Disclosure of Information

FederalRegulations

Ask Donna

How this section applies to your facts.

Federal Register › Vol. 91 › 91 FR 39726

This text was captured on Aug 14, 2026. It is a snapshot, not a live feed, so check the official code before relying on it.

Text

FEDERAL DEPOSIT INSURANCE CORPORATION 12 CFR Parts 303, 306, 309, 327 and 337 RIN 3064-AG30 Disclosure of Information AGENCY:

Federal Deposit Insurance Corporation.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Federal Deposit Insurance Corporation (FDIC) is inviting comment on a notice of proposed rulemaking that would update, clarify, and supplement the FDIC's regulations regarding the disclosure of confidential information by the FDIC and other parties, including by enhancing the ability of insured depository institutions to share confidential supervisory information with affiliates and certain other entities for appropriate business purposes, without seeking prior authorization from the FDIC. The proposal also would significantly simplify and clarify the requirements and restrictions applicable to the FDIC's discretionary disclosure of confidential information. Finally, the proposal would update and simplify the FDIC's rules regarding disclosures required under the Freedom of Information Act and would clarify how and when FDIC information may be disclosed in connection with legal proceedings and as a result of service of process made upon the FDIC and its directors, officers, and employees.

DATES:

Comments must be received by the FDIC no later than August 31, 2026.

ADDRESSES:

Comments should be directed to the FDIC, identified by RIN 3064-AG30, by any of the following methods:

• Agency Website: https://www.fdic.gov/resources/regulations/federal-register-publications/. Follow instructions for submitting comments on the FDIC website.

• Mail: Jennifer M. Jones, Deputy Executive Secretary, Attention: Comments—RIN 3064-AG30, Federal Deposit Insurance Corporation, 550 17th Street NW, Washington, DC 20429.

• Hand Delivered/Courier: Comments may be hand-delivered to the guard station at the rear of the 550 17th Street NW building (located on F Street NW) on business days between 7 a.m. and 5 p.m.

• Email: comments@FDIC.gov

te.

• Mail: Jennifer M. Jones, Deputy Executive Secretary, Attention: Comments—RIN 3064-AG30, Federal Deposit Insurance Corporation, 550 17th Street NW, Washington, DC 20429.

• Hand Delivered/Courier: Comments may be hand-delivered to the guard station at the rear of the 550 17th Street NW building (located on F Street NW) on business days between 7 a.m. and 5 p.m.

• Email: comments@FDIC.gov. Include RIN 3064-AG30 on the subject line of the message.

• Public Inspection: Comments received, including any personal information provided, may be posted without change to https://www.fdic.gov/resources/regulations/federalregisterpublications/. Commenters should submit only information that the commenter wishes to make available publicly. The FDIC may review, redact, or refrain from posting all or any portion of any comment that it may deem to be inappropriate for publication, such as irrelevant or obscene material. The FDIC may post only a single representative example of identical or substantially identical comments, and in such cases will generally identify the number of identical or substantially identical comments represented by the posted example. All comments that have been redacted, as well as those that have not been posted, that contain comments on the merits of this notice will be retained in the public comment file and will be considered as required under all applicable laws. All comments may be accessible under the Freedom of Information Act.

This proposal, all comments received, and a summary of not more than 100 words of the proposed rule pursuant to the Providing Accountability Through Transparency Act of 2023, 5 U.S.C. 553(b)(4), are available at https://www.fdic.gov/federal-register-publications.

FOR FURTHER INFORMATION CONTACT:

Sonya L. Allen, Regional Counsel, (816) 234-8036, soallen@fdic.gov, Bruce W. Hickey, Senior Counsel, (202) 898-6748, brhickey@fdic.gov, Andrew A. Lubash, Senior Attorney, (703) 562-6209, anlubash@fdic.gov, Legal Division

ding Accountability Through Transparency Act of 2023, 5 U.S.C. 553(b)(4), are available at https://www.fdic.gov/federal-register-publications.

FOR FURTHER INFORMATION CONTACT:

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Background and Policy Objectives II. Proposed Amendments to 12 CFR Part 309 A. Organization, Scope, and Purpose B. Disclosure of Information Under the Freedom of Information Act 1. Overview 2. Definitions 3. Making a Records Request to the FDIC Under FOIA 4. FDIC Practices for Processing, Reviewing, and Responding to FOIA Requests 5. Fees for FOIA Requests 6. Dispute Resolution and Administrative Appeals 7. Supplemental Procedures for Confidential Commercial Information C. Discretionary Disclosure of Confidential Information 1. Overview 2. Purpose, Scope, and General Requirements 3. Definitions 4. The “Good Cause” Standard 5. Procedure for Requesting Discretionary Disclosure 6. Disclosure by the FDIC 7. Disclosure of FDIC Confidential Information by Insured Depository Institutions and Their Parent Holding Companies a. General Disclosure Authorizations b. Disclosure of Historical Information c. Disclosure of Confidential Information by Parent Holding Companies d. Disclosure of Data for Aggregated Analyses 8. Disclosure of FDIC Confidential Information by Service Providers and Other Persons D. Disclosure of Confidential Information in Legal Proceedings in Which the FDIC Is Not a Party 1. Overview and Scope 2. Definitions 3. Use and Request of FDIC Information in a Non-Party Legal Proceeding 4. Decisions on Requests 5. Waiver of Requirement for Requests III. New Part 306 on Service of Process A. Overview, Purpose, and Scope B. Definitions C. Service of Process Requirements and Processes IV. Technical Amendments to Other Parts of the FDIC's Regulations V

h the FDIC Is Not a Party 1. Overview and Scope 2. Definitions 3. Use and Request of FDIC Information in a Non-Party Legal Proceeding 4. Decisions on Requests 5. Waiver of Requirement for Requests III. New Part 306 on Service of Process A. Overview, Purpose, and Scope B. Definitions C. Service of Process Requirements and Processes IV. Technical Amendments to Other Parts of the FDIC's Regulations V. Expected Effects A. Scope of Affected Entities B. Expected Benefits 1. Discretionary Requests To Disclose Confidential Information 2. Other Changes C. Expected Costs D. Conclusion VI. Matters of Regulatory Procedure A. Regulatory Flexibility Act B. Paperwork Reduction Act C. Riegle Community Development and Regulatory Improvement Act D. Executive Orders 12866 and 14192 I. Background and Policy Objectives

The FDIC's regulations set forth procedures, requirements, and restrictions for the disclosure of information by the FDIC and by other parties, including insured depository institutions, that may be in possession of the FDIC's confidential information. These include rules related to disclosure by the FDIC of information under the Freedom of Information Act (FOIA), disclosure by the FDIC and other parties of information that is confidential and exempt from disclosure under FOIA, and information related to legal proceedings (collectively, the information disclosure regulations). The FDIC has not significantly revised the information disclosure regulations in approximately 30 years

closure by the FDIC of information under the Freedom of Information Act (FOIA), disclosure by the FDIC and other parties of information that is confidential and exempt from disclosure under FOIA, and information related to legal proceedings (collectively, the information disclosure regulations). The FDIC has not significantly revised the information disclosure regulations in approximately 30 years. As a result, the FDIC's current information disclosure regulations (1) do not reflect or appropriately accommodate the business relationships and transactions that often give rise to a need by insured depository institutions to disclose the information subject to these provisions; (2) include administrative impediments to disclosing information that are

The proposal seeks to address these and other issues, including by providing flexibility to FDIC-supervised institutions to disclose information they commonly seek to share with certain third parties without prior approval of the FDIC and significantly reorganizing the FDIC's information disclosure regulations.

The FDIC invites comments on all aspects of the proposal, including ways the information disclosure regulations could be revised to further improve their clarity and reduce administrative burden.

II. Proposed Amendments to 12 CFR Part 309

A. Organization, Scope, and Purpose

Part 309 of the FDIC's regulations sets forth the FDIC's policies regarding the information it maintains and the procedures for obtaining access to such information. Part 309 addresses, among other information disclosures, both requests from the public for FDIC information subject to FOIA and requests from insured depository institutions and other parties to disclose FDIC confidential information to third parties or to receive such information from the FDIC. As noted in section I of this Supplemental Information, part 309 has not been significantly amended in approximately 30 years

ong other information disclosures, both requests from the public for FDIC information subject to FOIA and requests from insured depository institutions and other parties to disclose FDIC confidential information to third parties or to receive such information from the FDIC. As noted in section I of this Supplemental Information, part 309 has not been significantly amended in approximately 30 years. In that time, through its processing of requests for information under FOIA and its interactions with insured depository institutions and other parties seeking to disclose or receive FDIC confidential information, the FDIC has observed that part 309, both in its structure and content, has led to confusion among stakeholders and does not appropriately balance the need to protect sensitive, confidential information with the benefits of allowing greater transparency and access to information in appropriate circumstances.

To address these concerns and improve the FDIC's information disclosure regulations, the proposal would reorganize part 309 into the following four subparts: (1) subpart A describes general aspects of the regulation, including the rule's scope and organization; (2) subpart B sets forth the FDIC's FOIA policies and procedures; (3) subpart C establishes the FDIC's policies and procedures regarding discretionary disclosures of confidential information exempt from FOIA, including circumstances when an insured depository institution may disclose FDIC confidential information in its possession without the FDIC's prior approval; and (4) subpart D describes the FDIC's policies and procedures regarding disclosure of confidential information in connection with legal proceedings. As discussed later in this Supplemental Information, the FDIC's service of process regulations that currently appear in part 309 would be relocated to proposed part 306.

The following table summarizes the proposal's changes to the content and organization of the FDIC's information disclosure regulations

edures regarding disclosure of confidential information in connection with legal proceedings. As discussed later in this Supplemental Information, the FDIC's service of process regulations that currently appear in part 309 would be relocated to proposed part 306.

The following table summarizes the proposal's changes to the content and organization of the FDIC's information disclosure regulations.

