(a) Disclosure prohibited. Except as provided in paragraph (b) of this section or by 12 CFR part 310,2 no person shall disclose or permit the disclosure of any exempt records, or information contained therein, to any persons other than those officers, directors, employees, or agents of the Corporation who have a need for such records in the performance of their official duties. In any instance in which any person has possession, custody or control of FDIC exempt records or information contained therein, all copies of such records shall remain the property of the Corporation and under no circumstances shall any person, entity or agency disclose or make public in any manner the exempt records or information without written authorization from the Director of the Corporation's Division having primary authority over the records or information as provided in this section.

(b) Disclosure authorized. Exempt records or information of the Corporation may be disclosed only in accordance with the conditions and requirements set forth in this paragraph (b). Requests for discretionary disclosure of exempt records or information pursuant to this paragraph (b) may be submitted directly to the Division having primary authority over the exempt records or information or to the FOIA/PA Group for forwarding to the appropriate Division having primary authority over the records sought. Such administrative request must clearly state that it seeks discretionary disclosure of exempt records, clearly identify the records sought, provide sufficient information for the Corporation to evaluate whether there is good cause for disclosure, and meet all other conditions set forth in paragraph (b)(1) through (10) of this section. Information regarding the appropriate FDIC Division having primary authority over a particular record or records may be obtained from the FOIA/PA Group. Authority to disclose or authorize disclosure of exempt records of the Corporation is delegated as follows:

(1) Disclosure to depository institutions. The Director of the Corporation's Division having primary authority over the exempt records, or designee, may disclose to any director or authorized officer, employee or agent of any depository institution, information contained in, or copies of, exempt records pertaining to that depository institution.

(2) Disclosure to state banking agencies. The Director of the Corporation's Division having primary authority over the exempt records, or designee, may in his or her discretion and for good cause, disclose to any authorized officer or employee of any state banking or securities department or agency, copies of any exempt records to the extent the records pertain to a state-chartered depository institution supervised by the agency or authority, or where the exempt records are requested in writing for a legitimate depository institution supervisory or regulatory purpose.

(3) Disclosure to federal financial institutions supervisory agencies and certain other agencies. The Director of the Corporation's Division having primary authority over the exempt records, or designee, may in his or her discretion and for good cause, disclose to any authorized officer or employee of any federal financial institution supervisory agency including the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, Bureau of Consumer Financial Protection, the Financial Stability Oversight Council, the Securities and Exchange Commission, the National Credit Union Administration, or any other agency included in section 1101(7) of the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.) (RFPA), any exempt records for a legitimate depository institution supervisory or regulatory purpose. The Director, or designee, may in his or her discretion and for good cause, disclose exempt records, including customer financial records, to certain other federal agencies as referenced in section 1113 of the RFPA for the purposes and to the extent permitted therein, or to any foreign bank regulatory or supervisory authority as provided, and to the extent permitted, by section 206 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (12 U.S.C. 3109). Finally, the Director, or designee, may in his or her discretion and for good cause, disclose reports of examination or other confidential supervisory information concerning any depository institution or other entity examined by the Corporation under authority of Federal law to: Any other Federal or State agency or authority with supervisory or regulatory authority over the depository institution or other entity; any officer, director, or receiver of such depository institution or entity; and any other person that the Corporation determines to be appropriate.

(4) Disclosure to prosecuting or investigatory agencies or authorities.

(i) Reports of Apparent Crime pertaining to suspected violations of law, which may contain customer financial records, may be disclosed to federal or state prosecuting or investigatory authorities without giving notice to the customer, as permitted in the relevant exceptions of the RFPA.

(ii) The Director of the Corporation's Division having primary authority over the exempt records, or designee, may disclose to the proper federal or state prosecuting or investigatory authorities, or to any authorized officer or employee of such authority, copies of exempt records pertaining to irregularities discovered in depository institutions which are believed to constitute violations of any federal or state civil or criminal law, or unsafe or unsound banking practices, provided that customer financial records may be disclosed without giving notice to the customer, only as permitted by the relevant exceptions of the RFPA. Unless such disclosure is initiated by the FDIC, customer financial records shall be disclosed only in response to a written request which:

(A) Is signed by an authorized official of the agency making the request;

(B) Identifies the record or records to which access is requested; and

(C) Gives the reasons for the request.

