Handling of Highly Sensitive Information During Examinations | FDIC.gov

Handling of Highly Sensitive Information During Examinations | FDIC.gov Skip to main content An official website of the United States government The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site. The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely. Cambiar a español Search FDIC.gov Search Handling of Highly Sensitive Information During Examinations Supervisory Guidance July 16, 2026 Share on Facebook Share on X Share on X Follow the FDIC on LinkedIn Share through email Print Summary: On July 16, 2026, the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, and the Office of the Comptroller of the Currency (the Agencies) issued a joint statement regarding Coordinated Federal Banking Agency Approach for the Handling of Highly Sensitive Information During Examinations . The joint statement does not establish new expectations. Statement of Applicability: The contents of, and material referenced in, this FIL apply to all FDIC-supervised financial institutions. Highlights: The FDIC, the Board of Governors of the Federal Reserve System, and the Office of the Comptroller of the Currency recently have established a coordinated approach for the handling of highly sensitive information during examinations of supervised institutions. The FDIC is committed to protecting and handling sensitive data in accordance with applicable confidentiality laws and regulations and data security standards. Highly sensitive data may include confidential, proprietary information such as an institution’s: Technology/network diagrams and schematics, Detailed penetration test results, Technical details of specific information technology control weaknesses, and Succession planning. If an institution’s management believes certain information should be considered highly sensitive, they should discuss their concerns with the assigned Examiner-In-Charge (EIC) or primary agency contact. The FDIC will then consider several options to preserve the confidentiality of such information, including on-site review, direct digital review from the systems of the supervised bank, redacted or summarized versions of documents, or additional measures. The FDIC will ensure this process does not interfere with the FDIC’s ability to access information, conduct examinations, support conclusions, or maintain a historical record. The agencies have committed to notify affected banks of a potential or confirmed material CSI compromise as soon as practicable and within no more than 72 hours, once the agency impacted has a reasonable basis to believe a compromise has occurred and determines the banks affected, subject to applicable legal considerations. FIL-37-2026 Attachment(s) Joint Statement on the Handling of Highly Sensitive Information During Examinations Related Topics Examination Processes and Procedures Contact(s) Division of Risk Management Supervision Last Updated: July 16, 2026