OCC and FDIC Issue Final Rule Excluding Their Consideration of Reputation Risk

The OCC and FDIC jointly issued a final rule proscribing either agency from criticizing or taking adverse action against a regulated institution based on its reputation risk.

Under the final rule, “reputation risk” is defined as risk “that an action or activity, or combination of actions or activities, or lack of actions or activities, of an institution could negatively impact public perception of the institution for reasons not clearly and directly related to the financial or operational condition of the institution.”  The agencies assert that reputation risk is subjective, does not correlate with safety and soundness risks (or other statutory mandates), and could lead to regulatory overreach.  In their view, consideration of reputation risk is also inconsistent with their responsibilities under existing statutes to ensure fair access to financial services and fair treatment of customers by financial institutions.

Accordingly, the final rule provides, among other things:

• The FDIC [or OCC] will not require, instruct, or encourage an institution, or any employee of an institution, to:
  • Refrain from contracting or doing business with a third party, including an institution-affiliated party, on the basis of reputation risk;
  • Terminate a contract or discontinue doing business with a third party, including an institution-affiliated party, on the basis of reputation risk;
  • Sign a contract or initiate doing business with a third-party, including an institution-affiliated party, on the basis of reputation risk; or
  • Modify the terms or conditions under which it contracts or does business with a third party, including an institution-affiliated party, on the basis of reputation risk.
• The FDIC [or OCC] will not require, instruct, or encourage an institution, or any employee of an institution, to terminate a contract with, discontinue doing business with, sign a contract with, initiate doing business with, modify the terms under which it will do business with a person or entity, or take any action or refrain from taking any action on the basis of the person’s or entity’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of the person’s or entity’s involvement in politically disfavored but lawful business activities perceived to present reputation risk.

The final rule becomes effective June 9, 2026.