BANKING • Rule in force since June
Nearly 100,000 Complaints About Closed Accounts
The Comptroller of the Currency examined nine of the largest US banks and found the same or substantially similar account-closure policies at every one of them. It is now working through close to 100,000 pending consumer complaints.
The mechanism at issue is called reputational risk, and what it demonstrates is how little of this was ever written into law. For years, supervisors could criticise a bank for keeping a customer whose lawful business simply looked bad, and banks acted accordingly — closing accounts on the basis of values-alignment criteria rather than any documented financial or legal problem. No statute required it. No vote authorised it. It operated through guidance documents and examination practice, which is precisely why it could reach nearly 100,000 people before anyone counted.
It was then reversed just as quickly, and by the same kind of instrument. An executive order in August 2025 prohibited politicised or unlawful debanking. By June 9 this year a joint final rule from the Comptroller and the FDIC had removed reputational risk from bank supervision altogether. Ten months from one posture to the opposite one, with no legislation involved at either end — which tells you how fast this can move, and in which direction depends entirely on who is writing the guidance.
The perimeter widened in March, when the Federal Trade Commission sent warning letters to the largest payment processors, putting them on notice that helping banks debank customers could itself breach the FTC Act. Payment networks sit between you and every card transaction you make, and until this year nobody had suggested their account-eligibility policies were the government’s business.
Underneath all of it sits a quieter document. The Comptroller had to issue a bulletin reminding banks that they are obliged to protect customers’ financial records under the Right to Financial Privacy Act even when a government agency asks for them, and to use voluntary suspicious activity reports properly rather than freely. Regulators do not write that sentence down unless the practice had already drifted a long way from it.
The distinction worth holding: an account feels like a private contract, and legally it is a permission. The rules governing who may look at your transactions, and who may end your access to the system entirely, were rewritten twice in twelve months — both times by executive instrument rather than by Congress, and both times in documents that arrived without a headline. Whichever way the current version points, the mechanism that moved it is still sitting there.
Source: OCC / FDIC / FTC