(iii) When notice to the customer is required to be given under the RFPA, the Director of the Corporation's Division having primary authority over the exempt records, or designee, may disclose customer financial records to any federal or state prosecuting or investigatory agency or authority, provided, that:

(A) The General Counsel, or designee, has determined that disclosure is authorized or required by law; or

(B) Disclosure is pursuant to a written request that indicates the information is relevant to a legitimate law enforcement inquiry within the jurisdiction of the requesting agency and:

(1) The Director of the Corporation's Division having primary authority over the exempt records, or designee, certifies pursuant to section 1112(a)3 of the RFPA that the records are believed relevant to a legitimate law enforcement inquiry within the jurisdiction of the receiving agency; and

(2) A copy of such certification and the notice required by section 1112(b)4 of the RFPA is sent within fourteen days of the disclosure to the customer whose records are disclosed.5

(5) Disclosure to servicers and serviced institutions. The Director of the Corporation's Division having primary authority over the exempt records, or designee, may disclose copies of any exempt record related to a depository institution data center, service corporation, or any other data center that provides data processing or related services to an insured institution (hereinafter referred to as “data center”) to:

(i) The examined data center;

(ii) Any insured institution that receives data processing or related services from the examined data center;

(iii) Any state agency or authority which exercises general supervision over an institution serviced by the examined data center; and

(iv) Any federal financial institution supervisory agency which exercises general supervision over an institution serviced by the examined data center. The federal supervisory agency may disclose any such examination report received from the Corporation to an insured institution over which it exercises general supervision and which is serviced by the examined data center.

(6) Disclosure to third parties.

(i) Except as otherwise provided in paragraphs (c) (1) through (5) of this section, the Director of the Corporation's Division having primary authority over the exempt records, or designee, may in his or her discretion and for good cause, disclose copies of any exempt records to any third party where requested to do so in writing. Any such written request shall:

(A) Specify, with reasonable particularity, the record or records to which access is requested; and

(B) Give the reasons for the request.

(ii) Either prior to or at the time of any disclosure, the Director or designee shall require such terms and conditions as he deems necessary to protect the confidential nature of the record, the financial integrity of any depository institution to which the record relates, and the legitimate privacy interests of any individual named in such records.

(7) Authorization for disclosure by depository institutions or other third parties.

(i) The Director of the Corporation's Division having primary authority over the exempt records, or designee, may, in his or her discretion and for good cause, authorize any director, officer, employee, or agent of a depository institution to disclose copies of any exempt record in his custody to anyone who is not a director, officer or employee of the depository institution. Such authorization must be in response to a written request from the party seeking the record or from management of the depository institution to which the report or record pertains. Any such request shall specify, with reasonable particularity, the record sought, the party's interest therein, and the party's relationship to the depository institution to which the record relates.

(ii) The Director of the Corporation's Division having primary authority over the exempt records, or designee, may, in his or her discretion and for good cause, authorize any third party, including a federal or state agency, that has received a copy of a Corporation exempt record, to disclose such exempt record to another party or agency. Such authorization must be in response to a written request from the party that has custody of the copy of the exempt record. Any such request shall specify the record sought to be disclosed and the reasons why disclosure is necessary.

(iii) Any subsidiary depository institution of a bank holding company or a savings and loan holding company may reproduce and furnish a copy of any report of examination of the subsidiary depository institution to the parent holding company without prior approval of the Director of the Division having primary authority over the exempt records and any depository institution may reproduce and furnish a copy of any report of examination of the disclosing depository institution to a majority shareholder if the following conditions are met:

(A) The parent holding company or shareholder owns in excess of 50% of the voting stock of the depository institution or subsidiary depository institution;

(B) The board of directors of the depository institution or subsidiary depository institution at least annually by resolution authorizes the reproduction and furnishing of reports of examination (the resolution shall specifically name the shareholder or parent holding company, state the address to which the reports are to be sent, and indicate that all reports furnished pursuant to the resolution remain the property of the Federal Deposit Insurance Corporation and are not to be disclosed or made public in any manner without the prior written approval of the Director of the Corporation's Division having primary authority over the exempt records as provided in paragraph (b) of this section;

(C) A copy of the resolution authorizing disclosure of the reports is sent to the shareholder or parent holding company; and

(D) The minutes of the board of directors of the depository institution or subsidiary depository institution for the meeting immediately following disclosure of a report state:

(1) That disclosure was made;

(2) The date of the report which was disclosed;

(3) To whom the report was sent; and

(4) The date the report was disclosed.

(iv) With respect to any disclosure that is authorized under this paragraph (b)(7), the Director of the Corporation's Division having primary authority over the exempt records, or designee, shall only permit disclosure of records upon determining that good cause exists. If the exempt record contains information derived from depository institution customer financial records, disclosure is to be authorized only upon the condition that the requesting party and the party releasing the records comply with any applicable provision of the RFPA. Before authorizing the disclosure, the Director (or designee) may require that both the party having custody of a copy of a Corporation exempt record and the party seeking access to the record agree to such limitations as the Director (or designee) deems necessary to protect the confidential nature of the record, the financial integrity of any depository institution to which the record relates and the legitimate privacy interests of any persons named in such record.

