The Definition of “CSI”
The NPR proposes an amended definition of CSI to clarify that CSI includes any nonpublic information exempt from disclosure pursuant to 5 U.S.C. § 552(b)(8) (FOIA Exemption 8) “and includes information that is or was created or obtained in furtherance of the Board’s supervisory, investigatory, or enforcement activity. . . .” The current definition of CSI refers to information “gathered” by the Federal Reserve “in the course of any investigation, suspicious activity report, cease-and-desist orders, [and] civil money penalty enforcement orders,” among other things. The revised definition also makes clear that CSI includes portions of internal financial institution documents that contain, refer to, or would reveal CSI. In the NPR press release, the Federal Reserve indicated that the revised CSI definition does not expand or reduce the information covered by the definition, but rather is for “clarification purposes.”
Disclosure of CSI
If adopted, the new rule would allow a supervised financial institution to disclose CSI to the directors, officers, and employees of the institution’s “affiliates,” as defined in Regulation Y (12 C.F.R. § 225.2(a)), to the extent such individuals have a need for the CSI in the performance of their official duties. The current rule only allows institutions to disclose CSI to their parent holding company.
The proposed rule would also allow supervised financial institutions to disclose CSI directly to the Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Consumer Financial Protection Bureau (“CFPB”), and state financial supervisory agencies that supervise the institution, as long as the institution’s Federal Reserve CPC agrees that the other agencies have a legitimate supervisory or regulatory interest in the information. The proposed rule would also amend the regulations to clarify that the Federal Reserve may disclose CSI to the CFPB and state financial supervisory agencies.
Disclosures of CSI to Outside Legal Counsel and Auditors
The proposed rule would also modify the requirements governing disclosure of CSI to outside legal counsel and auditors by eliminating the requirement to view CSI on the premises of the supervised financial institution. The amendment would allow outside legal counsel and auditors to view CSI off-premises, subject to written agreements that, among other things, would require the electronic files to be returned, destroyed, or rendered effectively inaccessible through access control measures or other means at the conclusion of the engagement. The proposed rule would also permit disclosure only “so long as the disclosure is necessary to the legal counsel’s or auditor’s engagement.”
Procedures for Confidential Treatment Requests
The NPR would revise the procedures for confidential treatment requests by permitting such requests for “personal privacy information” and “proprietary commercial information.” The proposed revisions would require persons who submit confidential treatment requests to “state in reasonable detail the facts supporting the request, provide the legal justification, identify the specific information for which confidential treatment is requested, and include an affirmative statement that such information is not available publicly.” The proposed revision states that “[c]onclusory statements that release of the information would cause competitive harm generally will not be considered sufficient to justify confidential treatment . . . .”
The Effect of the Federal Reserve’s Disclosure of CSI on Privilege
The NPR proposes additional language stating that disclosures of CSI do not constitute a waiver by the Federal Reserve of any privileges. In the preamble to the proposed rule, the Federal Reserve indicates that the purpose of this language is to “make explicit” that the Federal Reserve’s disclosure of CSI “on a confidential and limited basis” does not constitute forfeiture of any privileges, including the bank examination privilege.
The Definition of “Supervised Financial Institution”
The proposed rule provides an amended definition of “supervised financial institution” to clarify that the term includes any entity or service subject to examination by the Federal Reserve, not just those institutions supervised by the Board.