Supervisory correspondence: a bank’s most candid file, held in a system it cannot assess

The week

On April 8, 2025, the Office of the Comptroller of the Currency notified Congress that a compromise of its email system was a major information security incident. The OCC had found unusual activity involving an administrative account in its email environment on February 11 and disclosed the intrusion publicly on February 26. In April, it said intruders had accessed about 100 email accounts of executives and employees. The messages included highly sensitive information on the financial condition of federally regulated banks. Press reports, led by Bloomberg, said access dated to mid-2023 and covered more than 150,000 emails. The OCC said outside experts were reviewing the incident. Within a week, Bloomberg reported that JPMorgan Chase and BNY had limited the information they shared with the OCC electronically.

Banks assess their vendors in detail. They cannot assess their regulators. Supervision requires a bank to hand over its most candid material: examination responses, remediation plans, incident details and descriptions of control gaps not yet closed. The bank does not choose the system that receives it. The OCC breach did not change the duty to share. It did show that this material lives in a concentrated store of sensitive data on many banks, protected by controls the banks cannot see. Bloomberg reported that bank submissions can include cybersecurity assessments and vulnerability reports, which is what makes the exposure strategic. A bank has three levers over it: the content of what it sends, the channel it uses, and its contingency plan for when the holder is breached.

Content: what goes into the correspondence

Examiners need detail, and banks should not withhold it. But much exploitable specificity in supervisory correspondence is incidental. A remediation update can describe a segmentation gap without naming the subnet, the firewall model and the unpatched version. An incident report can explain root cause without listing the service accounts that were abused. The examiner can request more through a secure channel or review it on site.

This is a drafting discipline, and it belongs with the people who write the material. Compliance, internal audit and information security staff who prepare responses to matters requiring attention should apply a simple test. Would this sentence help an attacker more than it helps the examiner? If so, describe the control gap and offer the specifics on request. A short internal standard, reviewed by counsel, keeps the practice consistent and defensible if an examiner asks why detail was summarized.

The trade-off is friction. Examiners may ask follow-up questions that a fuller first response would have avoided. Some will prefer documents to on-site review. Banks should raise the practice with their examination teams early, framed as shared security, so it does not look like evasion.

Retention is part of content discipline too. Supervisory correspondence tends to accumulate in shared mailboxes at both ends. Banks can set their own retention for working copies and ask, through their examination teams, how long the agency keeps routine correspondence. Less material held for less time means less to lose.

Channel: how the material travels

Most regulators offer secure portals for document submission. In practice, a great deal still moves by email: attachments to examiners, replies with spreadsheets, scheduling threads that grow into substantive discussion. Email copies material into many mailboxes, and each mailbox is a separate exposure.

Banks can route substantive material through the regulator’s secure portal by default and keep email for logistics. Where email is unavoidable, they can send encrypted files with keys exchanged separately, or send a pointer to a document held in a bank-controlled data room with access logging. That last option has a useful property. The bank can see who accessed the material and can revoke access if the regulator reports a compromise.

The channel question extends beyond the primary regulator. Banks share supervisory and incident information with the Federal Reserve, the FDIC, state banking departments and FinCEN. Credit unions deal with the NCUA and state supervisors. Each agency runs its own systems. A bank’s channel standard should name the approved method for each.

Some large banks went further after the disclosure and limited electronic sharing with the OCC altogether for a period. That is a defensible short-term response for an institution with the staff to support on-site review. It is not a sustainable model for a community bank, and it shifts work onto examiners. The more durable answer is a channel the bank can monitor and revoke.

Contingency: responding when the holder is breached

Incident response playbooks cover vendor breaches. Few cover a regulator telling a bank that supervisory correspondence may have been read by an intruder. That scenario has unusual features. The bank cannot investigate the regulator’s systems. Under OCC rules, non-public supervisory information is the agency’s property, which limits what a bank may disclose about it without permission. Counsel needs to be involved from the start.

The essential tool is a register of what sensitive material went to which agency, when and by what channel. With a register, a bank can quickly identify which disclosed weaknesses might now be known to an attacker. It can then decide what to accelerate, such as closing a specific control gap, rotating credentials described in a report, or raising monitoring on systems named in correspondence. Without a register, the bank is reconstructing two years of email under time pressure.

The playbook should name an owner, typically the chief information security officer working with the head of regulatory relations, and set criteria for escalation to the board. Boards should understand how this risk shows up. It rarely produces fraud losses. If it materializes, it appears as a better-targeted attack months later, aimed at a weakness the bank had already admitted in writing.

Taken together, the three levers apply ordinary third-party discipline to an extraordinary third party, one the bank cannot assess or replace.

With hindsight

The pause in electronic sharing by some large banks, reported in April 2025, showed that institutions would act on this risk even at the cost of friction with their primary supervisor. House and Senate committees sought more detail from the OCC. The agency said its onsite examiners continued to have access to bank information as needed.

The broader pattern held through 2025. In July, the ToolShell campaign against on-premises SharePoint servers compromised several federal agencies, according to agency statements and press reports. Federal systems that hold sensitive data about private institutions remained attractive targets. We have not found a public account of the OCC review’s detailed findings, so banks should not assume the underlying weaknesses are resolved. The low-cost controls in this article remain worth applying to every agency a bank reports to.