BPI Urges Tighter Safeguards for Regulatory Data Sharing

U.S. banks routinely provide regulators with strategic plans, capital data, trading records and cybersecurity details during examinations, often through regulator-run portals or encrypted email. The Bank Policy Institute says each transfer creates another copy outside a firm’s security perimeter, limiting its control over access, retention and deletion. The issue gained urgency after cyber incidents were discovered at the U.S. Treasury Department in December 2024 and the Office of the Comptroller of the Currency in February 2025, prompting a reassessment of supervisory data handling.

The Federal Reserve, Federal Deposit Insurance Corp. and OCC issued a joint statement on July 16, 2026, outlining coordinated treatment of highly sensitive examination information. BPI followed on July 23 with a risk-based framework urging fewer direct electronic transfers and greater use of firm-hosted applications, screen sharing and on-site reviews. For especially sensitive material, including pre-deal M&A information, it recommended oral briefings, summaries or narrower examiner access. If transfer is unavoidable, the parties should document storage, authorized users, safeguards, retention, onward sharing and disposal.