Hey all, Jason here.
You’re getting this slightly later than normal, due to travel and some last minute copy edits (please forgive any typos!). My time in Mexico City was, as always, delightful. I’m already here in Las Vegas for Money2020 — if you’re attending, I hope to see you around the Venetian!
Subscribe or Support by Upgrading
Build products that move money with Modern Treasury
Partner content: Day one: A software platform launches payments for its first customers. Each customer gets their own named U.S. account. Money comes in over ACH or wire, and goes out over ACH, wire, or check.
Year two: Ten thousand customers, now with instant payouts over RTP, FedNow, and push-to-card.
Same setup: one account per customer, one ledger tracking every dollar.
The team stayed focused on their roadmap. Their payments stack scaled with them.
Modern Treasury is the payments platform for accounts and money movement, across fiat and stablecoins, through one API.
Trusted by Procore, Navan, and companies of all sizes. Powering $600B+ in payments.
Debanking, Reputation Risk, AML, Oh My!
The Office of the Comptroller of the Currency released its “debanking” report last week.
President Trump’s Executive Order 14331, “Guaranteeing Fair Banking for All Americans,” directed federal banking regulators, including the OCC — ostensibly an independent bureau of the Department of the Treasury — to undertake a review of financial institutions under its jurisdiction that “have had any past or current, formal or informal, policies or practices that require, encourage, or otherwise influence such financial institution to engage in politicized or unlawful debanking and to take appropriate remedial action.”
E.O. 14331 defines “politicized or unlawful debanking” as “an act by a bank, savings association, credit union, or other financial services provider to directly or indirectly adversely restrict access to, or adversely modify the conditions of, accounts, loans, or other banking products or financial services of any customer or potential customer on the basis of the customer’s or potential customer’s political or religious beliefs, or on the basis of the customer’s or potential customer’s lawful business activities that the financial service provider disagrees with or disfavors for political reasons.”
The concept of “politicized or unlawful debanking” is, itself, legally problematic; as Adam Levitin notes in his analysis of the debanking report, “Viewpoint discrimination is entirely legal. No law prohibits banks from engaging in viewpoint discrimination, and there would be 1st Amendment questions about any law that purported to do so.”
The OCC’s supervisory review and subsequent report looked at the alleged debanking activities of the nine largest OCC-chartered banks: JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, U.S. Bank, Capital One, PNC Bank, TD Bank, and BMO Bank.
The report can only reasonably be read as a political and an explicitly partisan document; the first sentence of the report reads, “Under President Trump’s leadership, the United States government is committed to restoring fair access to financial services, which is a fundamental principle of the U.S. banking system.”
It’s worth pausing for a moment to reflect on the title of the E.O. and the report — Guaranteeing Fair Banking for All Americans.
Use of the word “Americans” is no accident, despite the lack of any law or regulation prohibiting financial institutions from providing products and services to non-citizens, whether lawful permanent residents (“green card” holders), temporary visa holders, or undocumented persons.
According to a September 2026 report from the Congressional Research Service, there are approximately 16 million noncitizens — meaning, not “American” — with legal status to reside in the United States. That figure excludes those awarded Temporary Protected Status (TPS), Deferred Action for Childhood Arrival recipients (DACA), and those on parole or with pending asylum applications, who are generally categorized as “unauthorized” and amount to an additional approximately five million people.
Implicitly, these 21 million or so people, equivalent to about 6% of people living in the U.S., are undeserving of “fair” access to banking.
In fact, financial regulators under the current administration have explicitly worked to discourage financial institutions from serving undocumented immigrants, despite the lack of any legal or regulatory basis prohibiting them from doing so.
E.O. 14406, “Restoring Integrity to America’s Financial System,” described opening depository or credit accounts with an Individual Tax Identification Numbers (ITINs), which enable undocumented immigrants to pay legally required taxes — a practice the IRS has actually long encouraged — as “a risk factor requiring enhanced due diligence.”
