```

[Federal Register Volume 77, Number 129 (Thursday, July 5, 2012)]
[Rules and Regulations]
[Pages 39617-39623]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2012-16247]

========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 
Prices of new books are listed in the first FEDERAL REGISTER issue of each 
week.

========================================================================


Federal Register / Vol. 77, No. 129 / Thursday, July 5, 2012 / Rules 
and Regulations

[[Page 39617]]

BUREAU OF CONSUMER FINANCIAL PROTECTION

12 CFR Part 1070

[Docket No. CFPB-2012-0010]
RIN 3170-AA20

Confidential Treatment of Privileged Information

AGENCY: Bureau of Consumer Financial Protection.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Bureau of Consumer Financial Protection (Bureau) is 
amending its rules relating to the confidential treatment of 
information by adding a new section providing that the submission by 
any person of any information to the Bureau in the course of the 
Bureau's supervisory or regulatory processes will not waive or 
otherwise affect any privilege such person may claim with respect to 
such information under Federal or State law as to any other person or 
entity. In addition, the Bureau has amended its regulations to provide 
that the Bureau's provision of privileged information to another 
Federal or State agency does not waive any applicable privilege, 
whether the privilege belongs to the Bureau or any other person.

DATES: This rule is effective August 6, 2012.

FOR FURTHER INFORMATION CONTACT: John R. Coleman, Senior Litigation 
Counsel, Office of General Counsel, Bureau of Consumer Financial 
Protection, 1700 G Street NW., Washington, DC 20552, at (202) 435-7770.

SUPPLEMENTARY INFORMATION:

I. Background

    Title X of the Dodd-Frank Wall Street Reform and Consumer 
Protection Act (Dodd-Frank Act) established the Bureau as an 
independent agency within the Federal Reserve System responsible for 
regulating the offering and provision of consumer financial products 
and services under the Federal consumer financial laws.\1\ The Bureau's 
mission is to ``implement and, where applicable, enforce Federal 
consumer financial law consistently for the purpose of ensuring that 
all consumers have access to markets for consumer financial products 
and services and that markets for consumer financial products are fair, 
transparent, and competitive.'' \2\ Congress equipped the Bureau with a 
number of tools to achieve this mission, including: broad authority to 
promulgate rules to regulate the consumer financial marketplace; a 
mandate to educate and inform consumers to make better informed 
financial decisions; the ability to bring enforcement actions to remedy 
violations of Federal consumer financial law; and the authority to 
supervise institutions for compliance with Federal consumer financial 
law.
---------------------------------------------------------------------------

    \1\ See Public Law 111-203, section 1011(a) (2010).
    \2\ See Dodd-Frank Act section 1021(a), 12 U.S.C. 5511(a).
---------------------------------------------------------------------------

    This final rule amends the Bureau's rules relating to the 
confidential treatment of information, 12 CFR part 1070, subpart D, in 
order to facilitate the exercise of the Bureau's authorities by 
ensuring that the confidentiality of privileged information is not 
vitiated by any person's disclosure of such information to the Bureau 
in the course of its supervisory or regulatory processes, or by the 
Bureau's exchange of privileged information with another Federal or 
State agency.
    The Bureau is in the process of reviewing comments received on 
other aspects of the interim final rule that governs the Bureau's 
disclosure of records and information. See 76 FR 44242 (July 22, 2011) 
(codified at 12 CFR part 1070). The Bureau intends to issue a final 
rule in response to those comments in the future.

II. Section-by-Section Analysis

A. Addition of 12 CFR 1070.48

Background
    The Bureau has authority to supervise and examine insured 
depository institutions and credit unions with total assets of more 
than $10,000,000,000 as well as their affiliates and service providers, 
in order to assess their compliance with Federal consumer financial 
law, to obtain information about their activities subject to such laws 
and their associated compliance systems or procedures, and to detect 
and assess risks to consumers and to markets for consumer financial 
products and services.\3\ This supervisory authority, and all related 
``powers and duties,'' transferred to the Bureau from the prudential 
regulators on July 21, 2011.\4\ In addition, in accordance with the 
goal of ensuring that Federal consumer law is ``enforced consistently, 
without regard to the status of a person as a depository institution, 
in order to promote fair competition[,]'' \5\ Congress also provided 
the Bureau with nearly identical authority to supervise certain 
nondepository institutions.\6\ The entities subject to the Bureau's 
supervisory authority are referred to herein as ``supervised 
entities.''
---------------------------------------------------------------------------

    \3\ See Dodd-Frank Act section 1025(b)(1), (d), 12 U.S.C. 
5515(b)(1), (d); see also Dodd-Frank Act section 1029A, 12 U.S.C. 
5511 note (stating that this provision becomes effective on the 
designated transfer date, established by the Secretary of the 
Treasury as July 21, 2011).
    \4\ See Dodd-Frank Act section 1061, 12 U.S.C. 5581. The 
prudential regulators are the Office of the Comptroller of the 
Currency (OCC), the Board of Governors of the Federal Reserve System 
(Board), the Federal Deposit Insurance Corporation (FDIC), the 
National Credit Union Administration (NCUA), and the former Office 
of Thrift Supervision (OTS). See Dodd-Frank Act section 1002(24), 12 
U.S.C. 5481(24). Although the prudential regulators retained primary 
authority to supervise smaller depository institutions and credit 
unions for compliance with Federal consumer financial law, the 
Bureau has certain supervisory authorities with respect to these 
institutions, as well as the service providers to a substantial 
number of such institutions. See Dodd-Frank Act sections 
1061(c)(1)(B), 1026(b), (c), (e), 12 U.S.C. 5581(c)(1)(B), 5516(b), 
(c), (e).
    \5\ See Dodd-Frank Act section 1021(b)(4), 12 U.S.C. 5511(b)(4).
    \6\ See Dodd-Frank Act section 1024(b), 12 U.S.C. 5514(b). The 
Bureau also has supervisory authority over service providers to such 
institutions. See Dodd-Frank Act section 1024(e), 12 U.S.C. 5514(e).
