January 13, 2026
SENT BY EMAIL
Dear XXXX:
Re: 2026-APP-00003 (Appeal of Response 2026-FOI-037)
On November 7, 2025, you submitted a Freedom of Information Act (FOIA) request (2026-FOI-037) to the National Credit Union Administration (NCUA). You requested access to, and copies of, organizational and charter records in the custody of the NCUA relating to the XXXX (also referred to as XXXX, XXXX, or similar names referring to a student or university-affiliated credit union at XXXX).
By letter of December 11, 2025, the NCUA FOIA Processing Center (FOIA Office) denied your FOIA request in full. The FOIA Office explained that the requested records are exempt from release pursuant to the FOIA exemptions at 5 U.S.C. §552 (b)(4) (Exemption 4), (b)(5) (Exemption 5), (b)(6) (Exemption 6) and (b)(8) (Exemption 8). Exemption 4 protects from disclosure records related to trade secrets and other confidential business information. Exemption 5 protects from disclosure information under the deliberative process privilege. Exemption 6 protects information about individuals in personnel and medical files, or similar files, when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy. Exemption 8 protects from disclosure records relating to the examination of banks and other financial institutions by agencies that regulate or supervise them.
The FOIA Office also explained that, in determining whether to withhold information, the NCUA determined that the harm from disclosing confidential commercial or financial information, which was submitted to the NCUA for consideration and deliberation as part of the charter process, is reasonably foreseeable.1 The FOIA Office noted that the harm in disclosure is particularly foreseeable in this instance given the pending nature of the application.
You appealed this determination in a correspondence received on December 11, 2025. Your appeal challenges the agency’s use of Exemptions 4, 5, 6, and 8. You argue that “the denial fails to meet the foreseeable harm standard, does not satisfy the FOIA’s segregability requirement, and improperly relies on the ‘pending nature’ of an application that has been stalled for years.” You assert that, based on your review of public reporting in XXXX, “the initiative began in 2018 and intended to launch in 2020.” You note that “it is now 2025, meaning the charter process has been effectively pending for five to seven years—far beyond a reasonable deliberative timeframe.”
Upon a full and independent review, your appeal is denied, as discussed more fully below.
Exemption 4
In your appeal, you argue that generic speculative harm assertions are legally insufficient and the NCUA has not shown any specific competitive harm from releasing five to seven year-old materials, whether the charter applicant actually maintains this information confidentially, nor any commercial competition facing a student-run credit union initiative at a single university.
Exemption 4 is intended to protect the interests of both the government and submitters of information.2 This exemption protects “commercial or financial information” obtained from a person3 that is “privileged or confidential.”4 When Exemption 4 is implicated, the interest protected by Exemption 4 is the information’s confidentiality.5 The term “confidential” is given its “ordinary” meaning of “private” or “secret” for purposes of Exemption 4.6 Thus, if commercial or financial information is held in confidence and given to the government under an assurance of confidentiality, the foreseeable harm standard is satisfied and the information may be withheld.7
The records you requested consist of sensitive financial and proprietary information that qualifies as confidential commercial or financial information that is within the scope of Exemption 4. Organizers of the proposed federal credit union (PFCU) customarily and actually hold such information in confidence as private information, and any commercial or financial information submitted to the agency in the course of the chartering process was provided under an implied assurance of confidentiality. Indeed, the PFCU’s confidential commercial or financial information is only in possession of the NCUA in its capacity as the federal agency that charters, regulates, and insures federal credit unions. Accordingly, the information you requested is properly withheld as exempt from FOIA release under Exemption 4.
Exemption 5
You challenge the agency’s use of Exemption 5, arguing that “deliberative process protection is not a permanent shield,” and the privilege applies only to records under active, ongoing deliberations by the agency. You assert that “courts reject using indefinite or unreasonable delay as justification for withholding,” and “the age of the application (7 years since inception, 5 years since intended launch) undermines any assertion that the matter is still actively under review.”
Exemption 5 incorporates the deliberative process privilege, the attorney-client privilege, and the attorney work product privilege.8 The deliberative process privilege is generally intended to “prevent injury to the quality of agency decisions.”9 The privilege protects “debate and candid consideration of alternatives,” thus improving agency decision making.10 After all, “experience teaches that those who expect public dissemination of their remarks may well temper candor . . . to the detriment of the decision-making process.”11 Records are protected as pre-decisional and deliberative where they are “antecedent” to the adoption of an agency policy or decision,12 and where they are “part of the deliberative process in that it makes recommendations or expresses opinions on legal or policy matters.”13
The records you requested are pre-decisional and deliberative and disclosure will harm the agency’s decision-making process. The charter application is currently pending, and disclosure of the requested records will hinder candid consideration of the application and temper open communication and deliberations among agency staff. Further, disclosure of a pending charter application will competitively disadvantage a nascent PFCU and undermine public confidence in the fairness and confidentiality of the NCUA’s charter application process.
