OCC Final Report on Debanking Focuses on Subjective Risk Practices and Signals Continued Fair-Access Scrutiny

On Oct. 14, 2026, the Office of the OCC issued a report titled “Guaranteeing Fair Banking for All Americans,” detailing the results of its supervisory review of potential debanking practices at the nine largest national banks it supervises. The report builds on the OCC’s December 2025 preliminary findings discussed in our January 2026 alert.

In the report, the OCC asserted that, between January 2020 and September 2025, broad reputation-risk policies that lacked clear standards and objective, risk-based criteria disadvantaged certain customers from having fair access to financial services based on their political, religious, or social views or based on their lawful business activities. Comptroller Jonathan V. Gould stated that banks are not required to serve every customer, but should evaluate customers using objective, risk-based criteria.¹ The report notes that the banks have taken steps to address fair-access concerns.² The report reflects a supervisory review, not an adjudication that particular conduct violated law.

The OCC’s Findings

The OCC reviewed nearly 100,000 complaints, hundreds of individual decisions, and approximately 420,000 pages of bank documents. The complaints spanned January 2020 to December 2025, while the review examined policies, procedures, and practices in effect between 2020 and September 2025. The OCC tested decisions involving customer onboarding, expansion of existing relationships, account restrictions, and terminations, as well as related complaint handling and customer communications.

The report’s principal observations include:

• Reputation risk. According to the OCC, the banks maintained reputation-risk policies that incorporated non-financial triggers or red flags to consider when deciding whether to escalate and ultimately establish or maintain a banking relationship. Relationships that could create reputation risk included those that appear to be involved in controversial activities, raise concerns of negative publicity, or affect opinions of core stakeholders without clear and measurable standards and objective, risk-based criteria. The report further found that some banks created scores or ratings for reputation risk or environmental and social scores, as well as negative news decision matrices, seemingly to add greater structure or quantitative elements to their risk assessments. However, the OCC could not determine that these methods proved effective at clearly and measurably assessing the risk to the bank’s “reputation.”
• Industry-specific policies. In its report, the OCC identified policies restricting certain industry sectors’ access to financial services, including by requiring escalated reviews and approvals before providing access to services. The report enumerates six categories of industries, stating that categories subject to restrictions “included, but were not limited to,” the following: (i) oil and gas exploration, development, or production in the Arctic; (ii) coal mining or coal-powered plants; (iii) firearms, firearms accessories, or ammunition manufacturing or distribution; (iv) construction or operation of detention facilities; (v) tobacco or e-cigarette manufacturing, distribution, or online retail; and (vi) digital asset activities. The OCC notes that these restrictions during the relevant period reflected the fact that “banks were subject to significant external pressures relating to these activities, including congressional oversight, shareholder resolutions, activist campaigns, and scrutiny from state and local officials,” which the report says can create a snowball effect as banks seek to avoid seeming outside the “mainstream” with peers. The OCC also notes that the policies and their application may have disproportionately impacted smaller businesses while exceptions preserved lucrative relationships.
• Passage of state fair-access laws likely acted as a catalyst for changes in policies. The OCC report credits state fair-access laws, such as Florida Statute Section 655.0323 (2024), with prompting many banks to revise their policies in 2023 and 2024 to eliminate industry prohibitions and replace them with “heightened” risk designations and enhanced due diligence reviews. However, the OCC notes that it “cannot rule out the risk that industry status continues to weigh heavily on bank decision making,” suggesting that escalated review that lacks objective rationale for differing treatment may also be problematic, even when there is no outright prohibition.
• Customer communications. According to the report, account-closure notices frequently provided little explanation regarding a bank’s decision to deny services or terminate a relationship, impairing the customers and prospective customers’ ability to understand the reason for a bank’s inquiries or decisions or to correct misunderstandings. The OCC acknowledges that several factors may have influenced the banks to limit the amount of useful information disclosed in communications (e.g., suspicious activity report (SAR) confidentiality), but states that those concerns “alone do not account for the banks’ poor communication with existing and prospective customers regarding the reasons for terminating or denying financial services.” That said, the report makes no finding that any bank in fact used the Bank Secrecy Act pretextually.

The OCC reported that all nine banks had adopted or revised fair-access policies, strengthened oversight of reputation-based decisions, narrowed certain prohibited-business classifications, and improved monitoring and complaint procedures. However, the OCC questioned whether these changes would meaningfully constrain subjective reputation-risk assessments, noting that few banks had established objective, measurable standards, acknowledged past debanking decisions, or implemented comprehensive remediation for affected customers. It also cautioned that business restrictions based on limited expertise or operational capacity might raise concerns if they categorically exclude small and medium-size businesses or lack adequate financial justification.

