OCC to Banks: Don’t Let Technology Come Between Us

The Office of the Comptroller of the Currency (OCC) has been a little down on technology as of late.

In mid-March, Comptroller of the Currency Thomas Curry declared in a public speech that so-called emerging “fintechs,” or financial technology companies, would not take the place of banks. On March 31, Curry spoke again of emerging fintechs and stressed the difference between “responsible” innovation and just plain innovation.

On Wednesday, the OCC issued a bulletin to remind national banks and federal savings associations of their obligations when it comes to maintaining and retaining records—and allowing examiners access to those records, which includes not letting technology get in the way.

“The OCC has become aware of communications technology recently made available to banks that could prevent or impede OCC access to bank records through certain data deletion or encryption features,” the bulletin said. “Use of communications technology in this manner is inconsistent with the OCC’s expectations regarding data retention and availability.”

The OCC said that in order to meet its supervisory responsibilities, its examiners must be able to communicate freely with bank personnel and have timely access to banks’ records. The purpose of the bulletin was to remind banks that the OCC should have full and unimpeded access to a bank’s books and records pursuant to the OCC’s authority, and that access should not be limited by communications technology.

“Certain available communications technology contains data deletion and encryption features that can be used to prevent or impede OCC access to a bank’s books and records,” the bulletin said. “For example, the OCC is aware that some chat and messaging platforms have touted an ability to ‘guarantee’ the deletion of transmitted messages. The permanent deletion of internal communications, especially if occurring within a relatively short time frame, conflicts with OCC expectations of sound governance, compliance, and risk management practices as well as safety and soundness principles.”

Any technology used by bank management must allow the OCC’s examiners access to appropriate bank records, the OCC said.