---------------------------------------------------------------------------

    The Bureau's supervision program is focused on supervised entities' 
``ability to detect, prevent, and correct practices that present a 
significant risk of violating the law and causing consumer harm.'' \7\ 
Thus, while the Bureau is committed to remedying violations of Federal 
consumer financial law, the primary goal of the Bureau's supervision 
program is to prevent violations of law or consumer harm from 
occurring. To

[[Page 39618]]

this end, supervised entities are expected ``to have an effective 
compliance management system adapted to [their] business strategy and 
operations.'' \8\ Indeed, every ``CFPB examination will include review 
and testing of components of the supervised entity's compliance 
management system.'' \9\
---------------------------------------------------------------------------

    \7\ See Consumer Financial Protection Bureau, Supervision and 
Examination Manual, Overview at 3 (``CFPB Examination Manual''), 
available at www.consumerfinance.gov/guidance/supervision/manual/.
    \8\ CFPB Examination Manual, Compliance Management Review (CMR) 
at 1.
    \9\ Id. The Bureau has adopted the Federal Financial Institution 
Examination Council's (FFIEC) Uniform Consumer Compliance Rating 
System. Institutions are eligible for the highest rating in this 
system only if the Bureau determines that they have ``[a]n effective 
compliance program, including an efficient system of internal 
procedures and controls.'' CFPB Examination Manual, Examinations at 
9.
---------------------------------------------------------------------------

    An independent audit program and regular self-testing for 
violations of Federal consumer financial law are essential elements of 
a strong compliance program.\10\ Supervised entities sometimes rely 
upon counsel to conduct these analyses. As a consequence, in exercising 
its supervisory authority, the Bureau may request from its supervised 
entities information that may be subject to one or more statutory or 
common law privileges, including the attorney-client privilege and 
attorney work product protection.\11\ Certain supervised entities have 
expressed concern, based on cases decided outside of the supervisory 
context,\12\ that compliance with the Bureau's supervisory requests for 
such information may result in a waiver of any applicable privilege 
with respect to third parties.
---------------------------------------------------------------------------

    \10\ CFPB Examination Manual, CMR at 8-12.
    \11\ The final rule applies to ``any privilege'' that applies to 
information obtained by the Bureau.
    \12\ See In re Pacific Pictures Corp., 679 F.3d 1121, 1127 (9th 
Cir. 2012) (collecting cases).
---------------------------------------------------------------------------

    On January 4, 2012, the Bureau issued a bulletin, CFPB Bulletin 12-
01, in which it stated its view that ``because entities must comply 
with the Bureau's supervisory requests for information, the provision 
of privileged information to the Bureau would not be considered 
voluntary and would thus not waive any privilege that attached to such 
information.'' \13\ Further, the Bulletin observed that the prudential 
regulators' authority to examine very large depository institutions and 
credit unions, and their affiliates, for compliance with Federal 
consumer financial law, as well as all related powers and duties, 
transferred to the Bureau on July 21, 2011.\14\ The Bureau interprets 
this transfer of authority as including the ability, codified at 12 
U.S.C. 1785(j) & 1828(x), to obtain privileged information without 
waiving any applicable privilege claimed by the provider of the 
information.
---------------------------------------------------------------------------

    \13\ CFPB Bulletin 12-01, at 2, available at http://files.consumerfinance.gov/f/2012/01/GC_bulletin_12-01.pdf.
    \14\ See Dodd-Frank Act section 1061(b), 12 U.S.C. 5581(b).
---------------------------------------------------------------------------

    On March 15, 2012, in order to provide further reassurances to its 
supervised entities, the Bureau published a notice and request for 
comment regarding its proposal to add a new section to its rules 
relating to the confidential treatment of information that would 
provide that any person's submission of information to the Bureau in 
the course of the Bureau's supervisory or regulatory processes will not 
waive any privilege such person may claim with respect to such 
information as to any other person or entity.\15\ The proposed rule was 
intended to provide protections for the confidentiality of privileged 
information substantively identical to the statutory provisions that 
apply to the submission of privileged information to the prudential 
regulators, and State and foreign bank regulators.\16\ The notice of 
proposed rulemaking reiterated the position set forth in CFPB Bulletin 
12-01 that the submission of privileged information to the Bureau would 
not, under existing law, result in a waiver of any applicable 
privilege, and explained that the Bureau was exercising its rulemaking 
authority to codify this result in order to provide maximum assurances 
of confidentiality to the entities subject to its supervisory or 
regulatory authority. As a result, the proposed rule was intended to 
govern any claim, in Federal or State court, that a person has waived 
any applicable privilege, including the privilege for attorney work 
product, by providing such information to the Bureau in the exercise of 
its supervisory or regulatory processes.\17\
---------------------------------------------------------------------------

    \15\ See 77 FR 15286, 15286 (March 15, 2012) (hereinafter 
``notice of proposed rulemaking'').
    \16\ Id. at 15287.
    \17\ Id. at 15289.
---------------------------------------------------------------------------

Response to Comments
    The Bureau received 26 comment letters regarding the proposed rule. 
These comments were submitted on behalf of twenty trade associations 
(one letter was submitted on behalf of five trade associations), eight 
individual financial institutions, and two individuals. A majority of 
the comments supported adoption of the proposed rule; however, several 
commenters recommended that the Bureau not adopt the proposed rule, but 
wait for Congress to address institutions' concerns regarding privilege 
waiver through the enactment of legislation. Although the Bureau has 
expressed support for legislation codifying the Bureau's view that the 
submission of privileged information to the Bureau does not result in a 
waiver,\18\ the Bureau does not believe such legislation is necessary. 
As discussed below, Congress has delegated to the Bureau the authority 
to issue regulations to ensure the confidentiality of information 
submitted to the Bureau and to facilitate the exercise of its 
supervisory authority. Delegated rulemaking authority is designed to 
relieve Congress of the obligation to anticipate and address every 
issue that arises in an agency's administration of the laws entrusted 
to its care.\19\ Accordingly, while the Bureau continues to support 
appropriate legislation, the possibility of future congressional action 
does not counsel against the Bureau's exercise of its existing 
authority to protect the confidentiality of information it obtains in 
the course of its supervisory or regulatory processes.
