CRA revisions and CSI sharing – August 7, 2026

  • August 07, 2026

Change remains a constant in financial services regulation

Read "our take" on the latest developments and what they mean.

OCC and FDIC propose Community Reinvestment Act revisions, again

What happened? On July 31st, the OCC and FDIC issued a proposal to revise their Community Reinvestment Act (CRA) regulations. The proposal follows a series of efforts by the banking agencies to modernize the CRA framework.1

What would the new proposal do? The proposal would make targeted changes to bank size classifications, examination criteria, community development credit eligibility and administrative processes, including:

  • Raise the asset thresholds for bank categories. The small-bank threshold would increase from approximately $412 million to $1 billion, and the large-bank threshold would increase from approximately $1.649 billion to more than $10 billion. The OCC estimates that 387 OCC-supervised banks would move into the small-bank category and 147 would move from the large-bank to the intermediate-bank category. The FDIC estimates that 604 FDIC-supervised banks would move into the small-bank category and 250 would move from the large-bank to the intermediate-bank category.
  • Apply a major-product-line standard to retail lending evaluations. Today, consumer lending (i.e., consumer loans outside of mortgage, small business, and small farm lending) is generally evaluated only when it represents a substantial majority of a bank’s business or when the bank elects to include it. The proposal would introduce a new “major product line” method, under which examiners would measure a bank’s two largest retail product lines (including mortgages and all other retail loan products) by dollar volume and loan count. Consumer lending would be considered in the CRA assessment only if it accounts for more than 50% of retail lending by both measures or at the bank’s request. Alternatively, the agencies are considering an approach that would let major product lines vary assessment area by assessment area, based on examiner judgment rather than a strict formula.
  • Refocus the large-bank service and investment tests on credit needs. The service test would focus on access to credit services and retail banking facilities. Deposit products and deposit services, which may be considered under the currently applicable framework, would no longer be evaluated as retail banking services. The investment test would no longer separately evaluate whether investments are innovative or not routinely provided by private investors. Instead, examiners would place greater emphasis on the amount of community development investments and grants and how well they respond to local credit needs.
  • Add new conditions for community development grants. Grants would count toward CRA performance only when recipients use the funds directly for a qualifying program, project or initiative. For banks with more than $10 billion in assets, grant recipients could use no more than 15% of grant proceeds for administrative, overhead or indirect expenses for the grant to be eligible. The currently applicable framework has no comparable limit or documentation requirement.
  • Clarify which loans, investments, grants and services count as community development activity. The proposal would place more of the eligibility criteria in the regulation, including when financing or supporting affordable housing, low- and moderate-income individuals, economic and workforce development, revitalization and stabilization, civic assistance, and Tribal and Native communities qualifies for CRA consideration. The agencies would also publish examples of activities that qualify or do not qualify and allow banks to request advance confirmation for planned activities. Similar lists of qualifying activities and confirmation processes appeared in earlier CRA modernization proposals.
  • Clarify when activities outside assessment areas may count. The proposal would provide more specific quantitative and qualitative standards for determining when a bank has adequately addressed community development needs within its assessment areas before receiving CRA consideration for qualifying activities elsewhere. The current framework permits outside-area consideration but provides less specific direction on how that determination is made.
  • Further define content and approval timelines for strategic plans. The proposal would augment existing strategic plan rules with detailed required content for strategic plans, and additional procedures and timelines for agency review and approval of those plans, including 14 days for an agency to identify missing components and 60 days to act on a technically complete plan (if the agency fails to act in this timeframe, the plan would be deemed approved).
  • Reduce standardized data collection and reporting for small and intermediate banks. Banks with under $10 billion in assets generally would not be subject to the data collection, maintenance and reporting requirements applicable to large banks. The proposal would retain targeted requirements where needed, including certain consumer-lending data when that lending is evaluated and information supporting community development grants and activities.
  • Shift public-file and notice requirements online. Banks could provide CRA public-file information through their websites, stop maintaining or providing certain paper copies, and use website information to satisfy portions of the public-notice requirement.

What's next? Comments are due 60 days after the proposal is published in the Federal Register.

