Subscribe free
occcfpbfdicdebankingreputation-riskecoafair-banking

The OCC's Debanking Report Carries No Penalty. The CFPB Referral, the CSI Proposal and Bulletin 2025-22 Are Where It Bites

How the OCC's debanking report shifts liability to the CFPB (ECOA/FCRA), private plaintiffs, and licensing via Bulletin 2025-22 despite no penalty.

By Lex, LexRegPulse Analyst · ·10 min read
Primary-source research · AI-drafted · human-reviewed. Methodology

On October 14 the OCC published "Guaranteeing Fair Banking for All Americans," its account of how the nine largest national banks it supervises screened customers for reputation risk between 2020 and September 2025. The report names JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, U.S. Bank, Capital One, PNC Bank, TD Bank and BMO Bank. It reprints their internal emails. It finds no violation of law, assesses no penalty and sets no compliance date.

The trade read is that regulators blasted big banks. That read misses where the exposure went. The OCC has little left to enforce with, because its April rule with the FDIC bars examiners from criticizing a bank on the basis of reputation risk. So the report routes liability elsewhere. It goes to the CFPB, which said the same day it will investigate "the institutions featured in OCC's report and others." It goes to private plaintiffs, whom the report openly invites in while the OCC rewrites its confidential-information rules. It also goes to the licensing desk, where Bulletin 2025-22 already makes a debanking record a factor in applications. Read that way, the report is a documentation standard for account-exit files.

How we got here

Executive Order 14331, signed August 7, 2025, told the agencies to strip reputation risk from their manuals and to review their institutions. The OCC announced its review of the nine banks and issued Bulletin 2025-22 on September 8, 2025, and published preliminary findings on December 10.

The OCC and FDIC then finalized "Prohibition on the Use of Reputation Risk by Regulators" (91 FR 18279), effective June 9, 2026. According to the report, the rule also deleted a requirement that certain large national banks "affirmatively consider reputation risk" in their risk governance. The Federal Reserve proposed its own version in February; the NCUA acted in June.

One passage in that preamble matters more now than it did in April. Commenters asked the agencies to require written reasons for terminations and reinstatement paths for exited customers. The agencies declined, calling the rule "solely focused on the actions of the agencies." Six months later the OCC's report faults the nine banks for vague closure letters. The notice obligation the OCC chose not to write has been handed to an agency that enforces one.

The OCC says it reviewed nearly 100,000 complaints and received approximately 50,000 documents consisting of approximately 420,000 pages, plus transaction testing of hundreds of decisions. Our briefs covered the release on October 15 and October 16.

Leg one: the CFPB runs a notice theory, not a viewpoint theory

The CFPB is precise about its tools. It evaluates compliance with ECOA and the FCRA, "particularly the adverse action notice requirements under these laws," as well as UDAAP. Its primary authority covers banks with over $10 billion in assets plus certain nonbanks. It says it has already removed reputation-risk concepts from its examination manual.

Neither ECOA nor the FCRA prohibits declining a customer over politics or a lawful industry. As Hinshaw's October 15 memo notes, ECOA largely reaches credit rather than deposit accounts. So the hook is procedural. Regulation B requires notice within 30 days of adverse action on an existing account, with reasons that "must be specific." Citing "the creditor's internal standards or policies" is expressly "insufficient" (12 CFR 1002.9(b)(2)).

Set that against the closure language the OCC catalogued: "your risk profile no longer aligns with the bank's risk tolerance," or simply "a business decision." On a card or credit line, those phrases sit close to what Regulation B rejects. On deposit accounts the theory shifts to UDAAP. The question becomes whether the reason the customer heard matches the reason in the file.

That is the gap that matters. A safety-and-soundness review asked whether the bank could justify the exit. A consumer-law investigation asks whether the bank told the customer the truth, and whether the file still says what it said on decision day. The report hands investigators a roadmap. At JPMorgan, a reputation risk employee, "at the direction of a more senior employee," later rewrote tracking-system entries to strip phrases such as "right-wing," in some cases years afterward. That is the kind of record a deception theory gets built on.

Who outside the nine should treat this as live? Every bank with over $10 billion in assets, since "and others" carries no limit. The sharper exposure sits with sponsor banks. The report describes Wells Fargo sending an independent sales organization a third-party website's account of a religious nonprofit's views on same-sex marriage. It then asked whether that "change[d] their stance." The ISO terminated the account immediately. In a BaaS program, the termination clause in the program agreement is the sponsor's closure policy executed by someone else.

Leg two: the regulator offers to lower the CSI wall

The report's "Promoting Increased Transparency" section is its most unusual passage. "Private litigants may play a role in depoliticizing the federal banking system," the OCC writes. It pledges to use its discretion under "current and proposed changes" to its disclosure rules so there are "no unreasonable barriers" to sharing information in debanking litigation.

The proposal is Bulletin 2026-37, issued August 3. It would create a subcategory called "confidential supervisory information." It would widen sharing exceptions for "business efficiency, government accountability, and supervisory coordination," release certain aged CSI and clarify the OCC's stance on criminal referrals for unauthorized disclosure. Under current Part 4, non-public OCC information covers material "created or obtained" by the agency, which banks may disclose only with prior approval.

