On October 14, the Office of the Comptroller of the Currency (OCC) released its final report on the results of its review of debanking at the nine then-largest national banks under its supervision by asset size, as part of its implementation of Executive Order 14331, “Guaranteeing Fair Access to Banking for All Americans” (EO 14331), which was issued in August 2025. The same day, the Consumer Financial Protection Bureau (CFPB) announced that it will investigate whether the banks featured in the report, and others, have complied with federal consumer financial protection laws. Together, these two regulatory actions signal that debanking is becoming a key focal point for both prudential and consumer financial protection examinations and supervision.

What the OCC Reviewed

The OCC’s debanking review covered the period from 2020 through September 2025. As part of its work, the OCC reviewed nearly 100,000 complaints made between January 1, 2020, and December 31, 2025, hundreds of individual bank decisions, and about 420,000 pages of bank documents. It reviewed two categories of bank policies and practices: those addressing “reputation risk” and those restricting access to financial services for specific industries. The report follows the OCC’s December 2025 preliminary findings.

The OCC states that its observations are limited by the completeness of the banks’ responses and the documentation available. It was unable to quantify the full extent of debanking across the banks, and it states that how often a bank is mentioned in the report does not reflect the volume of that bank’s decisions.

Comptroller Jonathan Gould discussed the report in remarks in Lexington, Kentucky, alongside Congressman Andy Barr and representatives of the coal and firearms industries. He said the OCC found that “all of these banks had adopted reputation risk policies at various levels which allowed political considerations, public opinion, and social pressures to influence who banks deemed not worthy to access financial services.” He added that “what began as decisions made by executives to debank disfavored industries became institutionalized and opaque bureaucracies,” and that some employees “created procedural frictions that achieved the same result as a practical matter.”

The OCC’s Principal Observations

The OCC makes several observations, which we summarize at a high level:

• Reputation risk standards. The OCC places much of the responsibility on the banks’ “broad” and “inexact” reputation risk policies. Despite the banks’ efforts to establish policies and processes that captured and measured reputation risk, the report states that the banks largely lacked clear, measurable, and objective criteria for assessing reputation risk and acknowledged the subjective nature of managing it. In the OCC’s words, “this practice infused the value judgments of stakeholders into banks’ business decisions.” The OCC says banks “spent considerable time discussing potential impacts to customer loyalty, the views of government entities (including the banks’ own regulators), the risks of shareholder petitions, and opinions of advocacy groups on both sides of the political spectrum.”
• Consistency. The OCC states that reputation risk decisions were not consistently applied across the transactions it sampled. According to the report, even within the same bank, relationship decisions involving customers with similar views sometimes resulted in different outcomes. The OCC attributes this inconsistency to the subjective nature of ambiguous and open-ended reputation risk policies, which could allow perceptions of public opinion or stakeholder views to influence decisions rather than objective, risk-based criteria.
• Industry-specific policies. The OCC reports that many banks maintained policies restricting or requiring heightened review for certain industries, including coal, firearms, and others, and that these policies could disproportionately affect smaller businesses. In the OCC’s view, such policies risk hindering competition and innovation in lawful industries, often harming smaller businesses. Some bank policies provided flexibility to seek exceptions from the industry-specific restrictions, which banks leveraged periodically to preserve existing, lucrative banking relationships.
• Third-party information and negative news. The OCC also focuses on the information banks used to make reputation risk determinations. According to the report, banks relied on sources including negative-news searches, advocacy organizations, third-party environmental and social governance reports, and complaint data. The OCC states that reliance on these sources could add another layer of subjectivity and bias to reputation risk determinations.
• Customer communications. The OCC states that account closure and denial communications often gave little or no explanation, and that, in several cases, greater transparency about the bank’s concern before closure could have allowed the account to remain open. The OCC’s concerns extend beyond account closure notices, however. The report also discusses customer communications during onboarding and customer due diligence, fraud and financial-crime screening, and inquiries about potentially unusual transactions. According to the OCC, limited explanations provided by banks about why information was being requested could hinder efforts by both customers and banks to address the underlying concerns.
• State fair access laws. The OCC states that state fair access laws likely prompted many banks to reconsider industry-specific restrictions or clarify how those restrictions should be applied. According to the report, many banks revised their policies in late 2023 and 2024 to move away from categorical industry-wide prohibitions and toward heightened, individualized reviews of customers in certain industries. The OCC did not assess whether banks complied with those state laws and cautions that changes in policy language may not necessarily reflect changes in practice. As a result, the agency states that it cannot rule out the possibility that a customer’s industry continues to weigh heavily in bank decision-making.
• Controls improvement. The report indicates that banks have taken steps to address debanking beyond revising written policies and procedures, including enhanced monitoring and testing, mapping customer decisions to applicable processes and controls, establishing metrics and enterprise reporting, reviewing documentation supporting escalations and adverse actions, and using second- and third-line functions to test whether controls were applied consistently. The OCC nevertheless cautions that changes in policy language do not necessarily correspond with changes in practice.
• Remaining risk. The OCC states that reputation risk remains a consideration at many banks, sometimes under other labels, such as “franchise” or “brand” risk, and that it cannot say with confidence that current policies preclude a return to the debanking practices it describes. The report points in particular to concepts such as stakeholder sentiment, franchise resilience, shareholder value, and prospective commercial harm where banks may still lack objective or readily measurable thresholds.

