Banking Agencies Coordinate Handling Of Highly Sensitive Examination Information

On July 16, 2026, The Federal Reserve Board (“FRB”), Federal Deposit Insurance Corporation (“FDIC”) and Office of the Comptroller of the Currency (“OCC” and collectively, the “Agencies”) issued a joint statement announcing a coordinated approach for handling particularly sensitive bank information during examinations. The Agencies’ stated objective is to reduce cybersecurity risks associated with their collection and storage of such information while preserving examiners’ access to materials needed for effective supervision.

The joint statement identifies examples of “highly sensitive information,” such as network schematics and technology control weaknesses. Banks will bear the initial responsibility for flagging requested information that they believe warrants heightened treatment and raising the issue with the examination team or primary agency contact. The joint statement states that where heightened treatment is appropriate, examiners may use alternatives intended to limit agency possession of the sensitive material. These may include on-site review, direct digital review through the bank’s systems, redacted or summarized documents, or additional controls over transmission and access. The Agencies also will establish escalation procedures for disagreements over whether information qualifies as highly sensitive or how it should be handled.

Although the Agencies do not identify a specific precipitating event, the statement may be in response, at least in part, to concerns raised by the OCC’s 2025 email-system breach. In April 2025, the OCC notified Congress that it had identified a “major information security incident” after determining that unauthorized access to employee and executive email accounts had exposed highly sensitive information concerning the financial condition of OCC-supervised institutions and used in examinations and supervisory oversight. In a subsequent letter to bank CEOs, the OCC explained that an unauthorized user had accessed OCC email accounts, including emails and attachments, through a compromised service account. The OCC stated that it was reviewing its information-security controls and would notify institutions whose information was affected.

The April 2025 breach highlighted a basic tension in bank supervision – examiners require access to a bank’s most sensitive information, but transferring and retaining that information on agency systems creates an additional point of vulnerability. The new interagency procedures appear designed to reduce that exposure by allowing particularly sensitive information to be reviewed without necessarily being transferred to or retained on Agency systems.

The statement does not permit a bank simply to withhold requested information. Examiners may still determine, with appropriate supervisory approval, that particular materials must be retained in the supervisory record. The framework also creates no enforceable legal right. Its practical value therefore will depend on how consistently examination teams accept alternative review arrangements and how readily banks escalate disputes.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.