Few regulatory shifts move this fast. What started as a Fair Banking Executive Order in August culminated in a final rule that eliminated reputational risk from bank supervision, which took effect on June 9, 2026.
And in between, the Office of the Comptroller of the Currency (OCC) released preliminary findings of its investigation into nine of the largest U.S. banks; the Federal Trade Commission (FTC) issued warning letters to major payment networks; the Small Business Administration issued a mandate to cease debanking, conduct reviews, report findings and reinstate customers; and a growing body of fair access state laws is being proposed despite industry calls for federal preemption.
The executive order targeted the prudential regulators, requiring the removal of reputational risk and any other language in supervisory documents that could lead to “politicized or unlawful debanking,” defined as any restriction on access to services based on political or religious beliefs or on disfavored lawful business activities. The order underscored that all banking decisions must be made “on the basis of individualized objective and risk-based analyses.”
The banking industry publicly welcomed the call for removal of reputational risk, noting it is in all “banks’ best interests to take deposits, lend to and support as many customers as possible” in a news release from the American Bankers Association in August 2025. Given a recent wave of U.S. Department of Justice (DOJ) subpoenas to banks, it remains important to understand the landscape shift, risks and impacts.
Congress Responds with Proposed Fair Access Legislation
Congress has neither prioritized nor had the need to codify standards governing access to the banking system.
A bank’s relationship with customers is primarily one of contract and choice. The supervisory concept of reputational risk is nothing new. It originated in the 1990s as part of the OCC’s introduction of risk-based supervision, and was not publicly reported to be used to influence access to financial services until what later became Operation Choke Point. The concept of “fair access” is not new either, having first appeared as part of the Dodd-Frank Act, when Congress added to the OCC’s oversight responsibilities “fair access to financial services.”
Despite prior efforts — including the OCC’s 2021 proposed fair access rule — the OCC never published a final rule implementing its “fair access” mandate until now.
Now, however, in the wake of Operation Choke Point 2.0, Congress appears to be moving more quickly toward a permanent solution. Legislatively, two bills would codify the principles of fair access: the Financial Integrity and Regulation Management (FIRM) Act, which would eliminate reputation risk, and the Fair Access to Banking Act, which would require impartial, individualized, risk-based analysis in decision-making. Of the two, only the FIRM Act has been reported out of committee in both chambers; the Fair Access to Banking Act remains in committee.
The industry has published its own Federal Fair Access Principles for Congress to consider as part of any legislative solutions, emphasizing the need for banks to maintain autonomy in pricing, products, risk and business decisions to remain competitive.
Agency Rulemakings Remove Reputational Risk and Drive BSA/AML Reform
The OCC and FDIC’s joint final rule wholesale eliminates “reputational risk” from bank supervision. The rule defines reputation risk as any risk to public perception “not clearly and directly related to the financial or operational condition of the institution” and prohibits both agencies from using it as a basis for any adverse supervisory action. This includes MRAs, examination criticism or pressure to close accounts. The Federal Reserve removed reputational risk from its examination programs in June 2025 and issued a parallel proposed rule in February 2026.
The rule goes further than removing a risk category by barring examiners from requiring or encouraging institutions to terminate customer relationships based on political, social, cultural or religious views; constitutionally protected speech; or lawful but politically disfavored business activities. The rule also includes an anti-evasion provision: Examiners cannot reroute reputational risk concerns through compliance, operational or other risk categories as a workaround.
Alongside the rule, the OCC and FDIC are also jointly working to finalize a new definition of “unsafe or unsound practice” that would codify, for the first time, a regulatory definition of “unsafe or unsound practice” under Section 8 of the Federal Deposit Insurance Act, tethered to the core concept of material harm to an institution’s financial condition or material risk of loss to the Deposit Insurance Fund. The era of supervisory actions grounded in public perception concerns has ended.
In addition, on April 7, 2026, the Financial Crimes Enforcement Network (FinCEN) issued a Notice of Proposed Rulemaking to “fundamentally reform” AML/CFT obligations under the Bank Secrecy Act and the Anti-Money Laundering Act of 2020, which is anticipated to be a significant overhaul of program requirements. Aligned with the new “unsafe or unsound” definition, Secretary of the Treasury Scott Bessent stated that the goal is not to measure success “by the volume of paperwork,” but rather by the “ability to stop illicit finance threats.”
A well-designed BSA/AML program should align with the principles of fair access to banking services and require individualized, documented decisions in each instance. The challenge that has arisen is when institutions implemented “de-risking” strategies that resulted in exiting wholesale categories of industries or sectors based on “risks” that were not individual to a particular customer.
A 2023 U.S. Department of the Treasury report confirmed that many de-risking decisions were “indiscriminate” and “overly broad,” driven by category-level judgments that bore little relationship to actual financial crime risk. The OCC issued guidance in September 2025, further reminding institutions that Suspicious Activity Report (SAR) filings must be grounded in concrete evidence of suspicious activity.
