OCC finds debanking policies at nine largest national banks

The Office of the Comptroller of the Currency's October 14, 2026 report finds that all nine of the largest national banks kept reputation-risk and industry-restriction policies capable of limiting access for political, religious, or lawful-business reasons, but the same document announces no legal violation and no civil money penalty.

News release NR-OCC-2026-90, published on October 14, 2026, sets out the Office of the Comptroller of the Currency's review of debanking at the nine largest national banks. The report relies on 12 U.S.C. § 1(a), which charges the OCC with assuring safety and soundness, compliance with law, fair access to financial services, and fair treatment of customers. It says that, between 2020 and September 2025, every one of those banks kept policies that may have led staff to deny or limit services because of political or religious beliefs or lawful business activities. What follows is what the document shows, how Florida and an FDIC merger proposal differ, and which dates are still open.

Key facts

• October 14, 2026: NR-OCC-2026-90 says all nine banks had policies, from 2020 through September 2025, that may have limited access for political, religious, or lawful-business reasons (OCC).
• Review opened September 5, 2025, under Executive Order 14331, signed August 7, 2025 (OCC report).
• OCC-supervised commercial assets were US$16.7 trillion as of September 30, 2025. The nine banks are a majority (OCC report).
• Nearly 100,000 complaints, January 1, 2020, through December 31, 2025; about 50,000 documents and about 420,000 pages (OCC report).
• OCC–FDIC reputation-risk rule, 91 Fed. Reg. 18279 (April 10, 2026), effective June 9, 2026.
• October 13, 2026: US$750 million OCC civil money penalty against Bank of America, N.A. for Bank Secrecy Act failures, separate from this report. FinCEN is assessing US$1.2 billion that credits the OCC amount (news release 2026-89).
• FDIC merger comments due on or before November 23, 2026. Fair-banking screen only above US$50 billion of resulting assets (September 22, 2026 proposal).

Methodology and sources

The window is August 7, 2025, through October 14, 2026, plus Sidley Austin's note of October 20, 2026. Documents read in full are the report linked from NR-OCC-2026-90, that release, Comptroller Jonathan V. Gould's remarks in NR-OCC-2026-91, the December 10, 2025 preliminary findings in news release 2025-123, and OCC Bulletin 2025-22 of September 8, 2025. Executive Order 14331 is taken from the White House text. The reputation-risk rule is the April 10, 2026 Federal Register text. Florida law is Florida Statutes section 655.0323. The FDIC text is the September 22, 2026 proposal, approved by the board on September 17, 2026. The penalty is news release 2026-89.

Related:Why client allocation messages must be machine-readable

Scope is national banks, Florida's code, and FDIC merger filings. Footnote 18 also cites Tenn. Code § 45-1-128 (2024), Idaho Code § 26-3804 (2025), and Texas Government Code chapters 809 and 2274 (2021); their penalty clauses were not opened and are not restated. The contrarian reading is Sidley Austin's October 20 update. The OCC could not quantify debanking or customer cost.

What the October 14 report actually describes

The Office of the Comptroller of the Currency's October 14, 2026 report, issued with news release NR-OCC-2026-90, is a review of nine national banks, not a consent order, and it assesses no civil money penalty for debanking. The OCC opened the review on September 5, 2025, under Executive Order 14331, signed on August 7, 2025, for the period between 2020 and September 2025. The banks are JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, U.S. Bank, Capital One, PNC Bank, TD Bank, and BMO Bank. Commercial assets at OCC-regulated institutions were US$16.7 trillion as of September 30, 2025, and the nine are a majority of that total. Examiners read nearly 100,000 complaints from January 1, 2020, through December 31, 2025, plus about 50,000 documents and about 420,000 pages. The report finds reputation-risk policies and industry limits at all nine that may have restricted access for political, religious, or lawful-business reasons, and it says the OCC could not quantify the harm.

Each bank kept broad reputation-risk policies, the report says, using protest risk, headlines, and stakeholder reaction. One policy admits it is "difficult to define all situations that should be escalated." Another says there is "no definitive checklist." The industry list is non-exhaustive and covers six sectors: Arctic oil and gas, coal, firearms, detention, tobacco or e-cigarettes, and digital-asset activity, often tied to financial crime.

The examples are not one-sided. In February 2021, WePay, a JPMorgan subsidiary, closed a merchant selling Trump and Make America Great Again goods. An employee wrote that "MAGA and Trump-related items are part of it." In late 2021, PNC declined a line of credit after a note that the owners' views were "very contrary to PNC's beliefs/values." TD dropped a loan under US$50,000 to a rifle-component maker after backing a large firearms firm that later received a multimillion-dollar letter of credit. Closure letters often said only that the bank had "chosen not to service" the business. Banks cited 31 U.S.C. §§ 5318(g)(2), 5321, and 5322.

"Today's report provides irrefutable evidence that the nation's largest banks have denied, debanked and discriminated against customers and lawful businesses. Americans should have access to financial services regardless of their beliefs, affiliations, or political views. Fair access to financial services is not a mantra—it is a mandate."