Current rule Proposed rule General Provisions Subpart A 12 CFR 309.1-12 CFR 309.2 12 CFR 309.1 12 CFR 309.1—Purpose and scope 12 CFR 309.1—Purpose and scope. 12 CFR 309.2—Definitions 12 CFR 309.11 (Subpart B) 12 CFR 309.31 (Subpart C). 12 CFR 309.51 (Subpart D). 12 CFR 306.2. FOIA Provisions Subpart B—FOIA 12 CFR 309.3 to 12 CFR 309.5 12 CFR 309.10-12 CFR 309.24 X 12 CFR 309.10—Scope. 12 CFR 309.3— Federal Register publication X. 12 CFR 309.4—Publicly available records 12 CFR 309.12—FDIC information that may be made available on request. 12 CFR 309.5—Procedures for requesting records (See below). 12 CFR 309.5(a)—Definitions 12 CFR 309.11—Definitions. 12 CFR 309.5(b)—Making a request for records 12 CFR 309.13—Making a request for records. 12 CFR 309.5(c)—Defective requests 12 CFR 309.5(d)—Processing requests 12 CFR 309.14—Processing requests—in general. 12 CFR 309.15—Processing requests—expedited processing. 12 CFR 309.5(e)—Providing responsive records X. 12 CFR 309.5(f)—Fees 12 CFR 309.17—Fees in general. 12 CFR 309.18—Types of fees. 12 CFR 309.19—Charging fees. 12 CFR 309.20—Payment of fees. 12 CFR 309.21—Waiver or reduction of fees. 12 CFR 309.5(g)—Exempt information X. 12 CFR 309.5(h)—Dispute resolution 12 CFR 309.22—Dispute resolution. 12 CFR 309.5(i)—Appeals 12 CFR 309.23—Administrative appeals. 12 CFR 309.5(j)—Records of another agency 12 CFR 309.16—Consultations and referrals. X 12 CFR 309.24—Supplemental procedures for confidential commercial information

by person served X. 12 CFR 309.7(c)—Appearance by person served X. In addition, the proposal would make a number of revisions to part 309 that are generally intended to provide greater clarity, simplify administrative processes, and, where appropriate, remove or narrow restrictions on the ability of insured depository institutions to disclose FDIC confidential information to certain third parties. Importantly, while insured depository institutions are typically required to obtain prior approval from the FDIC before disclosing FDIC confidential information under the FDIC's current information disclosure regulations, the proposal would permit insured depository institutions to disclose such information to certain third parties without prior approval for a business purpose, subject to having in place a qualifying confidentiality agreement with each intended recipient. These third parties include, for example, an insured depository institution's legal counsel, majority shareholder, qualifying service providers, and certain potential merger counterparties. In addition, where prior approval from the FDIC would still be required, the proposal would clarify and simplify the standard under which the FDIC may authorize an insured depository institution or other party to disclose FDIC confidential information.

As described in section III of this Supplemental Information, the proposal also would remove the provisions currently in part 309 regarding service of process in a legal proceeding and relocate them to a separate part of the FDIC's regulations, proposed part 306. The FDIC has observed that the service of process provisions bear little relation to the other provisions of part 309 regarding information maintained by the FDIC and the policies and procedures for the disclosure of such information

provisions currently in part 309 regarding service of process in a legal proceeding and relocate them to a separate part of the FDIC's regulations, proposed part 306. The FDIC has observed that the service of process provisions bear little relation to the other provisions of part 309 regarding information maintained by the FDIC and the policies and procedures for the disclosure of such information. Relocation of these service of process requirements to a separate part of the FDIC's regulations would improve the clarity of both the service of process requirements and the information disclosure requirements more generally.

Question 1: Does the proposed reorganization of part 309 achieve its intended objectives? If not, how can the structure and organization of part 309

B. Disclosure of Information Under the Freedom of Information Act

1. Overview

Under the proposal, requirements for parties requesting information from the FDIC under FOIA and the FDIC's processes for reviewing and responding to such requests would be codified at a new subpart B of part 309. Based on the FDIC's experience in processing FOIA requests, the FDIC believes its current requirements for FOIA requests, which are codified at sections 309.3 through 309.5 of part 309, could be clarified to better explain the FDIC's existing processes and improve readability. The proposed rule would also amend certain aspects of the FDIC's FOIA requirements to align them more closely with the applicable statutory requirements.

2. Definitions

Proposed section 309.11 would introduce certain new defined terms that the FDIC believes will help clarify the FDIC's FOIA requirements and better align the terminology used in the regulation with applicable statutory definitions.

Confidential commercial information would mean trade secrets and commercial or financial information obtained by the FDIC from a submitter that may contain material exempt from disclosure under Exemption 4 of FOIA

irements for requesting information from the FDIC under FOIA. These proposed sections would be generally consistent with the requirements currently codified at section 309.5 of part 309, with revisions to clarify existing processes, improve readability, and use more modern terminology.

The proposal would make certain changes related to how parties may request information from the FDIC under FOIA. First, section 309.13(c) would provide more explicit guidance on the contents of a records request, including by directing requesters to include details about the records sought so that the FDIC can locate them with a reasonable amount of effort, and stating that requests about very general topics, or those without limitations or dates, are more likely to be viewed as defective requests.

Second, proposed section 309.13(d) would add a new provision to clarify the FDIC's existing practice that individuals requesting records pertaining to themselves must satisfy the identify verification requirements established under 12 CFR 310.4(c), which ensures the FDIC's compliance with the Privacy Act. 1

1 12 U.S.C. 552a.

Third, proposed section 309.13(e) would describe requirements for requesting information about third parties ( i.e., about parties other than the requester). Specifically, this paragraph provides that a requester seeking records regarding third parties may receive greater access to requested records by submitting a written authorization by the individual who is the subject of the record. This paragraph also provides that, when requested records concern a deceased individual, a requester must submit proof that the individual is deceased and that the FDIC may require other verification documentation.

4. FDIC Practices for Processing FOIA Requests

Paragraph (d) of section 309.5 of the current rule establishes how the FDIC processes requests for information under FOIA. The proposal would include substantively consistent provisions, with modifications to clarify existing procedures and improve readability

e individual is deceased and that the FDIC may require other verification documentation.

4. FDIC Practices for Processing FOIA Requests

Proposed section 309.14 would generally replace paragraph 309.5(d) of the current rule and explain how the FDIC processes requests for information. Proposed section 309.14 would also include an updated and more detailed description of how the FDIC conducts multitrack processing and may aggregate certain requests. Proposed section 309.15 would establish how the FDIC conducts expedited processing for certain requests. This section is generally consistent with section 309.5(d)(3) of the current rule, with modifications to clarify existing practices and improve readability. Furthermore, proposed section 309.15 would establish that, in addition to the current rule's eligibility criteria, requests that involve the loss of substantial due process rights or possible questions of federal government integrity may be eligible for expedited processing. Any request for expedited processing would be required to be made concurrently with the initial record request and include a statement explaining the basis for expedited processing. 2 In addition, proposed section 309.16 would replace paragraph 309.5(j) of the current rule and provide additional detail regarding the circumstances under which the FDIC may consult with, and refer requests to, another agency that may have an interest in a request received by the FDIC.

2 Proposed section 309.15 also would permit the FDIC to move any request to expedited processing as appropriate.

requirements for a party that submits confidential commercial information to the FDIC (for example, confidential commercial information that an insured depository institution may submit in connection with an application to the FDIC) to designate, at the time of submission or thereafter, information the submitter claims could reasonably be expected to cause substantial competitive harm if disclosed. Second, proposed section 309.24 would establish the process by which the FDIC would provide notice to a submitter of confidential commercial information in the event that a FOIA request would seek the disclosure of such information, how a submitter may object to disclosure, and how the FDIC would respond to an objection. If the FDIC were to provide notice to a submitter of a request under FOIA for confidential commercial information, proposed section 309.24 would also require the FDIC to inform the requester that such notice has been made.

Question 3: Do the proposed amendments to subpart B of part 309 help clarify the FDIC's FOIA process?

Question 4: Are there additional revisions that can be made to subpart B of part 309 to clarify the FDIC's FOIA process or reduce administrative burden?

C. Discretionary Disclosure of Confidential Information

1. Overview

the FDIC's FOIA process or reduce administrative burden?

C. Discretionary Disclosure of Confidential Information

1. Overview

Under the proposal, subpart C of part 309 would establish the FDIC's policies and procedures regarding discretionary disclosures of confidential information that is exempt from disclosure under FOIA, replacing most of the provisions of section 309.6 of the current rule. Proposed subpart C would make a number of substantive changes to the current rule, including: (1) significantly expanding the categories of parties with which insured depository institutions and certain other entities can share confidential information without making a request to the FDIC, subject to certain conditions; (2) updating the process by which parties may request disclosure of confidential information to increase flexibility, including by allowing FDIC authorized directors to modify certain requirements and disclose confidential information on their own initiative; and (3) clarifying that the general standard for disclosure under this subpart is “good cause,” as determined by the appropriate authorized director.

These changes are being proposed to reduce or eliminate procedural barriers and inefficiencies that exist under the current rule. The FDIC intends for the proposed rule to streamline disclosures of confidential information, both by the FDIC and by insured depository institutions and other parties with confidential information in their possession, while providing safeguards to ensure that such information remains appropriately protected. Additionally, the proposal would make a number of non-substantive changes to improve the rule's clarity and readability.

2. Purpose, Scope, and General Requirements

Proposed section 309.30 would describe the purpose and scope of subpart C. Proposed sections 309.32 and 309.33 would establish the general prohibition on the disclosure of confidential information, except as permitted under subpart C

under subpart C. However, subpart C would neither restrict nor authorize the disclosure by an insured depository institution, including an insured depository institution for which the FDIC is the appropriate federal banking agency, or by any other party, of the confidential information of another federal banking agency or a state banking authority that an insured depository institution may possess. Additionally, the FDIC recognizes there are certain records or information that may be confidential information of both the FDIC and another supervisory agency. In such cases, insured depository institutions would still need to ensure their ongoing compliance with any information disclosure restrictions

4 12 U.S.C. 1813.

Question 5: Should the FDIC provide additional clarity on disclosure of records or information that is confidential information of both the FDIC and another federal or state supervisory agency? If so, what additional clarity would be helpful?

3. Definitions

Proposed section 309.32 would introduce certain new defined terms that the FDIC believes will help clarify the FDIC's disclosure requirements regarding its confidential information.

Affiliate would mean any company that controls, is controlled by, or is under common control with another company as defined in 12 U.S.C. 1841(k).

Authorized director would mean any of the directors of FDIC divisions and offices, or their designees, who have primary responsibility for FDIC records or information; and deputies to the chairperson of the FDIC Board of Directors, to the extent such officials have primary responsibility for FDIC records or information.

Confidential information would mean any FDIC record or other FDIC information in any form that is exempt from disclosure under FOIA, and any information derived from or related to such FDIC record or information

be published or made available to the public pursuant to 12 U.S.C. 1818(u), the Community Reinvestment Act, or other applicable law.

Parent holding company would mean a company that has control of an insured depository institution. Control for purposes of this subpart C is defined in 12 U.S.C. 1841(a)(2).

Person would mean an individual, or an entity in any form, including a government agency.

Qualifying confidentiality agreement would mean an agreement that: (1) is written; (2) is governed by the laws of the United States or a State of the United States; (3) prohibits the use of the information by the recipient for purposes other than that for which it is provided and provides that the recipient will not further disclose or make public in any manner the information; (4) limits access to the information at a recipient entity to those directors, officers, or employees who have a business need to know the information and are bound by the qualifying confidentiality agreement; and (5) expressly provides that the FDIC is an intended third-party beneficiary of the agreement and is permitted to enforce the terms of the agreement through a civil action filed in the U.S. District Court for the District of Columbia and any other court having jurisdiction and venue over disputes arising from the agreement.

