OCC Releases Final Debanking Report on Nation’s Largest Banks; CFPB Announces Follow-On Initiative

On October 14, 2026, the Office of the Comptroller of the Currency (OCC) released its long-awaited report on the debanking practices of the nine largest national banks it supervises.

The report, titled Guaranteeing Fair Banking for All Americans, concludes that, between 2020 and September 2025, each of these banks maintained policies or practices that may have required, encouraged, or otherwise influenced the denial or limitation of financial services based on customers’ political or religious beliefs or lawful business activities.

That same day, the Consumer Financial Protection Bureau (CFPB) announced that it will investigate whether the banks featured in the OCC’s report, and any others, complied with federal consumer financial laws.

Taken together, these announcements signal that the federal debanking campaign launched by Executive Order 14331 in August of 2025 has moved beyond policy statements and preliminary findings into a phase in which banks should expect concrete supervisory and enforcement consequences.

Background

As we discussed in a recent article for the Conference on Consumer Finance Law’s Quarterly Report, “Fair Access and Debanking: Recent Developments and Unanswered Questions,” fair access has become a top regulatory priority.

Executive Order 14331, entitled “Guaranteeing Fair Banking for All Americans,” directed the federal banking regulators to review the institutions they supervise for politicized or unlawful debanking.

• • In September 2025, the OCC announced that it had requested information from the nine largest banks and clarified that it would consider debanking in certain licensing decisions and in Community Reinvestment Act (CRA) evaluations.

• • The OCC issued preliminary findings from its review in December 2025, concluding that the banks had drawn inappropriate distinctions among customers based on their lawful business activities.

• • In April 2026, the federal banking agencies issued a final rule prohibiting regulators from using reputation risk. This series of rapid developments underscores the great importance the administration has put on this initiative.

The OCC’s Final Report

The scope of the OCC’s review was substantial. According to the agency, it reviewed nearly 100,000 complaints submitted to OCC-regulated institutions and approximately 50,000 documents produced by the banks concerning their policies, procedures, practices, and individual customer decisions.

The report focuses on two broad categories of policies that, in the OCC’s view, presented an elevated risk of influencing banks to deny services: (1) general reputation risk policies, and (2) industry-specific policies.

1. Broad Reputation Risk Policies

In the first category, the OCC found that broad reputation risk policies lacked clear standards and objective, risk-based criteria, and that employees escalated customers and prospects holding controversial viewpoints for heightened review.

The report highlights examples, including a bank-owned payment processor’s 2021 closure of the account of a merchant selling pro-Trump and MAGA merchandise, and a bank that treated businesses engaged in “partisan activity” as presumptively high-reputation risk.

Notably, the OCC acknowledged that the latter policy appears to have been applied to organizations across the political spectrum, but nonetheless criticized the bank for declining services based on constitutionally protected views.

2. Industry-Specific Policies

In the second category, the OCC found that the banks maintained public and nonpublic policies restricting access to financial services for certain industry sectors, including oil and gas exploration, coal mining and coal-powered plants, firearms and ammunition manufacturing or distribution, detention facilities, tobacco and e-cigarettes, and digital asset activities. The OCC also examined related practices for account closures, the content and timing of closure notices, and complaint resolution.

The OCC did not announce any enforcement actions or penalties. Instead, Comptroller Jonathan Gould stated that he was “not confident” the banks’ own remedial efforts “will be enough,” and that the OCC “will be assessing further changes to the regulatory and supervisory framework applicable to the largest banks.”

The OCC also stated that it is considering actions to prevent banks from discriminating on the basis of political or religious beliefs and to address the role of reputation risk in bank decision-making.

The CFPB’s Follow-On Initiative

The CFPB wasted no time after the OCC’s release. In its own announcement, the CFPB noted that it holds primary supervisory and enforcement authority over banks with more than $10 billion in assets, including each of the nine banks named in the OCC report, and stated that it will “fully investigate” whether those institutions and others complied with federal consumer financial laws and “take appropriate action.”

The CFPB Identified Three Areas of Focus:

1. 1. The Equal Credit Opportunity Act (ECOA),
   2. The Fair Credit Reporting Act (FCRA), “particularly the adverse action notice requirements under these laws,” and
   3. Prohibitions on unfair, deceptive, or abusive acts or practices (UDAAP).

The CFPB also reported that it has already removed reputation risk concepts from its Examination Manual and other supervisory materials, is reviewing consumer complaints and supervisory and enforcement data for evidence of unlawful debanking, and is pursuing its own investigations based on that data. It has also updated its website and complaint portal to encourage consumers who believe they were debanked to submit complaints.

Key Takeaways

Adverse Action Notices are the Likely Enforcement Hook

• • Neither ECOA nor FCRA prohibits a bank from declining a customer based on political views or lawful business activity, and ECOA’s protections largely extend to consumer and commercial credit, not deposit accounts.

• • The CFPB’s emphasis on adverse action notices suggests it may pursue procedural theories, such as whether credit applicants received timely, accurate statements of the specific reasons for denial.

• • The agency’s UDAAP authority may be invoked to reach account closures and deposit products that fall outside ECOA and FCRA. Institutions should expect questions about whether the reasons communicated to customers match internal escalation alerts.

Internal Communications Matter

• • The OCC’s report relies heavily on excerpts from bank emails and notes from internal tracking systems.

• • Banks should assume that informal commentary about customers’ viewpoints or affiliations may be scrutinized by examiners, investigators, and potentially private litigants.

The Scrutiny is Not Limited to the Nine Named Banks

• • The CFPB expressly stated that its review extends to “others,” and the OCC’s announcement affirms that its broader fair access work remains ongoing. The OCC has also said it will consider debanking in licensing and CRA evaluations.

• • Banks of all sizes, and nonbanks within the CFPB’s jurisdiction, should review their customer onboarding, escalation, and exit policies to confirm that decisions about whether to provide services to a customer rest on objective, risk-based criteria that are documented and individualized.

Further Rulemaking is Likely

• • Comptroller Gould’s statement that the OCC will assess changes to the regulatory and supervisory framework for the largest banks suggests that additional fair access rulemaking or guidance may be forthcoming.

Hinshaw will continue to monitor these developments. If you have questions about how the OCC’s findings or the CFPB’s initiative may affect your institution’s policies, supervisory examinations, or litigation risk, please contact the authors or your Hinshaw attorney.