Our Take

Many banks will welcome the narrower approach, but several longstanding issues are unresolved

After several starts and stops over the last six years, the OCC and FDIC are pursuing a more limited approach that fits the Administration’s broader preference for rules tied closely to statutory text. Rather than redesigning how CRA performance is evaluated, the proposal largely preserves the existing framework while making targeted changes in areas that have drawn the most criticism. The most significant relief comes from the proposed asset-threshold increases, which would move a substantial number of regional and community banks out of the large-bank framework and its lending, investment and service tests. Banks are also likely to welcome the decision to avoid the 2023 rule’s additional assessment areas, prescriptive calculations and expanded data regime, as well as the effort to provide clearer answers on which community development activities qualify for credit. That relief would not be without tradeoffs. Examiners and banks could have less readily comparable peer information for smaller institutions, placing more weight on bank-provided records, public data and examiner judgment and potentially making some evaluations less consistent or more time-consuming. Larger banks could also face new documentation expectations for community development grants, and the proposed 15% limit on administrative, overhead and indirect expenses may exclude some grants that receive consideration today.

At the same time, the proposal leaves some of the hardest modernization questions unresolved, including how CRA should account for digital banking and lending conducted outside branch networks. Without a change in assessment areas, the strategic-plan option could become more useful for banks with large digital businesses or limited branch networks. A more predictable approval process could give these institutions greater flexibility to establish CRA performance goals that better reflect how and where they serve their communities, rather than relying solely on the standard tests.

The Fed’s absence from the proposal also adds uncertainty. Its 2020 proposal retained branch-based assessment areas but also contemplated nationwide evaluation for certain business models and a broader set of retail and community development assessments. That contrast suggests the Fed may still be less comfortable with the OCC and FDIC’s narrower interpretation of how far CRA can extend beyond physical facilities and traditional credit activity, although it is unclear whether policy differences, Board voting dynamics or both explain its decision not to participate. Without interagency alignment, institutions with similar activities could eventually face different expectations depending on their primary federal regulator, undermining the consistency that prior modernization efforts sought to achieve.

OCC joins FDIC in proposing confidential information sharing overhaul

What happened? On August 3rd, the OCC proposed changes to its rules governing when banks may disclose confidential supervisory information (CSI)2 and other non-public OCC information. The proposal closely tracks a notice of proposed rulemaking the FDIC published on June 30th, which similarly set out to overhaul the framework governing how banks may disclose “confidential information” to outside parties.

What would the proposals do? Both proposals would significantly expand the circumstances in which banks may share CSI without first obtaining agency approval on a case-by-case basis as they need to do currently. Notable elements include:

  • An expanded list of permitted CSI recipients, subject to conditions. Both proposals would permit disclosure of OCC CSI or FDIC confidential information without prior agency approval to certain affiliates, external counsel, auditors, and other service providers, incoming senior executive officers, and potential merger counterparties (capped at three per transaction),3 provided that, in each case, the disclosure is covered by a “qualifying confidentiality agreement.” The OCC proposal would also allow disclosure to nonprofits and trade associations for anonymized, aggregated publication or advocacy, subject to specified contractual safeguards.
  • Added requirements for service providers receiving CSI. Under the OCC proposal, qualifying confidentiality agreements with service providers would need to state that the provider consents to OCC regulation and enforcement to the same extent as if the bank were performing the service itself, and acknowledges itself to be an institution-affiliated party (IAP).4 OCC licensed banks would also need to maintain a log of general categories of information disclosed. While the FDIC proposal also stipulates qualifying confidentiality agreements with enumerated provisions, it does not include these additional enforcement-related requirements.
  • Different treatment of holding companies and majority shareholders, for now. The FDIC proposal would expressly allow disclosure to a bank’s parent holding company and to shareholders that own more than 50% of the bank. The OCC proposal also treats parent holding companies as permitted affiliates, but does not currently include majority shareholders in its list of permitted CSI recipients. It requests comment on whether shareholders above the 50% threshold should also be allowed to receive CSI without prior approval.
  • OCC adds language regarding waiver of examination privilege. The OCC proposal states that sharing CSI with a permitted recipient does not remove the protections that keep the information confidential or allow it to be disclosed more broadly. It provides that only the OCC can waive the bank examination privilege over CSI. The FDIC proposal does not contain a similar provision, but note that existing Fed rules contain similar, but broader language.
  • OCC removes reference to criminal liability. The OCC's proposal would remove the current rule's reference to criminal penalties for unauthorized disclosure, citing recent case law and the Administration's policy against overcriminalization of regulatory offenses.