Qualifying service provider would mean an entity that: (1) has a contractual relationship with a depository institution and (2) provides: (A) products or services to the institution that are used in connection with the provision of financial products or services to the depository institution's customers; (B) advisory or consulting services related to the management or operations of the depository institution; or (C) technological infrastructure to the depository institution. This definition would include third party “fintech” companies that provide services used in connection with the provision of financial products or services to customers

ts or services to the depository institution's customers; (B) advisory or consulting services related to the management or operations of the depository institution; or (C) technological infrastructure to the depository institution. This definition would include third party “fintech” companies that provide services used in connection with the provision of financial products or services to customers. The definition is intended to strike a balance by capturing types of service providers with respect to which insured depository institutions have the greatest need to share confidential information, while excluding service providers that are less likely to need confidential information as part of the services provided.

Question 6: Are the proposed defined terms appropriate for the purpose and intent of proposed subpart B? Should the FDIC include any additional defined terms or modify any of the proposed defined terms?

Question 7: Is the proposed definition of confidential information appropriate? Should the definition be revised to broaden or narrow it to appropriately capture the types of FDIC information that should be treated as confidential by insured depository institutions?

hat should be treated as confidential by insured depository institutions?

Question 8: Is the proposed definition of qualifying confidentiality agreement appropriate? What, if any, additional terms or requirements should the FDIC consider to appropriately protect the integrity of confidential information? For example, should a qualifying confidentiality agreement be required to be governed by U.S. law or include provisions that impose restrictions on how the confidential information is used, require the eventual destruction or return of the confidential information by the recipient, or require the recipient to acknowledge and consent to be subject to the FDIC's regulatory, examination, and enforcement authorities?

Question 9: Is the proposed definition of qualifying service provider appropriate? Should the definition be revised to broaden or narrow it to capture the universe of third parties that insured depository institutions should be able to share information with without requiring FDIC approval?

Proposed section 309.31 would not incorporate any terms currently defined in section 309.2 of part 309. 5

5 The following terms would be removed from part 309 under the proposal: depository institution, disclose/disclosure, examination, record, report of examination, customer financial records, and director of the division having primary authority.

4. The “Good Cause” Standard

The proposed rule would substantially clarify the standard under which the FDIC may approve the disclosure of confidential information. Specifically, proposed section 309.35 would establish “good cause” as the general standard for authorizing disclosure of confidential information and provide a non-exhaustive list of factors the authorized director may consider when making a good cause determination

e proposed rule would substantially clarify the standard under which the FDIC may approve the disclosure of confidential information. Specifically, proposed section 309.35 would establish “good cause” as the general standard for authorizing disclosure of confidential information and provide a non-exhaustive list of factors the authorized director may consider when making a good cause determination. This standard would apply to decisions by the FDIC to disclose confidential information under subpart C—either on its own initiative or in response to a request—and decisions by the FDIC to permit an insured depository institution to disclose to a third party confidential information in the insured depository institution's possession, in those circumstances where such approval would continue to be required.

The factors to be assessed under the good cause standard would include: (1) whether disclosure will serve a legitimate regulatory, supervisory, resolution, or law enforcement purpose; (2) whether there is another source for the confidential information; (3) whether disclosure of the confidential information is unduly burdensome or otherwise may adversely affect or prejudice the FDIC, its mission, or its operations; (4) the scope and nature of the confidential information; (5) the recipient's intended use of the confidential information; (6) whether disclosure is lawful; (7) whether the confidential information includes

While the good cause standard and associated factors have been established as a matter of internal FDIC practice, they are not currently provided for in the FDIC's information disclosure regulations. The FDIC believes that incorporating the standard and associated factors into part 309 will help promote transparency and consistency in assessing potential disclosures of confidential information, as well as providing prior notice regarding the types of requests for disclosure that may not be authorized

ractice, they are not currently provided for in the FDIC's information disclosure regulations. The FDIC believes that incorporating the standard and associated factors into part 309 will help promote transparency and consistency in assessing potential disclosures of confidential information, as well as providing prior notice regarding the types of requests for disclosure that may not be authorized.

Question 10: Would the proposal provide sufficient clarity regarding the good cause standard?

Question 11: Should the FDIC consider any other factors when assessing whether there is good cause for disclosure of confidential information? Are any of the proposed factors not appropriate to be considered as part of the good cause standard?

5. Procedure for Requesting Discretionary Disclosure

Proposed section 309.34 would describe the process for an insured depository institution or other party to request discretionary disclosure of confidential information in a manner that is generally consistent with the FDIC's current information disclosure regulations. Proposed section 309.34 would also introduce certain changes to the FDIC's information disclosure regulations that are intended to provide for additional flexibility and streamline the process for requesting discretionary disclosure, where appropriate. First, proposed section 309.34 would expressly permit an authorized director to waive one or more of the generally applicable requirements for requesting a discretionary disclosure. In addition, proposed section 309.34 would also explicitly allow an authorized director to self-initiate the disclosure of confidential information without a request from a third party, provided that, in the authorized director's discretion, the good cause standard in proposed section 309.35 is satisfied.

6. Disclosure by the FDIC

Proposed section 309.36 would provide for the disclosure of confidential information by the FDIC to certain categories of parties that commonly make requests for confidential information

confidential information without a request from a third party, provided that, in the authorized director's discretion, the good cause standard in proposed section 309.35 is satisfied.

6. Disclosure by the FDIC

Proposed section 309.36 would provide for the disclosure of confidential information by the FDIC to certain categories of parties that commonly make requests for confidential information. These include: (1) insured depository institutions and their affiliates; (2) federal, state, and foreign financial regulatory and supervisory authorities; (3) civil investigative and criminal law enforcement agencies and authorities; and (4) certain supervised bank service providers, insured depository institutions that receive services from such service providers, and state and federal authorities that supervise financial institutions serviced by such serviced providers. Proposed section 309.36 would also provide for the disclosure of confidential information to any other party and clarify the authority of the FDIC chairperson to authorize the disclosure of confidential information, in both cases subject to the good cause standard.

While proposed section 309.36 is intended generally to conform to the authorizations and requirements currently codified at paragraphs (b)(1) through (b)(6) and (b)(9) of section 309.6 of the current rule, the proposal would make various modifications to improve consistency, eliminate unnecessary barriers to appropriate disclosures, provide transparency, and reflect current practices. In particular, while the FDIC's current information disclosure regulations sometimes apply different and unnecessarily complicated procedural requirements for authorizing the disclosure of confidential information to different categories of parties, the proposed rule would make all disclosures of confidential information made under proposed section 309.36 subject to the good cause standard established at proposed section 309.35

ption of the disclosure of certain examination materials to a parent holding company, any disclosure by an insured depository institution of confidential information in its possession requires the prior approval of the appropriate FDIC director. The FDIC's experience in implementing section 309.6(b)(7) has been that many types of requests from insured depository institutions are routinely approved. Requiring the FDIC's prior approval in these cases is time consuming, imposes unnecessary administrative burdens on insured depository institutions, and appears to serve no significant policy or other objectives. The FDIC is also aware that the broad restrictions on disclosure of confidential information under section 309.6(b)(7) may impose particular burdens for insured depository institutions in the context of their relationships with certain third-party service providers and other business partners. Furthermore, the FDIC's 6

6 For example, the Office of the Comptroller of the Currency explicitly allows national banks and Federal savings associations to disclose non-public OCC information to attorneys, auditors, and consultants without a request under 12 CFR 4.37(b)(2). Additionally, the Board of Governors of the Federal Reserve System explicitly allows supervised financial institutions to disclose confidential supervisory information to its legal counsel, auditors, and service providers without a request under 12 CFR 261.21(b)(3)-(4).

a. General Disclosure Authorizations

Consequently, while the current rule requires that insured depository institutions make a request and obtain FDIC authorization prior to disclosing confidential information to other parties in almost all circumstances, the proposed rule would enable insured depository institutions and certain other entities to disclose confidential information without prior approval from the FDIC in certain circumstances, subject to certain conditions

equires that insured depository institutions make a request and obtain FDIC authorization prior to disclosing confidential information to other parties in almost all circumstances, the proposed rule would enable insured depository institutions and certain other entities to disclose confidential information without prior approval from the FDIC in certain circumstances, subject to certain conditions. Disclosure of such confidential information without a request to the FDIC would not compromise safety and soundness and will, among other things, reduce burden, facilitate regulatory compliance, and improve efficiencies—including between an institution and third parties that have business relationships with the institution. The proposed rule would establish safeguards to help ensure the confidential information is adequately protected (and not used for impermissible purposes) by the recipient(s) of such information. In some circumstances, these safeguards include requiring recipients to have agreed to a qualifying confidentiality agreement. In addition, insured depository institutions may only share confidential information without FDIC approval if sharing is “necessary or appropriate for business purposes,” meaning it must be in furtherance of specific objectives related to the insured depository institution's business.

In other circumstances, such as disclosure of certain confidential information by an insured depository institution to its affiliates and to directors, officers, and employees of its affiliates, no qualifying confidentiality agreement would typically be required. These changes are intended to reduce the burdens and detailed processes in the current rule to permit a more streamlined flow of confidential information between insured depository institutions and other parties when necessary or appropriate for business purposes. The proposed rule would also retain the authority of the FDIC to authorize disclosure of confidential information in other circumstances, subject to the good cause standard

(a)(1)(iii) through (vii) of section 309.37 would be subject to the requirement that, prior to or concurrently with any such disclosure, the insured depository institution must enter into a qualifying confidentiality agreement with the intended recipient of the information. The requirements for a qualifying confidentiality agreement are described in section II.C.3 of this Supplemental Information.

Question 14: Does the proposal appropriately identify the types of parties to, and circumstances in which,

Question 15: Would the safeguards to be introduced under the proposal sufficiently mitigate the risk of inappropriate disclosure of confidential information? Should the FDIC consider any additional safeguards? For example, should insured depository institutions be required to maintain a written record of disclosures of confidential information and the legal basis for such disclosures? If so, should this requirement be applicable to any disclosure or only in respect of disclosures to certain recipients (e.g., disclosures to qualifying service providers)?

Question 16: Should different types of confidential information be subject to more stringent safeguards than those contemplated under the proposal?

b. Disclosure of Historical Information

Proposed section 309.37(b) would allow insured depository institutions to disclose confidential information if at least twenty-five years have elapsed since that confidential information was created, unless otherwise notified by the FDIC, and any such disclosure maintains compliance with privacy and trade secret laws. The FDIC believes that the justifications for maintaining the confidentiality of information would generally be diminished after twenty-five years. Such information may still be of value, however, for research, analytical, and other purposes. Accordingly, the FDIC believes it is appropriate to allow for the disclosure of such information without the prior approval of the FDIC

iding services without the prior approval of the FDIC, subject to certain limitations. As with other disclosures of confidential information that would be permitted without the prior approval of the FDIC, the disclosure of confidential information by these service providers to their insured depository institution partners would only be permitted when necessary or appropriate for a business purpose. Such service providers would also need to have in place a qualifying confidentiality agreement with the intended recipient of the information.

