The proposed rule correctly identifies that "reputation risk" has been used as a basis for supervisory pressure that discourages banks from serving lawful customers in emerging industries. What the preamble does not fully address is the disproportionate impact this practice has had on institutions that serve underserved communities.
The National Bankers Association—the sole trade association advocating for the needs of Minority Depository Institutions (MDIs)—has documented how MDIs face compounding challenges when subjective supervisory standards create compliance uncertainty. MDIs, which are mission-driven institutions critical to bridging the racial wealth gap, lack the compliance infrastructure of megabanks and are more likely to preemptively terminate relationships rather than risk adverse examination findings.1 When reputation risk standards discourage MDIs from partnering with technology providers, these institutions lose access to the tools they need to modernize and compete.
Bill Bynum, CEO of HOPE Credit Union—a CDFI serving over three million people across Alabama, Arkansas, Louisiana, Mississippi, and Tennessee—testified before the House Financial Services Committee in 2022 that CDFIs play an outsized role in supporting jobs, businesses, and people in underserved communities of color, and that partnerships with technology providers are essential to expanding their reach.2 Reputation risk as a supervisory tool creates barriers to exactly these partnerships.
The National Community Reinvestment Coalition (NCRC), under the leadership of CEO Jesse Van Tol, has identified a direct tension between reputation risk-driven debanking and the goals of the Community Reinvestment Act. In NCRC's 2025 EGRPRA comment, the organization noted that the OCC's approach to codifying debanking prohibitions could raise Bank Secrecy Act compliance costs while reducing community development financing.3 NCRC has further characterized aspects of the OCC's debanking-related guidance as a "veiled attack on CRA," arguing that when banks withdraw from technology partnerships or underserved markets due to reputational pressure, the communities CRA was designed to protect bear the cost.4
This analysis is directly relevant to the Board's proposed rule. If the Board eliminates reputation risk from its supervisory framework without providing an alternative, objective basis for evaluating emerging financial relationships, banks may substitute their own subjective assessments for the examiner's—producing the same outcome through private risk aversion rather than supervisory pressure.
The proposed rule removes a flawed supervisory tool. We urge the Board to also create the conditions for a better one.
Operation HOPE, under the leadership of John Hope Bryant, has demonstrated that banking access combined with technology tools produces measurable improvements for underserved populations. Operation HOPE's 2023 data shows that among its 56,793 clients, credit scores improved by an average of 41 points, and the proportion of unbanked or underbanked clients was reduced from 22.9% to 12.4%.5 These gains depend on the financial technology ecosystem remaining accessible.
The Center for Responsible Lending, founded by Martin Eakes, has demonstrated through Self-Help Credit Union's more than $12 billion in financing for underserved borrowers that community institutions can responsibly serve populations that traditional banks have underserved—when supervisory frameworks focus on objective financial metrics rather than subjective reputation assessments.6
Independent third-party credentialing: for AI companies it provides verified compliance benchmarks; for banks it provides a defensible basis for maintaining relationships; for regulators it provides a scalable alternative to subjective assessments.
This model has precedent in banking supervision. The Basel framework relies on external credit ratings. The GENIUS Act of 2025 brought stablecoin issuers into a clear regulatory framework rather than leaving them subject to ad hoc reputational assessments.
Box Commons' particular concern is the emerging category of AI-driven entities—autonomous AI agents that require financial services to operate. These systems are already executing transactions, managing accounts, and participating in commercial relationships. Under the current supervisory framework, a bank considering whether to provide services to an AI-driven entity has no objective standard to evaluate—only the subjective question of whether the relationship poses "reputational risk."
The proposed rule, by eliminating reputation risk, removes the most significant barrier to banks serving this emerging category. We urge the Board to ensure that the final rule does not create a vacuum in which banks substitute their own subjective reputation assessments for the examiner's. The Board should signal that objective, third-party credentialing of AI systems and fintech providers is an appropriate component of a bank's due diligence framework.
We commend the Board for this proposed rule. The elimination of reputation risk from supervision is overdue and will benefit the financial system broadly. We urge the Board to:
Box Commons stands ready to share our standards architecture and to support the Board's work in developing objective alternatives to subjective reputation risk.
Contact:
Brice Love, Acting Executive Director
Box Commons
[email protected]
MDIs lack the compliance infrastructure of megabanks and are more likely to preemptively terminate relationships rather than risk adverse examination findings. When reputation risk standards discourage MDIs from partnering with technology providers, these institutions lose access to tools they need to modernize and compete.
Independent third-party credentialing: for AI companies it provides verified compliance benchmarks; for banks it provides a defensible basis for maintaining relationships; for regulators it provides a scalable alternative to subjective assessments.
When banks withdraw from technology partnerships or underserved markets due to reputational pressure, the communities CRA was designed to protect bear the cost.
Autonomous AI agents increasingly require financial services. Under the reputation risk framework, banks had no objective standard to evaluate AI-driven entities. Eliminating reputation risk removes this barrier, but objective credentialing is needed to fill the vacuum.