Start Printed Page 10072
Bureau of Consumer Financial Protection.
The Bureau of Consumer Financial Protection (CFPB) is issuing a compliance bulletin entitled “Treatment of Confidential of Supervisory Information” as a reminder that, with limited exceptions, persons in possession of confidential information, including confidential supervisory information (CSI), may not disclose such information to third parties.
This bulletin is effective February 25, 2015 and applicable beginning January 27, 2015.
Start Further Info
FOR FURTHER INFORMATION CONTACT:
Christopher Young, Managing Senior Counsel and Chief of Staff, (202) 435-7408, Office of Supervision Policy.
End Further Info
Start Supplemental Information
The CFPB issues this compliance bulletin as a reminder that, with limited exceptions, persons in possession of confidential information, including CSI, may not disclose such information to third parties.
More particularly, this bulletin:
1. Sets forth the definition of CSI;
2. Provides examples of CSI;
3. Highlights certain legal restrictions on the disclosure of CSI; and
4. Explains that private confidentiality and non-disclosure agreements (NDAs) neither alter the legal restrictions on the disclosure of CSI nor impact the CFPB's authority to obtain information from covered persons 
and service providers 
in the exercise of its supervisory authority.
II. Compliance Bulletin
The CFPB has supervisory authority over certain covered persons, including very large depository institutions, credit unions and their affiliates; 
certain nonbanks; 
and service providers 
(collectively, supervised financial institutions).
Many supervised financial institutions became subject to federal supervision for the first time under the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act).
Pursuant to authority granted under the Dodd-Frank Act,
the CFPB has issued regulations that govern the use and disclosure of CSI.
The CFPB expects all supervised financial institutions to know and comply with the regulations governing CSI, and provides the following guidance to assist with such compliance.
A. Definition of CSI
Under the CFPB's regulations, “confidential supervisory information” means:
- Reports of examination, inspection and visitation, non-public operating, condition, and compliance reports, and any information contained in, derived from, or related to such reports;
- Any documents, including reports of examination, prepared by, or on behalf of, or for the use of the CFPB or any other Federal, State, or foreign government agency in the exercise of supervisory authority over a financial institution, and any supervision information derived from such documents;
- Any communications between the CFPB and a supervised financial institution or a Federal, State, or foreign government agency related to the CFPB's supervision of the institution;
- Any information provided to the CFPB by a financial institution to enable the CFPB to monitor for risks to consumers in the offering or provision of consumer financial products or services, or to assess whether an institution should be considered a covered person, as that term is defined by 12 U.S.C. 5481, or is subject to the CFPB's supervisory authority; and/or
- Information that is exempt from disclosure pursuant to 5 U.S.C. 552(b)(8).
CSI does not include documents prepared by a financial institution for its own business purposes and that the CFPB does not possess.
B. Examples of CSI
Supervised financial institutions and other persons that may come into possession of CSI should understand what constitutes CSI in order to comply with the applicable rules.
Examples of CSI include, but are not limited to:
- CFPB examination reports and supervisory letters;
- All information contained in, derived from, or related to those documents, including an institution's supervisory Compliance rating;
- Communications between the CFPB and the supervised financial institution related to the CFPB's examination of the institution or other supervisory activities; and
- Other information created by the CFPB in the exercise of its supervisory authority.Start Printed Page 10073
Thus, CSI includes any workpapers or other documentation that CFPB examiners have prepared in the course of an examination. CSI also includes supervisory information requests from the CFPB to a supervised financial institution, along with the institution's responses. In addition, any CFPB supervisory actions, such as memoranda of understanding between the CFPB and an institution, and related submissions and correspondence, are CSI.
C. Disclosure of Confidential Information Generally Prohibited
Subject to limited exceptions, supervised financial institutions and other persons in possession of CSI of the CFPB may not disclose such information.
D. Exceptions to General Prohibition on Disclosure of CSI
There are certain exceptions to the general prohibition against disclosing CSI to third parties. A supervised financial institution may disclose CSI of the CFPB lawfully in its possession to:
- Its affiliates;
- Its directors, officers, trustees, members, general partners, or employees, to the extent that the disclosure of such CSI is relevant to the performance of such individuals' assigned duties;
- The directors, officers, trustees, members, general partners, or employees of its affiliates, to the extent that the disclosure of such CSI is relevant to the performance of such individuals' assigned duties;
- Its certified public accountant, legal counsel, contractor, consultant, or service provider.
Supervised financial institutions may also in certain instances disclose CSI to others with the prior written approval of the Associate Director for Supervision, Enforcement, and Fair Lending, or his or her delegee (Associate Director).
The recipient of CSI shall not, without the prior written approval of the Associate Director, utilize, make, or retain copies of, or disclose CSI for any purpose, except as is necessary to provide advice or services to the supervised financial institution or its affiliate.
Moreover, any supervised financial institution or affiliate disclosing CSI shall take reasonable steps as specified in the regulations to ensure that the recipient complies with the rules governing CSI.
Confidential information made available by the CFPB pursuant to 12 CFR part 1070 remains the property of the CFPB. There are other important requirements relating to the disclosure of confidential information, including disclosure pursuant to third-party legally enforceable demands, such as subpoenas or Freedom of Information Act requests. Among a number of other requirements, a recipient of a demand for confidential information must inform the CFPB's General Counsel of the demand.
E. NDAs Do Not Supersede Federal Legal Requirements
The CFPB recognizes that some supervised financial institutions may have entered into third-party NDAs that, in part, purport to: (1) Restrict the supervised financial institution from sharing certain information with a supervisory agency; and/or (2) require the supervised financial institution to advise the third party when the institution shares with a supervisory agency information subject to the NDA. However, such provisions in NDAs between supervised financial institutions and third parties do not alter or limit the CFPB's supervisory authority or the supervised financial institution's obligations relating to CSI.
A supervised financial institution should not attempt to use an NDA as the basis for failing to provide information sought pursuant to supervisory authority. The CFPB has the authority to require supervised financial institutions and certain other persons to provide it with reports and other information to conduct supervisory activities, pursuant to the Dodd-Frank Act.
Failure to provide information required by the CFPB is a violation of law for which the CFPB will pursue all available remedies.
In addition, a supervised financial institution may risk violating the law if it relies upon provisions of an NDA to justify disclosing CSI in a manner not otherwise permitted. As noted above, any disclosure of CSI outside of the applicable exceptions would require the prior written approval of the Associate Director for Supervision, Enforcement, and Fair Lending (or his or her delegee).
Supervised financial institutions should contact appropriate CFPB supervisory personnel with any questions regarding this Bulletin.
III. Regulatory Requirements
This compliance bulletin provides nonbinding guidance on matters including limitations on disclosure of CSI under applicable law. It is therefore exempt from the notice and comment rulemaking requirements under the Administrative Procedure Act pursuant to 5 U.S.C. 553(b). Because no notice of proposed rulemaking is required, the Regulatory Flexibility Act does not require an initial or final regulatory flexibility analysis.
In addition, the CFPB has determined that this bulletin summarizes existing requirements and does not establish any new nor revise any existing recordkeeping, reporting, or disclosure requirements on covered entities or members of the public that would be collections of information requiring OMB approval under the Paperwork Reduction Act.
End Supplemental Information
Dated: February 2015.
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2015-03791 Filed 2-24-15; 8:45 am]
BILLING CODE 4810-AM-P