# Exemptions.
**AGENCY:**
National Credit Union Administration (NCUA).
**ACTION:**
Interim final rule; request for comments.
**SUMMARY:**
In accordance with the Privacy Act of 1974, the National Credit Union Administration (NCUA) Board is issuing this interim final rule to make a correction to the numbering of one system of records and to exempt one system of records from certain requirements of the Act. NCUA has previously published System of Records Notices (SORN) for these systems. The Board has found good cause to issue the interim final rule without advance notice-and-comment procedures and with an immediate effective date.
**DATES:**
This rule is effective on January 12, 2026. Comments must be received on or before February 11, 2026.
**ADDRESSES:**
Comments may be submitted in one of the following ways. (Please send comments by one method only):
• *Federal eRulemaking Portal: https://www.regulations.gov.* The docket number for this proposed rule is NCUA-2026-XXXX. Follow the “Submit a comment” instructions. If you are reading this document on *federalregister.gov,* you may use the green “SUBMIT A PUBLIC COMMENT” button beneath this rulemaking's title to submit a comment to the *regulations.gov* docket. A plain language summary of the proposed rule is also available on the docket website.
• *Mail:* Address to Melane Conyers-Ausbrooks, Secretary of the Board, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428.
• *Hand Delivery/Courier:* Same as mailing address. Mailed and hand-delivered comments must be received by the close of the comment period.
*Public Inspection:* Please follow the search instructions on *https://www.regulations.gov* to view the public comments. Do not include any personally identifiable information (such as name, address, or other contact information) or confidential business information that you do not want publicly disclosed. All comments are public records; they are publicly displayed exactly as received, and will not be deleted, modified, or redacted. Comments may be submitted anonymously. If you are unable to access public comments on the internet, you may contact the NCUA for alternative access by calling (703) 518-6540 or emailing *[email protected].*
**FOR FURTHER INFORMATION CONTACT:**
Elizabeth Harris, Senior Agency Official for Privacy, National Credit Union Administration, or Jennifer Harrison, Senior Counsel, 1775 Duke Street, Alexandria, Virginia 22314-3428 or by phone at (703) 518-6540.
**SUPPLEMENTARY INFORMATION:**
**I. Background**
The Privacy Act of 1974 places requirements on federal agencies regarding the collection, maintenance, distribution, and security of an individual's personal information that is contained in an agency's systems of records. Pursuant to the Privacy Act, NCUA publishes a Systems of Records Notice (SORN) that informs the public of each system of records the agency maintains, describes the nature and routine use of records in the system, identifies the system manager responsible for the system including contact information, and provides procedures whereby individuals may determine whether a system contains a record pertaining to them, gain access to records pertaining to them, or seek to amend or correct information in a record about them. NCUA Systems of Records Notices are published in the *Federal Register* and are available at *https://www.ncua.gov/privacy.*
The Privacy Act also requires each federal agency to publish rules describing its Privacy Act procedures and any system of records it exempts from provisions of the Act, including the reasons for the exemption. NCUA publishes its rules at part 792, subpart E; the rules provide individuals with detailed information regarding the exercise of their rights under the Privacy Act, identify and describe the NCUA systems of records that are exempt from provisions of the Privacy Act, and provide standards for NCUA employees regarding collecting, using, maintaining, or disseminating records.
**II. Proposed Changes**
The Board is revising its Privacy Act regulations at 12 CFR part 792 to correct the number associated with a system of records, NCUA-11 (previously numbered as NCUA-20). The Board has previously promulgated exemptions to the Privacy Act for this system of records in accordance with subsections (k)(2) and (j)(2). The Board is also revising its Privacy Act regulations at 12 CFR part 792 to exempt one system of records, NCUA-28, from certain requirements of the Privacy Act in accordance with subsection (k)(2) of the Privacy Act. The interim final rule amends 12 CFR 792.66, the provision on exemptions.