---------------------------------------------------------------------------

    \18\ See How Will the CFPB Function Under Richard Cordray?: 
Hearing Before the Subcomm. on TARP, Fin. Serv. & Bailouts of Pub. & 
Private Programs of the H. Comm. on Oversight & Gov't Reform, 112th 
Cong. (2012) (Statement of Richard Cordray).
    \19\ See United States v. Mead, 533 U.S. 218, 229 (2001) 
(``Congress * * * may not have expressly delegated authority or 
responsibility to implement a particular provision or fill a 
particular gap. Yet it can still be apparent from the agency's 
generally conferred authority and other statutory circumstances that 
Congress would expect the agency to be able to speak with the force 
of law when it addresses ambiguity in the statute or fills a space 
in the enacted law, even one about which `Congress did not actually 
have an intent' as to a particular result.'') (quoting Chevron, 
U.S.A., Inc. v. Natural Res. Def. Council, 467 U.S. 837, 845 
(1984)). As noted, the Bureau's exercise of rulemaking authority is 
consistent with Congress's broad grant to the Bureau of all powers 
and duties ``relat[ing]'' to the prudential regulators' transferred 
supervision authority, and by its emphasis on the need for 
consistent regulatory treatment of depository and nondepository 
institutions.
---------------------------------------------------------------------------

    Some commenters disagreed with the Bureau's position, stated in the 
notice of proposed rulemaking, that the Bureau has the authority to 
compel privileged information and that the submission of privileged 
information to the Bureau pursuant to this authority does not waive any 
applicable privilege because it is not voluntary.\20\ Commenters

[[Page 39619]]

argued that, for this reason, the rule will not effectively preserve 
the privileged nature of information submitted to the Bureau. The 
Bureau continues to adhere to the position that it can compel 
privileged information pursuant to its supervisory authority. The 
prudential regulators have consistently taken the view that they can 
compel privileged information pursuant to their supervisory 
authority,\21\ and the case law that directly addresses the issue 
supports the view that the submission of privileged information to a 
supervisory agency is not voluntary and therefore does not result in a 
privilege waiver.\22\ The Bureau's authority in this regard is not, 
however, a prerequisite to its authority to promulgate the rule.
---------------------------------------------------------------------------

    \20\ See 77 FR at 15288 & n. 16 (citing Boston Auction Co. v. W. 
Farm Credit Bank, 925 F. Supp. 1478, 1481-82 (D. Haw. 1996) (no 
waiver where documents provided to examiners from the Farm Credit 
Administration because disclosure not voluntary); Vanguard Sav. & 
Loan Assn v. Banks, No. 93-cv-4267, 1995 WL 555871, at *5 (E.D. Pa. 
Sept. 18, 1995) (holding that the disclosure of work product 
privileged information to state bank regulator is ``involuntary'' 
and, therefore, does not waive the privilege); United States v. 
Buco, Crim. No. 90-10252-H, 1991 WL 82459, at *2 (D. Mass. May 13, 
1991) (holding that ``the public interest served by encouraging the 
free flow of information between the banks and their Federal 
regulators is substantial; a rule which provided that a bank 
generally waived its attorney-client privilege as to materials 
submitted to federal regulators would substantially impair that 
interest.'').
    \21\ See, e.g., OCC Interpretive Letter, 1991 WL 338409 (Dec. 3, 
1991); Statement of Scott Alvarez, General Counsel of the Board of 
Governors of the Federal Reserve System, before the H. Fin. Servs. 
Comm. at 2 (May 17, 2012) (``The Federal Reserve examines, on a 
regular basis, institutions for which we have been granted 
supervisory authority by Congress and, through that authority, has 
complete and unfettered access to an institution's most sensitive 
financial information and processes, including information that 
would otherwise be privileged and not subject to public 
disclosure.'') available at http://financialservices.house.gov/UploadedFiles/HHRG-112-BA00-WState-SAlvarez-20120517.pdf.
    \22\ See supra n. 20. Reliance upon case law outside of the 
supervisory context is misplaced as doing so ignores the ``well 
established distinction between supervision and law enforcement.'' 
Cuomo v. Clearing House Assoc., 557 U.S. 519, 129 S. Ct. 2710, 2717 
(2009).
---------------------------------------------------------------------------

    The validity and effectiveness of the rule depends on the scope of 
the Bureau's rulemaking authority, not on the Bureau's authority to 
compel privileged information.\23\ In the preamble to the proposed 
rule, the Bureau noted that it had issued CFPB Bulletin 12-01, which 
took the position ``that, like the prudential regulators, its 
supervisory authority encompasses the authority to compel supervised 
entities to provide privileged information and, therefore, a supervised 
entity's submission of privileged information to the Bureau in response 
to a request is not a voluntary disclosure that would result in the 
waiver of any applicable privilege.'' \24\ Consistent with this view of 
the law, the Bureau observed that the effect of the proposed rule would 
be to codify the result courts considering claims of waiver would reach 
in the absence of the rule; thus, the rulemaking would give further 
assurance to regulated entities regarding the issue of waiver.\25\ The 
Bureau was clear, however, that the proposed rule would protect the 
privileged nature of information submitted to the Bureau even assuming 
courts would have reached a different determination under existing 
law.\26\ Thus, the Bureau did not indicate in the notice of proposed 
rulemaking that its authority to promulgate the proposed rule depends 
on its authority to compel privileged information, or that the proposed 
rule would codify the Bureau's claimed authority to compel privileged 
information. To the contrary, the Bureau stated that ``the rule does 
not impose obligations on covered persons to provide information; 
rather, any requirement to provide information stems from the Bureau's 
authority under existing law.'' \27\
---------------------------------------------------------------------------

    \23\ Indeed, the Bureau intends the rule to also govern claims 
of waiver related to the voluntary submission of privileged 
information to the Bureau.
    \24\ See 77 FR at 15288.
    \25\ Id. at 15290.
    \26\ Id.
    \27\ Id.