(8) Disclosure by General Counsel.

(i) The Corporation's General Counsel, or designee, may disclose or authorize the disclosure of any exempt record in response to a valid judicial subpoena, court order, or other legal process, and authorize any current or former officer, director, employee, agent of the Corporation, or third party, to appear and testify regarding an exempt record or any information obtained in the performance of such person's official duties, at any administrative or judicial hearing or proceeding where such person has been served with a valid subpoena, court order, or other legal process requiring him or her to testify. The General Counsel shall consider the relevancy of such exempt records or testimony to the litigation, and the interests of justice, in determining whether to disclose such records or testimony. Third parties seeking disclosure of exempt records or testimony in litigation to which the FDIC is not a party shall submit a request for discretionary disclosure directly to the General Counsel.6 Such request shall specify the information sought with reasonable particularity and shall be accompanied by a statement with supporting documentation showing in detail the relevance of such exempt information to the litigation, justifying good cause for disclosure, and a commitment to be bound by a protective order. Failure to exhaust such administrative request prior to service of a subpoena or other legal process may, in the General Counsel's discretion, serve as a basis for objection to such subpoena or legal process. Customer financial records may not be disclosed to any federal agency that is not a federal financial supervisory agency pursuant to this paragraph unless notice to the customer and certification as required by the RFPA have been given except where disclosure is subject to the relevant exceptions set forth in the RFPA.

(ii) The General Counsel, or designee, may in his or her discretion and for good cause, disclose or authorize disclosure of any exempt record or testimony by a current or former officer, director, employee, agent of the Corporation, or third party, sought in connection with any civil or criminal hearing, proceeding or investigation without the service of a judicial subpoena, or other legal process requiring such disclosure or testimony, if he or she determines that the records or testimony are relevant to the hearing, proceeding or investigation and that disclosure is in the best interests of justice and not otherwise prohibited by Federal statute. Customer financial records shall not be disclosed to any federal agency pursuant to this paragraph that is not a federal financial supervisory agency, unless the records are sought under the Federal Rules of Civil Procedure (28 U.S.C. appendix) or the Federal Rules of Criminal Procedure (18 U.S.C. appendix) or comparable rules of other courts and in connection with litigation to which the receiving federal agency, employee, officer, director, or agent, and the customer are parties, or disclosure is otherwise subject to the relevant exceptions in the RFPA. Where the General Counsel or designee authorizes a current or former officer, director, employee or agent of the Corporation to testify or disclose exempt records pursuant to this paragraph (b)(8), he or she may, in his or her discretion, limit the authorization to so much of the record or testimony as is relevant to the issues at such hearing, proceeding or investigation, and he or she shall give authorization only upon fulfillment of such conditions as he or she deems necessary and practicable to protect the confidential nature of such records or testimony.

(9) Authorization for disclosure by the Chairman of the Corporation's Board of Directors. Except where expressly prohibited by law, the Chairman of the Corporation's Board of Directors may in his or her discretion, authorize the disclosure of any Corporation records. Except where disclosure is required by law, the Chairman may direct any current or former officer, director, employee or agent of the Corporation to refuse to disclose any record or to give testimony if the Chairman determines, in his or her discretion, that refusal to permit such disclosure is in the public interest.

(10) Limitations on disclosure. All steps practicable shall be taken to protect the confidentiality of exempt records and information. Any disclosure permitted by paragraph (b) of this section is discretionary and nothing in paragraph (b) of this section shall be construed as requiring the disclosure of information. Further, nothing in paragraph (b) of this section shall be construed as restricting, in any manner, the authority of the Board of Directors, the Chairman of the Board of Directors, the Director of the Corporation's Division having primary authority over the exempt records, the Corporation's General Counsel, or their designees, or any other Corporation Division or Office head, in their discretion and in light of the facts and circumstances attendant in any given case, to require conditions upon and to limit the form, manner, and extent of any disclosure permitted by this section. Wherever practicable, disclosure of exempt records shall be made pursuant to a protective order and redacted to exclude all irrelevant or non-responsive exempt information.

[60 FR 61465, Nov. 30, 1995, as amended at 63 FR 16408, Apr. 3, 1998; 67 FR 71071, Nov. 29, 2002; 73 FR 2146, Jan. 14, 2008; 76 FR 35965, June 21, 2011]