Confidential Supervisory Information: What to Know

Confidential supervisory information, or CSI, generally refers to nonpublic information created or obtained through the bank supervision process. It can include examination reports, supervisory correspondence, supervisory ratings such as CAMELS ratings, Matters Requiring Attention and information about enforcement activities.

The federal banking agencies consider CSI to be their property and take the view that sharing it may result in criminal charges. Stringent penalties and unclear definitions stifle banks' ability to share such information, even within the firm. The current CSI rules fail to strike a balance between security and flexibility - but newly proposed changes could make the regime more practical.

Why Does It Matter?

Banks must be able to protect CSI while also ensuring that the right people have access to the information needed to manage risk, address supervisory concerns and run their organizations effectively.

In practice, that often means that banks need to share information with affiliates, parent companies, legal counsel, auditors, service providers, prospective executives and others involved in governance, compliance and remediation activities. Current rules can make those disclosures difficult, even when recipients have a legitimate business need and are subject to confidentiality obligations.

Banks also frequently interact with multiple federal banking agencies that maintain different rules governing the treatment and disclosure of CSI. Those differences can create unnecessary inefficiency and uncertainty.

What Are the FDIC and OCC Proposals?

The FDIC and the OCC have proposed updates to their rules governing CSI and other nonpublic information. The proposals would expand the circumstances in which banks may share their own CSI without obtaining prior regulatory approval. BPI supports many aspects of these proposals, which recognize the need for responsible information sharing while maintaining appropriate confidentiality protections. However, further adjustments would strengthen the overall framework.

What Is BPI Recommending?

The FDIC and OCC should:

• Define CSI clearly and precisely, and in a manner that does not result in institution-generated materials becoming CSI in the institution's hands merely because they are provided to, discussed with or reviewed by the FDIC or OCC.
• Replace prescriptive confidentiality agreement requirements with a principles-based framework.
• Revise the framework for disclosure to affiliates, service providers, prospective senior officers, participants in M&A transactions, trade associations and other banking supervisors.
• Expand the categories of third parties that may receive CSI without prior agency approval to include, among others, prospective directors and, in the case of the FDIC, trade associations of which an institution is a member.
• Provide supervised entities with certain procedural protections, including notice and an opportunity to object, before an agency makes a discretionary disclosure of institution-specific CSI.
• Work together with the Federal Reserve to align the federal banking agencies' regulations on CSI.

Bottom Line

Protecting CSI is critical to effective bank supervision. At the same time, banks need workable rules that allow them to use and share information responsibly to manage risk, address supervisory concerns and operate efficiently, while maintaining robust safeguards. BPI's recommended changes would preserve the confidentiality of the supervisory process while creating a clearer, more consistent and more practical framework for information sharing.