---------------------------------------------------------------------------

    In fact, the rule is authorized by the rulemaking authority 
delegated to the Bureau in the Dodd-Frank Act. In the notice of 
proposed rulemaking, the Bureau cited three sources of rulemaking 
authority that support the rule. First, the Bureau relied on ``its 
authority to `prescribe rules regarding the confidential treatment of 
information obtained from persons in connection with the exercise of 
its authorities under Federal consumer financial laws.' '' \28\ The 
Bureau also relied upon ``its general rulemaking authority to 
`prescribe rules * * * as may be necessary or appropriate to enable the 
Bureau to administer and carry out the purposes and objectives of the 
Federal consumer financial laws, and prevent evasions thereof,'' and 
its authority to ``prescribe rules to facilitate the supervision of 
[nondepository institutions] and assessment and detection of risks to 
consumers.'' \29\ As the Bureau noted, the proposed rule is an 
appropriate means to facilitate the Bureau's supervision program 
because, by providing supervised entities greater assurances that their 
privileges will be maintained, it encourages the free flow of 
information that is essential to an effective supervision program.\30\ 
With respect to large depository institutions and credit unions and 
their affiliates, the rule is also supported by the Bureau's 
interpretation of Dodd-Frank Act section 1061(b) as including within 
its grant to the Bureau of all powers and duties relating to the 
prudential regulators' transferred supervisory authority the power, 
codified at 12 U.S.C. 1785(j) & 1828(x), to receive privileged 
information from supervised entities without effecting a waiver. The 
rule is intended to codify the Bureau's interpretation of section 1061 
in this respect.
---------------------------------------------------------------------------

    \28\ See id. at 15289-90 (quoting Dodd-Frank Act section 
1022(c)(6)(A), 12 U.S.C. 5512(c)(6)(A)).
    \29\ See id. at 15290 (citing Dodd-Frank Act sections 
1022(b)(1), 1024(b)(7)(A), 12 U.S.C. 5512(b)(1) 5514(b)(7)(A)).
    \30\ See, e.g., In re Subpoena Served Upon the Comptroller of 
the Currency, and Sec'y of the Bd. of Governors of the Fed. Reserve 
Sys., 967 F.2d 630, 634 (D.C. Cir. 1992) (``Because bank supervision 
is relatively informal and more or less continuous, so too must be 
the flow of communication between the bank and the regulatory 
agency. Bank management must be open and forthcoming in response to 
the inquiries of bank examiners, and the examiners must in turn be 
frank in expressing their concerns about the bank. These conditions 
simply could not be met as well if communications between the bank 
and its regulators were not privileged.'')
---------------------------------------------------------------------------

    Commenters generally agreed that an effective supervision program 
requires that the Bureau be able to obtain privileged information, and 
that the proposed rule would facilitate such access. As one trade 
association commenter observed, ``the Bureau needs to have a trusting 
and open relationship with its supervised entities, which includes 
having appropriate access to certain privileged information.'' A large 
financial services provider agreed that the proposed rule would ``yield 
numerous benefits, chief among them encouraging the free flow of 
information between supervised persons and their counsel and between 
supervised persons and the CFPB.'' Another trade association agreed 
that ``the preservation of existing legal privileges * * * is vitally 
important to the functioning of an effective regulatory and supervisory 
framework.'' Commenters also generally agreed with the Bureau that the 
same standards should apply to entities supervised by the Bureau as to 
entities currently or formerly supervised by the prudential regulators. 
These comments confirm the Bureau's judgment in the exercise of its 
rulemaking authorities that the rule will ensure the confidentiality of 
information it obtains in the course of its supervisory or regulatory 
processes and is necessary or appropriate to administer or facilitate 
the exercise of its supervisory responsibilities.
    No commenters argued that the rule was not within the plain text of 
the rulemaking authority upon which the Bureau relies, but some 
commenters suggested that Congress's failure to amend 12 U.S.C. 1828(x) 
to include the Bureau when it enacted the Dodd-Frank Act raises the 
negative inference that Congress did not intend the Bureau to 
accomplish the same end through an exercise of its rulemaking 
authority. The text of both the Federal Deposit

[[Page 39620]]

Insurance Act and the Dodd-Frank Act suggest otherwise. First, 12 
U.S.C. 1828(x) itself cautions against construing the protections it 
affords to information submitted to the Federal banking agencies as 
suggesting that ``any person waives any privilege applicable to 
information that is submitted or transferred under any circumstance to 
which [it] does not apply.'' 12 U.S.C. 1828(x)(2)(A). Second, nothing 
in either the Federal Deposit Insurance Act or the Dodd-Frank Act 
suggests that Congress intended depository institutions or credit 
unions with more than $10,000,000,000 in assets, or nondepository 
entities subject to supervision by the Bureau, to be entitled to less 
protection for the confidentiality of their information than smaller 
depository institutions or credit unions supervised for compliance with 
Federal consumer financial law by the prudential regulators or state 
bank regulators. To the contrary, Congress explicitly authorized the 
Bureau to exercise its authority--including the rulemaking authority 
relied upon here--to ensure that ``Federal consumer financial law is 
enforced consistently, without regard to the status of a person as a 
depository institution, in order to promote fair competition.'' \31\ 
Thus, the Bureau does not believe that Congress's silence regarding 
this provision of the Federal Deposit Insurance Act suggests that the 
Bureau lacks the rulemaking authority to promulgate section 1070.48. 
Congress has entrusted the Bureau with administering and implementing 
Title X of the Dodd-Frank Act, the Consumer Financial Protection Act of 
2010,\32\ and the Bureau is adopting section 1070.48 pursuant to the 
rulemaking authorities expressly provided under that law. Accordingly, 
section 1070.48 is a valid exercise of the Bureau's rulemaking 
authority and will govern third parties' claims of waiver based on the 
submission of privileged information by any person to the Bureau.\33\
---------------------------------------------------------------------------

    \31\ See Dodd-Frank Act section 1021(b)(4), 12 U.S.C. 
5511(b)(4). In similar circumstances, the United States Court of 
Appeals for the Third Circuit expressly refused to ``infer an 
intention to prohibit [a] selective waiver rule from Congress's'' 
failure to enact a statutory selective waiver provision sought by 
the Securities and Exchange Commission. See Westinghouse Elec. Corp. 
v. Republic of Philipines, 951 F.2d 1414, 1427 n.15 (1991).