What’s next? Comments on the proposals are due by August 31st for the FDIC and October 5th for the OCC.

Our Take

Easier sharing with careful handling

Banks have long faced frustration with having to seek agency approval before sharing CSI with parties that may have a legitimate business need for it, particularly affiliates, service providers and transaction counterparties. The FDIC and OCC proposals would ease that friction, but the tradeoff is a more formal set of conditions around how the information is shared and protected. The OCC’s proposed confidentiality agreement and enforcement provisions are particularly important because they make the regulatory consequences of receiving CSI more explicit. That could affect whether service providers are willing to receive CSI and how banks structure those relationships. Banks and service providers should assess the proposed confidentiality, recordkeeping and jurisdiction requirements against existing and future contracts before relying on the new disclosure pathways.

Convergence, but not full consistency

If finalized, the proposals would make CSI sharing more routine for OCC- and FDIC-supervised institutions, but they would not create a fully consistent interagency framework. In some respects, the OCC and FDIC are moving closer to the Fed’s existing approach, particularly by allowing disclosures to affiliates and service providers without prior approval. In others, they would go further by permitting disclosures to senior executive officer candidates and merger counterparties without case-by-case agency approval. Unless the Fed makes corresponding changes, banks could continue to face different CSI-sharing requirements depending on their primary federal regulator. Institutions operating across multiple regulatory regimes should therefore account for those differences when updating CSI governance, contracting and information-sharing practices.

States push back against CFTC authority over prediction markets

What happened? On July 27th, attorneys general (AGs) from 44 states submitted a comment letter to the CFTC urging the agency to reconsider its prediction markets proposal released in June 2026.

What does the CFTC’s proposal contain? The proposal provides a framework for determining which events contracts are contrary to the public interest, due to promoting unethical conduct or susceptibility to market manipulation, which would result in such contracts violating the Commodity Exchange Act (CEA). As part of this framework, the proposal explains that for contracts involving “gaming,” the CFTC will likely view games impacted by the participants skill (such as sports) as permissible, while games of random chance are likely to be more akin to gambling and therefore out of the agency’s scope. Notably, the proposal explicitly sets forth that state laws are preempted by the CEA as applied to events contracts on CFTC-registered platforms.

What did the attorneys general comment letter say? The letter states that prediction markets fall into the category of gaming, which has historically been regulated by state gaming authorities rather than the CFTC. It argues that by preempting state gaming rules, the proposal would impinge on states’ authorities to protect their citizens through problem gambler rules, marketing regulations and consumer protection as well as raise taxes to support the public interest. The attorneys general further argue that the regulation of predictions markets is a “major question” that, according to a 2022 Supreme Court decision, must be determined by Congress rather than agencies.

What's next? The comment period on the CFTC proposal ended on July 27th.

Our Take

A (nearly) united front by state AGs

The comment letter is unlikely to materially impact the eventual final rule, given CFTC Chair Mike Selig’s repeated vigorous defense of the agency’s sole jurisdiction over prediction markets. Instead, the letter is a preview of the significant future litigation that will follow a final rule. Courts are currently split on the issue of CFTC prediction markets authority, with the Third Circuit ruling for the CFTC and a Nevada district court ruling for the state. With 44 state AGs all poised to enter the legal battle, we do not expect a resolution in the near future. Considering the ongoing and likely future litigation, firms should prepare for a prolonged stretch of regulatory uncertainty as opposed to viewing the final rule as a finish line. In the meantime, prediction markets platforms should consider taking the following steps:

  • Operate as if regulation had already arrived. Regardless of whether prediction markets are ultimately overseen by the CFTC, state regulators, or both, firms with mature consumer protection, anti-money laundering, sanctions and market integrity programs will be well-suited to comply with the future regulatory regime.
  • Pressure test events contracts against CFTC standards. With the CFTC unlikely to significantly change its stance in a final rule, prediction markets platforms should weigh their listed events contracts against factors highlighted in the proposal to determine their legality. The proposal’s framework for contracts that are against the public interest – such as those involving terrorism or assassinations – are generally categories that are best avoided from a reputation and consumer trust perspective in addition to being potentially problematic depending on the future regulatory regime. Firms should also make sure they have a de-listing process in place that can halt trading, unwind existing contracts and provide customers with notice and dispute resolution.
  • Continue to monitor the final rule, state enforcement, and litigation. Prediction market regulation is in its nascent stages and will continue to shift and evolve. Firms should be prepared to adapt quickly and avail themselves of opportunities to shape future regulation through comment processes, amicus curae briefs and setting industry best practices.