In the report, the OCC cautioned that the scope of its observations and conclusions reflects a variety of factors and limitations, including the completeness of the banks’ responses, methods employed by the banks for tracking these matters internally, and the availability of detailed documentation reflecting the contemporaneous reasons for bank decisions. Accordingly, the OCC “was unable to quantify on a comprehensive basis the full extent of debanking or alleged debanking actions or the costs to customers and prospective customers across the nine banks.” The report also explained that the frequency of examples does not establish the relative prevalence of issues at any particular institution.

Regulatory Developments

The report describes several developments that build on the federal and state initiatives covered in our January 2026 alert:

• OCC and Federal Deposit Insurance Corporation rulemaking: In April 2026, the agencies jointly issued a final rule eliminating reputation risk from their supervisory programs. The rule bars the agencies from criticizing or taking adverse action against an institution based on reputation risk. It also prohibits agencies from encouraging service restrictions based on specified political, social, cultural, religious, or lawful-business grounds.
• OCC licensing and Community Reinvestment Act processes: The OCC may consider a bank’s record and policies concerning politicized or unlawful debanking in relevant licensing reviews and Community Reinvestment Act evaluations.
• CFPB scrutiny and investigations: On Oct. 14, 2026, the CFPB announced that it will “fully investigate” whether the institutions featured in the OCC report and others complied with federal consumer financial laws and will take appropriate action. The CFPB identified the Equal Credit Opportunity Act and Fair Credit Reporting Act — particularly the adverse-action notice requirements under those laws — and the prohibition on unfair, deceptive, or abusive acts or practices as areas it evaluates.³
• SAR-related communications: In September 2026, the OCC and other agencies clarified that SAR confidentiality generally does not prevent banks from discussing underlying facts, transactions, and documents with customers, provided they do not disclose the SAR or its existence. The statement neither alters legal requirements nor establishes new supervisory expectations.
• State fair-access laws remain relevant: Although state-law compliance was outside the report’s scope, state fair-access laws remain relevant. Institutions operating across jurisdictions should consider assessing applicable attestation, complaint, and customer-explanation requirements imposed under the laws of the states in which they operate.

Key Takeaways

While the OCC report does not cite a violation of law nor indicate enforcement, banks and financial institutions may draw important risk-management considerations from the report. Banks should consider reviewing relevant policies and procedures with applicable federal and state fair-access requirements and expectations in mind.

Specifically, banks may consider:

1. Reviewing policies and decision standards. Reviewing reputation or franchise-risk standards, categorical restrictions, “heightened risk” classifications, and related screening practices. Assessing whether renamed or successor concepts rely on the same subjective inputs criticized by the OCC rather than measurable credit, liquidity, market, operational, legal, and compliance risk criteria, applied consistently on a per-customer basis.
2. Defining decision criteria. Supporting adverse decisions with documented, individualized legal, credit, liquidity, market, operational, or other compliance risk factors — not reputational or other subjective risk factors, and adopting written standards for the use of adverse media, third-party ratings and advocacy-organization designations. Parties should also consider reassessing covenants and conditions that require customers to adopt environmental or social standards above those required under applicable law in order to maintain a relationship.
3. Testing consistency across the customer lifecycle. Comparing onboarding, expansion, restriction, and termination decisions involving similarly situated customers and assessing whether exceptions, escalation paths, and decision-making authority are applied consistently and documented contemporaneously.
4. Improving notices and customer communications. Revising account-closure and declination communication procedures, as appropriate, to confirm that customers receive a clear explanation of the basis for the account closure or denial, while maintaining compliance with SAR confidentiality requirements. Training employees on permissible and prohibited disclosures to verify that communications do not compromise SAR confidentiality.
5. Strengthening complaint handling and oversight. Identifying, investigating, escalating, and tracking debanking complaints. Verifying that monitoring covers business lines, subsidiaries, payment processors, and other third parties operating through the institution’s service channels.
6. Providing role-specific training. Using scenarios based on the OCC’s findings to train customer-facing staff, decision-makers, and control functions to distinguish objective, customer-specific risk factors from considerations involving factors based on political or religious views, lawful business activities, or anticipated public reaction. Reinforcing expectations for documenting decisions, escalating uncertain cases, and handling customer communications and complaints.
7. Mapping multistate requirements. Reviewing state fair-access requirements concerning attestations, investigations, written explanations, and complaints, as well as relevant payment-network and third-party service provider rules.

1 See Jonathan V. Gould, Comptroller of the Currency, Remarks on the Debanking of Coal, Firearms, and Other Industries 2–3 (Oct. 14, 2026).

2 See Off. of the Comptroller of the Currency, News Release 2026-91, Comptroller Gould Discusses Findings of Debanking Report (Oct. 14, 2026); Off. of the Comptroller of the Currency, Guaranteeing Fair Banking for All Americans 6–8, 39–45 (Oct. 14, 2026).

3 See Consumer Fin. Prot. Bureau, CFPB Announces New Initiative to Address OCC-Uncovered Debanking by Large Banks (Oct. 14, 2026).