— Jonathan V. Gould, Comptroller of the Currency, Office of the Comptroller of the Currency (OCC news release NR-OCC-2026-90, October 14, 2026)

How the OCC, Florida, and the FDIC proposal compare

Three rule sets cover this subject, and they do not bind the same firms. National-bank mergers of the nine are usually OCC filings, not FDIC filings.

Sources: OCC report; Bulletin 2025-22; 91 Fed. Reg. 18279; Fla. Stat. § 655.0323; FDIC proposal; news release 2026-89. Last updated: October 21, 2026.

Federal and state fair-access rules do not share one penalty. Executive Order 14331 of August 7, 2025, directs agencies to drop reputation risk where it could produce politicized or unlawful debanking. The OCC and FDIC rule at 91 Federal Register 18279, published on April 10, 2026, and effective on June 9, 2026, bars those agencies from criticising a bank, or pressing an account closure, for reputation risk. Bulletin 2025-22 of September 8, 2025, lets the OCC weigh debanking in licensing under 12 CFR Part 5 and in Community Reinvestment Act exams under 12 USC 2903(a). Florida Statutes section 655.0323 requires an attestation under penalty of perjury each July 1 from July 1, 2023, and gives a customer 30 days to complain about a non-quantitative sector denial. The FDIC proposal of September 22, 2026, comments due on or before November 23, 2026, screens fair banking only above US$50 billion, and only on an FDIC merger. The nine banks in NR-OCC-2026-90 answer to the OCC on their own combinations.

Florida bars any factor that is not "quantitative, impartial, and risk-based," including business sector. The June 9, 2026 rule binds examiners, except where Bulletin 2025-22 reviews a charter, branch, merger, or CRA rating. Earlier Industry Spread coverage of the Community Reinvestment Act treated that law as a credit-needs statute. A December 2023 BMO note quoted by the OCC recalled a Florida attestation of no gun-industry bar. The OCC says later wording changes are not, by themselves, a change in outcomes.

A BSA penalty beside a report that assesses no debanking fine

The same week produced a large penalty, and it was not for debanking. On October 13, 2026, the OCC announced a US$750 million civil money penalty against Bank of America, N.A., one of the nine, for Bank Secrecy Act violations and for 12 CFR 21.21 and 12 CFR 21.11. News release 2026-89 calls it the largest civil money penalty in OCC history. The bank was already under a December 2024 cease-and-desist order to repair its BSA/AML compliance programme. FinCEN is assessing a US$1.2 billion fine that credits the OCC's US$750 million. The release does not mention politics, religion, firearms, coal, or digital assets.

The debanking report warns of the opposite use of the same statute. Footnote 20 says the October 30, 2025 proposal, 90 Fed. Reg. 48825, 48828, found a risk that BSA compliance would pretext a reputation concern. The October 14 report has not found that any of the nine did that. It cites the Anti-Money Laundering Act of 2020, Public Law 116-283, section 6215, and OCC Bulletin 2020-101 of November 19, 2020. On September 2, 2026, five agencies issued OCC Bulletin 2026-43, which the report says lets a bank discuss the facts behind a suspicious-activity report without revealing the report. Industry Spread's 2019 account of risk-focused BSA supervision and a later report on FinCEN and FX wire data show the statute being used to demand more reporting, not less.

There is still no case caption and no dollar penalty for the reputation-risk examples. The tools the report describes are a licensing representation, a CRA rating, a possible rule, and easier private suits. The agency says it will avoid "unreasonable barriers" to sharing supervisory information in those suits, citing OCC Bulletin 2026-37 of August 3, 2026, on 12 CFR Part 4.

What this means for banks, payment firms, and compliance teams

For the nine banks, the policies are now public and tied to sentences the OCC printed. All nine affirmed that belief should not decide access, and all nine revised policies, including 2025 training. Several said reputation risk can no longer be the sole ground for an exit. Some renamed it "franchise" or "brand" risk. The OCC says few could state an objective test, and that no bank has publicly acknowledged past decisions or built a remediation programme.

Payment units are inside the review. WePay's terms, until April 2022, barred "hate, violence, racial intolerance." Screening terms at times included MAGA. From at least May 2021, bank staff joined closures without written standards for a terms breach. Digital-asset firms are one of the six sectors: many of the nine restricted issuers, exchanges, or administrators. A trust charter is a different path. Industry Spread has tracked how many OCC crypto trust charters have opened. FinCEN's withdrawal of the unhosted-wallet proposal is the reporting-side companion.

Clients in coal, Arctic oil, firearms, or detention are not under a new ban. A file written only as "sector policy" is now public, while a large client often kept an exception once "the depth of the relationship and economics" changed. JPMorgan, the report says, denied IPO help where lawful sales rules did not match the bank's magazine and age limits. The OCC has not found closure letters generally unlawful, but it may write guidance. Florida firms attest each July 1 and answer a complaint within 90 calendar days unless the law forbids it. 31 U.S.C. § 5318(g)(2) still bars disclosing a suspicious-activity report. The Industry Spread regulation desk follows these rules into examinations.