While you suggest that the requested charter application is 5-7 years old and therefore “stalled” for a period that is “far beyond a reasonable deliberative timeframe,” the application is, in fact, still pending. It should be noted that every charter application varies, and the chartering process for some PFCUs may span multiple years. The NCUA’s chartering process is a phased approach.14 Generally, an organizing group should expect a minimum of one year to complete the charter application process.15 The complexity of the PFCU’s business model and the time the organizers take to complete all three phases of the process, including providing all necessary documentation, are major factors affecting the timeline. The NCUA strives to complete the review of a charter application, provide a charter decision, and complete the chartering process (in the case of a charter approval) within 180 calendar days from receipt of a complete charter application. In some cases, however, charter applications may have deficiencies that must be addressed before the NCUA’s analysis of the application can be completed. The agency will defer action on an incomplete application, granting multiple opportunities if needed, to enable organizers to cure those deficiencies and submit a revised application. An organizing group’s delay in sufficiently addressing application deficiencies can further prolong the process. Organizers have no fixed deadlines to correct deficiencies and resubmit complete applications, often taking some time to do so. This often leads to extended periods for correction, consequently causing additional delays.
Here, the subject charter application is pending and the harm in disclosure of records regarding an open application is reasonably foreseeable. Accordingly, the requested records are properly withheld under Exemption 5.
Exemption 6
Your appeal asserts that student names, phone numbers, and similar identifiers contained in the requested records can be redacted and the denial fails to explain why redaction is insufficient.
Under the FOIA, Exemption 6 protects information about individuals in “personnel and medical files and similar files” when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy.16 Determining whether information warrants protection under Exemption 6 requires a four-step analysis: (1) determine whether the information is a personnel, medical, or “similar” file;17 (2) determine whether there is a significant privacy interest in the requested information;18 (3) evaluate the requester’s asserted FOIA public interest in disclosure;19 and (4) if there is a significant privacy interest in non-disclosure and a FOIA public interest in disclosure, balance those competing interests to determine whether disclosure “would constitute a clearly unwarranted invasion of personal privacy.”20
Exemption 6 is interpreted broadly, and all information that “applies to a particular individual” meets the threshold requirement of falling within the category of “personnel and medical files and similar files” to warrant protection under Exemption 6.21 In this case, the requested records include personally identifying information (PII) that applies to particular agency personnel, as well as credit union organizers, subscribers, officials, mentors, and others who are private citizens participating in the charter application process. Thus, the threshold requirement is satisfied. Additionally, there is a significant privacy interest in the requested PII. PII is vulnerable to cybersecurity attacks and has been found to implicate a substantial privacy interest cognizable under the FOIA.22
Since a substantial privacy interest may be infringed by the disclosure of the requested PII, the next steps of the analysis require an assessment of the asserted public interest followed by a “balancing of the public interest served by disclosure against the harm resulting from the invasion of privacy.”23 When the disclosure of requested information could result in the invasion of personal privacy, the burden is on the requester to establish that disclosure would serve a public interest.24 The only relevant public interest in disclosure is the extent to which disclosure would serve the “core purpose of the FOIA,” which is “contributing significantly to public understanding of the operations or activities of the government.”25 “That purpose, however, is not fostered by disclosure of information about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency’s own conduct.”26
You have not asserted that any FOIA public interest would be served by disclosure of the PII in the requested records. If a significant privacy interest is found to exist, but there is no FOIA public interest in disclosure, the information should be protected because “something, even a modest privacy interest, outweighs nothing every time.”27 In the absence of any FOIA public interest in disclosure, the use of Exemption 6 to withhold PII is proper. The redaction of exempt PII is acceptable, provided that there are reasonably segregable portions of the agency’s responsive records that can be disclosed. See the discussion below for further details.
Exemption 8
Your appeal acknowledges that Exemption 8 covers supervision or examination materials, but you argue that organizational documents, bylaws, feasibility studies, and publicly facing application materials are not examination documents and require segregation and release.
