Institute of International Bankers and trade groups issue paper recommending firm controlled access for sensitive supervisory information

The Institute of International Bankers and eight other financial trade associations published a joint paper setting out risk-based practices for sharing sensitive information with bank examiners. The paper argues that, as supervision has become more digital, firms should reduce unnecessary transmission and retention of highly sensitive material such as cybersecurity defense roadmaps, CEO succession plans and M&A proposals, and instead give supervisors access in ways that keep the institution in control of the data. The recommendations complement recent guidance from the Office of the Comptroller of the Currency, the Federal Reserve and the Federal Deposit Insurance Corporation, which updated supervisory data-handling procedures after cyber incidents at the Office of the Comptroller of the Currency in 2025 and the Treasury Department in 2024. Those interagency procedures encourage more consistent secure transfer methods, greater reliance on firm-controlled access either electronically or through on-site review, and additional controls for especially sensitive information. The trade groups' paper adds practical measures including use of firm-hosted applications, screen-sharing or on-site review, limiting examiner access to those with a demonstrable need to know, providing summaries or aggregated information instead of full detailed records, using samples or excerpts rather than complete data sets, and redacting details such as personally identifiable information, compensation and performance data, board evaluations, internal IP addresses and privileged material.