I. INTRODUCTION
The Consumer Financial Protection Bureau (CFPB) has issued a bulletin to provide guidance regarding its collection of information through the supervisory process and the confidentiality protections that this process provides to supervised institutions.
II. THE CFPB'S SUPERVISION AUTHORITY
On July 21, 2011, the CFPB assumed the authority to supervise insured depository institutions with total assets of more than $10 billion and their affiliates for compliance with Federal consumer financial law and other related purposes. Like the prudential regulators, the CFPB has broad authority to require reports and conduct examinations of its supervised institutions. The CFPB exercises this authority for certain purposes, including assessing compliance with the requirement of Federal consumer financial law; obtaining information about the activities subject to such laws and the associated compliance systems or procedures of supervised entities; and detecting and assessing associated risks to consumers and markets for consumer financial products and services.
Once the CFPB has issued a request for information that it has determined serves one or more of these purposes, supervised institutions are required to provide all documents and other information responsive to the request. Supervised institutions may not selectively withhold responsive documents based on their judgment that such materials are not necessary to the CFPB’s execution of its responsibilities or that other materials would be sufficient to suit the CFPB’s needs. The supervisory process is based on the supervisor’s full and unfettered access to information, and the supervisor is entitled—indeed, duty bound—to ensure that it thoroughly understands the institution in question and has access to all information that, in its independent judgment, may bear on its supervisory responsibilities. Failure to provide information required by the CFPB is a violation of law for which the CFPB will pursue all available remedies.
III. PROVISION OF PRIVILEGED INFORMATION TO THE CFPB
Certain supervised institutions have expressed concern that providing privileged information, such as documents protected by the attorney-client privilege, to CFPB examiners could waive the institutions' privilege with respect to third parties. The provision of information to the CFPB pursuant to a supervisory request would not waive any privilege that may attach to such information. Further, if a supervised institution were ever faced with a claim of waiver, the CFPB will take all reasonable and appropriate actions to rebut such a claim.
Because entities must comply with the CFPB's supervisory requests for information, the provision of privileged information to the CFPB would not be considered voluntary and would thus not waive any privilege that attached to such information. The OCC articulated this view at greater length in a 1991 interpretative letter. Consistent with the policy articulated by the OCC in that letter, the CFPB would not object if supervised institutions take steps to memorialize privilege claims when conveying privileged documents or information to the CFPB.
Congress intended the CFPB’s examination authority to be equivalent to that of the prudential regulators. On July 21, 2011, the CFPB was granted “all powers and duties” that had been vested in the prudential regulators “relating” to such examination authority previously executed by the prudential regulators. The prudential regulators have the power to receive privileged information from supervised entities (whether or not deemed voluntarily provided) without effecting a waiver of privilege. Accordingly, the examination authority and all related “powers and duties” assigned by statute to the CFPB encompass the ability to receive privileged information from supervised entities without effecting a waiver.
As a result of the foregoing, the CFPB will not consider waiver concerns to be a valid basis for the withholding of privileged information responsive to a supervisory request. Review of a supervised institution’s privileged materials may often be the most efficient means for a supervisor to understand and assess an issue, and the CFPB will request such material as appropriate. However, the CFPB will give due consideration to supervised institutions’ requests to limit the form and scope of any supervisory request for privileged information. The CFPB's policy is to request privileged information only when it determines that such information is material to its supervisory objectives and that it cannot practicably obtain the same information from non-privileged sources. Further, upon request, the CFPB will provide a demand identifying the privileged information sought and confirming that the materials will be treated confidentially in accordance with the Bulletin and applicable CFPB rules.
IV. THE CFPB'S TREATMENT OF CONFIDENTIAL SUPERVISORY INFORMATION
The CFPB’s supervision program depends upon the full and frank exchange of information concerning supervised institutions’ operations and compliance with Federal consumer financial law. Consistent with the policies of the prudential regulators, the CFPB’s policy is to treat information obtained in the supervisory process as confidential and privileged. For example, the CFPB will treat all such information as exempt from disclosure under Exemption 8 of the Freedom of Information Act. Also consistent with the policies of the prudential regulators, the CFPB recognizes that the sharing of such information with other government agencies may in some circumstances be appropriate, and, in some instances, required. For example, in accordance with the scheme of coordinated supervision established by Congress, the CFPB’s policy is to exchange confidential supervisory information with the prudential regulators and state regulators that share supervisory jurisdiction over an institution supervised by the CFPB.
By contrast, the CFPB will not routinely share confidential supervisory information with agencies that are not engaged in supervision. Except where required by law, the CFPB’s policy is to share confidential supervisory information with law enforcement agencies, including State Attorneys General, only in very limited circumstances and upon review of all the relevant facts and considerations. The significance of the law enforcement interest at stake will be an important consideration in any such review. However, even the furtherance of a significant law enforcement interest will not always be sufficient, and the CFPB may still decline to share confidential supervisory information based on other considerations, including the integrity of the supervisory process and the importance of preserving the confidentiality of the information. In these circumstances, the decision whether to provide confidential supervisory information to another agency will be made by the General Counsel, in consultation with appropriate CFPB personnel.
By articulating its policy regarding its treatment of confidential supervisory information, the CFPB does not intend to limit its use of such information in administrative or judicial proceedings, subject to appropriate protective orders.