Today, President Obama signed into law a bill that makes clear that submission to the Consumer Financial Protection Bureau (“CFPB”) of information subject to attorney-client or other privileges during the CFPB’s supervisory process does not result in a waiver of privilege as to private plaintiffs and other third parties. The law also allows the CFPB to share privileged information with other federal agencies without effecting a waiver. The law supplements even broader antiwaiver provisions contained in CFPB rules enacted this year, pursuant to the CFPB’s broad rulemaking authority under the Dodd- Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank”).

In combination, the law and the CFPB’s rules should provide entities that produce privileged information to the CFPB with substantial protection against third-party claims of privilege waiver. With these protections now in place, the CFPB may more readily and regularly request privileged information during its supervisory process, particularly where such privileged information is the best and most efficient resource for the CFPB to assess an entity’s compliance with applicable laws.


Dodd-Frank authorizes the CFPB to supervise and examine insured depository institutions and credit unions with total assets of more than $10 billion and their affiliates, as well as certain non-depository institutions, and to request information from those entities to ensure compliance with the federal consumer financial laws.

In the course of its supervisory efforts, the CFPB has requested, and can be expected to request in the future, that entities under its supervision provide it with documents that are subject to a claim of attorney-client privilege or protected by the work-product doctrine. These requests find precedent in the pre-Dodd-Frank actions of the prudential regulators of financial institutions,1 which in the course of their supervisory efforts have requested the production of privileged information.

Prior to and following enactment of Dodd-Frank, banking institutions and credit unions have had the ability to produce privileged information to prudential regulators without waiving applicable disclosure protections. Specifically, 12 U.S.C. § 1828(x) provides that the submission of any information to a federal banking agency, state bank supervisor, or foreign banking authority in the course of the supervisory or regulatory process does not waive any applicable privilege as against third parties. Moreover, pursuant to 12 U.S.C. § 1828(t), the federal prudential regulators can share information with other federal agencies without effecting a waiver of privilege.

When Congress passed Dodd-Frank and gave the CFPB supervisory authority, including with respect to financial institutions formerly overseen by the prudential regulators, Congress did not also amend 12 U.S.C. § 1828(x) or 12 U.S.C. § 1821(t) to include the CFPB among the enumerated regulators who may receive or share privileged information without effecting a waiver. As a result, the CFPB’s requests have raised concerns among supervised entities that production to the CFPB could result in a privilege waiver as against private plaintiffs and other third parties. The CFPB sought to address these concerns first through guidance, and then through rulemaking. Supervised entities, however, remained concerned that the CFPB’s rulemaking did not provide as definitive a protection as the statutes applicable to the federal banking agencies.


Initially, in its Bulletin 12-01 dated January 4, 2012, the CFPB attempted to reassure supervised entities that, pursuant to the common law of attorney-client privilege, production in response to a CFPB demand would be involuntary, and thus not result in a waiver. The CFPB further took the position that, because Dodd-Frank transferred examination authority and all related powers and duties with respect to certain financial institutions from the prudential regulators to the CFPB, the CFPB was empowered under 12 U.S.C. § 1828(x) to receive privileged information from supervised entities without effectuating a waiver. The CFPB also stated that it would request only privileged information that was material to its supervisory objectives and that could not practicably be obtained from non-privileged sources. The CFPB further noted that, although it would share information with State Attorneys General and other law enforcement agencies in “very limited circumstances and upon review of all the relevant facts and considerations” or where required by law, it would “not routinely share confidential supervisory information with agencies that are not engaged in supervision.”

Despite the CFPB’s assurances, some entities subject to supervision remained concerned that courts would nevertheless deem the disclosure of privileged information to the CFPB a waiver, particularly in light of Congress’ failure to amend 12 U.S.C. §§ 1828(x) and 1821(t) to extend waiver protection to the CFPB. Although the CFPB maintained that such concerns were unwarranted, it nevertheless engaged in formal rulemaking that attempted to provide entities producing privileged information to the CFPB with protections against waiver that equaled or exceeded those set forth in 12 U.S.C. §§ 1828(x) and 1821(t). See 77 Fed. Reg. 39,617 (July 5, 2012) (codified at 12 C.F.R. pt. 1070).

