Office of the Comptroller of the Currency Proposes to Permit Disclosure of CSI, Including in Bank M&A Transactions

On August 3, 2026, the Office of the Comptroller of the Currency (the “OCC”) issued a notice of proposed rulemaking (the “NPR”) that would substantially revise the OCC’s framework for non-public OCC information and permit disclosure of confidential supervisory information (“CSI”) without prior OCC approval in specified circumstances.[1] Of particular significance, the NPR would permit an OCC-supervised entity to disclose CSI to potential counterparties in covered bank M&A transactions.[2]

The OCC’s NPR follows a similar proposal by the Federal Deposit Insurance Corporation (the “FDIC”) on June 30, 2026 that would authorize disclosure of CSI to potential merger parties.[3] See our prior Memorandum to Clients regarding the FDIC proposal.

The proposed exception for disclosure of CSI in a bank M&A transaction would be subject to the following conditions and limitations:

• The potential counterparty must be engaged in good-faith negotiations. CSI may be disclosed solely to enable the potential counterparty to perform reasonable due diligence or other transaction-related duties.
• The exception would be limited to disclosure of CSI to no more than three potential counterparties for a given transaction or series of transactions. The proposal does not define a discrete “transaction” or “series of transactions,” and the OCC is requesting comment on whether clarification is needed. This limitation would need to be taken into account in the context of an auction.
• Parties must enter into a “qualifying confidentiality agreement” which, among other requirements, must require notice to the OCC of any violation and make the OCC a third-party beneficiary.
• The potential counterparty must provide a written acknowledgment and waiver to the OCC, which generally provide that the counterparty is not entitled to rely on the accuracy or completeness of the CSI and waive any potential claim against the OCC in respect of the counterparty’s use of CSI.
• The potential counterparty must agree in writing not to reference CSI in any agreement with the disclosing party, which is intended to prevent CSI-based contractual conditions, including conditions tied to reports of examination or supervisory ratings.
• In addition to a potential counterparty, CSI may also be disclosed to the potential counterparty’s U.S.‑based attorneys and consultants (which, unlike the FDIC proposal, appears to also include investment bankers).

Beyond M&A, the NPR would also provide for exceptions that permit disclosure of CSI to affiliates, certain U.S.-based service providers and candidates for specified senior executive officer positions, each subject to safeguards and conditions defined in the proposal. The NPR would also allow sharing of CSI with trade associations, subject to certain conditions, to aggregate and analyze information provided by members.

In general, the proposed exceptions relate specifically to the OCC-supervised entity’s ability to disclose CSI, and the parent holding company could not independently rely on the supervised entity’s exceptions to disclose the CSI to its own advisers or potential transaction counterparties. The OCC is requesting comment on whether to extend the exceptions to parent holding companies.

The NPR also would establish procedures for disclosures of CSI to the Federal Reserve, the FDIC and other federal agencies and revise the OCC’s current Freedom of Information Act (“FOIA”) procedures. Comments are due 60 days after publication in the Federal Register.