**A. NCUA-11**
The NCUA SORN entitled “Office of Inspector General (OIG) Investigative Records” and currently numbered as NCUA-11, was originally published at 53 FR 37372 (Sept. 26, 1988) as “Investigation Files” and numbered as NCUA-20. A modified SORN was published at 60 FR 18149 (Apr. 10, 1995), renaming the system “Office of Inspector General Investigative Records” and listing exemptions from certain provisions of the Privacy Act. Those exemptions were promulgated at 60 FR 31912 (June 19, 1995). The system was renumbered to NCUA-11 at 65 FR 3486 (Feb. 20, 2000). The corresponding reference to the SORN in § 792.66(b)(3) was not updated at that time. Subsequent modifications to the SORN were published at 71 FR 77807 (Dec. 27, 2006),75 FR 41539 (July 16, 2010), and 88 FR 43152 (July 6, 2023), however the corresponding reference to the SORN was still not updated. The NCUA is now updating the SORN number in § 792.66(b)(3) as a technical correction.
**B. NCUA-28**
The Board is also adopting exemptions under subsection (k)(2) for NCUA-28, Anti-Harassment Case Tracking and Records. NCUA has previously published a SORN for this system in the *Federal Register* at 88 FR 37584 (June 8, 2023). NCUA-28 contains information collected by the NCUA to assist the NCUA with conducting internal investigations into allegations of harassment brought by current NCUA employees and NCUA contractors and taking appropriate action(s) to address such allegations.
Subsection (k)(2) of the Privacy Act authorizes the head of an agency to exempt a system of records from the applicable subsections if investigatory records are compiled for law enforcement purposes; provided, however if an individual is denied any right, privilege, or benefit that he or she would otherwise be entitled by Federal law, or for which he or she would otherwise be eligible, as a result of the maintenance of such material, such material shall be provided to such individual, except to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence. Because of the investigatory nature of information that is maintained in this system of records, this rule would add NCUA's Anti-Harassment Case Tracking and Records System to the list of NCUA systems that are exempt from specific provisions of the Privacy Act pursuant to 5 U.S.C. 552a(k)(2).
Specifically, the Board is exempting this system of records under 5 U.S.C. 552a(k)(2) from the following provisions of the Privacy Act of 1974:
• Subsection (c)(3) relating to access to the accounting of disclosures;
• Subsection (d) relating to access to the records;
• Subsection (e)(1) relating to the type of information maintained in the records;
• Subsections (e)(4)(G), (H) and (I) relating to publishing in the annual system notice information as to agency procedures for access and correction and information as to the categories of sources of records; and
• Subsection (f) relating to developing agency rules for gaining access and making corrections.
The determination to exempt these records was made because it is necessary for NCUA to continue to investigate alleged violations of law, regulation, and NCUA policy and also to determine continued suitability for Federal employment. In accordance with Federal anti-discrimination laws, the Equal Employment Opportunity Commission (EEOC) requires that all Federal agencies have an anti-harassment policy and program. NCUA's specific policy prohibits harassment by all employees, provides an avenue for individuals to report allegations of harassment, and a process by which NCUA factfinders conduct inquiries and investigations. Furthermore, NCUA's policy prohibits retaliation against individuals for raising allegations of harassment or participating in the process. For NCUA to promptly address and resolve potential violations of law, regulation, or NCUA policy, individuals who are participating in this process must be assured that their statements will be kept confidential consistent with law. Without this exemption, the NCUA's ability to address allegations of harassment would be hindered by witnesses' and/or victims' lack of willingness to come forward, fearful that their statements or identities may be revealed. Other agencies, including the EEOC, have exempted similar records from certain provisions of the Privacy Act.
The Board is promulgating these exemptions on the following bases:
5 U.S.C. 552a(c)(3)—The release of the disclosure accounting to the individual who is the subject of the investigation would present a serious impediment to NCUA's ability to conduct inquiries or investigations into potential violations of law or policy.
5 U.S.C. 552a(d)—Access to records contained in this system would inform the subject of an actual or potential investigation, of the existence of that investigation, of the nature and scope of the investigation, of the information and evidence obtained as to their activities, and of the identity of witnesses. Such access would impede an investigator's ability to freely investigate such cases, including concerns that some witnesses have been promised confidentiality and would not want their statements provided to the subject of the investigation. Amendment of the records would interfere with the ongoing fact-finding process. Furthermore, subject individuals of the files in this system have access to relevant information as part of the investigatory process and are given the opportunity to explain or contradict such information and to submit any responsive evidence of their own.
