The federal Consumer Financial Protection Board (CFPB) has proposed new regulations and changes to its existing regulations that expand the agency's ability to disclose information to others, potentially compromising the attorney-client privilege. Current federal law provides non-waiver protection of attorney-client privileged communications and materials that are provided to prudential regulators (FDIC, OCC, FRB) as well as the CFPB, and likewise extends the non-waiver protection when those federal agencies share such information with each other.

The CFPB has recently proposed new regulations and changes to its existing regulations that appear on their face to exceed what federal law currently protects in terms of disclosure of attorney-client materials. The proposed changes could:

• Discourage regulated entities from voluntarily submitting requested information due to a possible lack of control over (and knowledge of) to whom the confidential information may be provided. 

• Lead to more conflict between regulators and financial institutions who are frequently asked to provide materials that are protected by the attorney-client privilege.

• Arguably exceed the current statutory authorization that Congress has provided to ensure that privileged materials are protected. If the proposed disclosure rules are not backed by statutory authorities and institutions do share information with regulators and the CFPB, then doing so may put the institution at risk of losing its privilege claims.

Among other things, the proposed changes include:

• Adding a new definition to the term "Agency" which would include any federal, state, or foreign governmental authority or any entity exercising governmental authority. The effect of this change would be to permit the CFPB to share confidential information with foreign regulators and other entities that exercise governmental authority, such as state attorneys general and disciplinary organizations like state bar associations.

• Changing the current rule that includes two distinct standards for disclosure of confidential information and creating a single broad standard providing the CFPB with discretion to disclose both confidential supervisory information and other categories of confidential information to the extent the disclosure of the information is relevant to the exercise of the agency's statutory or regulatory authority. Currently, the CFPB may share confidential supervisory information only with those agencies having jurisdiction over a supervised financial institution, while the CFPB is permitted to share other non-supervisory confidential information with any federal or state agency to the extent that the disclosure of the information is relevant to the exercise of the agency's statutory or regulatory authority.

• Amending the current regulation to relax the CFPB's duty to notify a financial institution before it discloses privileged information to Congress. The current rule provides that the CFPB "shall" notify a financial institution in writing prior to any disclosure, whereas the proposed rule provides that the CFPB "may notify" the financial institution in such circumstances.

While the comment period for the proposed changes is closed, several organizations – including the American Bar Association, American Bankers Association, The Financial Services Roundtable and Consumer Bankers Association – opposed the new rules while a number of state attorneys general supported them.