    \32\ See Dodd-Frank Act section 1022(a); 12 U.S.C. 5512(a).
    \33\ See Westinghouse, 951 F.2d at 1427 (suggesting that it 
would not have found a waiver if the SEC's confidentiality rule had 
``justified a reasonable belief on Westinghouse's part that the 
attorney-client privilege w[ill] be preserved.'').
---------------------------------------------------------------------------

    Several commenters asked the Bureau to make clear that the rule 
would apply to the submission of privileged information by insured 
depository institutions or credit unions with $10,000,000 or less in 
assets, as defined in section 1026(a) of the Dodd-Frank Act. As the 
commenters note, although the prudential regulators retain primary 
supervisory authority over these institutions, the Bureau has 
authority, at its discretion, to participate in the prudential 
regulators' examinations of these institutions on a sampling basis.\34\ 
The Bureau may also require reports from smaller depository 
institutions and credit unions as necessary to support its 
implementation of Federal consumer financial law, to support its 
examination of these institutions, and ``to assess and detect risks to 
consumers and consumer financial markets.'' \35\ Although the need for 
the rule has arisen primarily in the context of the Bureau's 
supervision of larger depository institutions and credit unions, the 
term ``person'' used by section 1070.48 is not intended to be limited 
to such institutions, but is intended to be interpreted broadly in 
accordance with the definition of that term in 12 CFR 1070.2. 
Accordingly, to the extent smaller depository institutions or credit 
unions submit privileged information to the Bureau in the course of the 
Bureau's supervisory or regulatory processes, section 1070.48 will 
govern any claim, in Federal or State court, that such submission 
resulted in a waiver of the privilege.
---------------------------------------------------------------------------

    \34\ See Dodd-Frank Act sections 1061(c)(1)(B), 1026(c); 12 
U.S.C. 5581(c)(1)(B), 5516(c).
    \35\ See Dodd-Frank Act section 1026(b); 12 U.S.C. 5516(b).
---------------------------------------------------------------------------

    Commenters also sought clarification as to whether the rule would 
apply to claims that institutions have waived protections afforded to 
attorney work product by submitting such information to the Bureau. The 
Bureau does intend the rule's reference to ``privilege'' to encompass 
``any privilege'' that applies to information submitted by the Bureau, 
including the attorney work product protection. In fact, in discussing 
the need for the rule in the notice of proposed rulemaking, the Bureau 
began by observing that it ``will at times request from its supervised 
entities information that may be subject to one or more statutory or 
common law privileges, including, for example, the attorney-client 
privilege and attorney work product protection.'' \36\ The Bureau 
believes that interpreting the term ``privilege'' as including the 
protection afforded by the work product doctrine is consistent with 
courts' treatment of the term,\37\ and with the purpose of the rule. 
Section 1070.48 is intended to facilitate the free flow of information 
between the Bureau and its supervised institutions by reassuring such 
institutions that the submission of information to the Bureau will not 
affect the institutions' ability to protect it from disclosure to third 
parties. This purpose is served by construing the term privilege, as 
used in the section 1070.48, to include attorney work product. 
Accordingly, the Bureau interprets the term ``privilege'' to include 
the protection afforded by the work product doctrine.
---------------------------------------------------------------------------

    \36\ See 77 FR at 15286.
    \37\ The protection afforded to information subject to the work 
product doctrine is often referred to as a privilege, albeit a 
qualified one. See Edna S. Epstein, The Attorney-Client Privilege 
and Work Product Doctrine, 792 (5th ed. 2007) (``The words 
`doctrine,' `immunity,' and `privilege' (among others) have been 
used in naming the protection given work product. Any of the terms 
is probably appropriate.''); see also United States v. Nobles, 422 
U.S. 225, 237 (1975); Solis v. Food Emp'r Labor Relations Ass'n, 644 
F.3d 221, 231 (4th Cir. 2011); Hernandez v. Tanninen, 604 F.3d 1095, 
1100 (9th Cir. 2010).
---------------------------------------------------------------------------

    Several commenters asked the Bureau to reaffirm its policy, as 
expressed in CFPB Bulletin 12-01, that it will request privileged 
information only in limited circumstances. As noted in CFPB Bulletin 
12-01, the Bureau recognizes the important interests served by the 
common law privileges, in particular the attorney-client privilege. The 
Bureau understands that compliance with Federal consumer financial law 
is served by policies that do not discourage those subject to its 
supervisory or regulatory authority from seeking the advice of counsel. 
Accordingly, the Bureau continues to adhere to its policy to request 
submission of privileged information only when it determines that such 
information is material to its supervisory objectives and that it 
cannot practicably obtain the same information from non-privileged 
sources. The Bureau also continues to adhere to its policy of giving 
``due consideration to supervised institutions' requests to limit the 
form and scope of any supervisory request for privileged information.'' 
\38\ The Bureau believes that its policies regarding requests for 
privileged information are consistent with those of the prudential 
regulators.\39\
---------------------------------------------------------------------------

    \38\ See CFPB Bulletin 12-01 at 3.
    \39\ See, e.g., Office of the Comptroller of the Currency, 
Access to Privileged Information, 2000 WL 226431 (Feb. 2000).
---------------------------------------------------------------------------

    In light of these policies, the Bureau disagrees with the 
contention of several commenters that the final rule will have the 
effect of chilling attorney-client communications within supervised 
entities. To the contrary, the final rule encourages and strengthens 
communications between supervised entities and their attorneys by 
providing additional protections for the

[[Page 39621]]

confidentiality of those communications. As the Bureau made clear in 
the notice of proposed rulemaking, the rule itself does not require the 
submission of privileged information, but instead merely provides 
protections for privileged information that is submitted to the Bureau, 
voluntarily or otherwise. As stated above, to the extent the Bureau 
requests privileged information from supervised entities, it will do so 
only when it determines that such information is material to its 
supervisory objectives and that it cannot practicably obtain the same 
information from non-privileged sources.