Proposed changes to insider lending restrictions

What happened? On August 4th, the Fed published a notice of proposed rulemaking to comprehensively revise Regulation O, which governs extensions of credit by member banks to their executive officers, directors, and principal shareholders (together, “insiders”) and to companies they control (“related interests”). While the Board consulted with the OCC and FDIC in developing the proposal, the FDIC concurrently issued its own, narrower notice of proposed rulemaking, updating the insider-lending thresholds for FDIC-supervised institutions.

What would the Fed proposal do? Notable elements include:

  • Narrow the definition of who is presumed to be an "executive officer." The proposal would remove "every vice president," "the cashier," and "the secretary," and add CEO, CFO, chief lending officer, and chief investment officer to the list of titles presumed to be executive officers. Employees who exercise major policymaking authority could still be treated as executive officers regardless of title.
  • Index compliance thresholds to GDP. It would increase several longstanding Regulation O thresholds based on nominal GDP growth (e.g., the amount of insider credit card debt excluded from certain Regulation O restrictions would be raised from $15,000 to $60,000, and the threshold for when prior board approval is required for an insider loan would be raised from 500,000 to $2 million). The Board would recalculate these thresholds every five years based on cumulative nominal GDP growth, with no downward adjustment in periods of negative growth.
  • Provide a new exemption from the presumption of control for passive fund complexes. Regulation O generally applies not only to loans made directly to insiders but also to loans made to companies that are treated as their related interests. The proposal would provide that portfolio companies held by a qualifying fund complex5 would no longer be automatically swept in as related interests of a bank for which the fund complex is a principal shareholder. This addresses a long-standing industry concern (and a series of interim relief letters dating to 2019) arising from the growth of index-fund ownership stakes in banking organizations.
  • Expand the list of covered transactions. The proposal would largely adopt existing staff guidance by clarifying that transactions such as functional-equivalent leases, investments in insider debt securities, material modifications to existing extensions of credit, and guarantees/acceptances/letters of credit (including credit derivatives and equity/total-return swaps that operate as guarantees) are treated as extensions of credit, adding consistency with the Fed’s affiliate transactions rules.
  • Clarify when loans to spouses, trusts and estates are treated as loans to an insider. Extensions of credit to an insider's spouse (or a related interest of the spouse) would presumptively be treated as extensions of credit to the insider unless the spouse is independently creditworthy and repayment doesn't depend on the insider's income. Extensions of credit to a trust or estate would be attributed to a beneficiary with a 25% or greater beneficial interest, with a request for comment on a 10% alternative.
  • Align valuation methodologies for derivatives and securities financing transactions. The proposal would let banks value derivatives, repos, reverse repos, and securities lending/borrowing exposures using methods already permitted under the risk-based capital rules, with a simplified alternative for community bank leverage ratio banks. It would also allow offsetting collateral limited to cash (in a segregated account) and U.S. government obligations.

What would the FDIC's proposal do? Under its narrower proposal, the FDIC would update its own insider lending rules to mirror the Fed’s dollar-based limits in its own regulatory text by:

  • Raising its board prior-approval/aggregate lending threshold from $500,000 to $2 million;
  • Adopting the same five-year, GDP-based indexing methodology; and
  • Simplifying the calculation of the lending limit applicable to FDIC-supervised institutions.

What's next? Comments on both proposals are due October 6th. The Board has posed more than 45 questions throughout its proposal, including several either/or choices (e.g., a 10% vs. 25% beneficial-interest threshold for trusts, GDP vs. CPI indexing, whether to extend the passive fund complex exemption to other presumptions of control). The FDIC's proposal poses no comparable open questions of its own; it frames itself as conforming to whatever the Fed ultimately adopts.

