Serving businesses disfavored by bureaucrats should never have been considered a financial risk.
Serving businesses disfavored by bureaucrats should never have been considered a financial risk.
W e are in the middle of a quiet revolution in how banks are regulated in the United States, and you can be forgiven if you missed it. The major federal agencies that have oversight of banks in this country — the Federal Reserve, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency — have moved to drop the idea of corporate reputation, or “reputational risk,” from their list of things they look at when deciding if banks are operating soundly and within the law. This is a development everyone in America should cheer, and its impact goes far beyond the arcane world of bank audits.
In the traditional world of bank regulation, financial institutions are examined to ensure they have sufficient cash on hand and aren’t making overly risky capital allocations. But in recent years, federal agencies started looking at the public perception of the bank itself as a reason for regulatory scrutiny. A negative reputation could become a liability for the bank and threaten its financial future: Imagine if your bank’s clients were narco-traffickers or terrorists. You wouldn’t want it to become known for those associations.
That sort of concern is reasonable enough. But eventually, the agencies making these calls began moving into less clear-cut territory. They began judging banks based on whether their clients had business interests that, while perfectly legal, were somehow… unsavory. That is, unsavory in the subjective judgment of the examiners. In other words, if you provided banking services to someone who gave government bureaucrats the ick, you might just be in big trouble. Unfortunately for small-business owners, quite a few banking clients fell into that category.
Such discriminatory oversight ramped up during Barack Obama’s presidency, becoming known as “Operation Choke Point” (OCP). As part of this playbook, federal banking regulators pressured bank executives to cut off financial services to allegedly risky small-business clients, particularly through their relationships with third-party payment processors. The businesses in question — payday lenders, coin shops, gun stores, adult content providers — were engaged in what are now referred to as “politically disfavored but lawful business activities.”
My Competitive Enterprise Institute colleague Iain Murray described this process in a study back in 2014, writing: “As a result, many companies and individuals that have done nothing wrong have been frozen out of banking services. Without the links to banks, their financial lifeblood is choked off indeed.” Aggressive supervisory activities by the Department of Justice, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) thus inflicted significant harm on law-abiding U.S. citizens without due process of law.
While OCP was eventually discontinued after receiving significant negative news media coverage and an investigation by the US House Oversight and Government Reform Committee, the road to redress was long. Begun in 2011, it was not until 2017 that the Department of Justice officially committed to ending it, and then only after a change of administration. The FDIC did not reach a settlement with payday lenders who had sued to protest their treatment until 2019.
We can at least be glad that bank regulators finally disavowed this unlawful and infamous legacy. Unfortunately, OCP was by no means a unique or rare instance of government overreach via executive authority. It was conceptually similar to other policies and initiatives in recent years that have attempted to coerce and commandeer, without lawful authority, the management decisions of major US corporations, to the detriment of small business clients, shareholders as a class, and individual U.S. citizens in general.
These include efforts as wide-ranging as climate-finance policy intended to damage domestic oil and gas production to attempts to censor public health information on social media platforms during the pandemic. It also includes the anti-cryptocurrency initiatives undertaken by the Biden administration that have been widely referred to as “Operation Choke Point 2.0,” described by crypto analyst Nic Carter as a “coordinated, ongoing effort across virtually every US financial regulator to deny crypto firms access to banking services.” Current efforts to counter reputational-risk-based debanking must be understood against this background.
As mentioned above, the concept of reputational risk can be a legitimate tool for individual firms or even individual investors to protect their image. No one wants to become known as the mob’s favorite banker. This can also be true in the world of legal investments, too. For example, someone managing investments on behalf of an entity associated with the Roman Catholic church may wish to avoid any connection with a company that provides abortions or distributes pornographic content. The asset manager for an environmental activist organization may want to avoid any investments associated with deforestation.
As a tool for financial regulation in general, however, reputational risk — especially when associated with businesses acknowledged as legal — is fatally vague and prone to abuse. Unlike profit and loss or, say, interest-rate exposure risk, reputation defies quantification by regulators. Not only can a bank’s reputation not be precisely measured, but prior administrations have erred in assuming that they can describe what kind of reputation is desirable for a firm to have in the first place. In addition, since a firm’s reputation is subject to the flow of opinion in the public square, it can be negatively engineered — that is, anti-corporate activist groups can (and often do) attempt to engage in character assassination via press release, billboard, and protest sign for political and ideological purposes that have nothing to do with the financial soundness of the targeted firm.