For discovery, the effect is direct. The 50,000 documents the nine banks produced are information the OCC obtained in its supervisory role, and the OCC controls their release. Banks have long treated the supervisory privilege as a dependable shield against producing exam-related material. Here the privilege holder has said in writing that it does not intend to be an obstacle. Expect plaintiffs to quote that sentence in motions to compel.

The industry asked for the opposite. The fair-access principles BPI republished with its December 10, 2025 statement say there "should be no private rights of action." No federal statute creates one for political debanking. Plaintiffs will plead state law instead, such as Florida's fair-access statute, which the report says requires bank attestations. The OCC cannot create a cause of action. It can make the evidence cheaper to get.

Leg three: Bulletin 2025-22 turns a file problem into deal risk

Bulletin 2025-22 reaches new charters, conversions, branching, business combinations, changes in control and other filings. In each, the OCC weighs "a bank's record of" debanking alongside its policies to avoid it. In CRA examinations, debanking "is a factor the OCC may consider" in the rating.

The April rule complicates this without neutralizing it. That rule bars denying an application on reputation grounds, yet it still lets the agency weigh statutory factors. Debanking is one of them. Put plainly, the OCC cannot hold reputation risk against you, but it can hold your reputation-risk program against you.

The report shows the price. One bank, "in a recent merger application," represented that it will not restrict any product unless the decision rests on an "individualized, objective, and risk-based analysis." Expect that language to become a standard deal-file commitment. The OCC's January 2021 Business Combinations booklet already flagged terminations made without case-by-case review. What is new is a published record that commenters on your application can cite.

Sector policies and the BSA cross-current

The report names six restricted categories: Arctic oil and gas, coal, firearms and ammunition, detention facilities, tobacco and e-cigarettes, and digital assets. Many banks swapped categorical bans for "heightened" individualized review in late 2023 and 2024. The OCC's reply: "changes in the wording of policies do not always correspond with changes in practice." Its best evidence is the exception log. PNC granted an Arctic exception to a "top 5" energy client. TD's escalation team recommended against a small-business loan under $50,000 to a rifle-component maker about four months after its reputation risk committee endorsed potential guarantees to a large multinational gunmaker. A sector rule that bends for large clients reads as a judgment about the customer, not the risk.

None of this obliges a bank to take every account; Comptroller Gould has said the OCC is "not forcing these banks to serve every customer." But a bank with a sector policy should tie each trigger to the financial or operational risk it proxies. It should then audit who received exceptions. Relabeling the concept "franchise" or "brand" risk will not help, since the report names both.

The BSA cross-current is real. On October 13, the OCC imposed a $750 million civil money penalty on Bank of America, the largest in its history, in part for failing to escalate potentially suspicious activity. A day later the same agency criticized exits built on thin rationales.

To be fair, those positions reconcile. Financial-crime exits remain legitimate; the file has to show the financial-crime reason. The September 2 joint statement from the Federal Reserve, FDIC, NCUA, OCC and FinCEN confirms SAR confidentiality does not stop banks from discussing underlying facts or account closures with customers, provided they do not reveal a SAR. It also says it sets no "new supervisory expectations." The report adds that SAR concerns "alone do not account for" poor communication, quoting a PNC employee's view that "less is more." The report also floats guidance on domestic politically exposed persons and changes "to prevent pretextual reliance on the BSA." The statement lets banks say more in a closure letter. It is no safe harbor for an exit coded as BSA when the file shows a reputation discussion.

The complication the report skips

The report concedes banks tried to predict stakeholder reactions "whether instigated by regulators or the banks themselves," including "the banks' own regulators." It goes no further. The April rule's own impact analysis is blunter: roughly one in five OCC MRAs each year from 2017 through 2022 listed reputation risk as a primary or secondary concern. Cato's Nicholas Anthony told American Banker the report gives "insufficient weight to the role regulators played." JPMorgan, which says it has wound down WePay, told the same outlet that a regulatory environment that "often second-guessed decisions contributed to a culture of caution."

That history is accurate, yet it does not change the exposure. The CFPB and plaintiffs will not ask who taught the bank to weigh reputation; they will ask what the bank told the customer. BPI's post-report statement backed "clear and consistent standards." We found no bank-specific response from the other eight.

What to watch

The OCC is weighing further rulemaking on political and religious discrimination, including banks' reliance on third-party opinions. It may also issue guidance or regulations on termination notices. The CSI proposal is pending, and the CFPB has given no timeline.

Until then, the report works as an exit-file standard:

Bottom line

The OCC's report imposes nothing, which is why it should not be filed away. It moves debanking risk from a prudential supervisor that has disarmed itself on reputation to a consumer regulator with notice rules, a plaintiffs' bar holding a regulator's invitation and a licensing process with a published record. For any bank with over $10 billion in assets, the question is no longer whether its exit decisions were defensible. It is whether its exit files survive a stranger reading them.

Sources