For Examiner Eyes Only: The Safest Ways for Financial Institutions to Share Sensitive Information

Washington, D.C. - Regulators require banks and other financial institutions to share certain sensitive information as part of the examination process. This information can include roadmaps to the institution's cybersecurity defenses, CEO succession plans and M&A proposals. Given the sensitivity of such data and the rise in sophisticated cyber threats, it's critical that financial firms can keep their information secure - including when examiners need to access it. Granular details of such data are often extraneous to the mandate of examiners, who are meant to focus on material risks to the bank, such as interest rate risk. A new joint paper by a coalition of financial trade association^[1] recommends best practices for sharing access to sensitive information in the supervisory process.

"These improved data sharing practices will collectively reduce the cybersecurity risks associated with the collection, retention and transmission of sensitive supervisory information, benefiting customers, investors, financial regulators and supervised institutions alike," the associations wrote in the paper.

Context. In the past, examiners would visit banks to inspect their records on-site, but now, the process is increasingly digital, which risks exposing the sensitive data to breaches. Cybersecurity incidents discovered at the Office of the Comptroller of the Currency in 2025 and the Treasury Department in 2024 respectively brought such threats to the forefront - after the breaches, the banking agencies worked with the industry to update, standardize and strengthen sharing practices for sensitive supervisory data.

Updated Procedures. The OCC, Federal Reserve and FDIC recently released guidance that updated procedures for handling sensitive bank data during the supervisory process. The updated protocols would:

• Encourage consistency among secure data transfer methods and protections in line with risk-based best practices.
• Increase reliance on information sharing via firm-controlled access, electronically or physically via on-site review.
• Apply additional content and access control measures for particularly sensitive types of information.

Recommended Practices. The paper complements the interagency statement and suggests risk-based practices to safeguard the information that firms share with regulators:

• Providing firm-controlled access to sensitive data either electronically via firm-hosted applications, by screen-sharing or physically via on-site review.
• Narrowing the regulator audience by tracking and controlling access to certain examiners with a demonstrable need to know.
• Creating summaries or aggregated data instead of transmitting detailed records, individually identifiable information or entire privileged documents.
• Providing samples or excerpts instead of comprehensive data sets or documents to reduce unnecessary exposure.
• Redacting sensitive details such as personally identifiable information (PII), employee compensation and performance data, board member evaluations, internal IP addresses and any material protected by the attorney-client privilege or the attorney work product doctrine.

[1] The groups co-authoring the paper are: the Bank Policy Institute, American Bankers Association, Consumer Bankers Association, Global Financial Markets Association, Independent Community Bankers of America, Institute of International Bankers, Investment Company Institute, Managed Funds Association and Securities Industry and Financial Markets Association.

###

About BPI

The Bank Policy Institute is a nonpartisan public policy, research and advocacy group that represents universal banks, regional banks and the major foreign banks doing business in the United States. The Institute produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud and other information security issues.

About ABA

The American Bankers Association is the voice of the nation's $26.1 trillion banking industry, which is composed of small, regional and large banks that together employ over 2 million people, safeguard $20.5 trillion in deposits and extend $13.7 trillion in loans.

About ASIFMA

ASIFMA (Asia Securities Industry & Financial Markets Association) is an independent, regional trade association comprising a diverse range of approximately 150 leading financial institutions from both the buy and sell side, including banks, asset managers, professional services firms and market infrastructure service providers. Together, we harness the shared interests of the financial industry to promote the development of liquid, deep and broad capital markets in Asia. ASIFMA advocates stable, competitive and efficient Asian capital markets that are necessary to support the region's economic growth. We drive consensus, advocate solutions and effect change around key issues through the collective strength and clarity of one industry voice. Our many initiatives include consultations with regulators and exchanges, development of uniform industry standards, advocacy for enhanced markets through policy papers, and lowering the cost of doing business in the region. Through the GFMA alliance with SIFMA in the US and AFME in Europe, ASIFMA also provides insights on global best practices and standards to benefit the region. Please see www.asifma.org for more information.

About CBA

The Consumer Bankers Association represents America's leading retail banks. We promote policies to create a stronger industry and economy. Established in 1919, CBA's corporate member institutions account for 1.7 million jobs in America, extend roughly $4 trillion in consumer loans and provide $275 billion in small business loans annually. Follow us on X @consumerbankers.

About GFMA

The GFMA represents the common interests of the world's leading financial and capital market participants, to provide a collective voice on matters that support global capital markets. We advocate on policies to address risks that have no borders, regional market developments that impact global capital markets, and policies that promote efficient cross-border capital flows, benefiting broader global economic growth. The Global Financial Markets Association ("GFMA") brings together three of the world's leading financial trade associations to address the increasingly important global regulatory agenda and to promote coordinated advocacy efforts. The Association for Financial Markets in Europe ("AFME") in London, Brussels and Frankfurt, the Asia Securities Industry & Financial Markets Association ("ASIFMA") in Hong Kong and Singapore, and the Securities Industry and Financial Markets Association ("SIFMA") in New York and Washington are, respectively, the European, Asian and North American members of GFMA.

About IIB

The Institute of International Bankers (IIB) represents the U.S. operations of internationally headquartered financial institutions from more than 35 countries around the world. The membership consists of international banks that operate branches, agencies, bank subsidiaries, and broker-dealer subsidiaries in the United States. The IIB works to ensure a level playing field for these institutions, which supported $5.4 trillion in foreign direct investment by underwriting more than 70% of debt issuance in the United States by internationally headquartered companies between 2020 and 2024. These institutions also underwrote more than 40% of U.S. financing raised during this same time period and comprise the majority of U.S. primary dealers.

About ICBA

The Independent Community Bankers of America® has one mission: to create and promote an environment where community banks flourish. We power the potential of the nation's community banks through effective advocacy, education, and innovation.

As local and trusted sources of credit, America's community banks leverage their relationship-based business model and innovative offerings to channel deposits into the neighborhoods they serve, creating jobs, fostering economic prosperity, and fueling their customers' financial goals and dreams. For more information, visit ICBA's website at icba.org.

About MFA

Managed Funds Association (MFA), based in Washington, D.C., New York City, Brussels, and London, represents the global alternative asset management industry. MFA's mission is to advance the ability of alternative asset managers to raise capital, invest it, and generate returns for their beneficiaries. MFA advocates on behalf of its membership and convenes stakeholders to address global regulatory, operational, and business issues. MFA has more than 180 fund manager members, including traditional hedge funds, private credit funds, and hybrid funds, that employ a diverse set of investment strategies. Member firms help pension plans, university endowments, charitable foundations, and other institutional investors diversify their investments, manage risk, and generate attractive returns throughout the economic cycle.

About SIFMA

SIFMA is the voice of the U.S. securities industry. We represent the broker-dealers, banks and asset managers whose nearly 1 million employees provide access to the capital markets, raising over $2.5 trillion for businesses and municipalities in the U.S., serving clients with over $20 trillion in assets and managing more than $67 trillion in assets for individual and institutional clients including mutual funds and retirement plans. SIFMA, with offices in New York and Washington, D.C., is the U.S. regional member of the Global Financial Markets Association (GFMA). For more information, visit http://www.sifma.org.

Media Contacts

Tara PayneBank Policy [email protected]

Sarah GranoAmerican Bankers [email protected]

Weston LoydConsumer Bankers [email protected]

Corliss RugglesASIFMA/[email protected]

Nicole SwannIndependent Community Bankers of [email protected]

Leslie GarrettInstitute of International [email protected]

Stephen BradfordInvestment Company [email protected]

Managed Funds [email protected]

Lindsay [email protected]