Prohibiting Use of Reputational Risk in Regulation of Depositories and Licensed Financial Services Providers Act

Model Policy

Section 1. Short Title.

This Act may be cited as the “State FIRM (Depositories and Licensees) Act.”

Section 2. Purpose.

(A) The purpose of this Act is to ensure that state supervision and examination are grounded in safety-and-soundness (where applicable), consumer protection, and compliance with law, and not in “reputational risk.”

Section 3. Definitions.  As used in this Act:

(a) “State financial regulator” means the [State Department/Division/Commission] and the [Commissioner/Superintendent/Director], including any examiner, employee, agent, or contractor acting on behalf of the [Department/Division/Commission].

(b) “Covered depository institution” means any entity chartered, organized, or regulated under the laws of this State as:

1. a state bank;
2. a state savings bank or savings association (if applicable under state law);
3. a state trust company (if the state regulator conducts examinations/supervision);
4. a state credit union (if within the state regulator’s jurisdiction); and
5. any other state-chartered depository institution subject to examination or supervisory authority by the State financial regulator.

(c) “Covered financial services licensee” means any person or entity required to be licensed, registered, or authorized under the laws of this State—and subject to examination or supervisory authority by the State financial regulator—to engage in one or more of the following lines of business:

1. Money services businesses (MSBs) and payments licensees, including any person or entity licensed or required to be licensed for:
   • i. money transmission, funds transfer, or remittance services;
   • ii. issuance, sale, or redemption of payment instruments;
   • iii. stored value, prepaid access, or digital wallet services (whether custodial or non-custodial), to the extent the activity is licensed or otherwise regulated by the State;
   • iv. check cashing, currency exchange, or other MSB activities regulated by state law (if applicable).
2. Mortgage lending, brokering, servicing, or origination activities regulated by state law.
3. Consumer finance, including consumer lending and related consumer finance activities regulated by state law.
4. Digital asset / virtual currency businesses, including any person or entity licensed or required to be licensed under the laws of this State to engage in:
   • i. virtual currency or digital asset transmission;
   • ii. custody or safekeeping of digital assets for others;
   • iii. exchange, brokerage, or dealing in digital assets for compensation (whether as principal or agent);
   • iv. issuance or administration of digital assets, stablecoins, or similar instruments to the extent the activity is within the scope of a state licensing or supervisory regime; or
   • v. any other digital asset activity expressly requiring licensure, registration, or approval by the State financial regulator.

(d) “Covered entity” means a covered depository institution or a covered financial services licensee.

(e) “Reputational risk” means the potential that negative publicity or negative public opinion regarding a covered entity’s business practices or the political, ideological, or religious beliefs or affiliations of its employees, contractual partners, or clients, whether that publicity or opinion is accurate or not, will cause a decline in confidence in the covered entity, a decline in the customer base, costly litigation, revenue reductions, or otherwise adversely impact the covered entity.

(f) “Prudential and compliance factors” means measurable or articulable factors relevant to a covered entity’s lawful operation, including (as applicable): capital/solvency, liquidity, credit, operational resiliency, governance and internal controls, consumer compliance, fraud prevention, licensing compliance, recordkeeping, cybersecurity, third-party risk management, complaint handling, and compliance with state and federal law (including BSA/AML and sanctions obligations to the extent applicable to the covered entity’s business).

Section 4. Prohibition on the Use of Reputational Risk in Regulation, Supervision, or Examination.

(a) General prohibition. No State financial regulator may engage in any activity concerning or related to the regulation, supervision, or examination of a covered entity that is based on reputational risk.

(b) No “reputational risk” supervisory criticism or requirements. The State financial regulator may not:

1. include reputational risk as an element in any supervisory rating, examination conclusion, deficiency, matter requiring attention, supervisory letter, condition of licensure/renewal, or enforcement recommendation; or
2. require, request, recommend, or pressure a covered entity to adopt a policy, terminate a relationship, decline onboarding, restrict products/services, or otherwise take an adverse business action on the basis of reputational risk.

(c) No indirect pressure through third parties. The State financial regulator may not direct, encourage, or pressure any other governmental body, quasi-governmental entity, or regulated financial institution to influence a covered entity’s customer selection, account relationships, or product/service offerings on the basis of reputational risk.

Section 5. Rule Of Construction; Preservation of Lawful Authority.

(a) Law enforcement and consumer protection preserved. Nothing in this Act limits the State financial regulator’s authority to enforce applicable state or federal law, including licensing requirements, safety-and-soundness standards (for depositories, where applicable), consumer protection laws, fraud prevention, and other requirements expressly imposed by statute or valid rule.

(b) Risk-based supervision permitted without “reputational risk.” The State financial regulator may consider prudential and compliance factors and may take action based on documented violations, consumer harm, fraud risk, or failure to meet legal obligations—provided the regulator does not characterize “reputational risk” as an independent basis for supervisory criticism or action.

Section 6. Conforming Updates to Supervisory Materials.

Within [180] days after the effective date, the State financial regulator shall review and update examination manuals, guidance, policies, procedures, training materials, forms, templates, and model examination/licensing request lists to remove “reputational risk” as a standalone category of supervisory concern for covered entities.

Section 7. Enforcement; Remedies; No Private Right of Action.

(a) Administrative compliance mechanism. A covered entity may submit a written request to the State financial regulator identifying a specific supervisory communication, examination request, licensing condition, or enforcement premise that the covered entity reasonably believes relies on reputational risk. The State financial regulator shall respond in writing within [30–60] days confirming withdrawal/correction or explaining the non-reputational prudential or compliance basis.

(b) No private right of action. Nothing in this Act creates a private right of action.

(c) No damages; no fee shifting. Nothing in this Act authorizes monetary damages or attorney’s fees against the State.

Section 8. Severability.

[Standard severability clause.]

Section 9. Effective Date.

This Act takes effect [upon enactment / July 1, 20XX].