5 U.S.C. 552a(e)(1)—Under the provision of (e)(1), the agency must only maintain such information that is relevant and necessary. It is difficult to know during the course of an investigation what is relevant and necessary. In this context, facts or evidence may not seem relevant at first, but later in the investigation, their relevance is borne out.
5 U.S.C. 552a(e)(4)(G) and (H)—These subsections are inapplicable to the extent that this system is exempt from the access provisions of subsection (d) and the rules provisions of subsection (f).
5 U.S.C. 552a(e)(4)(I)—The categories of sources of the records in this system has been published in the *Federal Register* under the requirements of the Privacy Act. In the event, however, that this subsection should be interpreted to require more detail as to the identity of sources of the records in this system, exemption from this provision is necessary as the application of this provision could disclose investigative techniques and procedures and cause sources to refrain from giving such information because of fear of reprisal, or fear of breach of promises of anonymity and confidentiality. This would compromise the ability to conduct investigations, and to make fair and objective decisions on questions of suitability for Federal employment and related issues.
5 U.S.C. 552a(f)—Procedures for notice to an individual pursuant to subsection (f)(1) as to existence of records pertaining to the individual dealing with an actual or potential criminal, civil, or regulatory investigation or prosecution must be exempted because such notice to an individual would be detrimental to the successful conduct and/or completion of an investigation or case, pending or future. In addition, mere notice of the fact of an investigation could inform the subject or others that their activities are under investigation or may become the subject of an investigation and could enable the subjects to avoid detection, to influence witnesses improperly, to destroy evidence, or to fabricate testimony. Since an exemption is being claimed for subsection (d) of the Act, the rules required pursuant to subsections (f)(2) through (5) are inapplicable to this system of records to the extent that this system of records is exempted from subsection (d).
For these reasons, the listed exemptions are both necessary and appropriate.
**III. Interim Final Rule**
The Board is publishing these changes in an interim final rule for the following reasons:
A. The correction of NCUA-20 to NCUA-11 is a non-substantive correction. The change merely corrects the system number to match the current number of the corresponding SORN, which is an administrative change. No opposition to the changes and no significant adverse comments are expected. Therefore, the Board finds that prior notice and comment are unnecessary.
B. The promulgation of exemptions for NCUA-28 concerns “agency organization, procedure, and practice” and is limited to “agency organization, management, or personnel matters.” The exemption from provisions of the Privacy Act by the interim final rule affects only current NCUA employees and contractors, as described previously. No opposition to the changes and no significant adverse comments are expected. Accordingly, this rule is exempt from notice-and-public comment requirements under 5 U.S.C. 553(b).
C. NCUA employees and contractors have had notice of the exemptions for NCUA-28 since *Federal Register* publication of the SORN on June 8, 2023. At the time of publication, no comments regarding the proposed exemptions were received. Therefore, even if this portion of the rule were not exempt from notice-and-comment requirements, the Board would find prior notice and comment unnecessary for this reason.
Accordingly, the Board finds good cause exists for making the amendments set forth in this interim final rule effective less than 30 days after publication.
**IV. Regulatory Procedures**
**A. Administrative Procedure Act**
The Board is issuing this interim final rule without prior notice and the opportunity for public comment and the 30-day delayed effective date ordinarily prescribed by the Administrative Procedure Act (APA). [^1] Pursuant to the APA, general notice and the opportunity for public comment are not required with respect to a rulemaking when an “agency for good cause finds (and incorporates the finding and a brief statement of reasons therefor in the rules issued) that notice and public procedure thereon are impracticable, unnecessary, or contrary to the public interest.” [^2]
[^1] 5 U.S.C. 553.
[^2] 5 U.S.C. 553(b)(B).
The Board believes that the public interest is best served by implementing the interim final rule as soon as possible. As discussed in the previous section of this preamble, one of the corrections is non-substantive, while the other concerns internal agency organization, management, or personnel matters, and is thus exempt from notice and comment requirements. For the reasons noted previously, the Board finds that there is good cause consistent with the public interest to issue the rule without advance notice and comment. [^3] Independently, the change to NCUA-28 is also exempt from the APA's notice-and-comment requirements as a rule of agency organization, procedure, or practice.