Active Enforcement Investigations Underscore Need to Understand Impact
A reported wave of recent subpoenas issued by the DOJ to financial institutions is a reminder that all institutions should understand how the removal of reputational risk impacts both current operating procedures and documented, historical risk-based decisions. At a minimum, banks should:
- Confirm no remnants of reputational risk, categorical or industry-based risk-tiers or escalation requirements exist within policies and procedures (e.g., political, religious, ESG-based criteria) for whether a customer qualifies for bank services;
- Update policies and procedures, if needed, to require individualized decisions with a focus on impartial and financially based metrics and criteria;
- Confirm procedures are in place to comply with the Right to Financial Privacy Act when responding to government requests for information;
- Understand if accounts were closed or services denied historically based on policies and procedures that would not conform with the new rule and updated guidance, and evaluate a scoped review that includes customer complaint data and critically evaluating the impact of SAR filing activity on account terminations;
- Brief executive management and the board on impacts and risks; the OCC has advised that findings related to debanking activity can impact licensing, Community Reinvestment Act evaluations and acquisitions;
- Track ongoing state laws imposing heightened fair access standards that may exceed federal requirements.
So, what is the likely subject of the DOJ’s investigation?
The DOJ subpoenas follow a task force launched by the U.S. Attorney’s Office for the Eastern District of Virginia to combat “illegal debanking,” which the task force defines as the denial of financial services for political views, religious beliefs or lawful activities. “Debanking” determinations may result in enforcement actions if determined by regulators to amount to unlawful discrimination practices in violation of fair lending or civil rights statutes, such as Title VI of the Civil Rights Act of 1964, the Equal Credit Opportunity Act (for credit transactions) and the Fair Housing Act (if related to mortgages).
The DOJ also has broad, civil enforcement authority for a variety of underlying criminal (fraud) activity under Section 951 of the Financial Institutions Reform, Recovery and Enforcement Act of 1989.
The investigations likely build on preliminary findings released by the OCC last year, which stated the OCC’s position on debanking activities undertaken by nine of the nation’s largest banks. The OCC found that between 2020 and 2023, each institution maintained policies that restricted or escalated review of customers in certain sectors (e.g., oil and gas, coal, firearms, private prisons, payday lending, tobacco, political action committees and digital assets).
In most cases, the stated basis was reputational risk or values-alignment criteria rather than documented financial or legal risk. The OCC characterized the decisions as inappropriate distinctions drawn among customers based on lawful business activities. The OCC reported that the same or substantially similar policies were in place at every bank it reviewed and stated that it is working through nearly 100,000 pending consumer complaints to identify further instances of political or religious debanking.
In remarks accompanying the rule, Comptroller of the Currency Jonathan Gould stated the ongoing investigation should “shine a spotlight on the actions of agencies and certain banks.” In March 2026, the enforcement perimeter may have extended to payment processing when the FTC issued public warning letters to the largest payment processors, putting them on notice that facilitating member institutions’ debanking practices may itself violate the FTC Act.
Judicial and State Law Developments
There has not been much occasion for courts to develop precedent on an individual’s “right” to banking services, which exists nowhere in the Constitution or federal statute. The D.C. Circuit Court has previously recognized a due process liberty interest in bank account access in a case brought by payday lender trade associations arising from Operation Choke Point 1.0. And in 2024, in a case brought by the National Rifle Association against the superintendent of the New York Department of Financial Services, the U.S. Supreme Court unanimously held that a government entity’s “threat of invoking legal sanctions and other means of coercion” against a third party, including financial institutions, can violate the First Amendment if used as a means of suppressing disfavored speech.
Following the U.S. Supreme Court’s decision, it is now likely considered “clearly established” that a regulator cannot use oversight tools such as rating downgrades, fines, or enforcement to cause an institution to suppress speech protected by the First Amendment through activities such as denying access to banking.
There are two pending “debanking” cases in the Southern District of Florida brought by entities affiliated with the Trump family against Capital One and JPMorganChase; neither case has proceeded to a merits determination or resulted in a published opinion. The legal claims raised by the plaintiffs in each case pursue a variety of state law theories only: asserting violations of consumer protection statutes in North Carolina, Nebraska, New Jersey and Minnesota against Capital One, while asserting state law claims of trade libel, Florida’s Unfair and Deceptive Trade Practices Act, enforcement of the Deposit Account Agreement and breach of good faith and fair dealing against JPMorganChase.
Whether any of the pleaded theories will hold water, survive motions to dismiss or result in judicial opinions at all (as opposed to arbitrated) remains to be seen.
Meanwhile, the states of Florida, Tennessee and Idaho have each enacted fair-access statutes, and several additional states have proposed or have pending similar laws. For institutions operating nationally, this creates a compliance map that cannot be satisfied by a single federal policy, because state-specific notice and documentation requirements must be addressed on a jurisdiction-by-jurisdiction basis.
Although similar, the three enacted regimes differ in scope and mechanics.
An Era of Fair Access Begins as Debanking Sunsets
The momentum is strong, and the path is clear for Congress to codify how access to the banking system is to be determined. Now that “reputational risk” has been sunset, it remains important for institutions to evaluate how operating procedures and account decisions will hold up in the new era of “fair access.”