FinCEN, with the FDIC, OCC, and NCUA, subsequently issued joint guidance encouraging financial institutions to conduct enhanced due diligence on customers using an ITIN to open an account.
The Consumer Financial Protection Bureau issued a policy statement emphasizing to lenders that, under the Truth In Lending Act, they may be obligated to consider an applicant’s immigration status, “especially where removal from the United States may disrupt the consumer’s income.”
The OCC, FDIC, and NCUA issued joint guidance warning lenders that “[l]ending to individuals who are not legally authorized to work in the United States may present elevated credit risk because a borrower’s ability to generate income, maintain employment, and remain financially stable may be subject to greater uncertainty.”
And this August, in remarks to a group of Arizona bankers, Treasury Secretary Scott Bessent said, “This administration will not tolerate blatant abuse of our financial system, nor will it permit risks posed by the extension of financial services to illegal aliens.”
The Trump administration has also floated but ultimately stopped short of requiring banks to collect citizenship information on account holders — a proposal that has been strongly opposed by bank trade groups, including the Independent Community Bankers of America.
ICBA President and CEO Rebeca Romero Rainey warned about a citizenship information collection requirement, saying (emphasis added), “As ICBA has repeatedly said in meetings with Treasury Department officials and federal banking regulators ahead of the release of today’s EO, policymakers must avoid information collection requirements that impose substantial burdens on community banks, undermine their ability to meet the needs of local communities, and drive American citizens out of the regulated banking system.”
The Rise And Fall Of Reputation Risk
Comptroller Gould commented on the release of the debanking report, saying in part, “Today’s report provides irrefutable evidence that the nation’s largest banks have denied, debanked and discriminated against customers and lawful businesses. Americans should have access to financial services regardless of their beliefs, affiliations, or political views. Fair access to financial services is not a mantra—it is a mandate.”
The report ties debanking in part to “reputation risk” policies at banks, which, the OCC says, “lacked clear standards and objective, risk-based criteria” and “disadvantaged certain Americans based on their political, religious, or social views or based on their lawful business activities.”
The topic of reputation risk has become, not unjustifiably, something of a lightning rod in recent years.
Banking, specifically, the business of taking and holding customer deposits, is uniquely dependent on trust. When depositor trust evaporates, banks can face a run — a type of problem that has persistently occurred across the history of banking, despite legal and regulatory reforms to discourage exactly that scenario. Prudential supervision, access to emergency liquidity (eg the Fed discount window), and deposit insurance are all mechanisms designed to support the stability of individual banks and the banking system, engendering trust and reducing the likelihood of a bank facing a run.
The concept of reputational risk in banking arguably dates at least to the 1971 Supreme Court case Investment Company Institute v. Camp, in which the court had to determine if a bank-run investment collective violated the Glass-Steagall Act’s prohibitions on national banks underwriting securities.
The Court’s opinion evaluated Glass-Steagall’s legislative history, including 1931 Senate subcommittee hearings, the 1933 Senate report, and floor statements by Senators Glass and Bulkley.
Those materials illustrated the obvious risks in banks investing in speculative securities, the Court found, but also highlighted “more subtle hazards that arise when a commercial bank goes beyond the business of acting as fiduciary or managing agent” by entering the investment banking business or establishing an affiliate to do so.
The opinion discusses how the public’s perception of a bank’s affiliate could transmit risk to the bank itself (emphasis added):
“For example, pressures are created because the bank and the affiliate are closely associated in the public mind, and should the affiliate fare badly, public confidence in the bank might be impaired. And since public confidence is essential to the solvency of a bank, there might exist a natural temptation to shore up the affiliate through unsound loans or other aid.”
The OCC brought the concept more directly into bank supervision in the early 1990s, in response to the booming use of financial derivatives.
