Reputational Risk Is Still Here

Norbert J. Michel and Nicholas Anthony

All signs were pointing to the end of reputational risk regulation. The president called out the practice, and three federal banking regulators were lining up to shut it down. After an executive order and multiple rulemakings, the intent was obvious. Yet, the fine print in one of those new rules suggests that the end is not quite here. 

A New Hope

Starting in the 1990s, as part of their broader efforts to manage financial institutions’ overall risks, federal banking agencies began to monitor “reputational risk.” As the name suggests, reputational risk regulation allows regulators to grade banks not on how they manage their money but on how they manage their reputations. According to the Office of the Comptroller of the Currency’s (OCC’s) 2018 bank examination handbook, “reputation risk is the risk to current or projected financial condition and resilience arising from negative public opinion,” and it “is inherent in all bank activities.”

In the worst case, this tool has been used to force banks to change their operating behavior and even shut down accounts of so-called controversial clients. Yet, after more than a decade of backlash following Operation Choke Point, it seemed this tool would finally be taken off the books. The Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation (FDIC) all announced in 2025 that they were ending the practice. In August 2025, President Donald Trump even ordered the end of reputational risk regulation in Executive Order 14331. The end seemed near. 

In April 2026, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation announced the official elimination of reputational risk regulation from their supervisory programs. According to the summary of the final rule, the regulators are now officially prohibited from “encouraging an institution to close an account … on the basis of a person or entity’s political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of politically disfavored but lawful business activities perceived to present reputation risk.” By all accounts, this battle seemed to be one in which financial freedom finally won.

The summary in the final rule suggests that regulators can no longer use this tool to cut someone off from the financial system just because they are deemed controversial. More so, it suggests that banks are now free to shape their reputations as they see fit. 

Read the Fine Print, You Must

Yet, there’s a problem. A closer look at the final rule shows that regulators carved out an exception that allows reputational risk to be considered so long as it affects a bank’s financial or operational condition. Given the original regulatory definition, which explicitly identified reputational risk as a risk to the “current or projected financial condition” of the bank, this carve-out raises the danger that future regulators will be able to abuse the reputational risk language just as they have under previous administrations. 

The Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation claim that they needed to preserve bank examiners’ ability to address financial difficulties at the banks, but this carve-out seems to go too far. 

The regulators could, for example, have included a rule of construction stating that other regulations remain in effect, thereby preserving examiners’ ability to adequately monitor banks’ financial condition. But the wording in the final rule effectively codifies a dangerous part of the OCC’s older definition of reputational risk. 

Consider a few scenarios. 

1. Moira runs a firearms business that becomes the target of a coordinated social media campaign. The campaign goes viral, and activists begin calling for a boycott of the bank that holds the business’s accounts, threatening to withdraw their own deposits en masse. Citing concerns that the public outcry could trigger a deposit run and threaten the bank’s projected financial condition, regulators encourage the bank to close the account—technically not because of the business’s lawful activities, but because of the “financial impact” the controversy is creating.
2. Brianna is a religious extremist who protests outside the funerals of gay veterans. News spreads that she is a customer of a particular bank. Customers complain to regulators and threaten to organize a boycott. As customer complaints mount, regulators could order that Brianna’s account be closed on the grounds that the bank’s financial condition is under threat. 
3. Christine is a fossil fuel executive whose company holds significant accounts at a bank. Bank employees find out about an oil spill by Christine’s company and stage a walkout in opposition to servicing her company, disrupting branch operations. Because of this development, regulators could argue that Christine’s account should be closed because she poses a reputational risk to the bank, one that threatens the financial and operational condition of the bank. 

No one here necessarily broke the law. Rather, they were just so controversial that they impacted the financial and operational conditions of their banks. And because there is an explicit carve-out for these cases, regulators would still be able to regulate based on reputational risk, as prior to the new rule.

The Regulators Strike Back

In the final rule, the regulators acknowledge that some people spoke out about problems with this definition of reputational risk. However, they argued that the financial condition carve-out is “necessary to maintain the ability of the agencies to address public concerns that directly relate to an institution’s financial condition and solvency because those concerns can lead to runs.” The regulators try to ease people’s fears by adding that “Unlike public concerns about an institution doing business with politically controversial people or entities, concerns about an institution’s financial condition have been shown repeatedly to lead to a direct negative impact on the institution that can cause failure.” 

When defending the addition of operational conditions, the regulators state that “public perception that an institution could be susceptible to a breakdown in the provision of services due to operational issues such as a cyberattack or a natural disaster could have a direct impact on customers’ willingness to do business with an institution and thus on the institution’s financial solvency.” 

The regulators deserve credit for taking the time to address people’s concerns. They could have said nothing. Yet the problem is that these terms and definitions allow exactly the same kind of abuse that the earlier definitions did. By including this carve-out in the final rule, future administrations will be able to implement the same kind of harmful policies we’ve seen in the past without even having to go through the process of publicly amending the rules.

Conclusion

The regulators say all the right things in the introduction of the new final rule. They point out that reputational risk regulation is ineffective, that it distracts regulators from bigger concerns, and that it has chilled potentially profitable business ventures. However, it’s difficult to celebrate the end of these reputational risk regulation problems when so much of the original definition is still on the table. 

The situation is certainly improved, but there are few great options left to fully fix the problem. Regulators could outline the scenarios above in formal guidance to say that the examples outlined above are, in fact, off the table. That would go a long way in establishing the intent of the rule. Still, guidance can be quickly undone by future administrations. Therefore, this experience is a reminder of why Congress should still act even though the possibility of reputational risk regulation abuse has been lessened.