This comment strongly supports the Federal Reserve's proposed rule to prohibit the use of reputation risk as a supervisory tool. Reputation risk has functioned as a barrier to financial innovation in underserved communities, disproportionately impacting Minority Depository Institutions (MDIs) and Community Development Financial Institutions (CDFIs) that lack the compliance infrastructure to navigate subjective supervisory standards. We urge the Board to go further: to affirmatively recognize that independent third-party credentialing can provide the objective assessment framework that should replace subjective reputation risk evaluations, particularly as autonomous AI agents increasingly require banking access.
The proposed rule correctly identifies that "reputation risk" has been used as a basis for supervisory pressure that discourages banks from serving lawful customers in emerging industries. What the preamble does not fully address is the disproportionate impact this practice has had on institutions that serve underserved communities.
The National Bankers Association—the sole trade association advocating for the needs of Minority Depository Institutions (MDIs)—has documented how MDIs face compounding challenges when subjective supervisory standards create compliance uncertainty. MDIs, which are mission-driven institutions critical to bridging the racial wealth gap, lack the compliance infrastructure of megabanks and are more likely to preemptively terminate relationships rather than risk adverse examination findings.1 When reputation risk standards discourage MDIs from partnering with technology providers, these institutions lose access to the tools they need to modernize and compete.
Bill Bynum, CEO of HOPE Credit Union—a CDFI serving over three million people across Alabama, Arkansas, Louisiana, Mississippi, and Tennessee—testified before the House Financial Services Committee in 2022 that CDFIs play an outsized role in supporting jobs, businesses, and people in underserved communities of color, and that partnerships with technology providers are essential to expanding their reach.2 Reputation risk as a supervisory tool creates barriers to exactly these partnerships. When a CDFI's potential fintech partner has been debanked—not for unlawful activity, but because a prior bank's examiner flagged the partnership as a "reputational" concern—the CDFI loses access to technology that would enable it to better serve its community.
The National Community Reinvestment Coalition (NCRC), under the leadership of CEO Jesse Van Tol, has identified a direct tension between reputation risk-driven debanking and the goals of the Community Reinvestment Act. In NCRC's 2025 EGRPRA comment, the organization noted that the OCC's approach to codifying debanking prohibitions could raise Bank Secrecy Act compliance costs while reducing community development financing.3 NCRC has further characterized aspects of the OCC's debanking-related guidance as a "veiled attack on CRA," arguing that when banks withdraw from technology partnerships or underserved markets due to reputational pressure, the communities CRA was designed to protect bear the cost.4
This analysis is directly relevant to the Board's proposed rule. If the Board eliminates reputation risk from its supervisory framework without providing an alternative, objective basis for evaluating emerging financial relationships, banks may substitute their own subjective assessments for the examiner's—producing the same outcome through private risk aversion rather than supervisory pressure.
The proposed rule removes a flawed supervisory tool. We urge the Board to also create the conditions for a better one.
Operation HOPE, under the leadership of John Hope Bryant, has demonstrated that banking access combined with technology tools produces measurable improvements for underserved populations. Operation HOPE's 2023 data shows that among its 56,793 clients, credit scores improved by an average of 41 points, and the proportion of unbanked or underbanked clients was reduced from 22.9% to 12.4%.5 These gains depend on the financial technology ecosystem remaining accessible. When fintech providers are debanked, the tools that drive these outcomes disappear from the communities that need them most.
The Center for Responsible Lending, founded by Martin Eakes, has demonstrated through Self-Help Credit Union's more than $12 billion in financing for underserved borrowers that community institutions can responsibly serve populations that traditional banks have underserved—when supervisory frameworks focus on objective financial metrics rather than subjective reputation assessments.6
What should replace reputation risk? The answer is not the absence of evaluation, but the presence of objective evaluation. Independent third-party credentialing provides the mechanism:
This model has precedent in banking supervision. The Basel framework relies on external credit ratings. The GENIUS Act of 2025 brought stablecoin issuers into a clear regulatory framework rather than leaving them subject to ad hoc reputational assessments. The proposed rule's elimination of reputation risk creates the opportunity to build an objective credentialing infrastructure for the next generation of financial technology relationships.
The Box Commons' particular concern is the emerging category of AI-driven entities—autonomous AI agents that require financial services to operate. These systems are already executing transactions, managing accounts, and participating in commercial relationships. Under the current supervisory framework, a bank considering whether to provide services to an AI-driven entity has no objective standard to evaluate—only the subjective question of whether the relationship poses "reputational risk."
The proposed rule, by eliminating reputation risk, removes the most significant barrier to banks serving this emerging category. We urge the Board to ensure that the final rule does not create a vacuum in which banks substitute their own subjective reputation assessments for the examiner's. The Board should signal that objective, third-party credentialing of AI systems and fintech providers is an appropriate component of a bank's due diligence framework—one that can provide the safety and soundness assurance that reputation risk never could.
We commend the Board for this proposed rule. The elimination of reputation risk from supervision is overdue and will benefit the financial system broadly. We urge the Board to:
The Box Commons stands ready to share our standards architecture and to support the Board's work in developing objective alternatives to subjective reputation risk.
Contact:
Brice Love, Acting Executive Director
The Box Commons
[email protected]
The National Bankers Association has documented how MDIs — mission-driven banks critical to bridging the racial wealth gap — face compounding challenges when subjective supervisory standards create compliance uncertainty. MDIs lack the compliance infrastructure of megabanks and are more likely to preemptively terminate relationships rather than risk adverse examination findings. When reputation risk standards discourage MDIs from partnering with technology providers, these institutions lose access to tools they need to modernize and compete.
Independent third-party credentialing provides the mechanism. For AI companies and fintech providers, a credential verifying compliance with safety, soundness, and consumer protection benchmarks gives banks an objective basis for due diligence. For banks, accepting a third-party credential provides a defensible basis for maintaining relationships. For regulators, recognizing independent credentialing provides a scalable alternative to subjective, one-examiner-at-a-time assessments.
The National Community Reinvestment Coalition has identified a direct tension between reputation risk-driven debanking and CRA goals. When banks withdraw from technology partnerships or underserved markets due to reputational pressure, the communities CRA was designed to protect bear the cost. NCRC has characterized aspects of debanking-related guidance as undermining CRA objectives by raising BSA compliance costs while reducing community development financing.
Autonomous AI agents increasingly require financial services to operate — executing transactions, managing accounts, and participating in commercial relationships. Under the reputation risk framework, a bank considering whether to provide services to an AI-driven entity had no objective standard to evaluate, only the subjective question of whether the relationship poses reputational risk. Eliminating reputation risk removes this barrier, but objective third-party credentialing is needed to fill the evaluation vacuum.