A Q&A on BC-277, “Risk Management of Financial Derivatives,” defined seven categories of risk banks face from financial derivative instruments: credit risk, market risk, liquidity risk, operational risk, systemic risk, legal risk, and reputation risk.
That 1994 Q&A defines reputation risk as “[t]he risk that a bank might lose a client, or its ability to compete effectively for new clients, due to perceptions that the bank does not deal fairly with clients or that it does not know how to properly manage its derivatives business.”
In 1995, when then-Comptroller Gene Ludwig announced the OCC’s “Supervision by Risk” program, he outlined nine risks, including reputation risk. In definitions appended to his remarks announcing the program, the OCC explained reputation risk by saying:
“Reputation risk is the risk to earnings or capital arising from negative public opinion. This affects the institution’s ability to establish new relationships or services, or continue servicing existing relationships. This risk can expose the institution to litigation, financial loss, or damage to its reputation. Reputation risk exposure is present throughout the organization and includes the responsibility to exercise an abundance of caution in dealing with its customers and community. This risk is present in such activities as asset management and agency transactions.
The assessment of reputation risk recognizes the potential impact of the public’s opinion on a bank’s franchise value. This risk is inherent in all bank activities. Banks which actively associate their name with products and services, such as with fiduciary services, are more likely to have higher reputation risk exposure. As the bank’s vulnerability to public reaction increases, its ability to offer competitive products and services may be affected.”
However, when introduced in the mid-1990s, the concept of “supervision by risk,” including reputation risk, was initially intended to create a common vocabulary for examiners to use in discussing and evaluating common categories of risks banks face — there was no requirement at the time for banks to adopt the structure themselves.
The Federal Reserve issued SR 95-51 in 1995, which instructed its examiners to use a formal risk management rating system, and it included reputation risk as one of its six risk categories, alongside credit, market, liquidity, operational, and legal risk.
The Fed’s definition of reputation risk in SR 95-51 was in a sense even more expansive than the OCC’s, as it warned of (emphasis added) “the potential that negative publicity regarding an institution’s business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions”
In remarks Acting Comptroller Julie Williams gave in 1998, she provided broader context and rationale for the use of reputation risk in bank supervision (emphasis added):
“Reputation risk requires bankers to exercise an abundance of caution in dealing with customers and the community.
‘Caution,’ in this context, does not mean timidity. Rather, it means that bankers need to weigh their business decisions — decisions that might be perfectly above-board from a legal or regulatory standpoint — against the reaction those decisions might elicit from the customers and communities they are chartered to serve. Customer perception is the relevant reality. Actions perceived by a customer to be unreasonable or unfriendly may trigger a backlash whose costs can easily exceed the narrow value of that customer's business. In short, when we talk about reputation risk, we are referring to how well bankers fare — individually and as an industry — at the court of public opinion.”
The scope and frequency of references to reputation risk increased significantly from the mid-1990s, showing up in OCC bulletins on stored value cards, data networks, securitization, and credit derivatives; JPMorgan Chase’s 2003 enforcement action stemming from the collapse of Enron; and a 2007 interagency statement of heightened legal and reputation risks of complex structured finance instruments.
Guidance from the FDIC in 2008 stretched the concept even further, by indicating that negative publicity about a bank’s third parties could create reputation risk, even if unrelated to the bank’s use of that third party.
While perhaps primarily a topic of concern to banks and their regulators, questions around who should and should not be permitted access to certain financial services — particularly when those services are used to facilitate scams and fraud — became a hotly contested topic following an Obama-era initiative known as Operation Choke Point.
Operation Choke Point has taken on near-mythical proportions. As Fintech Business Weekly explained in 2024:
Operation Choke Point was a real interagency task force, led by the Department of Justice, born in the aftermath of the 2008 Global Financial Crisis.
The task force was charged with focusing on consumer fraud in digital commerce, with the “choke point” name coming from the strategy of focusing on third-party payment processors that facilitated fraudulent transactions.