    Commenters also expressed concern regarding the Bureau's disclosure 
to other agencies of attorney-client or work product privileged 
information submitted to the Bureau in the course of its supervisory 
process. The Bureau's policy for the treatment of confidential 
supervisory information generally is expressed in CFPB Bulletin 12-01, 
which states, in pertinent part:

    [T]he Bureau will not routinely share confidential supervisory 
information with agencies that are not engaged in supervision. 
Except where required by law, the Bureau's policy is to share 
confidential supervisory information with law enforcement agencies, 
including State Attorneys General, only in very limited 
circumstances and upon review of all the relevant facts and 
considerations. The significance of the law enforcement interest at 
stake will be an important consideration in any such review. 
However, even the furtherance of a significant law enforcement 
interest will not always be sufficient, and the Bureau may still 
decline to share confidential supervisory information based on other 
considerations, including the integrity of the supervisory process 
and the importance of preserving the confidentiality of the 
information.\40\
---------------------------------------------------------------------------

    \40\ CFPB Bulletin 12-01, at 5.

    This policy applies to the Bureau's treatment of all confidential 
supervisory information, including the instances in which the Bureau is 
asked to share with a law enforcement agency confidential supervisory 
information that is also subject to the attorney-client or work product 
privileges. The Bulletin's presumption against sharing confidential 
supervisory information would be even stronger in such instances.
    As stated in CFPB Bulletin 12-01, ``[b]y articulating its policy 
regarding its treatment of confidential supervisory information, the 
Bureau does not intend to limit its use of such information in 
administrative or judicial proceedings, subject to appropriate 
protective orders.'' \41\
---------------------------------------------------------------------------

    \41\ Id.
---------------------------------------------------------------------------

Conclusion
    For the foregoing reasons, the Bureau adopts the proposed rule 
without modification.

B. Amendment of Section 1070.47(c)

    On July 28, 2011, the Bureau issued an interim final rule providing 
that ``[t]he provision by the CFPB of any confidential information 
pursuant to [12 CFR part 1070, subpart D] does not constitute a waiver, 
or otherwise affect, any privilege any agency or person may claim with 
respect to such information under federal law.'' 12 CFR 1070.47(c). In 
the notice of proposed rulemaking, the Bureau proposed readopting this 
rule in modified form to create a non-waiver provision substantively 
similar to that codified in section 11 of the Federal Deposit Insurance 
Act,\42\ with the exception that the rule will also apply to the 
disclosure of privileged information to State agencies in addition to 
Federal agencies. The primary purpose of the proposed rule is to 
protect the privileges of the Bureau in the context of a joint 
investigation or coordinated examination. The rule will, however, also 
foreclose claims that any other person's privilege has been waived by 
the Bureau's disclosure of that person's privileged information to 
another Federal or State agency.
---------------------------------------------------------------------------

    \42\ See 12 U.S.C. 1821(t).
---------------------------------------------------------------------------

    The Bureau received comparatively few comments related to its 
proposed revision of section 1070.47(c). As noted, some commenters 
expressed concern regarding the Bureau's treatment of attorney-client 
and attorney work product privileged information obtained in the course 
of its supervisory or regulatory processes, including whether the 
Bureau intends to provide such privileged information to other Federal 
or State agencies. One commenter suggested that the term ``State 
agency'' in section 1070.47(c) be defined to exclude State attorneys 
general, and suggested that the Bureau should not share with a State 
agency the privileged information of a regulated entity that relates to 
pending or anticipated litigation between the State agency and the 
entity.
    As addressed above in the discussion of section 1070.48, the 
ordinary presumption that the Bureau will not share confidential 
supervisory information is even stronger when the confidential 
supervisory information is also subject to the attorney-client or work 
product privilege. Although section 1070.47(c) will protect any 
person's privileged information from claims of waiver, it is primarily 
intended to protect the Bureau's privileges--including, for example, 
its examination privilege, its deliberative process privilege, and its 
law enforcement privilege--in the context of a coordinated examination 
or joint investigation.\43\ For this reason, the Bureau declines to 
define the term ``State agency'' as excluding State attorneys general. 
If the Bureau were to share privileged information obtained from a 
person in the course of its supervisory or regulatory functions with 
another agency, for example a prudential regulator, the information 
would remain the property of the Bureau.\44\ The agency receiving any 
person's privileged information from the Bureau would be required to 
maintain the confidentiality of the information and would be prohibited 
from further disclosure of such information without the Bureau's 
consent.\45\
---------------------------------------------------------------------------

    \43\ See 77 FR at 15289.
    \44\ See 12 CFR 1070.47(a).
    \45\ Id.
---------------------------------------------------------------------------

    Several commenters raised a specific concern regarding whether the 
corporate entity created by State regulators to administer the National 
Mortgage Licensing System (NMLS) will be considered a ``State agency'' 
for purposes of section 1070.47(c). According to the commenters, State 
regulators often use the NMLS to exchange confidential information of 
related companies. The Secure and Fair Enforcement for Mortgage 
Licensing Act (S.A.F.E. Act) protects the confidentiality of 
information exchanged by State and Federal agencies through the NMLS, 
and expressly provides that information provided to the NMLS ``may be 
shared with all State and Federal regulatory officials with mortgage 
industry oversight authority without the loss of privilege or the loss 
of confidentiality protections provided by Federal or State laws.'' 12 
U.S.C. 5111(a); see also 12 CFR 1008.3 (implementing regulation). One 
commenter expressed concern that a court could find that this provision 
does not extend to the sharing of information relating to nonbank 
lenders. To address this concern, the commenter suggested adding an 
additional rule of construction to section 1070.47(c) to make clear 
that the term ``State agency'' includes any entity employed by a state 
agency to carry out its statutory responsibilities. The Bureau declines 
to adopt this suggestion because, in its view, the confidentiality 
provisions of the S.A.F.E. Act and its implementing regulations provide 
the necessary assurances of confidentiality.

[[Page 39622]]

    Commenters also sought clarification that section 1070.47(c), like 
section 1070.48, would apply to attorney work product, as well as other 
types of privileged information. For the reasons set forth in the 
discussion of section 1070.48, the Bureau affirms that section 
1070.47(c) is intended to apply to attorney work product and other 
privileged information.
