OCC Debanking Report: The Account-Closure Controls Nine Large Banks Now Need

TL;DR

• The OCC debanking report says all nine large national banks reviewed used policies or practices that could restrict lawful customers based on political, religious, social, or industry considerations.
• No fine or consent order was announced. But the CFPB immediately said it would investigate whether the banks complied with ECOA, FCRA adverse-action requirements, and UDAAP standards.
• The control test is no longer “does the policy say decisions are risk-based?” It is whether each denial, restriction, and exit can be traced to objective evidence, an authorized decision, a consistent reason code, and an accurate customer communication.
• Compliance should sample production decisions now—especially industry rules, executive escalations, automated closures, exceptions, complaints, and reversals.

Nine banks. Nearly 100,000 complaints. Roughly 50,000 documents totaling about 420,000 pages. And a blunt supervisory conclusion: broad reputation-risk frameworks left room for lawful customers to lose financial access for reasons that were not sufficiently objective or individualized.

The OCC’s October 14 debanking report, Guaranteeing Fair Banking for All Americans, covers JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC Bank, TD Bank, and BMO Bank. The review focused primarily on policies and decisions from 2020 through September 2025.

This is not a consent order, and it does not establish that every customer decision at every named bank was unlawful. The OCC release announces no penalty. What it does is expose the evidence standard banks should expect next: show the regulator how the institution moved from a customer’s actual facts to a defensible risk decision—without relying on political pressure, public controversy, or a prohibited-industry shortcut.

That is a much harder exercise than rewriting “reputation risk” in a policy.

What the OCC debanking report actually says

The OCC reviewed complaints, bank policies, internal records, and hundreds of onboarding, relationship-expansion, and termination decisions. Its central observations are operational, not merely political.

The report’s most useful practitioner point is that a lawful industry can still carry serious risk. A firearms dealer may create transaction-monitoring, licensing, fraud, or credit concerns. A digital-asset firm may require enhanced BSA/AML controls. An oil-and-gas borrower may present concentration and collateral risk. None of those concerns disappear.

But “industry is controversial” is not a substitute for identifying the actual risk, assessing the customer’s controls, documenting what the bank can and cannot manage, and applying the same rule to comparable cases.

That distinction tracks the OCC and FDIC final rule published at 91 FR 18279. Effective June 9, 2026, the rule bars those agencies from criticizing or taking adverse action against institutions on the basis of reputation risk. It does not force banks to open or keep every account. Our earlier breakdown of the reputation-risk final rule covers that legal perimeter in detail.

The new report moves the problem from rule interpretation to production evidence.

Why the CFPB follow-on changes the work queue

Hours after the report, the CFPB announced a new debanking initiative. The Bureau said it would investigate whether the institutions identified by the OCC—and potentially others—complied with federal consumer financial laws.

The CFPB specifically referenced:

• the Equal Credit Opportunity Act;
• Fair Credit Reporting Act adverse-action notice requirements;
• unfair, deceptive, or abusive acts or practices; and
• its supervisory and enforcement authority over banks with more than $10 billion in assets and certain nonbanks.

Preserve the procedural distinction. The CFPB announcement is an investigation signal, not a finding that all nine banks violated ECOA, FCRA, or UDAAP. The OCC report is a supervisory review, not nine final orders. Compliance teams lose credibility when they turn an allegation, investigation, or report into an adjudicated violation.

Still, the combined signal is clear. Account-access decisions can now draw review from two directions:

1. OCC fair-access review: Was the decision individualized, objective, risk-based, and free from prohibited political or religious considerations?
2. CFPB consumer-law review: Did the institution comply with applicable nondiscrimination, adverse-action, disclosure, and UDAAP requirements?

The same case file needs to answer both without pretending the legal standards are interchangeable.

The account-closure control stack regulators can actually test

A defensible process has at least seven connected layers. If one lives in a policy library, another in a fraud platform, and the final decision sits in an executive’s email, the bank does not have a reviewable control—it has an evidence scavenger hunt.

1. Policy and rule inventory

The CCO should inventory every source that can deny, restrict, suspend, reserve, or terminate a relationship:

• customer acceptance and risk-appetite policies;
• prohibited and restricted industry lists;
• BSA/AML and sanctions procedures;
• fraud rules and model outputs;
• credit and operational-risk standards;
• card-network or sponsor-bank requirements;
• legal holds and law-enforcement requests; and
• executive or committee escalation protocols.

For each source, record the owner, approver, effective date, affected products, decision authority, reason codes, and exception route. A policy inventory without production-rule mapping will miss the rules that actually close accounts.

2. Individualized decision record

Each adverse decision should identify the customer’s conduct or risk condition, not merely a category. A workable record includes:

“Reputation risk” is not a useful reason code. Neither is “high risk” without the condition that made the customer high risk.

3. Industry-rule challenge

The first line may propose sector restrictions, but Legal and Compliance should force the business to state what activity creates the risk. This is where broad acceptable-use rules often fail.

A weapons manufacturer using a platform for ordinary payroll does not present the same transaction risk as a merchant using the platform to process firearm sales. A digital-asset software vendor is not automatically equivalent to an unregistered exchange. The assessment should follow the product, transaction, geography, counterparties, licenses, and controls—not stop at the customer’s NAICS code or marketing description.