Among other criteria, the initiative looked for tell-tale signs of consumer fraud, like abnormally high ACH return or card dispute rates — more common for higher-risk merchants and billers, including payday lenders, online pharmacies, and adult services, for example…
It was hoped that the efforts by DOJ combined with “moral suasion” from bank regulators would, according to South Texas College of Law Houston professor Dru Stevenson, encourage banks to more carefully vet their customers’ customers, thereby reducing the risk of consumer frauds and scams.
Though the focus was on choking off illegal fraud schemes, the effort did result in a number of legal businesses, Stevenson says, that lost access to payment processing.
When many banks — which, it’s worth noting, are distinct from third-party payment processors — opted not to work with crypto-related firms or moved to offboard crypto clients in the wake of the failure of FTX and subsequent voluntary liquidation of Silvergate and failure of Signature Bank, crypto advocates, including venture capitalist Marc Andreessen, dubbed the situation “Operation Choke Point 2.0” and complained of being “debanked.”
The term “debanking” has since lost any coherent meaning, with varying political factions and advocacy groups using the term to describe business practices or outcomes they don’t like.
Trump himself has complained that he and his businesses were “debanked” in the wake of January 6th.
Trump has claimed JPMorgan Chase, Bank of America, and others “discriminated” against him “very badly,” and that the banks discriminated against “conservatives” and specifically “Trump supporters” broadly.
Trump has even sued two banks, JPMorgan Chase and Capital One, alleging they wrongfully terminated accounts.
Capital One, however, has argued in redacted court filings it terminated Trump-related accounts as the result of a long-running money laundering investigation, not as a result of January 6th or any viewpoint bias or discrimination.
Since Trump took office for the second time, federal banking regulators announced in 2025 that they would stop examining for reputation risk. Subsequently, the OCC, the FDIC, the NCUA, and the Federal Reserve have proposed various rules to prohibit the use of reputation risk in taking action against financial institutions and acted to remove all mention of reputation risk from supervisory documents.
OCC Report Provides No Data Backing Up Debanking Claims
While Comptroller Gould asserts the OCC’s report “provides irrefutable evidence” of debanking, it offers no data — only anecdotes.
According to the report, “the OCC reviewed nearly 100,000 complaints, hundreds of individual bank decisions, and about 420,000 pages of bank documents.”
The report says that “the OCC found that broad reputation risk policies—which lacked clear standards and objective, risk-based criteria— disadvantaged certain Americans based on their political, religious or social views or based on their lawful business activities. The results of the Debanking Review also reaffirmed the OCC’s ongoing concern with the use of reputation risk in bank decision making.”
But, at no point does the report quantify how many consumers, businesses, non-profits, or other organizations were debanked.
Former Treasury Department Assistant Secretary for Financial Institutions Graham Steele noted that, due to the lack of quantitative data, “the report ends up being highly anecdotal and therefore of limited reliability.” Steele added that “many of the examples do not reveal much that we didn’t already know.”
Even among the anecdotes the report does provide, there isn’t a single example of a consumer being debanked due to political or religious beliefs. The cases provided speak only to businesses, non-profits, and political groups — not individual consumers.
Examples of allegedly debanked entities the OCC provides do cross the political spectrum and include merchants selling “MAGA” gear, a public education organization that endorsed Democratic candidates, and firearms businesses, among others.
And, while crypto advocates complaints of a so-called “Operation Choke Point 2.0” targeting the digital asset industry were arguably the spark that touched off the recent furor over debanking, the report only makes passing reference to digital assets. None of the examples provided in the report relate to crypto firms or individuals being debanked for ties to the crypto industry or crypto-related transactions.
The report addressed two broad policy categories: the aforementioned issue of reputation risk and industry-specific practices, in which financial services entities may implement policies and procedures that restrict certain legal industries’ access to financial services (eg pornography, cryptocurrency, firearms, payday lending, etc.)
