CFPB Rule Regarding Privileged Information

by Morgan Lewis

[authors: Tonya E. Oliver, Christian J. Mixter, Ivan P. Harris, and Kathleen W. Collins]

New regulation attempts to protect from disclosure privileged information provided by financial institutions to the Consumer Financial Protection Bureau, or shared by the Bureau with other agencies.

On June 28, the Consumer Financial Protection Bureau (CFPB or the Bureau) adopted a proposed rule intended to protect financial institutions' privileged information from disclosure when that information is offered to the CFPB for supervisory purposes. Under the rule, neither an institution's delivery of privileged information to the CFPB nor the CFPB's subsequent transfer of that information to another government agency or regulator waives any privilege the institution could otherwise claim.

The new rule adds a new regulation, 12 C.F.R. § 1070.48, which specifies that a supervised entity does not waive any applicable privilege with respect to third parties by providing privileged information to the CFPB. The rule also further clarifies 12 C.F.R. § 1070.47(c), stating that the sharing of any privileged information by the CFPB with any federal or state agency will not waive any applicable privileges. This provision covers both information submitted to the CFPB by supervised entities and privileged information created by the CFPB in its supervisory role.


The CFPB's regulations provide the CFPB with authority to request information from supervised institutions that the CFPB determines will help serve the purpose of promoting fairness and transparency for consumer financial products and services. Supervised institutions are required to comply with these requests. In January 2012, the CFPB released Bulletin 12-01, which stated that the CFPB would continue to demand attorney-client privileged documents from its supervised institutions but that such disclosures would not waive attorney-client privilege with respect to third parties.

In furtherance of its position, in March the CFPB issued a notice of proposed rulemaking, requesting comments on its proposed rule to codify Bulletin 12-01 and provide that information covered by both attorney-client privilege and attorney work-product privilege would not be waived for third parties. The proposed rule expanded the scope of Bulletin 12-01 explicitly to include materials covered under the work-product doctrine, evidencing the CFPB's intention to request both attorney-client and work-product materials from supervised institutions.

The notice of proposed rulemaking received a number of strong reactions. Commentators, including the American Bar Association, expressed concerns with the proposed rule, including the belief of some that the CFPB does not have legal authority to compel supervised entities to produce materials protected by the attorney-client privilege or the work-product doctrine and that the proposal would serve to undermine the attorney-client privilege and work-product doctrine. The CFPB has sought to rebuff these challenges. It argues that effective supervision requires access to privileged materials and that it inherited its supervisory authority (and right to privileged materials) from the federal banking agencies. Thus, according to the Bureau, it would only be sensible for the same antiwaiver rule enjoyed by the federal banking agencies to apply to the CFPB.[1]

Many commentators were not satisfied with the CFPB's response, hoping instead for a legislative solution to protect privileged information. Financial institutions are protected by a federal statute, the Federal Deposit Insurance Act (FDIA), 12 U.S.C. §§ 1821(t), 1828(x), which provides there is no waiver of the attorney-client privilege when a federally chartered bank provides privileged materials to a "federal banking agency." However, because the CFPB is not a "federal banking agency," it is not thought to be covered by the FDIA.

In related legislation, on March 26, 2012, the House of Representatives passed H.R. 4014, which would amend Sections 1821(t) and 1828(x) to include the Bureau in the list of federal agencies that may share attorney-client privileged information with other federal agencies without the privilege being waived. Its companion Senate bill, S. 2099, has been referred to the Senate Banking Committee but has not been acted upon. The CFPB reaffirmed that it "continues to support appropriate legislation" that will protect against the waiver of privileged information.

Going Forward

In its commentary to the rule, the CFPB has expressed its willingness to work with supervised entities to both limit the frequency of its requests for privileged information and to share confidential and privileged information "only in very limited circumstances and upon review of all the relevant facts and considerations." The CFPB will request privileged information "only when it determines that such information is material to its supervisory objectives and that it cannot practicably obtain the same information from non-privileged sources." All privileged information shared with another state or federal agency would remain the property of the CFPB, and the other agencies may not further disclose such information without the CFPB's consent.

Importantly, the CFPB conceded that it will share the privileged material with state law enforcement agencies, including state attorneys general. The rule indicates that although state law enforcement officials would have access to privileged materials, those officials would be unable to use that information in enforcement proceedings because they are third parties under the new rule. Still, financial institutions and other entities falling in the CFPB's purview should be aware that privileged information could be seen by other regulators, though the CFPB rules prevent that information from being used in any enforcement proceeding.

These provisions will become effective 30 days after the date of publication in the Federal Register.

[1]. Regardless of the legislative outcome, the CFPB believes "[t]he validity and effectiveness of the rule depends on the scope of the Bureau's rulemaking authority, not on the Bureau's authority to compel privileged information." Although the CFPB maintains that it has authority to compel production of privileged information, it relies less on its prior assertion that the reason supervised institutions do not waive their privileges after submission to the Bureau is because such submissions are not voluntary. The commentary on the rule now states in a footnote, "[T]he Bureau intends the rule to also govern claims of waiver related to the voluntary submission of privileged information to the Bureau."


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morgan Lewis | Attorney Advertising

Written by:

Morgan Lewis

Morgan Lewis on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.