Is your financial institution or company subject to the Consumer
Financial Protection Bureau's (CFPB) supervision? If so, take
note of a recent bulletin warning supervised entities –
both banks and non-banks – about the treatment of
confidential supervisory information.
There are two main takeaways from the bulletin:
- Disclosure of confidential supervisory information
(CSI) is prohibited, with limited exceptions.
The CFPB broadly defines CSI in its bulletin. Not surprisingly,
the CFPB takes the position that its examination and compliance
reports are CSI, but it also considers any information derived from
these reports to be CSI. The bulletin also declares CSI to include
communications related to the CFPB's supervision. What is more
surprising, perhaps, is the position that even information provided
to the CFPB may be CSI when the CFPB is monitoring risks to
consumers or determining whether the entity is subject to the
CFPB's supervisory authority.