Conclusion
    For the foregoing reasons, the Bureau adopts the proposed rule 
without modification.

III. Legal Authority

A. Rulemaking Authority

    The final rule is based on the Bureau's authority to ``prescribe 
rules regarding the confidential treatment of information obtained from 
persons in connection with the exercise of its authorities under 
Federal consumer financial laws.'' \46\ As explained above, section 
1070.48 will ensure that the confidential nature of privileged 
information obtained by the Bureau in the course of any supervisory or 
regulatory process is not waived, destroyed, or modified by compliance 
with the Bureau's requests for information. The revised version of 
section 1070.47(c) ensures that the sharing of information with Federal 
and State agencies mandated or authorized by Title X of the Dodd-Frank 
Act does not affect the confidential and privileged nature of the 
information. This protection is an appropriate use of the Bureau's 
authority to prescribe rules regarding the confidential treatment of 
information. Where any privileged information or material is submitted 
to the Bureau or shared by the Bureau as described in the final rule, 
the final rule prohibits discovery or disclosure of that information or 
material as if, and to the extent that, the privilege had not been 
waived.
---------------------------------------------------------------------------

    \46\ See Dodd-Frank Act section 1022(c)(6)(A); 12 U.S.C. 
5512(c)(6)(A).
---------------------------------------------------------------------------

    In addition, the Bureau relies on its general rulemaking authority 
to ``prescribe rules * * * as may be necessary or appropriate to enable 
the Bureau to administer and carry out the purposes and objectives of 
the Federal consumer financial laws, and to prevent evasions thereof.'' 
\47\ The supervision and other authorities provided by Title X of the 
Dodd-Frank Act are components of ``Federal consumer financial law.'' As 
explained above, the final rule is a necessary and appropriate measure 
to ensure that the Bureau is able to implement these authorities, and 
to do so consistently ``without regard to the status of a person as a 
depository institution, in order to promote fair competition.'' \48\ As 
explained above, the final rule will promote candid dialogue between 
supervised entities and the Bureau, again furthering the purposes and 
objectives of Federal consumer financial law. In addition, by providing 
greater certainty to supervised entities, the final rule will also 
prevent evasions of the Bureau's supervisory and other authorities 
because supervised entities might improperly attempt to rely upon the 
risk of waiving privilege in order to evade or hamper the Bureau's 
supervision. The final rule is also meant to codify the Bureau's 
interpretation of section 1061(b) of the Dodd-Frank Act as granting the 
Bureau the prudential regulators' authority, codified at 12 U.S.C. 
1785(j) and 1828(x), to obtain privileged information from very large 
depository institutions and credit unions and their affiliates without 
effecting a waiver.
---------------------------------------------------------------------------

    \47\ See Dodd-Frank Act section 1022(b)(1), 12 U.S.C. 
5512(b)(1); see also Dodd-Frank Act sections 1012(a)(10), 12 U.S.C. 
5492(a)(10) (authorizing the Bureau to establish policies with 
respect to ``implementing the Federal consumer financial laws 
through rules, orders, guidance, interpretations, statements of 
policy, examinations, and enforcement actions * * * '').
    \48\ See Dodd-Frank Act section 1021(b)(4), 12 U.S.C. 
5511(b)(4); see also Dodd-Frank Act section 1021(a), 12 U.S.C. 
5511(a).
---------------------------------------------------------------------------

    Finally, the Bureau also relies on its authority to ``prescribe 
rules to facilitate the supervision of [nondepository institutions] and 
assessment and detection of risks to consumers.'' \49\ For the reasons 
discussed above, the final rule will facilitate the Bureau's 
supervision of nondepository institutions and thereby enhance the 
Bureau's ability to assess and detect risks to consumers.
---------------------------------------------------------------------------

    \49\ See Dodd-Frank Act section 1024(b)(7)(A), 12 U.S.C. 
5514(b)(7)(A). This rulemaking does not concern supervisory 
requirements or coordinated registration systems for nondepository 
institutions. Accordingly, the Bureau has determined that 
consultation with state agencies is not appropriate. See Dodd-Frank 
Act section 1024(b)(7)(D), 12 U.S.C. 5514(b)(7)(D).
---------------------------------------------------------------------------

B. Section 1022(b)(2) of the Dodd-Frank Act

    In developing the final rule, the Bureau considered potential 
benefits, costs, and impacts, and has consulted or offered to consult 
with the prudential regulators and the Federal Trade Commission, 
including regarding consistency with any prudential, market, or 
systemic objectives administered by such agencies.\50\ The Bureau did 
not receive comments regarding the notice of proposed rulemaking's 
analysis of the proposed rule's potential benefits, costs, and impacts.
---------------------------------------------------------------------------

    \50\ Specifically, section 1022(b)(2)(A) calls for the Bureau to 
consider the potential benefits and costs of a regulation to 
consumers and covered persons, including the potential reduction of 
access by consumers to consumer financial products or services; the 
impact on depository institutions and credit unions with $10 billion 
or less in total assets as described in section 1026 of the Act; and 
the impact on consumers in rural areas. The manner and extent to 
which the provisions of section 1022(b)(2) apply to a rule of this 
kind that does not establish standards of conduct is unclear. 
Nevertheless, to inform this rulemaking more fully, the Bureau 
performed the described analyses and consultations.
---------------------------------------------------------------------------

    Section 1070.48 of the final rule provides that the submission by 
any person of information to the Bureau in the course of the Bureau's 
supervisory or regulatory processes does not waive or otherwise affect 
any privilege such person may claim with respect to such information 
under Federal or State law as to any other person or entity. Section 
1070.47(c) of the final rule provides that the Bureau's provision of 
privileged information to another Federal or State agency does not 
waive any applicable privilege.
