On January 27, the CFPB issued Compliance Bulletin 2015-01 to remind supervised financial institutions of their obligations concerning the disclosure of confidential supervisory information (CSI) to the CFPB and to third parties. Specifically, the bulletin addresses the interaction between a financial institution’s obligations with respect to the CFPB and its contractual obligations under nondisclosure agreements (NDAs) with a third party that restrict the sharing of information. Such NDAs typically (i) restrict sharing protected information with any third party (which would include a supervisory agency) other than in connection with a subpoena or similar legal requirement and (ii) require the institution to advise the third party before it shares information as required by law (which again would include sharing protected information with a supervisory agency).
Supervised financial institutions and other persons, with limited exceptions outlined in the bulletin, are generally prohibited from disclosing CSI to third parties. According to the bulletin, a supervised financial institution should not rely on the provisions of an NDA to justify disclosing CSI in a manner not otherwise permitted, either through a valid exception or prior written approval from the CFPB. The bulletin appears to take the position that the fact that information has been shared with the CFPB is itself CSI.
The bulletin also warns supervised financial institutions that an NDA between an institution and a third party does not alter or limit the CFPB’s supervisory authority, and that the failure based on an NDA to provide CSI or other information required by the CFPB to conduct its supervisory activities is a violation of law for which the CFPB will pursue all available remedies.
In that supervised institutions such as banks and bank holding companies have been subject to the same issue for many years, this bulletin may be aimed at non-banks that are new to being subject to federal financial supervision. Questions regarding the matters discussed in this Alert may be directed to any of our lawyers listed below, or to any other BuckleySandler attorney with whom you have consulted in the past.