Our Take

The insider scoop

The proposal reflects the Fed’s recognition that Regulation O has not kept pace with changes in inflation, ownership structures and financial innovation. Rather than reopening the core policy against preferential insider lending, the Fed is updating the mechanics around it by indexing outdated thresholds, codifying supervisory interpretations and clarifying how the rule applies to newer ownership structures and transaction types. Individually, most of the changes are incremental, but together they would make the rule more workable for banks without materially weakening its underlying restrictions.

Much of the relief would come from replacing outdated title-based presumptions, temporary relief and staff guidance with clearer standards, but this could also require banks to revisit how they identify insiders, attribute credit, and document covered transactions. Specifically:

  • The narrower executive-officer presumptions recognize that titles such as “vice president” no longer reliably indicate policymaking authority, but banks will still need to assess actual responsibilities and may need to update questionnaires, attestations and related-interest monitoring for spouses, trusts and estates.
  • The codification of existing interpretations on which transactions count as extensions of credit should provide greater certainty, but banks may need to confirm that current systems capture the newly specified transactions consistently.
  • The proposed passive fund exemption could replace years of interim relief with a more durable framework, though affected institutions should compare their current monitoring processes against the proposed qualification criteria rather than assume existing practices will carry over unchanged.
  • The derivatives and securities financing changes should also simplify compliance by allowing banks to rely on capital-rule valuation methodologies, but may require closer coordination across legal, credit, capital and regulatory reporting functions.

Illinois establishes new oversight of personal auto insurance rates

What happened? On August 4th, Illinois Governor JB Pritzker signed legislation giving the Illinois Department of Insurance (DOI) authority to review personal automobile insurance rates and challenge filings it determines are excessive, inadequate, or unfairly discriminatory.

What are key elements of the law? The new rate-review provisions apply to personal automobile insurance policies delivered or issued for delivery in Illinois to individuals and households, including named non-owner policies. They generally do not apply to commercial automobile insurance, policies issued through the Illinois Automobile Insurance Plan, or policies covering certain garage, automobile sales, repair, service station, or public parking operations. Notable requirements include:

  • New substantive rate standards. The Illinois DOI could challenge rates that it determines are excessive, too low to support insurer solvency, or produce unjustified differences among policyholders. The law focuses on whether rates and pricing differences are supported by expected losses and expenses rather than banning specific rating variables such as credit information or geography. Insurers would need to use credible Illinois loss experience when developing rates where sufficient data are available. Regional or national data could still be used to supplement Illinois experience when needed to produce reliable estimates.
  • Expanded filing documentation. Insurers would need to submit the proposed rates, applicable manuals and rules, and the data and analysis used to develop them. A complete filing must include all new or revised rates, the applicable rate manual and manual rules, and the experience, judgment, and interpretation of statistical data on which the insurer relied. If the DOI considers a submission incomplete, it must notify the insurer and identify the additional documents or information required.
  • Timebound DOI review and challenge process. The DOI would have 40 days to determine if the filing meets the new statutory standards or identify required modifications. Insurers could challenge DOI objections through an administrative hearing while the filing remains in effect. A final order may establish a date after which the filing is no longer effective and may require rebates to affected policyholders.
  • Advance notice of significant renewal increases. Insurers must provide at least 30 days’ advance notice before imposing a renewal premium increase of more than 10%. The requirement would not cap increases above 10%; those increases would still be permitted if the underlying rates meet the new statutory standards. Increases caused by policyholder-requested coverage or exposure changes would not count toward the 10% threshold.

What’s next? The law takes effect on July 1st, 2027, and applies to rate filings made, and covered renewal premium notices sent, on or after that date.

Our Take

Illinois could be an early test case for a more interventionist approach to personal auto rate review

By giving the DOI a defined basis to challenge rates and requiring more support for how they are developed, the law could affect both the pace and outcome of future pricing decisions. Insurers may become more cautious about the timing and size of rate changes, particularly where loss trends are moving quickly, while consumers could see slower premium increases, greater chances of rate revisions or rebates after successful challenges, and changes in coverage availability or competition if carriers pull back from less attractive segments.