"Despite its framing, the Report alleges no clear violations of law, finds none of the systematic political or religious discrimination the review initially set out to identify, and acknowledges that — despite the sheer depth of its review — the OCC could not quantify the extent of even the debanking it alleged."

— Kristin Lee, Partner, Sidley Austin LLP, and David I. Monteiro, Partner, Sidley Austin LLP, in the firm's client update (Sidley Austin, October 20, 2026)

What is still open after the report

The OCC says the review is nearly done and that fair access will stay a priority. It is considering a further rule on political and religious discrimination and on third-party opinions, with no draft and no comment date in the October 14 text. HelpWithMyBank.gov already explains how to report debanking. The report cites BSA proposals at 91 Fed. Reg. 18304 and 91 Fed. Reg. 18704, both April 10, 2026.

Two dates are fixed. Examiner use of reputation risk has been barred since June 9, 2026. FDIC comments must arrive on or before November 23, 2026. The fair-banking screen does not reach a typical OCC merger. It does reach an FDIC filing above US$50 billion, and the preamble says a favourable convenience-and-needs finding is likely only if fair-banking concerns are absent.

Sidley's October 20 update says the Consumer Financial Protection Bureau, hours after the report, said it would investigate the named institutions and others. This article has not opened that Bureau text, so the point stays Sidley's. Sidley also notes a fair-access rule finalised on January 14, 2021, then paused, so it never took effect. Gould says he is not confident the banks' fixes are enough, and he called the old process "institutionalized and opaque bureaucracies." Until a proposal appears, the binding pieces are the June 9, 2026 examiner rule, Bulletin 2025-22, Florida's attestation, and merger-file promises.

TL;DR

The OCC's October 14, 2026 report, news release NR-OCC-2026-90, says all nine largest national banks kept reputation-risk or industry-restriction policies between 2020 and September 2025 that could limit access for politics, religion, or a lawful business. Examiners reviewed nearly 100,000 complaints and about 420,000 pages. Commercial assets in the report's snapshot were US$16.7 trillion as of September 30, 2025. The report names Arctic oil, coal, firearms, detention, tobacco, and digital-asset activity. It announces no violation and no debanking fine. A separate October 13, 2026 action assessed a US$750 million penalty against Bank of America for Bank Secrecy Act failures. FDIC fair-banking comments are due on or before November 23, 2026.

FAQ

What is news release NR-OCC-2026-90?

It is the OCC's October 14, 2026 announcement of the report Guaranteeing Fair Banking for All Americans. The release names nine national banks and says that, between 2020 and September 2025, all nine had policies that may have limited services for political or religious beliefs or lawful business activities. The analysis itself is the PDF linked from the release. It is a supervisory narrative, not a consent order, and it assesses no civil money penalty for that conduct.

Did the OCC fine any bank for debanking?

No. NR-OCC-2026-90 states no legal violation and no civil money penalty for the reputation-risk or industry examples. The tools it describes are licensing, Community Reinvestment Act ratings under Bulletin 2025-22, possible later rules, and private suits. On October 13, 2026, the OCC did assess US$750 million against Bank of America, N.A. under 12 CFR 21.21 and 12 CFR 21.11. FinCEN is assessing US$1.2 billion that credits that sum. The case is about monitoring and late suspicious activity reports, not the debanking examples.

How does Florida differ from the OCC report?

Florida Statutes section 655.0323 is binding. A denial for political opinions, religion, a non-quantitative factor including business sector, or a social-credit score is an unsafe practice. Firms attest under penalty of perjury each July 1, from July 1, 2023. A customer has 30 days to complain, and the firm generally has 90 calendar days to answer. A violation also breaches the Florida Deceptive and Unfair Trade Practices Act. The section states no dollar fine. The OCC did not decide whether the nine banks complied with this law or with the Tennessee and Idaho statutes it cites.

Which deadline is still open?

The reputation-risk rule is in force. It was published on April 10, 2026, and took effect on June 9, 2026. Bulletin 2025-22 has applied to licensing and CRA exams since September 8, 2025. The open comment date here is November 23, 2026, on the FDIC merger proposal, including fair banking above US$50 billion of resulting assets. The OCC is considering another rule on political and religious discrimination, but the October 14 report sets no date. Florida's next attestation is July 1.

Must a bank serve every customer?

No. Comptroller Gould said on October 14, 2026, in NR-OCC-2026-91, that the OCC is not forcing these banks to serve every customer, and that each customer should face an objective, risk-based test. Refusals for illegal activity, sanctions, or money-laundering risk, and for products a line cannot control, remain available on the report's own account. What the OCC challenges is a refusal based only on politics, religion, or a lawful sector, above all where a large client in that sector was kept. Clearer notice, it adds, would likely have saved some accounts.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.