ Report, supra note 1, at 1 & n.1 (citing 12 U.S.C. § 1(a) and 12 U.S.C. § 2901). The quoted CRA language appears at 12 U.S.C. § 2901(a)(3).
¹⁵ Report, supra note 1, at 34–35 & nn.17–18, 37 n.19 (citing Fla. Stat. § 655.0323 (2024); Tenn. Code § 45-1-128 (2024); Idaho Code § 26-3804 (2025); Tex. Gov’t Code chs. 809, 2274 (2021); 31 U.S.C. §§ 5318(g)(2), 5321, 5322).
¹⁶ Exec. Order No. 14,331, supra note 3, §§ 1, 5(b); 15 U.S.C. § 45; 12 U.S.C. § 5531; 15 U.S.C. § 1691et seq.
¹⁷ Press Release, Off. of the Comptroller of the Currency, News Release 2021-14 (Jan. 28, 2021) (announcing a pause in publication of the final fair-access rule issued Jan. 14, 2021), https://occ.treas.gov/news-issuances/news-releases/2021/nr-occ-2021-14.html; see Report, supra note 1, at 8, 45 (private litigation).
¹⁸ Report, supra note 1, at 14–15.
¹⁹ Report, supra note 1, at 3, 16.
²⁰ Report, supra note 1, at 7.
²¹ Report, supra note 1, at 27–28, 30–31, and n.16.
²² Report, supra note 1, at 32–33.
²³ Report, supra note 1, at 5.
²⁴ Report, supra note 1, at 27.
²⁵ Report, supra note 1, at 28–29.
²⁶ Report, supra note 1, at 5, 33–34.
²⁷ Report, supra note 1, at 5, 34–35.
²⁸ Report, supra note 1, at 3, 16–17.
²⁹ Report, supra note 1, at 2, 18–20, and nn.11–12.
³⁰ Report, supra note 1, at 4, 17, 23.
³¹ Report, supra note 1, at 4, 24–26 and nn.14–15.
³² Report, supra note 1, at 4, 26.
³³ Report, supra note 1, at 3, 17–18, 20.
³⁴ Report, supra note 1, at 6, 36–37.
³⁵ Report, supra note 1, at 37–38 and n.19.
³⁶ Report, supra note 1, at 45 and n.28.
³⁷ Report, supra note 1, at 8 and nn.2–4, 38 and nn.20–21, 45. The Report cites the OCC’s April 2026 proposal to revise its AML/CFT program rule, 91 Fed. Reg. 18,304 (Apr. 10, 2026), and FinCEN’s substantively identical proposal, 91 Fed. Reg. 18,704 (Apr. 10, 2026), as reinforcing the risk-based nature of BSA requirements.
³⁸ Report, supra note 1, at 39–42.
³⁹ Report, supra note 1, at 6, 40–42.
⁴⁰ Report, supra note 1, at 42 n.22.
⁴¹ Report, supra note 1, at 43–45 and nn.23–28.
⁴² Report, supra note 1, at 8, 45, and n.27 (citing OCC Bulletin 2026-37, Bank Supervision: OCC Rules Regarding the Availability of OCC Information (Aug. 3, 2026), https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-37.html).
⁴³ See Press Release, Off. of the Comptroller of the Currency, News Release 2026-90, OCC Releases Report on Large Banks’ Debanking Activities (Oct. 14, 2026), https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-90.html. Pin cites are to the Report’s printed page numbers.
⁴⁴ See 15 U.S.C. § 1691e(g).
⁴⁵ Cf., Exec. Order No. 14,331, supra note 3, § 5(c) (citing 15 U.S.C. §§ 1691, 1691e(g)); Preliminary Report, supra note 4, at 4; Report, supra note 1, at 9, 44.
⁴⁶ Report, supra note 1, at 7, 15, 44; see 12 C.F.R. pt. 30, app. D, § II.C (as in effect before the April 2026 amendments) (providing that a covered bank’s risk governance framework should cover, among other categories, “reputation risk”); 91 Fed. Reg. 18,279 (Apr. 10, 2026).
⁴⁷ Off. of the Comptroller of the Currency, OCC Bulletin 2025-22, Licensing and Community Reinvestment Act: Consideration of Politicized or Unlawful Debanking (Sept. 8, 2025), https://www.occ.gov.news-issuances/bulletins/2025/bulletins-2025-22.html; Off. of the Comptroller of the Currency, OCC Bulletin 2025-23, Protecting Customer Financial Records (Sept. 8, 2025), https://www.occ.gov/news-issuances/bulletins/2025/bulletin-2025-23.html.
⁴⁸ OCC and FDIC, Prohibition on the Use of Reputation Risk by Regulators, 91 Fed. Reg. 18,279 (Apr. 10, 2026), https://www.federalregister.gov/documents/2026/04/10/2026-06947/prohibition-on-the-use-of-reputation-risk-by-regulators.
⁴⁹ Board of Governors of the Federal Reserve System, Prohibition on Use of Reputation Risk or Other Supervisory Tools to Encourage or Compel Banking Organizations to Engage in Politicized or Unlawful Discrimination, 91 Fed. Reg. 9,499 (Feb. 26, 2026) (notice of proposed rulemaking); see Report, supra note 1, at 15 n.9.