In particular, 12 C.F.R. § 1070.48 now provides that the submission of information to the CFPB, whether voluntary or involuntary, does not waive any potential privilege with respect to that information under federal or state law, other than as to the CFPB. In promulgating this rule, the CFPB stated that it interprets the term “privilege” to include not only attorney-client privileged information, but also information and materials protected by the attorney work-product doctrine.

Moreover, amended 12 C.F.R. § 1070.47(c) now states that the provision of privileged information by the CFPB to another federal or state agency does not waive any applicable privilege. In providing that sharing information with a state agency does not waive privilege, the CFPB’s non-waiver rule is broader than the protection currently provided by statute in connection with information sharing by the prudential regulators. In that context, 12 U.S.C. § 1821(t) currently provides waiver protection only when a federal prudential regulator shares information with other federal agencies (although 12 U.S.C. § 1821(x) separately protects the privilege of information submitted by any party to state bank supervisors).

Concerns persisted, however, that without legislation, private plaintiffs and other third parties would remain in a position to assert in court that the CFPB’s non-waiver rules exceed its rulemaking authority, particularly given that Congress did not amend 12 U.S.C. §§ 1828(x) and 1821(t) to include the CFPB when amending Dodd-Frank.

H.R. 4014

With the CFPB’s blessing, efforts have proceeded in Congress throughout 2012 to provide additional legislative protection against waiver claims. Those efforts culminated in today’s signing of H.R. 4014 by President Obama. Passed in the House on March 26, and adopted in the Senate by unanimous consent on December 11, H.R. 4014 amends 12 U.S.C. § 1828(x) to add the CFPB to the list of federal agencies to which the submission of privileged information does not constitute waiver of any applicable privilege. The law also amends 12 U.S.C. § 1821(t) to extend anti-waiver protection to instances in which the CFPB shares privileged information with other federal agencies.

Although similar to the CFPB’s non-waiver rule, H.R. 4014 arguably is narrower in scope in two respects. First, unlike the CFPB rule, H.R. 4014 does not explicitly extend protection to information shared by the CFPB with state agencies other than bank supervisors, including state attorneys general.2 Second, unlike the CFPB’s promulgating release, H.R. 4014 does not explicitly state that attorney work product is a “privilege” within the protection of 12 U.S.C. §1828(x).

The latter lack of clarification is not without potential significance, as the work-product doctrine has historically been viewed not as a legal privilege against disclosure, but rather as a matter of sound judicial policy.3 With this said, 12 U.S.C. § 1821(t)(2)(B), which protects against claims of waiver in the information-sharing context, already provides that the defined term “privilege” includes the work-product doctrine. A court properly reading the entire statutory scheme for disclosure to and information sharing among financial regulators should recognize that, if work product does not lose its protection when one regulator shares it with another, then work product should not lose its protection when shared with a regulator in the first place.


Despite these differences between the CFPB’s rules and newly enacted H.R. 4014, entities supervised by the CFPB now have both federal legislation and the product of CFPB noticeand- comment rulemaking with which to fend off third-party waiver claims. By contrast, private plaintiffs and other third parties asserting a waiver of privilege now will be left to argue that the CFPB lacks rulemaking authority in the ostensible gaps between its nonwaiver rule and H.R. 4014 – in particular, in the areas of CFPB information sharing with state agencies other than bank supervisors and (less likely) attorney work product provided to the CFPB. Given the broad rulemaking delegated to the CFPB in Dodd-Frank, persuading a court of this argument could prove no small task.

Finally, given the dual protections against waiver now provided by statute and the CFPB’s rules, the CFPB may become more assertive in its attempts to secure privileged information from supervised entities. This may be especially so where privileged information provides the most efficient and clearest path for the CFPB to assess whether a supervised entity is meeting its compliance obligations. In turn, supervised entities may be expected to take a more considered approach to their dealings with counsel on issues of CFPB concern, particularly when it comes to whether and how counsel will commit its findings and recommendations to writing.