The ultimate effect on premiums and availability will depend on how aggressively and consistently the DOI applies the new standards. A relatively predictable review process focused on clearly unsupported filings could leave insurers substantial room to adjust rates as costs change, while more frequent challenges or demanding evidentiary expectations could slow rate adjustments, increase filing costs and influence carriers’ appetite for certain customers or markets. Regardless of how frequently the DOI ultimately challenges filings, insurers will need to ensure that appropriate processes and personnel capacity are in place to support handling of future DOI inquiries and any related remedial actions. Carriers should expect to not only provide evidence that their indicated rate level is adequate, but also that the underlying data, assumptions, rating structures, and resulting policyholder impacts can withstand focused regulatory scrutiny.

While the law only applies in Illinois, it could become a test case for a more active state role in auto insurance pricing. If the framework is seen as improving affordability or transparency without creating major market disruption, lawmakers and regulators elsewhere may be more willing to pursue similar approaches. For multistate carriers, that could gradually shift rate-filing expectations across jurisdictions and increase the importance of having governance, documentation and regulatory engagement processes that can adapt to different state standards.

On our radar

CFPB sends open banking reconsideration rule to OIRA. On August 4th, the CFPB submitted a proposed rule reconsidering its Personal Financial Data Rights (Section 1033) requirements to the Office of Information and Regulatory Affairs (OIRA) for review.

GENIUS Act implementation moves to formal comment periods. On July 27th, the OCC published its stablecoin licensing and registration information collection notice with comments due September 25th. This follows the FDIC's and NYDFS's recent Federal Register publications on GENIUS Act stablecoin workstreams: the FDIC's reporting-forms proposal for supervised Permitted Payment Stablecoin Issuers (published July 20th, comments due September 18th) and NYDFS's proposed 23 NYCRR Part 202 aligning New York's stablecoin framework with the GENIUS Act (filed July 22nd, comments due September 14th).

FDIC Office of Supervisory Appeals becomes operational. On August 4th, the FDIC announced that its new Office of Supervisory Appeals is fully operational, replacing the prior Supervision Appeals Review Committee as the final, independent level of review for material supervisory determinations.

Senate Banking Committee holds hearing on Main Street Capital Access. On August 6th, the Senate Banking Committee held a hearing on how Congress can help small businesses raise capital through regulatory easing, including disclosure, enforcement, and market protection requirements.

SEC approves first phase of market-wide overnight price-band protections. SEC granted approval of Amendment No. 27 to the National Market System Plan to Address Extraordinary Market Volatility, establishing phased price band protections for overnight trading in anticipation of overnight trading by certain national securities exchanges. The amendment is expected to take effect through an interim phase when overnight trading commences on December 6th, 2026.

ECB publishes analysis on repo market dynamics and collateral scarcity. On July 28th, the European Central Bank released a working paper examining how central bank asset purchases and debt management operations affect repo market conditions. The analysis finds that central bank purchases can contribute to collateral scarcity, while targeted repo operations by debt managers can help alleviate market pressures.


Footnotes:

1 In 2020, the OCC independently finalized a CRA modernization rule. Later that year, the Fed issued its own, substantially different CRA proposal. The OCC, Fed and FDIC ultimately converged on a joint final CRA modernization rule in October 2023. Before that rule could take effect, however, it was challenged in court and enjoined by the U.S. District Court for the Northern District of Texas. As a result, banks have continued to operate under the CRA framework that generally dates back to the 1995 regulations.

2 CSI is material such as examination reports, supervisory correspondence, and enforcement files that federal banking regulators generally withhold from public disclosure under exemptions to the Freedom of Information Act which protect information generated or obtained as part of the bank supervisory process.

3 Unlike the FDIC proposal, the OCC proposal would generally limit permitted disclosures to service providers and merger-related advisors located in the United States.

4 An IAP is a person or company that can be held directly accountable by a banking regulator for certain misconduct connected to a bank. In addition to any director, officer, employee, controlling stockholder, it can include independent contractors (such as an attorney or appraiser) if they knowingly or recklessly participate in violations of law, breach of fiduciary duty, or an unsafe or unsound practice.

5 A qualifying fund complex generally would need to be unaffiliated with a bank, hold no more than 10% of a regulated company’s voting securities through any individual fund, hold no more than 10% in the aggregate through non-index funds, and avoid circumstances that would cause it to be presumed to control the company under the Fed’s bank control rules.

Our Take: Financial services regulatory update – August 07, 2026

(PDF of 326.58KB)
Follow us