The FDIC is not, at present, proposing to permit an FDIC-examined service provider to disclose confidential information without the prior approval of the FDIC to parties other than an insured depository institution that is an existing partner. The FDIC recognizes, however, that there may be benefits to facilitating greater disclosure of confidential information by FDIC-

Question 24: Should an FDIC-examined service provider be permitted to share confidential information with insured depository institutions that are potential partners? If so, what conditions or safeguards should apply to such arrangements? Should an FDIC-examined service provider be permitted to share confidential information with any other type of parties?

Finally, proposed section 309.38 would provide for disclosures by other parties that may have confidential information in their possession. Consistent with section 309.6(b)(7)(ii) of the current rule, such disclosures would be subject to the prior approval of the FDIC. The proposed rule, however, would simplify the requirements for such disclosures, including by eliminating the requirement that such approval be preceded by a written request for disclosure. Under certain exigent circumstances, such as a significant financial crisis, a written request may neither be timely nor necessary

posed subpart D?

2. Definitions

Proposed section 309.51 would introduce certain new defined terms that the FDIC believes will help clarify the FDIC's requirements and restrictions regarding disclosure of its information in legal proceedings in which the FDIC is not a party.

Access to FDIC documents or property would mean to produce, provide, or allow examination of FDIC documents or property.

Discovery demand would mean a subpoena, court order, request for production of documents, interrogatories, notice of deposition, motion to compel, or other notice or order in a legal proceeding requiring the FDIC or any other person in possession, custody, or control of FDIC information to provide FDIC information for use or possible use in the legal proceeding.

FDIC documents or property would mean documents, electronically stored information, tangible things, and premises that are owned by or were created by the FDIC except documents or property of a depository institution or financial company in FDIC receivership or conservatorship that the FDIC has transferred to the custody of a contractor, servicer, acquiring institution, bridge bank or other successor institution, or other third party in the course of the FDIC's depository institution or financial company resolution activities.

FDIC information would mean any FDIC documents, property, or FDIC testimony.

FDIC testimony would mean testimony by a current or former director, officer, employee, agent, or contractor of the FDIC concerning: (1) FDIC documents or property; or (2) knowledge or experience acquired, or communications or activities engaged in, as part of their official duties or otherwise related thereto or because of their official status while such individuals were employed by or acted as agent, contractor, or otherwise on behalf of the FDIC

ormer director, officer, employee, agent, or contractor of the FDIC concerning: (1) FDIC documents or property; or (2) knowledge or experience acquired, or communications or activities engaged in, as part of their official duties or otherwise related thereto or because of their official status while such individuals were employed by or acted as agent, contractor, or otherwise on behalf of the FDIC.

Legal proceeding would mean a judicial or administrative adjudication, action, case, matter, hearing, trial, arbitration, formal inquiry, formal investigation, or similar proceeding initiated before or subject to a court, agency or agency members, commission, board, grand jury, arbitrator, administrative law judge, hearing officer, or other authorized official or body, whether criminal, civil, or administrative in nature, under federal, state, local, or foreign law.

Non-party legal proceeding would mean a legal proceeding in which neither the FDIC (in the capacity to which the process is directed) nor an FDIC director, officer, or employee (in the capacity to which the process is directed) is a party.

Party would mean a person that is asserting claims or defending against claims in a legal proceeding. This would not include a person who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery.

Person would mean an individual or an entity in any form, including a governmental organization.

Request would mean a written statement in which a party or other person involved in a legal proceeding asks the FDIC to provide or authorize access to FDIC documents or property or authorize FDIC testimony for use in a legal proceeding.

Testimony would mean a sworn or unsworn statement made by an individual for use or possible use by a party in a legal proceeding

ed and clarified relative to the current rule, these proposed sections are not intended to introduce any substantive changes to current regulatory requirements or practices.

4. Decisions on Requests

Proposed section 309.54 would establish the process by which the FDIC general counsel or designee would consider and reach a determination on requests for FDIC information submitted under subpart D. While generally consistent with the current rule and existing FDIC practice, proposed section 309.54 would provide for greater transparency by identifying the factors that the FDIC general counsel or designee would consider when evaluating requests. These include (1) the contents of the request; (2) whether confidential, personal, commercial, or supervisory information is being requested and, if so, the risk that such information could be publicly disclosed; (3) whether fulfilling all or part of the request will materially interfere with the FDIC's operations; and (4) the public interest. Providing for these considerations directly in section 309.54 would help to inform the content of such requests.

Proposed section 309.54 would also provide requesters an avenue to seek reconsideration of the FDIC general counsel's decision within ten business days after the date of the written decision. After receipt of a request for reconsideration, the FDIC general counsel would have ten business days to review and decide on the request. A denial of such a request would be considered a final decision and would exhaust the requesting party's administrative remedies with respect to the request for FDIC information, thereby permitting such party to seek judicial review of such a final decision under the Administrative Procedure Act. 7

7 5 U.S.C. 702.

5. Waiver of Requirement for Requests

Proposed section 309.55 would introduce the authority of the FDIC general counsel or designee to waive the request process otherwise provided for in subpart D

ice process on an FDIC director, officer, or employee in an individual capacity. Relative to the current service of process provisions in 12 CFR 309.7, proposed section 306.3 would clarify the service procedures by providing, in a more organized and streamlined format, details on how and whom to serve at the FDIC, as well as a listing of the FDIC's agents for service of process, by geographic area. When serving a director, officer, or employee in an individual capacity, section 306.3(b) would provide that service of process must be made to the United States as well as the officer or employee, and requires a copy of such service of process to be sent to an FDIC agent for service of process. This provision would help to ensure the FDIC remains apprised of process served on its directors, officers, or employees that may require disclosure of the FDIC's confidential information.

Question 30: Would proposed section 306.3 improve the clarity of the FDIC's current service of process provisions under section 309.7? Are there additional revisions that could be made to address areas of ambiguity in the current rule?

IV. Technical Amendments to Other Parts of the FDIC's Regulations

Certain sections of parts 303, 327, and 337 of the FDIC's regulations include cross-references to various provisions of part 309. If part 309 is amended as proposed, these references would refer to sections of part 309 that either no longer exist or have been recodified at a different section of part 309. The proposal would, therefore, amend those sections of parts 303, 327, and 337 to incorporate references to the appropriate sections of part 309, as would be amended under the proposal.

V. Expected Effects

s 303, 327, and 337 to incorporate references to the appropriate sections of part 309, as would be amended under the proposal.

V. Expected Effects

The proposed rule would revise the FDIC's regulations related to the processing of FDIC records under FOIA, as well as the FDIC's restrictions on the disclosure of confidential information not subject to release under FOIA (confidential information). Specifically, the proposed rule would authorize insured depository institutions, their bank holding companies, and certain other entities to share confidential information with certain parties enumerated in the rule for business purposes without the prior approval of the FDIC. The proposed rule would also relocate the FDIC's procedures on the service of process to a new part 306.

This section summarizes the analysis performed by the FDIC to estimate the economic impact of the proposed rule. For this purpose, the FDIC compares estimated economic outcomes under the proposed rule to outcomes under a baseline that resembles a world in which the proposed rule is not promulgated.

A. Scope of Affected Entities

The proposed rule would generally apply to any person that possesses or comes to possess confidential information; however, the FDIC expects that the typical holder of such information would be an insured depository institution or an insured depository institution holding company. As of the quarter ending December 31, 2025, the FDIC insured 4,345 depository institutions 8 and there were 3,600 active holding companies according to FR Y-9C and FR Y-9SP filings. 9 The proposed rule would also impact FDIC-examined service providers, of which there are 108 as of May 2026.

8 Call Reports, December 31, 2025.

9 December 31, 2025, FR Y-9C and FR Y-9SP data.

Certain provisions of the proposed rule would apply to any person that files a FOIA request with the FDIC or serves legal process on the FDIC. The FDIC received 1,536 FOIA requests in the fiscal year ending September 30, 2025

of the FDIC that received the request. The FDIC performed a keyword search of 1,299 requests in one of the repositories received from insured depository institutions received over a period of 9.167 years and identified 360 that would not be necessary under the proposed rule (359 of which came from insured depository institutions and one from an entity other than an insured depository institution). The FDIC reviewed a random sample of 48 requests out of a total of 1,576 requests in the other repository received over 10 years and identified 9 requests from insured depository institutions out of the sample of 48 that would not be necessary under the proposed rule. Thus, the FDIC estimates that (9/48) * 1,576 = 296 of this group of requests would not be necessary under the proposed rule, for a total of 655 requests from insured depository institutions that would not be necessary under the proposed rule.

The reduced volume of disclosure requests, representing approximately 69 fewer requests per year, would result in cost savings for insured depository institutions and their parent holding companies. The FDIC estimates that this reduction equates to an annual savings of at least $19,807, or about $290 per request. 15 In addition, there may be instances in which insured depository institutions have a need to share confidential information with certain third parties but choose not to due to the process for obtaining FDIC prior approval, but would share such information under the proposed rule. For this reason and others, the amount of savings may be greater than estimated given that the number of requests no longer needed under the proposed rule may be greater than estimated.

15 Subject matter experts at the FDIC estimated that the reduction in volume of disclosure requests as a result of the proposed rule would save affected institutions 135 hours per year on average

enior executive officers to whom an offer of employment has been made could benefit both an insured depository institution and prospective officer by improving the ability of each party to make a more fully informed employment decision. Separately, the ability to share confidential information with a potential counterparty to a merger or other transaction would facilitate more robust due diligence.

In aggregate, the changes under the proposed rule could produce considerable efficiencies for insured depository institutions and related entities. Although the FDIC does not have the necessary data to quantify

2. Other Changes

The proposed rule also updates and clarifies the FDIC's regulations governing its handling of requests under FOIA. Under the proposed rule, several provisions would be revised to more clearly describe the documents the FDIC makes available to the public and the process for submitting FOIA requests. The proposed rule also would add provisions describing the FDIC's administrative appeals process under FOIA and supplemental procedures for the submission and disclosure of confidential commercial information. In particular, the latter provision would require entities submitting confidential commercial information to the FDIC to designate the portions of its submissions that it considers to be protected from disclosure under Exemption 4 of FOIA, and provides that such protection would ordinarily expire 10 years from the date of submission unless the submitter requests and provides justification for a longer designation period. This provision would also provide submitters of confidential commercial information with notice and an opportunity to object when the FDIC determines that it may need to disclose that information.

To the extent the improved clarity of the FDIC's FOIA regulations facilitates the submission of complete and compliant FOIA requests, it may expedite the FDIC's processing of such requests, resulting in more prompt disclosure of responsive information

hat service of process must be effected in accordance with the rules of the applicable jurisdiction in which the legal proceeding is taking place. The FDIC does not have the necessary information to quantify the effects of this aspect of the proposed rule on insured depository institutions, but expects the changes would improve the clarity and efficiency of the FDIC's service of process procedures.

