On August 24, 2016, the CFPB published proposed amendments to broaden its ability to share confidential information with agencies. If the proposed rule is finalized, the CFPB would be permitted to share information with agencies, including state attorneys general, even if those agencies have no supervisory authority over financial institutions.

The proposed rule focuses on the disclosure of confidential supervisory information (CSI), a broad term including any documents and communications used by the CFPB in the exercise of supervisory authority, including exams and inspections, or any information provided to the CFPB by a financial institution to enable the CFPB to "monitor for risks to consumers."  The current rule limits the disclosure of CSI to those agencies "having jurisdiction over a supervised financial institution.

Under the proposed rule, the need for an agency to have "jurisdiction" over a financial institution would be eliminated in order for the CFPB to disclose CSI. Instead, CSI could be disclosed as long as it is "relevant to the exercise of the agency's statutory or regulatory authority." As part of this proposed rule, the definition of "agency" would be modified to include "a Federal, State, or foreign governmental authority or an entity exercising governmental authority."

The CFPB stated that its goal with the proposed rule is to create an "information sharing regime" that it believes is a better interpretation of the Dodd-Frank Act. The proposed amendments would also align the standard for disclosing CSI with the current standards for disclosing other confidential information. The CFPB contends that the current rule is too burdensome and the changes would better serve its "mission and overall objectives."

The potential impact of this rule is extensive. The removal of the requirement that an agency have jurisdiction over a company means that the CFPB can disclose CSI to nearly any agency as long as it is deemed "relevant" to the agency's authority. This opens the door for state attorneys general or local authorities to obtain CSI as long as it can satisfy the CFPB's broad standard. Additionally, the new definition of "agency" expands the number of entities which can receive CSI beyond just federal and state agencies. The inclusion of entities "exercising governmental authority" is expansive and would include state bar associations and other registration and disciplinary organizations.

The establishment of the CFPB's "information sharing regime" would certainly mean that more agencies would have more access to confidential information. It could also result in increased costs to financial institutions. Comments on the proposed rule are being accepted until October 24, 2016.