    As explained above, the Bureau anticipates that section 1070.48 
will most often apply in the context of a supervised entity's 
involuntary submission of privileged information to the Bureau.\51\ In 
these circumstances, the final rule will not result in a determination 
regarding the privileged nature of information different than that 
which would have been reached in the absence of the rule, and would not 
be expected to impose costs on consumers or to impact consumers' access 
to consumer financial products or services. In circumstances in which 
section 1070.48 results in a determination regarding the privileged 
nature of information different than that which would be reached under 
existing law, the final rule will benefit covered persons by preserving 
any applicable privilege a covered person may claim in response to a 
third party's claim of waiver. Furthermore, in that scenario, the final 
rule could impose a potential cost on consumers or covered persons 
involved in subsequent third-party litigation regarding a supervised 
entity to the extent the rule, as opposed to existing law, prevents 
them from discovering or using privileged information subject to the 
rule pursuant to a theory of waiver. The final rule could also benefit 
consumers, however, by facilitating the Bureau's ability to supervise 
covered persons and service

[[Page 39623]]

providers and thereby detect and prevent risks to consumers.
---------------------------------------------------------------------------

    \51\ Notably, section 1070.48 does not require the submission of 
information; rather, any requirement to provide information stems 
from the Bureau's authority under existing law.
---------------------------------------------------------------------------

    The Bureau also believes that courts applying the principles of the 
common law would be unlikely to find a waiver of any applicable 
privilege in most circumstances in which it will share privileged 
information with another Federal or State agency. For example, the 
Bureau believes it unlikely that a court would find a waiver if it were 
to share its privileged deliberative work product with Federal or State 
agencies in the context of a coordinated examination or joint 
investigation. In circumstances in which the rule does result in a 
determination regarding waiver different than that which would be 
reached under existing law, section 1070.47(c)'s only effect would be 
to preserve the confidentiality of privileged information and, 
therefore, would not impose material costs on consumers or covered 
persons for the same reasons as set forth above in relation to section 
1070.48. Accordingly, section 1070.47(c) is not expected to impose 
material costs on consumers or covered persons or to impact consumers' 
access to consumer financial products or services.
    Finally, although the final rule would apply to privileged 
information submitted by depository institutions or credit unions with 
$10,000,000,000 or less in assets as described in section 1026 of the 
Dodd-Frank Act, it has no unique impact upon such institutions. Nor 
does the final rule have a unique impact on rural consumers.

IV. Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA), as amended by the Small 
Business Regulatory Enforcement Fairness Act of 1996, requires each 
agency to consider the potential impact of its regulations on small 
entities, including small businesses, small governmental units, and 
small not-for-profit organizations.
    The RFA generally requires an agency to conduct an initial 
regulatory flexibility analysis (IRFA) and a final regulatory 
flexibility analysis (FRFA) of any rule subject to notice-and-comment 
rulemaking requirements, unless the agency certifies that the rule will 
not have a significant economic impact on a substantial number of small 
entities. The Bureau did not perform an IFRA because it determined and 
certified that the proposed rule, if adopted, would not have a 
significant economic impact on a substantial number of small entities. 
The Bureau did not receive any comments regarding its certification, 
and is adopting the proposed rule without change.
    A FRFA is not required for the proposed rule because it will not 
have a significant economic impact on a substantial number of small 
entities. The proposed rule does not impose obligations or standards of 
conduct on any entities. In any event, as noted, the submission by any 
person of any information to the Bureau in the course of the Bureau's 
supervisory or regulatory processes or the Bureau's later disclosure of 
such submitted material generally does not waive or otherwise affect 
any privilege such person may claim with respect to such information 
under Federal or State law as to any other person or entity. The final 
rule is intended to codify this result in order to give further 
assurance to entities subject to the Bureau's authority. Any 
requirement to provide information stems from the Bureau's authority 
under existing law, not the final rule. To the extent that the final 
rule alters existing law, it protects any applicable privilege under 
Federal or State law that a covered person that provides information to 
the Bureau may claim.
    Accordingly, the undersigned hereby certifies that the final rule 
will not have a significant economic impact on a substantial number of 
small entities.

List of Subjects in 12 CFR Part 1070

    Confidential business information, Consumer protection, Privacy.

Authority and Issuance

    For the reasons set forth in the preamble, the Bureau amends 12 CFR 
part 1070, subpart D, as set forth below:

PART 1070--DISCLOSURES OF RECORDS AND INFORMATION

0
1. The authority citation for part 1070 continues to read as follows:

    Authority: 12 U.S.C. 3401; 12 U.S.C. 5481 et seq.; 5 U.S.C. 552; 
5 U.S.C. 552a; 18 U.S.C. 1905; 18 U.S.C. 641; 44 U.S.C. ch. 30; 5 
U.S.C. 301.

Subpart D--Confidential Information

0
2. Amend Sec.  1070.47 by revising paragraph (c) to read as follows:

Sec.  1070.47  Other Rules Regarding Disclosure of Confidential 
Information.

* * * * *
    (c) Non-waiver. (1) In general. The CFPB shall not be deemed to 
have waived any privilege applicable to any information by transferring 
that information to, or permitting that information to be used by, any 
Federal or State agency.
    (2) Rule of construction. Paragraph (c)(1) of this section shall 
not be construed as implying that any person waives any privilege 
applicable to any information because paragraph (c)(1) does not apply 
to the transfer or use of that information.

0
3. Add Sec.  1070.48 to read as follows:

Sec.  1070.48  Privileges not affected by disclosure to the CFPB.

    (a) In general. The submission by any person of any information to 
the CFPB for any purpose in the course of any supervisory or regulatory 
process of the CFPB shall not be construed as waiving, destroying, or 
otherwise affecting any privilege such person may claim with respect to 
such information under Federal or State law as to any person or entity 
other than the CFPB.
    (b) Rule of construction. Paragraph (a) of this section shall not 
be construed as implying or establishing that--
    (1) Any person waives any privilege applicable to information that 
is submitted or transferred under circumstances to which paragraph (a) 
of this section does not apply; or
    (2) Any person would waive any privilege applicable to any 
information by submitting the information to the CFPB but for this 
section.

    Dated: June 26, 2012.
Richard Cordray,
Director, Bureau of Consumer Financial Protection.
[FR Doc. 2012-16247 Filed 7-3-12; 8:45 am]
BILLING CODE 4810-AM-P
```