The report argues that “[d]espite attempts to impose internal rigor, the continued use of reputation risk not only distracts institutions from devoting resources to managing core financial risks but also provides a structure for them to refuse clients based on even the slightest public perception risk or potential stakeholder biases in contravention of the foundational principle of fair access.”
The OCC’s point here is not without merit — the relationship between a bank’s reputation and its customers’ trust in it is, admittedly, murky and difficult to assign a quantitative value to. However, that doesn’t mean that the threat reputation risk attempts to capture doesn’t exist at all.
Anti-money laundering and countering terrorist financing laws and regulations also play a role in banks opting to treat entire industries as higher risk and, sometimes as a result, opting not to accept customers who operate in those industries, the report notes. “The agency is aware of longstanding concerns that some banks have ‘derisked’ or ‘debanked’ certain categories of lawful businesses based on perceptions that such customers present elevated money laundering and terrorist financing risks,” the report says.
The OCC report says the agency “has previously observed that regulatory requirements related to money laundering and terrorist financing involve subjective evaluations of particular facts and circumstances and, therefore, are potentially susceptible to being used as a pretext for actions that are wholly unrelated to compliance with such laws and regulations.”
Customers who are unable to open accounts or have existing accounts closed experience real and significant harm. The report notes that in such cases “[c]ustomers or prospective customers may be denied access to funding or other specialized financial products to expand their business operations, be unable to make critical payments on time, be forced to quickly find new banking relationships and incur costs associated with opening a new account, or experience delays in receiving access to the funds in their closed accounts, among other consequences.”
The report argues that “[w]hen banks rely on difficult-to-quantify factors to decide whether to provide financial services, there is significant risk that bank decisions will whipsaw back and forth with the current political or social climate” and that this “whipsaw” effect may continue “with the change of each administration or Congress even in the absence of statutory changes.”
The report further argues that “the current environment favors fair access to financial services,” but warns that “a return to prioritizing public perception could easily result in backsliding and the renewal of industry-specific restrictions on lawful business activities.”
While that framing may seem logical, one could view the OCC’s efforts through a different lens — that the agency is seeking to pressure financial institutions to onboard or keep customers they otherwise wouldn’t.
An argument could be made that political and public pressure, as expressed through reputation risk, is merely being replaced with a different kind of political and public pressure, as expressed through the administration’s executive orders and the federal banking regulators’ policy changes, including the OCC’s debanking report.
The end result may be the exact whipsawing from administration to administration the OCC’s report warns about — putting banks in the unenviable position of having to navigate seemingly ever sharper swings in policies when the party in power changes.
Things To Know & Other Good Reads
OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance (OCC)
He Crafted a Crypto Law for Trump—as His Company Got Millions From a Crypto Giant (Wall Street Journal)
Illinois to Appeal Order Blocking State ‘Swipe Fee’ Restrictions (Bloomberg Law)
Inside the payment chains linked to crypto-funded ‘no-KYC’ cards (The Banker)
The AI boom meets a new kind of crypto scam (The Economist)
Fintech startup Ramp hits $60 billion valuation after $1.85 billion funding round (Reuters)
Upgrade Submits Applications to Establish an Industrial Loan Company (Upgrade)
Banking’s Ghost Story: Why talk about a bank that’s no longer with us (Fintech Takes Banking)
Money’s Public Cloud Moment (Fintech Takes)
Listen: What Getting a Trust Bank Charter Does and Doesn’t Change, with Modern Treasury’s Matt Marcus and Sam Aarons (Fintech Business Weekly)
About Fintech Business Weekly
Looking to work with me in any of the following areas? Email me.
Buy my best-selling book, Banking as a Service: Opportunities, Challenges and Risks of New Banking Business Models, here
Vendor, partner & investment opportunity advice and due diligence
Fintech advising & consulting
Sponsoring this newsletter
News tip or story suggestion — reach me on Signal at mikulaja.01