Except as provided in section 36.10 of the Banking Law, or subdivisions (b), (c) or (d) of this section, a regulated entity shall not disclose any confidential supervisory information to any person without the prior written approval of the department and subject to any terms and conditions that are imposed by the department on any such disclosure.

Notwithstanding the requirements of subdivision (a) of this section, without obtaining the prior written approval of the department, a regulated entity may disclose confidential supervisory information, which is lawfully in the possession of such regulated entity, to legal counsel or an independent auditor that has been retained or engaged by such regulated entity pursuant to an engagement letter or written agreement, provided that such legal counsel or an independent auditor has in writing:

A regulated entity may disclose confidential supervisory information, which is lawfully in the possession of such regulated entity, to independent auditors as part of the independent auditor’s acceptance of a new client engagement or the continuation of an existing annual audit engagement; provided that the regulated entity receives a written acknowledgement from the independent auditor that such disclosed information is confidential supervisory information under section 36.10 of the Banking Law, and the independent auditor agrees in writing to abide by the prohibition on the dissemination of confidential supervisory information contained in subdivision (a) of this section.

When necessary and appropriate for business purposes, a regulated entity may disclose confidential supervisory information, which is lawfully in the possession of such regulated entity, to its affiliates and the directors, officers and employees thereof on the condition that such persons maintain the confidentiality of such information.

Any regulated entity, any affiliate, legal counsel, independent auditor or any other person served with a request, subpoena, order, motion to compel, or other judicial or administrative process to provide confidential supervisory information shall:

Following receipt of notice pursuant to subdivision (e) of this section, the department may direct the requester to intervene in the judicial, administrative, or other action, take all reasonable efforts to have the compulsory process withdrawn, register other appropriate objections, or take other action.

Upon written request to and approval by both the Senior Deputy Superintendent for Banking (or his or her delegate) and the General Counsel (or his or her delegate), when not prohibited by law, confidential supervisory information relating to a regulated entity may be made available to a State or Federal supervisory agency having direct supervisory authority over such regulated entity.

The possession of confidential supervisory information by any regulated entity, any affiliate, legal counsel, independent auditor or any other person does not constitute a waiver by the department of its right to control, or impose limitations on, the subsequent use and dissemination of such confidential supervisory information.