In general, the proposed rule, if finalized, would clarify aspects of the FDIC's information disclosure regulations that are ambiguous, codify current practices to improve the public's understanding of the FDIC's information sharing processes, and harmonize the FDIC's regulations with those of the other federal banking agencies to the extent appropriate. In doing so, the proposed rule, if finalized, would enhance the public's understanding of the FDIC's information disclosure processes and improve the public's ability to engage and interface with those processes.

C. Expected Costs

The proposed rule would provide insured depository institutions with additional latitude to disclose confidential information when doing so is necessary and appropriate for a business purpose, and would require insured depository institutions disclosing confidential information to certain recipients to enter into a qualifying confidentiality agreement with the prospective recipient prior to or concurrent with the disclosure of such information. For purposes of the proposed rule, a “qualifying confidentiality agreement” is one that includes the provisions set forth in the proposed definition for this term. In addition, for an insured depository institution to disclose confidential information to a potential counterparty in a merger transaction, 18 the proposed rule would require a written waiver from the counterparty of any claims against the FDIC arising from the confidential information

expects that there would be only minimal costs associated with requiring merger counterparties receiving confidential information to submit a written waiver of any claims against the FDIC that may otherwise arise from receipt of confidential information. There were 110 voluntary mergers per year on average between insured depository institutions over the three-year period ending December 31, 2025. 20 If each merger involved three potential counterparties 21 for whom a written waiver was submitted, then 330 waivers per year would have been submitted if the proposed rule had been in place, at an estimated cost of only about $180 per waiver submission. 22 The proposed rule also could increase the risk that confidential information may be disclosed to unintended recipients not authorized to receive such information. However, the FDIC does not expect this risk to increase materially as a result of the proposal. The FDIC's longstanding practice has been to routinely approve the types of disclosures that would no longer require prior FDIC authorization under the proposed rule. Moreover, while the proposed rule would facilitate more

20 See https://www.fdic.gov/community-banking-research-program/community-banking-structure-reference-data-fourth-quarter-2025.

21 While mergers may involve fewer than three counterparties, the FDIC is using three as an estimate given the proposed rule's provision at proposed section 309.37(a)(1)(vii) limiting the disclosure of confidential information to three potential merger counterparties over a five-year period. Also, although many mergers may be completed without sharing confidential information with three counterparties, there are likely also potential mergers for which confidential information is shared, but which do not ultimately result in a merger. Accordingly, the estimate of three disclosures per completed merger attempts to account for both of these considerations

on any material economic effects that the agency has not identified.

VI. Matters of Regulatory Procedure

A. Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA) generally requires an agency, in connection with a proposed rule, to prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of the proposed rule on small entities. 23 However, an initial regulatory flexibility analysis is not required if the agency certifies that the proposed rule would not, if promulgated, have a significant economic impact on a substantial number of small entities. The Small Business Administration (SBA) has defined “small entities” to include banking organizations with total assets of less than or equal to $850 million. 24 As detailed in the following statement of factual basis, the FDIC certifies that the proposed rule would not, if promulgated, have a significant economic impact on a substantial number of small entities.

23 5 U.S.C. 601 et seq.

24 The SBA defines a small banking organization as having $850 million or less in assets and determines an organization's assets by averaging the assets reported on its four quarterly financial statements for the preceding year. See 13 CFR 121.201 (as amended by 87 FR 69118, effective December 19, 2022). Following these regulations, the FDIC uses an FDIC-supervised institution's affiliated and acquired assets, averaged over the preceding four quarters, to determine whether the FDIC-supervised institution is “small” for the purposes of the RFA.

Generally, the FDIC considers a significant economic impact to be a quantified effect in excess of 5 percent of total annual salaries and benefits or 2.5 percent of total noninterest expenses. To estimate the economic impact of the proposed rule on each small entity, the FDIC compares expected outcomes under the proposed rule to expected outcomes under a baseline absent the proposed rule

he RFA.

The proposed rule would apply to all FDIC-insured institutions, parent holding companies of insured depository institutions, persons and entities requesting information from the FDIC under FOIA, persons and entities requesting information from the FDIC in connection with legal proceedings, and persons and entities serving legal process on the FDIC. As of the quarter ending December 31, 2025, the FDIC insures 4,345 depository institutions, of which 2,996 are small. 25 In addition, 3,600 holding companies were active as of December 31, 2025 and filed a Y-9C or Y-9SP. 26 Of these, 2,253 are small entities for purposes of RFA. 27 The FDIC does not possess the data to estimate the population of the persons and entities other than insured depository institutions that are potentially affected by the proposed rule. However, the FDIC reviewed a random sample of 50 discretionary disclosure requests (requests) received over the last ten years from a full population of 1,262 DDRs. Of these requests, 19 were made by banks, 17 by government entities, and two by law and accounting firms, neither of which was a small entity. For 12 requests, it was not possible based on the data drawn to identify who made the request.

25 Call Reports, December 31, 2025.

26 December 31, 2025, FR Y-9C and FR Y-9SP data.

27 Based on average assets reported in FR Y-9C data from March 31, June 30, and December 31, 2025, and in FR Y-9SP data from December 31, 2024, June 30, 2025, and December 31, 2025

may not conduct or sponsor, and an organization is not required to respond to, an information collection unless the information collection displays a currently valid Office of Management and Budget (OMB) control number. The

Proposed Information Collection:

Title: Disclosure of Information.

OMB Control No.: 3064-NEW.

Type of Review: Regular.

Affected Public: Businesses or other for-profit.

Description: The proposed rule would update, clarify, and supplement the FDIC's regulations regarding the disclosure of confidential information by the FDIC and other parties. The information collection requirements in the proposed rule are as follows:

Section 309.34 would require requests for discretionary disclosure of confidential information to be submitted to the FDIC.

Section 309.37(a)(1)(vii)(C) would require potential counterparties to submit a written waiver to the FDIC.

Section 309.52(b) and (c) and section 309.53 would require a party in a legal proceeding, or any person substantially involved in the legal proceeding, to submit a request to the FDIC general counsel or designee.

Table 1—Summary of Estimated Annual Burden [OMB No. 3064-NEW] Information collection (IC) (obligation to respond) Type of burden (frequency of response) Number of respondents Number of responses per respondent Time per response (HH:MM) Annual burden (hours) 1. Request for discretionary disclosure of confidential information related to resolution plans—Section 309.34 (Required to obtain or retain a benefit) Reporting (On Occasion) 91 1 01:00 91 2. Request for discretionary disclosure of confidential information other than information related to resolution plans—Section 309.34 (Required to obtain or retain a benefit) Reporting (On Occasion) 139 1 03:00 417 3. Written waiver—Section 309.37(a)(1)(vii)(C) (Required to obtain or retain a benefit) Reporting (On Occasion) 330 1 01:00 330 4

retain a benefit) Reporting (On Occasion) 91 1 01:00 91 2. Request for discretionary disclosure of confidential information other than information related to resolution plans—Section 309.34 (Required to obtain or retain a benefit) Reporting (On Occasion) 139 1 03:00 417 3. Written waiver—Section 309.37(a)(1)(vii)(C) (Required to obtain or retain a benefit) Reporting (On Occasion) 330 1 01:00 330 4. Request to use FDIC information in a non-party legal proceeding—Section 309.52(b) and (c), Section 309.53 (Required to obtain or retain a benefit) Reporting (On Occasion) 254 1 2:30 635 Total Annual Burden (Hours) 1,473 Comments are invited on:

(a) Whether the collection of information is necessary for the proper performance of the FDIC's functions, including whether the information has practical utility;

(b) The accuracy of the estimate of the burden of the information collection, including the validity of the methodology and assumptions used;

(d) Ways to minimize the burden of the information collection on respondents, including through the use of automated collection techniques or other forms of information technology.

All comments will become a matter of public record. Comments on aspects of this proposed rule that may affect reporting, recordkeeping, or disclosure requirements and burden estimates should be sent to the address listed in the ADDRESSES section. Written comments and recommendations for this information collection also should be sent within 60 days of publication of this document to www.reginfo.gov/public/do/PRAMain. Find this particular information collection by selecting “Currently under 60-day Review—Open for Public Comments” or by using the search function.

en estimates should be sent to the address listed in the ADDRESSES section. Written comments and recommendations for this information collection also should be sent within 60 days of publication of this document to www.reginfo.gov/public/do/PRAMain. Find this particular information collection by selecting “Currently under 60-day Review—Open for Public Comments” or by using the search function.

C. Riegle Community Development and Regulatory Improvement Act

Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act of 1994 (RCDRIA), 30 in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, each Federal banking agency must consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on affected depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations. In addition, section 302(b) of the RCDRIA requires new regulations and amendments to regulations that impose additional reporting, disclosures, or other new requirements on insured depository institutions generally to take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form. The FDIC invites comments that further will inform its consideration of the RCDRIA. 31

30 12 U.S.C. 4802(a).

31 12 U.S.C. 4802(b).

D. Plain Language

Section 722 of the Gramm-Leach-Bliley Act 32 requires the Federal banking agencies to use plain language in all proposed and final rulemakings published in the Federal Register after January 1, 2000. The FDIC sought to present the proposed rule in a simple and straightforward manner. The FDIC invites your comments on how to make this proposal easier to understand. For example:

32 12 U.S.C. 4809

gulation. In furtherance of this standard, section 3(c) of Executive Order 14192 requires that the new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least ten prior regulations. This proposed rule, if finalized as proposed, is expected to be a deregulatory action under Executive Order 14192.

List of Subjects

12 CFR Part 303 Administrative practice and procedure, Bank deposit insurance, Banks, Banking, Reporting and recordkeeping requirements, Savings associations.

12 CFR Part 306 Administrative practice and procedure, Banks, Banking.

12 CFR Part 309 Banks, Banking, Credit, Freedom of information, Privacy.

12 CFR Part 327 Bank deposit insurance, Banks, Banking, Savings associations.

12 CFR Part 337 Banks, Banking, Reporting and recordkeeping requirements, Savings associations, Securities.

Authority and Issuance

For the reasons set forth in the preamble, the Federal Deposit Insurance Corporation proposes to amend 12 CFR chapter III as follows:

PART 303—FILING PROCEDURES

1. The authority citation for part 303 continues to read as follows:

Authority:

12 U.S.C. 378, 1464, 1813, 1815, 1817, 1818, 1819(a) (Seventh and Tenth), 1820, 1823, 1828, 1829, 1831a, 1831e, 1831 o, 1831p-1, 1831w, 1835a, 1843(l), 3104, 3105, 3108, 3207, 5414, 5415, and 15 U.S.C. 1601-1607.

§ 303.8 [Amended]

2. Amend § 303.8(a) by, in the last sentence, removing “in accordance with § 309.5(f) of this chapter” and adding “in accordance with § 309.18(c) of this chapter” in its place.

