On October 14, 2026, the Office of the Comptroller of the Currency (OCC) released its long-anticipated report on "debanking" at the nine largest national banks it supervises (OCC News Release 2026-90). The same day, the Consumer Financial Protection Bureau (CFPB) announced that it will investigate whether those institutions, "and others," complied with federal consumer financial laws (CFPB).
The coordinated releases mark a new phase in the federal government's fair-access campaign: the move from policy statements to institution-specific findings and potential enforcement. Below, we summarize what the agencies said, identify the tension at the center of this initiative, and outline practical steps banks should take now.
What the OCC Found
The OCC conducted its review under Executive Order 14331, "Guaranteeing Fair Access to Banking for All Americans," to determine whether bank policies or practices may have caused banks to deny or limit services because of customers' political or religious beliefs or lawful business activities. The agency concluded that, between 2020 and September 2025, all nine banks had such policies (OCC).
Two categories of findings stand out:
- Reputation-risk policies. The OCC found that broad reputation-risk policies "lacked clear standards and objective, risk-based criteria" and disadvantaged certain customers based on their views or lawful business activities.
- Sector restrictions. The OCC found public and nonpublic policies restricting access for oil and gas exploration, coal mining and coal-fired power, firearms and ammunition manufacturing or distribution, detention facility construction or operation, tobacco and e-cigarettes, and digital-asset activities.
Announced in September 2025, the review was extensive. The OCC reports that it examined nearly 100,000 complaints and received roughly 50,000 documents, totaling about 420,000 pages, from the banks. It follows the preliminary findings issued in December 2025 (OCC; Report).
Importantly, the OCC acknowledged "certain efforts by the largest banks to rein in these practices." Comptroller Jonathan V. Gould nonetheless said he is "not confident that they will be enough" and that the OCC "will be assessing further changes to the regulatory and supervisory framework applicable to the largest banks." The agency is also considering actions to prevent discrimination based on political or religious beliefs and to address "the problematic role of reputation risk in bank decision-making" (OCC).
The CFPB’s Simultaneous Release
The CFPB, which has primary supervisory and enforcement authority over banks with more than $10 billion in assets and certain nonbanks, stated that it will "fully investigate" the institutions named in the report "and others." Its focus is on the adverse action notice requirements of the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA), as well as unfair, deceptive, or abusive acts or practices (UDAAP). The Bureau also said it has been reviewing complaints and supervisory and enforcement data for evidence of unlawful debanking and is pursuing its own investigations (CFPB).
The tone of the CFPB release is notable. It frames the initiative in strongly political terms, including references to customers who supported the President and to "industries disfavored by the Left." Banks should expect that inquiries arising from this initiative may be pursued with considerable vigor.
The Paradox: Regulators Demanded the Very Caution They Now Fault
Fair access to financial services is a legitimate goal, and no institution should deny service because of a customer's lawful political or religious views. But any fair reading of the report must account for the regulatory environment in which these decisions were made. For more than a decade, the same federal agencies have told banks, through examinations, guidance, and record enforcement actions, that they will be held strictly accountable for the customers they choose to serve.
The most vivid example sits on the OCC's own list. In October 2024, one of the banks named in the report resolved Bank Secrecy Act and anti-money laundering (BSA/AML) matters with federal authorities for roughly $3.09 billion. The resolution included a $450 million OCC civil money penalty, a cease-and-desist order, and an asset cap limiting the bank's U.S. subsidiaries to their September 30, 2024 asset level (OCC Fact Sheet). FinCEN's $1.3 billion penalty was described as the largest against a depository institution in Treasury and FinCEN history (GARP). The OCC's stated concern was that the bank processed transactions with "clear indicia of highly suspicious activity" (ASIS).
The message to the industry was unmistakable: know your customer, understand the risks the customer brings, and exit the relationship when those risks cannot be managed. Banks responded by building risk-appetite frameworks, enhanced due diligence for higher-risk industries, and, yes, reputation-risk considerations that examiners themselves long treated as a component of safe and sound banking. Until recently, reputation risk appeared in the agencies' own examination materials, which is why both the OCC and CFPB have now had to remove it (OCC; CFPB).
Several of the sectors identified in the report also carry well-recognized compliance burdens. Digital-asset businesses, for instance, have long been the subject of heightened supervisory scrutiny regarding illicit-finance exposure. A bank that declined such a relationship in 2021 or 2022 was arguably doing exactly what its examiners expected at the time.
This raises a fair question: on what basis do regulators second-guess individual credit and account decisions as improper debanking, while simultaneously imposing billion-dollar penalties when a bank's customer-risk judgments prove too permissive? Banks cannot be expected to serve every lawful customer without reservation and also bear strict liability for every customer's misconduct. A coherent supervisory framework must give institutions a safe harbor for good-faith, documented, risk-based decisions, whichever direction those decisions run.
We do not read the OCC's report as foreclosing that position. The report's central criticism is the absence of "clear standards and objective, risk-based criteria," not the exercise of risk judgment itself. That distinction is the banks' strongest ground, and it should shape their response.
What Banks Should Do Now
The policies examined are largely historical, and many institutions have already revised them. Even so, the CFPB's announcement means past decisions may be reviewed against technical consumer-protection requirements. We recommend:
- Inventory policies. Identify every account-closure, onboarding-denial, and credit-decline policy since 2020 that references reputation risk or restricts an industry sector, including nonpublic desk-level guidance and emails that may have functioned as policy.
- Document the risk-based rationale. For each restriction, assemble the contemporaneous rationale, including credit, legal, BSA/AML, sanctions, and fraud considerations, and the supervisory expectations in effect at the time.
- Sample closures and declines. Test a representative sample of consumer and small-business decisions since 2020 to confirm each has a documented, objective basis and, where required, a timely and compliant ECOA or FCRA adverse action notice.
- Prepare for CFPB inquiries. Establish a privileged review structure, preserve relevant records, and coordinate messaging across regulators, since findings shared with one agency may inform another.
- Update forward-looking governance. Replace reputation-risk language with objective, measurable criteria tied to financial, legal, and operational risk, and ensure escalation and appeal procedures are documented.
- Engage on the rulemaking. The OCC has signaled further changes to the framework for the largest banks. Comment letters and industry engagement are the best opportunity to secure clear standards and a safe harbor for good-faith compliance decisions.
Conclusion
Banks should take the report seriously and treat the CFPB's announcement as a near-term enforcement risk. But the larger debate is not over. The industry's ability to manage risk, protect the financial system from illicit activity, and make sound business judgments is the foundation of the supervisory system regulators themselves built. Fair access and risk management can coexist, provided the rules are clear and applied consistently.
Bressler, Amery & Ross, P.C. continues to monitor these developments and stands ready to help financial institutions review policies, respond to regulatory inquiries, and advocate for a balanced framework. Please contact any member of our Financial Services Regulatory team with questions.
This alert is for informational purposes only and does not constitute legal advice.