⁵⁰ FDIC, Merger Transactions, 91 Fed. Reg. 60,196 (Sept. 22, 2026) (notice of proposed rulemaking), RIN 3064-AG18, https://www.govinfo.gov/content/pkg/FR-2026-09-22/pdf/2026-19308.pdf; FDIC Press Release, FDIC Board of Directors Approves Proposed Rule to Modernize and Reform the FDIC’s Framework for Reviewing Bank Merger Transactions (Sept. 17, 2026), https://www.fdic.gov/news/press-releases/2026/fdic-board-directors-approves-proposed-rule-modernize-and-reform-fdics.
⁵¹ 91Fed. Reg. 60,196, supra note 49, proposed 12 C.F.R. § 333.5 and preamble, at 60, 227. The proposal would first adjust the $50 billion threshold on October 1, 2029, and biennially thereafter. Id. at 60,222.
⁵² OCC Bulletin 2025-22, supra note 46; Report, supra note 1, at 40, 43 and n.23.
⁵³ Exec. Order No. 14,331, supra note 3, § 3(a).
⁵⁴ Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Financial Crimes Enforcement Network, National Credit Union Administration, and Office of the Comptroller of the Currency, Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers (Sept. 2, 2026) (the Joint Statement), https://www.fincen.gov/system/files/2026-09/Joint-Statement-on-SAR-Confidentiality.pdf; Report, supra note 1, at 44 and n.26 (citing OCC Bulletin 2026-43).
⁵⁵ 31 C.F.R. § 1020.320(e)(1)(ii)(A)(2); see also FinCEN, Confidentiality of Suspicious Activity Reports, 75 Fed. Reg. 75,593, 75,598 (Dec. 3, 2010); 31 U.S.C. § 5318(g)(2).
⁵⁶ Joint Statement, supra note 53, at 2.
⁵⁷ Joint Statement, supra note 53, at 1–3. The statement also cites the final rules prohibiting the FDIC, OCC, and NCUA from requiring, instructing, or encouraging institutions to terminate or modify customer relationships on the basis of political, social, cultural, or religious views or beliefs. Id. at 1 n.3.
⁵⁸ 91 Fed. Reg. 18,279, supra note 47; Prohibition on the Use of Reputation Risk, 91 Fed. Reg. 38,270 (June 25, 2026); see also Joint Statement, supra note 53, at 1 n.3; Report, supra note 1, at 15 n.9, 44.
⁵⁹ OCC and FDIC, Unsafe or Unsound Practices, Matters Requiring Attention, 91 Fed. Reg. 56,004 (Sept. 1, 2026) (final rule); OCC Bulletin 2026-40 (Aug. 27, 2026), https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-40.html; OCC News Release 2026-72 (Aug. 27, 2026), https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-72.html; OCC, Violations of Laws or Regulations, 91 Fed. Reg. 56,074 (Sept. 1, 2026) (notice of proposed rulemaking).
⁶⁰ Bd. of Governors of the Fed. Rsrv. Sys., Division of Supervision and Regulation, Statement of Supervisory Operating Principles (updated Sept. 24, 2026), https://www.federalreserve.gov/supervisionreg/files/statement-of-supervisory-operating-principles-20260924.pdf; 91 Fed. Reg. 9,499, supra note 48.
⁶¹ U.S. Department of the Treasury, U.S. Treasury Announces Record Enforcement Actions Against Bank of America (Oct. 13, 2026), https://home.treasury.gov/news/press-releases/sb0657; OCC News Release 2026-89 (Oct. 13, 2026), https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-89.html; FinCEN, In re Bank of America, N.A., Consent Order No. 2026-03 (Oct. 13, 2026), https://www.fincen.gov/system/files/2026-10/BoA-Consent-Order-Execution-Final.pdf.
⁶² Treasury Press Release, supra note 60; FinCEN Consent Order, supra note 60.
⁶³ CFPB, CFPB Announces New Initiative to Address OCC-Uncovered Debanking by Large Banks (Oct. 14, 2026), https://www.consumerfinance.gov/about-us/newsroom/cfpb-announces-new-initiative-to-address-occ-uncovered-debanking-by-large-banks/.
⁶⁴ CFPB, Fair Lending Report of the Consumer Financial Protection Bureau for 2025, § 2.3 (Sept. 2026), https://files.consumerfinance.gov/f/documents/cfpb_2025-fair-lending-annual-report_202609.pdf.
⁶⁵ U.S. Attorney’s Office, Eastern District of Virginia, U.S. Attorney Announces Launch of a Task Force to Combat Illegal Debanking in the Eastern District of Virginia (Apr. 28, 2025), https://www.justice.gov/usao-edva/pr/us-attorney-announces-launch-task-force-combat-illegal-debanking-eastern-district.
⁶⁶ See Jeanine Pirro’s Prosecutors Probe Big Banks for Alleged ‘Debanking’, Wall St. J. (June 10, 2026), https://www.wsj.com/finance/regulation/jeanine-pirros-prosecutors-probe-big-banks-for-alleged-debanking-13568e9b.