§ 303.41 [Amended]

3. Amend § 303.41(b) by, in the last sentence, removing “; see § 309.4(a) and (b) of this chapter for availability”.

§ 303.60 [Amended]

4. Amend § 303.60 by removing “; see § 309.4(a) and (b) of this chapter for availability”.

§ 303.62 [Amended]

5. Amend § 303.62(b)(3) by, in the last sentence, removing “; see § 309.4(a) and (b) of this chapter for availability”.

in the course of performing such duties or related to such duties; or production of designated documents, electronically stored information, or tangible things or the inspection of premises in the FDIC's possession, custody, or control.

§ 306.2 Definitions. FDIC means the Federal Deposit Insurance Corporation in any capacity, including as receiver, as conservator, and in its corporate capacity.

FDIC's agent for service of process means a person authorized by the FDIC to accept delivery of process on behalf of the FDIC in any capacity or on behalf of an FDIC director, officer, or employee in their official capacity, and includes:

(1) the FDIC's agent for service of process for the appropriate geographic area, as listed on the FDIC's website; and

(2) the FDIC executive secretary or designee at FDIC, 550 17th Street NW, Washington, DC 20429.

Legal proceeding means a judicial or administrative adjudication, action, case, matter, hearing, trial, arbitration, formal inquiry, formal investigation, or similar proceeding initiated before or subject to a court, agency or agency members, commission, board, grand jury, arbitrator, administrative law judge, hearing officer, or other authorized official or body, whether criminal, civil, or administrative in nature, under federal, state, local, or foreign law.

Party means a person that is asserting claims or defending against claims in a legal proceeding. For purposes of this part, party does not include a person who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery.

Person means an individual or an entity in any form, including a governmental organization.

Process means a summons, complaint, pleading, motion, subpoena, writ, discovery demand, or other notice or order issued in a legal proceeding and required to be served upon a person

ceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery.

Person means an individual or an entity in any form, including a governmental organization.

Process means a summons, complaint, pleading, motion, subpoena, writ, discovery demand, or other notice or order issued in a legal proceeding and required to be served upon a person. Process includes both physical documents and electronic documents to the extent authorized by the law applicable to the legal proceeding.

Serve or service means delivery of process in accordance with the rules applicable to the particular jurisdiction, type of legal proceeding, stage of the legal proceeding, and type of process. The applicable rules may specify methods for delivery of process; persons or representatives authorized to accept delivery; delivery to multiple recipients; time limitations for effecting service; and other requirements.

§ 306.3 Service of process. (a) Service on the FDIC in any capacity or an FDIC director, officer, or employee in an official capacity. Any person or party desiring to properly

(1) the FDIC's agent for service of process; or

(2) when authorized by the rules applicable to the particular legal proceeding, counsel for the FDIC or counsel for the FDIC director, officer, or employee in an official capacity.

(b) Service on an FDIC director, officer, or employee in an individual capacity. Any person or party desiring to properly initiate process upon an FDIC director, officer, or employee as a party for an act or omission occurring in connection with duties performed on the FDIC's behalf (whether or not the director, officer, or employee is also sued in an official capacity) must serve the United States and the director, officer, or employee in the manner specified by Rule 4(i) of the Federal Rules of Civil Procedure. A copy of such process must also be sent to the FDIC's agent for service of process.

ssion occurring in connection with duties performed on the FDIC's behalf (whether or not the director, officer, or employee is also sued in an official capacity) must serve the United States and the director, officer, or employee in the manner specified by Rule 4(i) of the Federal Rules of Civil Procedure. A copy of such process must also be sent to the FDIC's agent for service of process.

7. Revise part 309 to read as follows:

PART 309—DISCLOSURE OF INFORMATION

Sec.

Subpart A—General

309.1 Purpose and Scope. Subpart B—Freedom of Information Act

309.10 Scope. 309.11 Definitions. 309.12 FDIC information that may be made available on request. 309.13 Making a request for records. 309.14 Processing requests—in general. 309.15 Processing requests—expedited processing. 309.16 Consultations and referrals. 309.17 Fees in general. 309.18 Types of fees. 309.19 Charging fees. 309.20 Payment of fees. 309.21 Waiver or reduction of fees. 309.22 Dispute resolution. 309.23 Administrative appeals. 309.24 Supplemental procedures for confidential commercial information. Subpart C—Discretionary Disclosure of Confidential Information

309.30 Purpose and Scope. 309.31 Definitions. 309.32 Disclosure prohibited. 309.33 Disclosure authorized; limitations. 309.34 Procedure for requesting discretionary disclosure. 309.35 Standard for discretionary disclosure. 309.36 Disclosure by the FDIC. 309.37 Disclosure by insured depository institutions and certain other entities. 309.38 Disclosure by other persons. 309.39 Conditions and limitations. Subpart D—Disclosure of Confidential Information in Legal Proceedings in Which the FDIC Is Not a Party

309.50 Scope. 309.51 Definitions. 309.52 Use of FDIC information in a non-party legal proceeding. 309.53 Submitting a request. 309.54 Decisions on requests. 309.55 Waiver and exemption of requirement for requests. Authority:

5 U.S.C. 552, 12 U.S.C. 1819 “Seventh and Tenth.”

Subpart A—General

§ 309.1 Purpose and Scope. (a) Scope.

5 U.S.C. 552(b)(4).

Defective request means a request that does not reasonably describe the information requested or that does not otherwise comply with the requirements of this subpart, including those related to fees.

Direct costs means expenditures the FDIC incurs in searching for, duplicating, and, in the case of commercial requesters, reviewing records in response to a request for records.

Duplication means the process of making a copy of a record, or of information contained in the record, for purposes of responding to a request.

Educational institution means any school that operates a program of scholarly research. A requester in this category must show that the request is made in connection with the requester's role at an educational institution and that the records are not sought for a commercial use, but rather are sought to further scholarly research.

FOIA public liaison means the FDIC official responsible for assisting requesters by explaining the FOIA process, providing information on the status of requests, and resolving any disputes. Contact information for the FDIC FOIA public liaison is available on the FDIC's website located at: https://www.fdic.gov.

Non-commercial scientific institution means an institution that is not operated on a “commercial” basis as that term is used in paragraph (b) of this section, and that is operated solely for the purpose of conducting scientific research, the results of which are not intended to promote any particular product or industry. A requester in this category must show that the request is

Representative of the news media means any person or entity that gathers information about current events or of potential current interest to a segment of the public, uses its editorial skills to turn the raw materials into a distinct work, and distributes that work to an audience.

Review means the examination of a record located in response to a request to determine whether any portion of it is exempt from disclosure

portal found at https://www.fdic.gov;

(2) completing the online request form located on the U.S. government central portal for FOIA requests at www.FOIA.gov;

(3) sending an email to the FDIC at efoia@fdic.gov, clearly marked “Freedom of Information Act request” or “FOIA request”; or

(4) sending a letter to: Legal Division, FDIC, ATTN: FOIA/PA Group, 550 17th Street NW, Washington, DC 20429.

(b) Contents of a request—administrative information. The request must contain the following information:

(1) The name and street address of the requester, an email address, if available, and the telephone number at which the requester may be reached during normal business hours;

(2) Whether the requester is an educational institution, non-commercial scientific institution, or a representative of the news media and, as applicable, the content requirements provided in the definitions of the terms “educational institution” and “non-commercial scientific institution” in § 309.11; and

(3) A statement identifying a maximum fee, if any, that is acceptable to the requester, or a request for a waiver or reduction of fees that satisfies § 309.21.

(c) Contents of a request—description of records sought. A request for records must describe the records in a way that enables FDIC staff to identify and produce the records with reasonable effort and without unduly burdening the FDIC or significantly interfering with the operation of the FDIC's automated information systems.

(1) Requesters should include details about the specific records or the types of records that the requesters are seeking, such as the date, title or name of the record; author of the record; recipient of the record; name and location of the financial institution to which the record pertains, if applicable; and subject matter of the record so that the FDIC can locate the records with a reasonable amount of effort.

on or documentation, if necessary, for verification purposes.

§ 309.14 Processing requests—in general. (a) Receipt of requests. Upon receipt of a request, the FOIA/PA Group will acknowledge receipt of the request in writing to the requester and provide the requester with an individualized tracking number for the request and the telephone number to obtain information about the status of request.

(b) Multitrack processing. The FDIC places FOIA requests in simple or complex queues.

(1) In making the determination as to whether a request will be placed in the complex processing queue, the FDIC will consider whether it will need to:

(A) search for and collect records from one or more divisions or offices outside of the FOIA/PA Group;

(B) search for, collect, and review a voluminous number of records that are part of a single request; or

(2) Most other requests will be placed in the simple processing queue.

(3) Requesters may seek expedited processing under § 309.15.

(d) Status of a request. A requester may check on the status of a request using the tracking number assigned to obtain information including the date of the FDIC's receipt and an estimated date for a response. The status of a request may be obtained online at the FDIC's FOIA Service Center, at https://www.fdic.gov, if the request was submitted electronically using the FDIC's online FOIA request portal, by calling the FDIC's FOIA Service Center at (202) 898-7021, by email at efoia@fdic.gov, or by regular mail.

(e) Statutory time period for processing. The time for response to requests is twenty business days after the date of receipt of the request by the FOIA/PA Group. The date of receipt for such request, including one that is addressed incorrectly or that is referred by another agency, is the date the FOIA/PA Group actually receives the request.

021, by email at efoia@fdic.gov, or by regular mail.

(f) Extension of time in unusual circumstances.

(1) Whenever the statutory time limits for processing a request cannot be met because of unusual circumstances, as defined in 5 U.S.C. 552(a)(6)(B), the FDIC will, before the expiration of the twenty-day period to respond, notify the requester in writing of the unusual circumstances involved and of the date by which processing of the request can be expected to be completed.

(2) If this extension exceeds ten working days, the FDIC will, as described by the FOIA, provide the requester with an opportunity to modify the request or agree to an alternative time period for processing the original or modified request.

(3) The FDIC will make available its FOIA Public Liaison to assist in the resolution of any disputes with the requester, and will also notify the requester of the right to seek dispute resolution services from the OGIS.

(g) Aggregation of requests. The FDIC may aggregate requests in cases where it reasonably believes that multiple requests, submitted by the same requester or by a group of requesters acting in concert, constitute a single request that would otherwise involve unusual circumstances and involve clearly related matters.

§ 309.15 Processing requests—expedited processing. (a) Processing requests on an expedited basis. A request will be processed on an expedited basis only when the FDIC determines that the request involves:

(1) circumstances in which the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual;

learly related matters.

(1) circumstances in which the lack of expedited processing could reasonably be expected to pose an imminent threat to the life or physical safety of an individual;

(2) an urgency to inform the public about an actual or alleged Federal Government activity, if made by a person who is primarily engaged in disseminating information;

(3) the loss of substantial due process rights; or

(4) a matter of widespread and exceptional media interest in which there exists possible questions about the Federal Government's integrity which affect public confidence.

(b) Making a request for expedited processing. A request for expedited processing must be made at the time the initial request for one or more records is made, and must include a statement certified to be true and correct, explaining in detail the basis for making the request for expedited processing, consistent with the considerations set forth in § 309.15(a).