[^3] 5 U.S.C. 553(b)(B); 553(d)(3). For the same reasons, the Board is not providing the usual 60-day comment period before finalizing this rule. *See* NCUA Interpretive Ruling and Policy Statement (IRPS) 87-2, as amended by IRPS 03-2 and IRPS 15-1. 80 FR 57512 (Sept. 24, 2015), *available at https://www.ncua.gov/files/publications/irps/IRPS1987-2.pdf.*
While the Board believes that there is good cause to issue the rule without advance notice and comment and with an immediate effective date, it is interested in the views of the public and requests comment on the interim final rule.
**B. Congressional Review Act**
For purposes of the Congressional Review Act, the OMB makes a determination as to whether a final rule constitutes a “major” rule. If a rule is deemed a “major rule” by the Office of Management and Budget (OMB), the Congressional Review Act generally provides that the rule may not take effect until at least 60 days following its publication.
The Congressional Review Act defines a “major rule” as any rule that the Administrator of the Office of Information and Regulatory Affairs of the OMB finds has resulted in or is likely to result in (A) an annual effect on the economy of $100,000,000 or more; (B) a major increase in costs or prices for consumers, individual industries, Federal, State, or local government agencies or geographic regions, or (C) significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based enterprises to compete with foreign-based enterprises in domestic and export markets.
For the same reasons set forth above, the Board is adopting the interim final rule without the delayed effective date generally prescribed under the Congressional Review Act. The delayed effective date required by the Congressional Review Act does not apply to any rule for which an agency for good cause finds (and incorporates the finding and a brief statement of reasons therefor in the rule issued) that notice and public procedure thereon are impracticable, unnecessary, or contrary to the public interest. As discussed above, the Board has concluded there is good cause to issue the interim final rule without notice-and-comment procedures.
As required by the Congressional Review Act, the Board will submit the interim final rule and other appropriate reports to Congress and the Government Accountability Office for review. The Board believes the rule is not major.
**C. Regulatory Review (Executive Orders 12866 and 13563)**
Pursuant to Executive Order 12866 (“Regulatory Planning and Review”), a determination must be made whether a regulatory action is significant and therefore subject to review by the Office of Management and Budget (OMB) in accordance with the requirements of the Executive Order. OMB has determined that this proposed rule is not a “significant regulatory action” as defined in section 3(f) of Executive Order 12866.
Executive Order 13563 (“Improving Regulations and Regulatory Review”) directs executive agencies to analyze regulations that are “outmoded, ineffective, insufficient, or excessively burdensome, and to modify, streamline, expand, or repeal them in accordance with what has been learned.” Executive Order 13563 also directs that, where relevant, feasible, and consistent with regulatory objectives, and to the extent permitted by law, agencies are to identify and consider regulatory approaches that reduce burdens and maintain flexibility and freedom of choice for the public. This interim final rule does not govern the operations of regulated parties. It updates two of the agency's Privacy Act systems and exemptions. This proposed rule is consistent with Executive Order 13563.
**D. Regulatory Costs (Executive Order 14192)**
Executive Order 14192 (“Unleashing Prosperity Through Deregulation”) was issued on January 31, 2025. Section 3(c) of Executive Order 14192 requires that any new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least 10 prior regulations. This interim final rule is not expected to be an Executive Order 14192 regulatory action because it imposes no costs on regulated parties.
**E. Paperwork Reduction Act**
The Paperwork Reduction Act of 1995 (PRA) generally provides that an agency may not conduct or sponsor, and not withstanding any other provision of law, a person is not required to respond to a collection of information, unless it displays a currently valid Office of Management and Budget (OMB) control number.
The PRA applies to rulemakings in which an agency creates new or amends existing information collection requirements. For purposes of the PRA, an information-collection requirement may take the form of a reporting, recordkeeping, or a third-party disclosure requirement. The NCUA has determined that the changes in the interim final rule do not create a new information collection or revise an existing information collection as defined by the PRA.
**F. Executive Order 13132**
Executive Order 13132 (“Federalism”) encourages certain agencies to consider the impact of their actions on state and local interests. The NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order to adhere to fundamental federalism principles.
This interim final rule does not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government. The rule is administrative and largely governs internal agency procedures. The NCUA has therefore determined that this rule does not constitute a policy that has federalism implications for purposes of the executive order.