The reputation a bank or other financial firm seeks to cultivate can vary widely depending on its value proposition to potential customers and its competitive strategy. Some financial institutions may desire to project an image of being solid, trustworthy, and stable. Others may go out of their way to position themselves as nimble, innovative, and responsive to the latest market opportunities.
The same is true for any industry. Customer surveys will no doubt reveal that Starbucks and Black Rifle Coffee Company have very different reputations, and an analysis of their management and marketing will demonstrate that those divergent reputations were intentionally established and cultivated. Moreover, large firms serving the public may have a variety of customer-facing brands, each with its own emotional associations, advertising strategy, and reputation for quality and service.
Cultivating a corporate and brand reputation is thus itself an expressive act, and regulating it risks infringing on protected speech. Reputational-risk supervision becomes constitutionally problematic when it operates as vague, informal pressure on banks to deny services to lawful customers because of protected political or religious viewpoints, or when it uses coercion or threatened regulatory consequences to induce private firms to indirectly suppress disfavored associations. Supreme Court opinions in Bantam Books, Inc. v. Sullivan (1963) and National Rifle Association of America v. Vullo (2024) are relevant here.
Therefore, the new rules issued by the Federal Reserve, OCC, and FDIC (with a single joint rule covering the latter two agencies) are a step in the right direction. Beyond the limitation in using reputational risk per se, there are a couple of other welcome angles that might not be immediately obvious. The Federal Reserve’s rule, for example, includes language that will “explicitly prohibit the Board from encouraging or compelling Board-supervised banking organizations” from debanking clients for political reasons. The inclusion of the word “encouraging” here is key.
A problem with countering the weaponization policies of the recent past is that they were neither explicit nor clearly announced, making it difficult for affected parties to oppose or counter them. The inclusion of “encouraging” rather than simply “requiring” is vital to covering the more “soft law” type applications that flow from guidance, interpretive documents, and face-to-face meetings with regulated parties rather than formal rulemaking.
One of the most pernicious aspects of previous policies, such as OCP and various jawboning efforts, is that they have been too vague and obscure to challenge effectively, even when third parties have been adversely affected. Executive agencies will, by definition, not announce to the public or publish a regulatory notice that they intend to infringe on the constitutional rights of regulated parties, so any rule needs to explicitly cover conduct that might have the effect of creating such a violation or merely encourage it. It is cold comfort to inform a citizen, for example, “You can always sue to contest an illegitimate policy” if, according to the agencies in question, no such policy formally exists (but is nonetheless being implemented informally).
The other encouraging aspect of the new reputational-risk policy is that it doesn’t err in the opposite direction. The Federal Reserve’s rule says that “the decision regarding whether or not to [provide services] rests with the banking organization, acting in accordance with applicable law.” Some critics of previous debanking policies have, unfortunately, gone too far in their enthusiasm to remedy that harm, proposing to mandate access to banking services regardless of a bank’s own independent risk assessment. This would itself be an unjust case of regulatory overreach, albeit in the opposite direction of previous abuses. The current proposed rule rightly omits (previously discussed) provisions implementing so-called fair-access mandates on commercial banks and credit unions.
But, of course, no federal regulatory proceeding could be entirely a cause for celebration. Keen observers of the fine print at the Cato Institute, Nick Anthony and Norbert Michel, have informed us that “Reputational Risk Is Still Here.” They write:
A closer look at the final rule shows that regulators carved out an exception that allows reputational risk to be considered so long as it affects a bank’s financial or operational condition. Given the original regulatory definition, which explicitly identified reputational risk as a risk to the “current or projected financial condition” of the bank, this carve-out raises the danger that future regulators will be able to abuse the reputational risk language just as they have under previous administrations.
Anthony and Michel are, of course, correct to point out this lingering deficiency. Which is why I support their proposal for a legislative solution: “Congress should still act even though the possibility of reputational risk regulation abuse has been lessened.”
There’s quite a bit of financial regulation and guidance that has flip-flopped between administrations over the past several years. Most of it could have been clarified and reformed with a few simple bills addressing topics such as public company disclosure mandates, proxy advisory services, and pension fund fiduciary obligations. Congress should include the full, final, no-exceptions death of reputational-risk regulation as part of that effort.