(c) Notice of determination of request for expedited processing. A requester seeking expedited processing will be notified whether expedited processing has been granted or denied within ten calendar days of the receipt of the request by the FOIA/PA Group. If the request for expedited processing is denied, the requester may file an appeal pursuant to the procedures set forth in § 309.23.

§ 309.16 Consultations and referrals. (a) In general. If the FDIC determines that another agency of the Federal Government is subject to the FOIA and is in a better position to process records responsive to a request, then it will either:

(1) consult with the agency that has a substantial interest in the responsive records before responding to the request; or

ocedures set forth in § 309.23.

(1) consult with the agency that has a substantial interest in the responsive records before responding to the request; or

(2) refer the responsive records to the agency that created or initially acquired the records. Whenever the FDIC refers any part of the responsibility for responding to a request to another agency, it will notify the requester of the referral and inform the requester of the name of each agency to which the records were referred, unless such disclosure, in itself, would be exempt from disclosure.

(b) Timing of responses to consultations and referrals. All consultations and referrals received by the FDIC will be handled according to the date that the first agency received the perfected FOIA request.

(c) Agreements regarding consultations and referrals. The FDIC may establish agreements with other agencies to eliminate the need for consultations or referrals with respect to particular types of records.

§ 309.17 Fees in general. (a) Fee schedule. The FDIC's Records Fee Schedule is available at https://www.fdic.gov/foia/fees. The Fee Schedule should be read in conjunction with the text of the FOIA and the Uniform Freedom of Information Fee Schedule and Guidelines published by the Office of Management and Budget. The FDIC may charge the full allowable direct costs it incurs. In order to resolve any fee issues that arise under this subpart, the FDIC may contact a requester for additional information. The FDIC shall ensure that searches, review, and duplication are conducted in the most efficient and the least expensive manner.

on Fee Schedule and Guidelines published by the Office of Management and Budget. The FDIC may charge the full allowable direct costs it incurs. In order to resolve any fee issues that arise under this subpart, the FDIC may contact a requester for additional information. The FDIC shall ensure that searches, review, and duplication are conducted in the most efficient and the least expensive manner.

(b) Fees by category of requester.

(1) Commercial use requesters will be charged search, duplication and review costs.

(2) Educational institutions, non-commercial scientific institutions and any representative of the news media will be charged duplication costs beyond the first 100 pages.

(3) All other requesters will be charged the full reasonable direct cost of search and duplication, except for the first two hours of search time and the first 100 pages of duplication.

§ 309.18 Types of fees. (a) Search fees. Search fees will be charged to any requester who is not an educational institution, a non-commercial scientific institution, or a representative of the news media. The FDIC will charge for manual searches for records at the hourly labor rates set forth in the FDIC's Records Fee Schedule. The fee for a search of electronic records will be the actual direct cost of the search, including computer search time and the time spent by the operator in conducting the search. Search costs are assessed even if responsive records are not located or are determined to be exempt from disclosure.

(b) Review fees. The FDIC will charge commercial use requesters for the review of records at the hourly labor rates set forth in the FDIC's Records Fee Schedule. The FDIC will not charge at the administrative appeal level for review of an exemption already applied. Requesters will be charged for review costs even if responsive records are

ng of the request will be tolled when the FDIC notifies the requester of the estimated fees. The requester will then be given the opportunity to agree to pay the estimated amount or modify the request. Upon receipt of the requester's response, the FDIC's time to respond will resume. If the FDIC does not receive a response from the requester within thirty calendar days, the request will be closed.

(1) If the FDIC determines that the estimated fees for search, duplication, and review will exceed $250.00, the FDIC will advise the requester that the requester must pay an amount equal to 20 percent of the estimated fees before the FDIC will continue processing the request. The time for the processing of the request will be tolled when the FDIC notifies the requester of the amount due. The requester will then be given the opportunity to pay the amount due. Upon receipt of the requester's payment, the FDIC's time to respond will resume.

(2) Where a requester previously failed to pay a properly charged FOIA fee within 30 calendar days of the billing date, the FDIC may require that the requester pay the full amount due, plus any applicable interest on that prior request, and may require that the requester make an advance payment of the full amount of any anticipated fee before beginning to process a new request or continuing to process a pending request or any pending appeal.

(d) Restrictions on charging fees.

(1) No search fees will be charged for requests by educational institutions, noncommercial scientific institutions, or representatives of the news media, unless the records are sought for a commercial use.

(2) If the FDIC fails to comply with the FOIA's time limits in which to respond to a request, it may not charge search fees, or for requests from requesters described in paragraph (d)(1) of this section, it may not charge duplication fees, except as described in paragraphs (d)(3) through (5) of this section.

representatives of the news media, unless the records are sought for a commercial use.

(3) If the FDIC determines that unusual circumstances exist, as defined by the FOIA and § 309.14(f), and provides timely written notice to the requester in accordance with the FOIA, a failure to comply with the time limit shall be excused for an additional 10 days.

(4) If the FDIC determines that unusual circumstances as defined by the FOIA and § 309.14(f) apply, and more than 5,000 pages are necessary to respond to the request, the FDIC may charge search fees, or, in the case of requesters described in paragraph (d)(1) of this section, may charge duplication fees if the FDIC has:

(i) Provided timely written notice of unusual circumstances to the requester in accordance with the FOIA and § 309.14(d); and

(ii) Discussed with the requester via written mail, email, or telephone (or made not less than three good-faith attempts to do so) how the requester could effectively limit the scope of the request in accordance with 5 U.S.C. 552(a)(6)(B)(ii). If this exception is satisfied, the FDIC may charge all applicable fees incurred in the processing of the request.

(5) If a court has determined that exceptional circumstances exist, as defined by the FOIA and § 309.14(f), a failure to comply with the time limits shall be excused for the length of time provided by the court order.

(6) Except for requesters seeking records for a commercial use, the FDIC shall provide without charge:

may charge all applicable fees incurred in the processing of the request.

(6) Except for requesters seeking records for a commercial use, the FDIC shall provide without charge:

(i) The first 100 pages of duplication (or the cost equivalent for other media); and

(ii) The first two hours of search.

(7) No fee will be charged when the total fee, after deducting the 100 free pages (or its cost equivalent) and the first two hours of search, is equal to or less than $25.

§ 309.20 Payment of fees. (a) Payment prior to release of records. The FDIC reserves the right to collect all applicable fees before releasing copies of requested records to the requester.

(b) Payment prior to processing. At its election, the FDIC may require payment in full of any amounts outstanding, plus interest, or advance payment of the full amount of any estimated fee, before the FDIC begins to process a new request or new appeal. The FDIC may also require a requester to demonstrate that any previously invoiced fees have been paid in full, before any further processing of a request occurs. If the FDIC requires advance payment, the request will not be considered received until the required payment is received. If an advance payment is not received within thirty calendar days of a demand for payment, the request will be closed.

FDIC may also require a requester to demonstrate that any previously invoiced fees have been paid in full, before any further processing of a request occurs. If the FDIC requires advance payment, the request will not be considered received until the required payment is received. If an advance payment is not received within thirty calendar days of a demand for payment, the request will be closed.

(c) Interest on unpaid fees. Interest charges on unpaid fees will begin to accrue on the 31st day following the day on which the invoice was sent, at the rate prescribed in 31 U.S.C. 3717.

§ 309.21 Waiver or reduction of fees. (a) Request for waiver or reduction of fees. A requester may request that the FDIC waive or reduce fees if disclosure of the records is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government and is not primarily in the commercial interest of the requester.

(b) Public interest. In deciding whether disclosure of the requested records is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government, the FDIC will consider the following factors:

(1) The subject of the request must concern identifiable operations or activities of the government.

(2) Disclosure of the requested information would be likely to contribute significantly to public understanding of those operations or activities. This factor is satisfied if the disclosure of the requested records would: be meaningfully informative about government operations or activities and would contribute to the understanding of a reasonably broad audience of persons interested in the subject, as opposed to the individual understanding of the requester. The FDIC will presume that a request from a representative of the news media will satisfy the latter consideration.

isclosure of the requested records would: be meaningfully informative about government operations or activities and would contribute to the understanding of a reasonably broad audience of persons interested in the subject, as opposed to the individual understanding of the requester. The FDIC will presume that a request from a representative of the news media will satisfy the latter consideration.

(3) The disclosure must not be primarily in the commercial interest of the requester. To determine whether disclosure of the requested information

§ 309.22 Dispute resolution. A requester seeking to engage in dispute resolution, may make a request to the FOIA public liaison and/or the OGIS by following the procedures set forth online in the FDIC's FOIA Service Center at https://www.fdic.gov. Dispute resolution is a voluntary process.

§ 309.23 Administrative appeals. (a) Basis for an appeal. A person who has received an adverse determination on a FOIA request has the right to appeal the denial to the FDIC general counsel or designee. For purposes of this section, an adverse determination includes a determination that:

(1) the requested records cannot be located;

(2) the requested records have been withheld in whole or in part;

(3) a request for expedited processing has been denied; or

(4) a request for a waiver or reduction of fees has been denied in whole or in part.

(b) Submitting an appeal.

(1) Form. An appeal of the adverse determination must be submitted in writing or electronically. Appeals submitted in writing must be submitted by mail addressed to the FOIA/PA Group, Legal Division, FDIC, 550 17th Street NW, Washington, DC 20429. Appeals submitted electronically must be by email clearly marked “Freedom of Information Act Appeal” or “FOIA Appeal,” to efoia@fdic.gov; submitted through the FDIC's FOIA request portal.

etermination must be submitted in writing or electronically. Appeals submitted in writing must be submitted by mail addressed to the FOIA/PA Group, Legal Division, FDIC, 550 17th Street NW, Washington, DC 20429. Appeals submitted electronically must be by email clearly marked “Freedom of Information Act Appeal” or “FOIA Appeal,” to efoia@fdic.gov; submitted through the FDIC's FOIA request portal.

(2) Content. The appeal must include any information relevant to the consideration of the appeal and must clearly identify the adverse determination that is being appealed and the request number.

(3) Timing. Appeals must be received within ninety calendar days of the adverse determination. Appeals submitted in writing must be postmarked within ninety calendar days after the date of the response of the adverse determination to be considered timely. Any appeal that has not been submitted electronically or postmarked within the specified timeframe will be considered untimely and will be closed administratively with notice to the requester.

(4) Outstanding fees. Complete payment of any outstanding fee invoice will be required before an appeal is processed.

(c) Time period for response. Except as provided in 309.23(c)(1) and (2), below, the FDIC will notify the appellant of the appeal determination within twenty business days after the date of receipt of the appeal. Notification of the appeal determination shall be in writing.

(1) This time period may be extended in the event of unusual circumstances as defined in 5 U.S.C. 552(a)(6)(B).