If the institution truly cannot manage a sector’s recurring risks, document the capability gap. That is more defensible than converting discomfort into a categorical compliance claim.

4. Exceptions and revenue influence

The report flags the risk that large, profitable, or high-net-worth relationships may receive exceptions unavailable to smaller customers. That makes exception testing essential.

Internal Audit should compare approved and denied exceptions by:

• underlying reason code;
• customer size and revenue;
• product and geography;
• approver level;
• remediation offered;
• time allowed to respond; and
• final outcome.

An exception is not automatically improper. But a bank needs to explain why the exception changed the risk outcome. “Strategic relationship” is a commercial fact, not a control mitigation.

5. Notices, SAR confidentiality, and adverse action

Teams often retreat to vague customer notices because they fear revealing a SAR, fraud method, or investigative detail. That concern can be legitimate, but it should not erase the internal record.

The September 2 interagency statement on SAR confidentiality and customer communications says banks may discuss underlying facts, transactions, and documents without disclosing a SAR or information that would reveal its existence. Compliance should maintain two connected fields:

• the complete internal decision basis; and
• the counsel-approved customer explanation, including why any detail was withheld.

Then test whether the notice was accurate and whether any applicable ECOA or FCRA timing and content requirements were met. The account-closure workflow discussed in our FTC debanking warning-letter analysis provides a useful nonbank comparison, but do not collapse FTC, OCC, and CFPB authorities into one rule.

6. Complaints, appeals, and reversals

A reversal is not just customer service data. It can show that a production rule is overbroad, evidence is unreliable, reviewers apply different standards, or notices do not explain what customers need to cure.

The complaint-management owner should link each complaint and appeal to the original decision ID. Monthly reporting should show:

• complaints and appeals by reason code;
• reversal rate by rule and reviewer;
• repeat complaints after a supposedly final resolution;
• unsupported or missing decision records;
• time to investigation and resolution; and
• concentrations by customer segment or protected basis where lawful to analyze.

Do not set a universal “acceptable reversal rate” without history. Start with three to six months of internal data, identify outlier rules and reviewers, and trace a sample from request to ticket to final record. A lower reversal rate can mean accurate decisions—or an inaccessible appeal process.

7. Governance and closure evidence

The board does not need a deck listing how many accounts were closed. It needs evidence that the institution’s decision system works.

The CRO or CCO should sponsor the review. Business-line owners own rule design and first-line execution. Compliance owns legal and policy challenge. Model Risk or data governance should review automated decision systems. Internal Audit should independently test whether fixes operate in production.

Every remediation item should have an issue ID, root cause, accountable owner, due date, affected population, validation method, and closure evidence. That is the difference between “policy updated” and “the unsupported rule no longer makes customer decisions.”

A 30/60/90-day response plan

Days 1–30: freeze the evidence perimeter

• CCO/Legal: Issue a preservation notice covering policies, rule versions, decision records, notices, complaints, appeals, committee materials, and relevant messages for the review period.
• Operations/Product: Produce the complete inventory of denial, restriction, reserve, suspension, and closure paths—including automated rules.
• Compliance: Select a risk-based sample spanning affected industries, manual and automated decisions, approvals and denials, exceptions, complaints, and reversals.
• Issue Management: Open separate findings for missing evidence, unsupported categories, inaccurate reason codes, inconsistent notices, and broken appeal lineage. Do not bury distinct root causes in one giant “debanking” issue.

Days 31–60: test and remediate

• First line: Reperform sampled decisions using the policy and rule version in effect on the decision date.
• Compliance Testing: Compare similarly situated cases and challenge unexplained differences.
• Legal: Map notice obligations by product and decision type; document SAR, fraud, sanctions, or security disclosure constraints.
• Data/Model Risk: Test automated rules for proxy variables, stale inputs, unexplained overrides, and missing version history.
• Customer Operations: Review unresolved complaints and appeals tied to rules that fail testing.

Days 61–90: prove operating effectiveness

• Internal Audit: Validate that corrected rules are deployed, not just approved.
• Compliance: Run a fresh sample after implementation and reconcile every case to source evidence.
• Risk Committee: Review issue aging, affected-customer analysis, exception patterns, reversals, notice defects, and overdue corrective actions.
• Board committee: Receive a concise report on material gaps, customer impact, regulatory communications, and independently validated closure status.

Five things to check Monday morning

1. Pull the top 20 closure and denial reason codes by volume. Flag anything vague enough to hide the real basis.
2. Search current policies and production rules for “reputation,” “values,” “controversial,” “sensitive industry,” and undocumented catch-all categories.
3. Trace five recent closures end to end. If the evidence cannot be assembled quickly, log the lineage gap.
4. Compare industry exceptions by customer revenue and approval level. Ask what control—not commercial value—changed the risk decision.
5. Send complaint and appeal reversals back to the rule owner. Require a documented decision on whether the original rule needs correction or retrospective review.

The OCC report does not say banks must ignore fraud, AML, sanctions, credit, or operational risk. It says subjective labels and sector shortcuts are not enough. The practical burden is precise: make the decision basis specific, preserve the evidence, treat comparable cases consistently, and prove that remediation reached production.

If those gaps are already turning into findings, the Issues Management Tracker & Template gives each one an owner, due date, action plan, root cause, and closure-validation trail.

This article is for general informational purposes and is not legal advice. Account-access decisions require analysis of the institution, product, customer, and applicable law.