OCC Releases Findings on Large Banks’ Debanking Activities

What Is New?

The Office of the Comptroller of the Currency (OCC) recently issued a news release on its supervisory review of debanking activities across the top nine national banks it oversees. The OCC’s review responds to President Trump’s August 2025 executive order (EO) 14331 “Guaranteeing Fair Banking for All Americans,” which scrutinized practices that have restricted customers from services based on political affiliations, religious beliefs, or lawful business activities. Comptroller Jonathan Gould stated that the report “provides irrefutable evidence that the nation’s largest banks have denied, debanked and discriminated against customers and lawful businesses.”

What Did the OCC Find in Its Supervisory Review?

The OCC initiated its review on JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, U.S. Bank, Capital One, PNC Bank, TD Bank, and BMO Bank. According to the OCC, all nine banks held policies between 2020 and September 2025 that barred access to financial services as a result of customers’ affiliations and political views.

The OCC concluded that the banks’ reputation risk policies lacked clear, specific criteria on decisions that deny or limit customers’ fair banking access. Industry sectors that faced restricted access by the banks’ public and nonpublic policies include oil and gas exploration, coal mining or plant operations, firearms or ammunition manufacturing and distribution, construction or operation of detention facilities, tobacco and e-cigarette manufacturing and distribution, and digital asset activities. While some states enacted “fair access laws” during the review period, prompting banks to update their industry-specific business line policies, the OCC continues to stress concerns about industry status risk on access to banking services.

Alongside its commercial grade graphics, this report differs from prior regulatory releases with its inclusion of examples of banks’ policies on customer decisions. The OCC, in preparing the report, identified and reviewed nearly 100,000 complaints to OCC-regulated institutions and 420,000 pages from these banks on their procedures, which supported its conclusion that customers were being debanked based on their affiliations and lawful business activities. The examples the OCC has presented are meant to serve as a practical reference for banks on whether their own customer evaluation policies are supported by clear risk criteria and supporting documentation.

How Has Trump’s EO Influenced Reputation Risk Policies?

President Trump’s EO 14331 states that banking decisions should be based on “individualized, objective, and risk-based analyses.” The EO directed federal banking regulators, including the Small Business Administration (SBA) and certain federal member agencies with supervisory and regulatory authority, to take appropriate remedial action to concepts that could result in “[p]oliticized or unlawful debanking.”

The OCC’s findings represent a further step in implementing the EO’s directive. The agency had already announced in OCC Bulletin 2026-12 (April 2026) that it had eliminated reputation risk considerations from its supervisory programs and clarified how improper debanking may affect licensing applications. Also in April, the OCC and Federal Deposit Insurance Corporation (FDIC) issued a final rule prohibiting the federal banking regulators from using reputation risk as a basis for adverse supervisory action. That rule addresses regulators’ conduct and does not prohibit banks from assessing financial or compliance risks.

The Federal Reserve Bank has also sought to remove reputation risk from supervision. In February 2026, it proposed codifying the removal while emphasizing that banks remain responsible for sound risk management and compliance with applicable laws.

Although the OCC has not established a new implementation deadline for banks, it is assessing further changes to the regulatory and supervisory framework applicable to large banks.

What Should Banks Consider?

Reputation risk and customer decision-making

Banks should determine whether reputation risk still influences policies on customer risk ratings, onboarding decisions, prohibited industries, adverse media screening, or escalation procedures. Simply removing the term “reputation risk” from a policy may not address how decisions are made if customers continue to be debanked based on controversial affiliations or lawful activities instead of individual customer risks.

A practical review should distinguish reputation risk concerns from documented credit, fraud, or money laundering risks. These policies should explain how specific risks translate into customer onboarding decisions and whether additional controls could address the exposure before services are restricted. Banks may consider:

• Document risk-based decisions with sufficient specificity and supporting evidence. By maintaining a record of the decision alongside a metric for its risk threshold, the appropriate policy, and customer-specific evidence, the bank may address a limitation that the OCC identified: the “availability of detailed documentation reflecting […] reasons for bank decisions.”
• Quantify the underlying risk of the decision. Where able, banks should quantify the identified exposure and assess how additional controls could reduce it.
• Establish clear definitions. The OCC identified an example of a reputation-risk employee using the word “rhetoric” to characterize speech associated with a political affiliation. Organizations should adopt specific definitions for violent speech rather than create references to unspecific “rhetoric,” making sure that reviewers preserve the actual statements alongside definition criteria.
• Implement additional controls before drawing exclusions for lawful industries. Instead of excluding an entire lawful industry based on reputational exposure, banks should identify customer-specific controls and then explain why those specific measures are sufficient for assessing a customer’s risk profile.

Alignment with BSA/AML processes

This review should also consider how the Bank Secrecy Act (BSA) and anti-money laundering (AML) processes inform customer decisions. Previous interagency guidance indicates that negative news by itself does not require an institution to file a suspicious activity report (SAR). Further, filing a SAR alone does not create a BSA requirement to terminate a customer relationship. Banks may also consider:

• Distinguish mandatory and voluntary SAR filings. Banks may still file voluntary SARs for suspicious transactions involving possible regulatory violations, even if reporting is not required. Banks should note if their SAR filing procedures distinguish between mandatory and voluntary filings and whether either could lead to an account exit trigger.
• Establish ties between the financial crime risk and an exit decision. When considering an exit after filing a voluntary SAR, banks may identify and document transaction activity patterns that create cause for a financial crime or money laundering concern.
• Assess mitigation and the reporting decision separately. Documenting the underlying activity and separately assessing the customer relationship can help prevent reporting decisions from substituting for an individualized risk assessment.

How Can BRG Help?

BRG’s Financial Institution Advisory practice can help banks assess customer risk profiles. Support can include:

• Customer onboarding and exit frameworks. Assess customer entry and exit decisions to reflect evidence-based, customer-specific metrics.
• BSA/AML policies and escalation frameworks. Review SAR filing procedures, including distinctions between mandatory and voluntary filings and the documented financial crime risks supporting exit decisions.
• Consistency testing. Test whether comparable customer cases receive consistent treatment. If not, assess whether decision records explain customer-specific risks and control rationales.
• Implementation and staff training. Support the incorporation of quality control testing tailored to the bank’s customers and operating model, ensuring that the correct risk criteria are applied during testing.