Where the OCC Is Headed

The debanking report and Comptroller Gould’s remarks signal continued attention to this issue by the OCC, and the end of the report contains a section describing the OCC’s efforts to address debanking and promote fair access to banking services to date:

• The OCC has eliminated reputation risk from its supervisory framework, including through a rule issued with the Federal Deposit Insurance Corporation (FDIC).

• The OCC has incorporated debanking considerations into other aspects of its supervisory and regulatory framework. Under OCC Bulletin 2025-22, issued in September 2025, the agency states it may consider a bank’s record of, and policies and procedures designed to avoid, politicized or unlawful debanking in relevant licensing filings. Additionally, the bulletin provides that the OCC may consider debanking in Community Reinvestment Act examinations when assessing a bank’s record of meeting its community’s credit needs, consistent with safe and sound operations.

• The OCC is considering further rulemaking to prevent discrimination based on political or religious beliefs and to address the role of reputation risk in bank decision-making, including the reliance on or incorporation of third-party opinions.

• The OCC is considering further steps on Bank Secrecy Act (BSA) practices. These could include additional guidance on the risk-based application of BSA requirements, additional reforms to reinforce the OCC’s risk-based approach to BSA supervision, and potential regulatory or supervisory changes addressing pretextual reliance on the BSA for account terminations unrelated to legitimate money-laundering or terrorist-financing concerns.

• The OCC will continue evaluating customer communications and account-termination practices, including wide differences it observed in the content, timing, and completeness of customer notices. The OCC also points to a September 2026 joint agency statement clarifying that Suspicious Activity Report (SAR) confidentiality requirements do not prohibit banks from communicating with customers about the underlying facts, transactions, and documents on which a SAR is based, so long as the communication does not reveal the existence of a SAR.

Comptroller Gould emphasized that the OCC is “not forcing these banks to serve every customer. Instead, banks should evaluate every customer on objective, risk-based criteria.” While he acknowledged that the subject banks have made some efforts to “rein in” debanking practices, Comptroller Gould is concerned that it will not be enough, stating “there is more work to do.” Toward that end, Comptroller Gould stated that the OCC “will be assessing further changes to the regulatory and supervisory framework applicable to the largest banks to reduce the likelihood of these harmful practices occurring in the future.” According to the OCC press release, such changes include considering actions to prevent banks from discriminating against customers or prospective customers on the basis of their political or religious beliefs and to address the “problematic role” of reputation risk in bank decision-making.

The CFPB Responds

On the same day as the release of the OCC report, the CFPB announced a new investigative initiative tied to the report. Acting Director Mark Paoletta said the CFPB “will fully investigate whether the institutions featured in OCC’s report and others have complied with federal consumer financial laws and take appropriate action.” The CFPB holds primary supervisory and enforcement authority for banks with over $10 billion in assets, including the nine banks cited in the report, as well as certain nonbank financial institutions, to assess their compliance with federal consumer financial laws.