**G. Assessment of Federal Regulations and Policies on Families**
The NCUA has determined that this rule will not affect family well-being within the meaning of § 654 of the Treasury and General Government Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681 (1998).
**H. Regulatory Flexibility Act**
The Regulatory Flexibility Act (RFA) generally requires that when an agency issues a proposed rule or a final rule pursuant to the APA or another law, the agency must prepare a regulatory flexibility analysis that meets the requirements of the RFA and publish such analysis in the *Federal Register* . Specifically, the RFA normally requires agencies to describe the impact of a rulemaking on small entities by providing a regulatory impact analysis. For purposes of the RFA, the Board considers credit unions with assets less than $100 million to be small entities. This rule does not impose any requirements on federally-insured credit unions or other small entities.
As discussed previously, consistent with the APA, the Board has determined for good cause that general notice and opportunity for public comment is unnecessary, and therefore the Board is not issuing a notice of proposed rulemaking. Rules that are exempt from notice and comment procedures are also exempt from the RFA requirements, including conducting a regulatory flexibility analysis, when among other things the agency for good cause finds that notice and public procedure are impracticable, unnecessary, or contrary to the public interest. Accordingly, the Board has concluded that the RFA's requirements relating to initial and final regulatory flexibility analysis do not apply.
**List of Subjects in 12 CFR Part 792**
Administrative practice and procedure, Credit unions, Freedom of information, Information, Privacy, Records, Systems of records.
By the National Credit Union Administration Board on December 17, 2025.
Melane Conyers-Ausbrooks,
Secretary of the Board.
For the reasons stated in the preamble, the NCUA Board is amending 12 CFR part 792 as set forth below:
**PART 792—REQUESTS FOR INFORMATION UNDER THE FREEDOM OF INFORMATION ACT AND PRIVACY ACT, AND BY SUBPOENA; SECURITY PROCEDURES FOR CLASSIFIED INFORMATION**
**12 CFR Part 792**
1. The authority citation for part 792 continues to read as follows:
**Authority:**
5 U.S.C. 301, 552, 552a, 552b; 12 U.S.C. 1752a(d), 1766, 1789, 1795f; E.O. 12600, 52 FR 23781, 3 CFR, 1987 Comp., p.235; E.O. 13526, 75 FR 707, 2009 Comp. p.298.
**12 CFR Part 792**
2. Amend § 792.66 by:
a. In paragraph (b)(3), removing the text “NCUA-20” and adding in its place the text “NCUA-11”; and
b. Adding paragraph (b)(5).
The addition reads as follows:
§ 792.66
(b) * * *
(5) System NCUA-28, entitled “Anti-Harassment Case Tracking and Records” consists of investigatory materials compiled for law enforcement purposes. Records in the Anti-Harassment Case Tracking and Records system are used in connection with the execution of NCUA's responsibilities relating to conducting internal investigations into allegations of harassment. Because the system covers investigatory materials compiled for law enforcement purposes, it is eligible for exemption under subsection (k)(2) of the Privacy Act. The Anti-Harassment Case Tracking and Records system is exempt from subsections (c)(3), (d), (e)(1), (e)(4)(G), (e)(4)(H), (e)(4)(I), and (f) of the Privacy Act. However, if an individual is denied any right, privilege, or benefit to which he would otherwise be entitled by Federal law, or for which he otherwise would be eligible, as a result of the maintenance of such records, the records or information will be made available to him, provided the identity of a confidential source is not disclosed. NCUA need not make an accounting of previous disclosures of a record in this system of records available to its subject, and NCUA need not grant access to any records in this system of records by their subject. Further, whenever individuals request records about themselves and maintained in this system of records, the NCUA will advise the individuals only that no records available to them pursuant to the Privacy Act of 1974 have been identified. However, if review of the record reveals that the information contained therein has been used or is being used to deny the individuals any right, privilege or benefit for which they are eligible or to which they would otherwise be entitled under Federal law, the individuals will be advised of the existence of the information and will be provided the information, except to the extent disclosure would identify a confidential source. Where possible, information that would identify a confidential source will be extracted or summarized in a manner which protects the source and the summary or extract will be provided to the requesting individual.