(2) If a requester is appealing an adverse determination involving the denial of expedited treatment under § 309.15, the FDIC will determine the appeal and notify the appellant of the appeal determination as soon as practicable.

information derived from or related to such FDIC record or information. Confidential information includes but is not limited to information about FDIC's supervision or resolution of depository institutions and financial companies; information about FDIC's enforcement of laws and regulations; and information about consumer complaints received by the FDIC. Confidential information does not include:

(1) Documents prepared by or for an insured depository institution, or any other party, for its own business purposes that are in its own possession, even though copies of such documents in the FDIC's possession otherwise would constitute confidential information; or

(2) Final orders, amendments, or modifications of final orders, or other actions or documents that are specifically required to be published or made available to the public pursuant to 12 U.S.C. 1818(u), the Community Reinvestment Act, or other applicable law.

Parent holding company means a company that has control of an insured depository institution. Control for purposes of this subpart is defined in 12 U.S.C. 1841(a)(2).

Person means an individual, or an entity in any form, including a government agency.

Qualifying confidentiality agreement means an agreement that:

(1) Is written;

(2) Is governed by the laws of the United States or a State of the United States;

(3) Prohibits the use of the information by the recipient for purposes other than that for which it is provided and provides that the recipient will not further disclose or make public in any manner the information;

(4) Limits access to the information at a recipient entity to those directors, officers, or employees who have a business need to know the information and are bound by the qualifying confidentiality agreement; and

e FDIC organizational directory on the FDIC's official website at https://www.fdic.gov/contact; or

(2) using the online request form on the web page of the FDIC Information and Support Center, https://ask.fdic.gov.

(c) Procedural waiver. An authorized director may, in the authorized director's sole discretion, waive any one or more of the requirements in paragraphs (a) or (b) of this section.

(d) Disclosure without a request. An authorized director may disclose confidential information on the authorized director's own initiative and without a request, provided that the good cause requirement of § 309.35 is satisfied.

§ 309.35 Standard for discretionary disclosure. (a) Good cause standard. An authorized director may disclose or authorize disclosure of confidential information when, in the authorized director's sole discretion, there is good cause for disclosure. Pursuant to § 309.39, the authorized director may require such other terms and conditions in writing in connection with and for purposes of the disclosure as the authorized director deems appropriate.

(b) Good cause considerations. An authorized director may consider the following, among other factors, when making a good cause determination:

(1) Whether disclosure will serve a legitimate regulatory, supervisory, resolution, or law enforcement purpose;

(2) Whether there is another source for the confidential information;

(3) Whether disclosure of the confidential information is unduly burdensome or otherwise may adversely affect or prejudice the FDIC, its mission, or its operations;

(4) The scope and nature of the confidential information;

(5) The recipient's intended use of the confidential information;

(6) Whether disclosure is lawful;

(7) Whether the confidential information includes privileged information, trade secrets, or confidential commercial or financial information; and

l and state agencies.

(d) Disclosure to foreign financial authorities. The authorized director may, for good cause and subject to § 309.39, disclose confidential information to any foreign financial regulatory or supervisory authority as provided, and to the extent permitted, by section 206 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (12 U.S.C. 3109) and 12 CFR 347.207.

(e) Disclosure to civil investigatory agencies or authorities. The authorized director may, for good cause and subject to § 309.39, disclose to a federal or state civil investigatory authority, or to any authorized officer or employee of such authority, confidential information relating to actual or potential violations of any federal or state civil law, unsafe or unsound banking practices, or breach of fiduciary duty.

(f) Disclosure to criminal law enforcement agencies or authorities. The authorized director may, for good cause and subject to § 309.39, disclose to any federal or state criminal law enforcement authority, or to any authorized officer or employee of such authority, confidential information relating to actual or potential violations of criminal law.

(g) Disclosures related to service providers subject to FDIC examination. The authorized director may, for good cause and subject to § 309.39, disclose confidential information to:

(1) a service provider that is subject to examination by the FDIC;

(2) Any insured depository institution or credit union that receives services from such a service provider;

(3) Any state agency or authority that exercises supervision over a financial institution serviced by such a service provider; and

n's own directors, officers, or employees;

(ii) Affiliates of the insured depository institution and the directors, officers, or employees of the insured depository institution's affiliates;

(iii) The insured depository institution's external legal counsel, accountant, or auditor;

(iv) A shareholder that owns in excess of 50 percent of the voting stock of the insured depository institution;

(v) A qualifying service provider to the insured depository institution;

(vi) An individual to whom an offer of employment has been made for that individual to serve as a senior executive officer, as defined in 12 CFR 303.101, of the insured depository institution; or

(vii) Directors, officers, employees, affiliates (including directors, officers, and employees of affiliates), auditors, and legal counsel of an insured depository institution that is a potential counterparty with which the insured depository institution is contemplating a merger or other transaction subject to 12 U.S.C. 1817(j), 1842, 1828(c), or 1467a. Such authorization is limited to three potential counterparties over a five-year period and the information disclosed must not be otherwise available in the course of due diligence nor used as a substitute for a counterparty's due diligence.

(A) Notwithstanding the numerical limitations set forth in 12 CFR 309.37(a)(1)(vii), an insured depository institution may disclose confidential information to directors, officers, employees, affiliates, auditors, and legal counsel of a potential counterparty with which it has a written agreement to enter into a merger or other transaction subject to 12 U.S.C. 1817(j), 1842, 1828(c), or 1467a.

(B) Any disclosures made under this paragraph (a)(vii) must be limited to directors, officers, employees and legal counsel with a need to know the confidential information for the purposes of performing their own reasonable due diligence or other duties related to the transaction or series of transactions

utory or regulatory processes, including, but not limited to, the Freedom of Information Act (FOIA), 5 U.S.C. 552 and subpart B of this part; the Privacy Act, 5 U.S.C. 552a and 12 CFR part 310; and public access to applications, notices, and other filings under 12 CFR 303.8.

(2) Requests seeking discretionary disclosure of confidential information of the FDIC pursuant to subpart C of this part.

(3) Requests seeking FDIC information made by persons who are not parties to or otherwise substantially involved with a legal proceeding.

§ 309.51 Definitions. Access to FDIC documents or property means to produce, provide, or allow examination of FDIC documents or property.

Discovery demand means a subpoena, court order, request for production of documents, interrogatories, notice of deposition, motion to compel, or other notice or order in a legal proceeding requiring the FDIC or any other person in possession, custody, or control of FDIC information to provide FDIC information for use or possible use in the legal proceeding.

FDIC documents or property means documents, electronically stored information, tangible things, and premises that are owned by or were created by the FDIC except documents or property of a depository institution or financial company in FDIC receivership or conservatorship that the FDIC has transferred to the custody of a contractor, servicer, acquiring institution, bridge bank or other successor institution, or other third party in the course of the FDIC's depository institution or financial company resolution activities.

FDIC information means any FDIC documents, property, or FDIC testimony.

FDIC testimony means testimony by a current or former director, officer, employee, agent, or contractor of the FDIC concerning:

(1) FDIC documents or property; or

hat is asserting claims or defending against claims in a legal proceeding. For purposes of this subpart, party does not include a person who intervenes, joins, or appears in a legal proceeding for a limited or special purpose, such as to contest a subpoena or seek a protective order in non-party discovery.

Person means an individual or an entity in any form, including a governmental organization.

Request means a written statement in which a party or other person involved in a legal proceeding asks the FDIC to provide or authorize access to FDIC documents or property or authorize FDIC testimony for use in a legal proceeding.

Testimony means a sworn or unsworn statement made by an individual for use or possible use by a party in a legal proceeding. Testimony may include, but is not limited to, live statements at a deposition, hearing, trial, or interview in person or by audio or visual communication; written or recorded responses to questions; or an affidavit, declaration, sworn statement, certification, or attestation.

Use, with respect to FDIC information provided in accordance with this subpart, means that, subject to conditions and limitations required by the FDIC general counsel or designee, authorized parties or other persons involved in a legal proceeding may disclose FDIC information in the legal proceeding in the same manner and with the same protections as information obtained in discovery in the legal proceeding.

§ 309.52 Use of FDIC information in a non-party legal proceeding. (a) Prohibition. No party or other person may obtain access to FDIC documents or property, obtain FDIC testimony, or use FDIC information in connection with a non-party legal proceeding without express authorization by the FDIC general counsel or designee, except as provided in this subpart or otherwise required by law.

st is exempt pursuant to § 309.55, a party seeking FDIC information for use in a non-party legal proceeding must submit a request to the FDIC general counsel and receive a decision prior to serving a subpoena or other discovery demand.

(1) Subpoenas or other discovery demands in a non-party legal proceeding will be processed in accordance with applicable law, rules, regulations, and privileges.

(2) The FDIC may object to, move to quash, or otherwise oppose a subpoena or other discovery demand on any appropriate basis, including failure to exhaust administrative remedies.

§ 309.53 Submitting a request. (a) Where to submit a request. A party or other person should submit a request

(b) Contents of a request. A request must be in writing and should state, or attach documents containing, the following information:

(1) Information about the legal proceeding, current status, and schedule, and copies of pertinent pleadings and other filings.

(2) A detailed description of the FDIC documents or property sought; information about any person whose testimony is being requested and a summary of the anticipated FDIC testimony; why the FDIC information is relevant to the issues in the legal proceeding; and whether other evidence on those issues is available from non-FDIC sources.

(3) An agreement to reimburse the FDIC's reasonable costs for (A) locating, reviewing, and providing access to FDIC documents or property; and (B) providing FDIC testimony; and

Subpoenas, court orders, or other legal process issued for such records will be evaluated in accordance with state and federal law, regulations, rules, and privileges applicable to the FDIC as receiver or conservator.

PART 327—ASSESSMENTS

8. The authority citation for part 327 continues to read as follows:

Authority:

12 U.S.C. 1813, 1815, 1817-19, 1821, 1823.

§ 327.4 [Amended]

9. Amend § 327.4(d) by removing “exempt information within the scope of § 309.5(g)(8) of this chapter” and adding “confidential information as defined at § 309.31 of this chapter” and by removing “the disclosure restrictions set out at § 309.6 of this chapter” and adding “the disclosure restrictions set out at § 309.32 of this chapter”.

PART 337—UNSAFE AND UNSOUND BANKING PRACTICES

10. The authority citation for part 337 continues to read as follows:

Authority:

12 U.S.C. 375a(4), 375b, 1463, 1464, 1468, 1816, 1818(a), 1818(b), 1819, 1820(d), 1821(f), 1828(j)(2), 1831, 1831f, 1831g, 5412.

§ 337.12 [Amended]

11. Amend § 337.12(b)(3)(ii) by removing “(copies of which are available at the addresses specified in § 309.4 of this chapter)”.

Federal Deposit Insurance Corporation. By order of the Board of Directors.

Dated at Washington, DC, on June 25, 2026. Jennifer M. Jones, Deputy Executive Secretary.

[FR Doc. 2026-13123 Filed 6-29-26; 8:45 am] BILLING CODE 6714-01-P

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.