The CFPB’s announcement points to several tools it may use to address debanking activities:

• Federal consumer financial protection laws. The CFPB evaluates compliance with the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA), particularly the adverse action notice requirements under those laws, as well as the prohibition on unfair, deceptive, or abusive acts or practices (UDAAP), and opens investigations when warranted.
• Internal review. The CFPB states that it reviewed its Examination Manual, guidance, and regulations, and other materials used to regulate or examine financial institutions under its authority to ensure that they do not contain reputation risk concepts that could result in unlawful debanking. It is also reviewing consumer complaints and supervisory and enforcement data for evidence of potential unlawful debanking and is pursuing its own investigations.
• Consumer complaints. The CFPB has updated its website and complaint portal with information to raise awareness about debanking and encourages consumers who believe they were debanked to submit complaints.

The CFPB’s announcement is notable because it extends the issue beyond safety-and-soundness supervision into consumer financial protection law. Its statement that it will investigate the banks identified in the OCC report “and others” suggests that scrutiny of potential debanking practices may extend beyond the nine banks reviewed by the OCC.

Our Take and Considerations for Banks

As we have noted in prior blog posts, debanking has become President Trump’s signature fair banking issue, and we are now seeing two key federal agencies – the OCC and CFPB – publicly respond with findings from their internal debanking reviews of supervised institutions and plans for future action. It is possible that the FDIC, Federal Reserve Board, and perhaps the Small Business Administration may soon follow suit.

In light of the OCC’s report and the CFPB’s investigative announcement, supervised institutions may wish to consider the following steps to further address debanking risk:

• Review policies. Assess whether policies that address reputation, franchise, brand, stakeholder sentiment, or similar risks, and any industry-specific restrictions, use clear, measurable, objective, and risk-based criteria. Consider whether changes in terminology have been accompanied by corresponding changes in decision-making practices.
• Review information used in customer decisions. Assess how negative news, third-party ratings and assessments, customer reviews, complaint information, and other external sources enter onboarding, escalation, and termination decisions, including whether that information is validated and tied to objective, risk-based criteria. The OCC specifically identifies the incorporation of third-party opinions as an area it may address through further rulemaking.
• Document decisions. Review how account opening or loan denial decisions, onboarding, escalation, relationship expansion, and exit decisions are documented, and whether the stated reasons are accurate and consistent with the underlying records.
• Test implementation and controls. Consider whether fair access requirements are reflected throughout the customer lifecycle and whether monitoring, testing, management reporting, complaint handling, and second- and third-line testing provide reasonable assurance that controls are being applied consistently in practice.
• Review customer communications and adverse action notices. Evaluate communications throughout the customer lifecycle, including onboarding and due-diligence inquiries, requests concerning unusual activity, account closure and denial notices, and customer service scripts.Consider whether customers receive sufficient information to understand and, where possible, address the bank’s concerns,taking into account legal limits on what may be disclosed, such as SAR confidentiality. Consider how ECOA and FCRA adverse action requirements apply to credit decisions.
• Assess UDAAP exposure. Consider whether account closure and loan denial practices, and the explanations given for them, could give rise to UDAAP concerns.
• Evaluate BSA/AML practices. Consider how BSA and anti-money laundering determinations are made and documented, given the OCC’s stated interest in pretextual use of those requirements.
• Consider state and broader regulatory implications. Review compliance with applicable state fair access laws, including any attestation obligations. OCC-supervised banks also may wish to consider the potential relevance of debanking practices and related controls in OCC licensing matters and CRA examinations.
• Prepare for follow-on activity. Expect continued interest in debanking from the OCC and the CFPB, as well as renewed interest from the other federal banking regulators (FDIC and Federal Reserve Board), and perhaps the Small Business Administration (which was the subject of EO 14331), Congress, and state authorities.

We will continue to monitor and report any debanking developments.