Exemption 8 provides for protection against release of information contained in “or related to” examination, operating or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions.28 Exemption 8 was intended by Congress, and has been interpreted by courts, to be “very broadly construed.”29 Courts have noted that “Congress has intentionally and unambiguously crafted a particularly broad, all-inclusive definition,” and “it is not [the courts’] function, even in the FOIA context, to subvert that effort.”30 The primary purpose for Exemption 8 is “to ensure the security of financial institutions by elimination of the risk that disclosure of examination, operation, and condition reports containing frank evaluations of the investigated [institutions] might undermine public confidence” in those institutions.31 However, the secondary purpose is to safeguard the relationship between financial institutions and their supervising agencies.32 Generally, “all records, regardless of the source, of [a financial institution’s] financial condition and operations [that are] in the possession of a federal agency ‘responsible for the regulation or supervision of financial institutions,’ are exempt.”33
The requested information meets this broad standard insofar as the information is related to records of a PFCU’s financial condition and operations that are in the possession of the NCUA, a federal agency responsible for the regulation or supervision of financial institutions. The fact that a credit union is not in operation does not, in itself, render the exemption inapplicable.34 Courts have held that even records pertaining to institutions that are no longer in operation are protected under Exemption 8 to serve the public policy of promoting “frank cooperation” between institution and agency officials.35 The same logic and reasoning can be applied to records of a PFCU that is in the process of applying for a charter but not yet operational. Accordingly, Exemption 8 is also available in this case.
Reasonably Segregable
If an agency determines that it cannot or should not make full disclosure of a requested record, the FOIA calls for agencies to “consider whether partial disclosure of information is possible” and “take reasonable steps necessary to segregate and release nonexempt information.”36 However, the NCUA is not required to disclose information “inextricably intertwined with exempt portions,”37 and “need not disclose a redacted version of [a record] if the unredacted markings would have minimal or no information content.”38
The requested records that were withheld are fully exempt under one or more of Exemptions 4, 5, 6, or 8, or inextricably intertwined with exempt portions of the records. There are no reasonably segregable portions of the agency’s responsive records that can be disclosed without causing reasonably foreseeable harm to the PFCU and its organizers, agency decision-making and public confidence, agency relations with supervised entities, or cause a clearly unwarranted invasion of personal privacy. Accordingly, the requested information is properly withheld as fully exempt pursuant to one or more FOIA exemptions.
Vaughn Index
Finally, you have requested a so-called “Vaughn index,” which is an index of withheld documents or portions of documents that a plaintiff in a FOIA litigation is entitled to.39
Your administrative appeal is outside the litigation context. The agency declines to provide a Vaughn index in this matter.
For these reasons, the December 11, 2025, response is affirmed, and your FOIA appeal is denied. Pursuant to 5 U.S.C. §552(a)(4)(B) of the FOIA, you may seek judicial review of this determination by filing suit against the NCUA. Such a suit may be filed in the United States District Court where you reside, where your principal place of business is located, the District of Columbia, or where any documents, if available, are located (the Eastern District of Virginia).
The 2007 FOIA amendments created the Office of Government Information Services (OGIS) to offer mediation services to resolve disputes between FOIA requesters and Federal agencies as a non-exclusive alternative to litigation. Using OGIS services does not affect your right to pursue litigation. You may contact OGIS in any of the following ways:
Office of Government Information Services
National Archives and Records Administration
8601 Adelphi Road - OGIS
College Park, MD 20740-6001
Email: ogis@nara.gov
Web: https://ogis.archives.gov
Telephone: 202.741.5770
Toll-free: 877.684.6448
Fax: 202.741.5769
Sincerely,
/s/
Frank Kressman
General Counsel
GC/PY
2026-APP-00003; 2026-FOI-037
Footnotes
1 5 U.S.C. § 552(a)(8)(A)(i).
2 See Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356, 2363 (2019).
3 The FOIA defines “person” as an “individual, partnership, corporation, association, or public or private organization other than an agency.” 5 U.S.C. § 551(2).
4 5 U.S.C. § 552(b)(4).
5 American Small Business League v. Department of Defense, 3:18-cv-01979-WHA (N.D. Cal. 2019) ECF No. 153 at 14.
6 Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356, 2363 (2019) (finding that “where commercial or financial information is both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy, the information is ‘confidential’ within the meaning of Exemption 4.”).
7 American Small Business League at 14.
8 Id.
9 NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 151 (1975).
10 Jordan v. DOJ, 591 F.2d 753, 772 (D.C. Cir. 1978) (en banc).
11 Machado Amadis v. United States Dep't of State, 971 F.3d 364, 371 (D.C. Cir. 2020) (quoting Sears at 150–51 (quotation marks omitted)).
12 Ancient Coin Collectors Guild v. U.S. Dep't of State, 641 F.3d 504, 513 (D.C. Cir. 2011) (quoting Jordan v. DOJ, 591 F.2d 753, 774 (D.C. Cir. 1978) (en banc)); see also Adamowicz v. IRS, 672 F. Supp. 2d 454, 469 (S.D.N.Y. 2009).
13 Vaughn v. Rosen, 523 F.2d 1136, 1143-44 (D.C. Cir. 1975).
14 See Overview of the Charter Application Process, available at https://ncua.gov/support-services/credit-union-resources-expansion/starting-new-federal-credit-union.
15 See Frequently Asked Questions, available at https://ncua.gov/regulation-supervision/manuals-guides/federal-credit-union-charter-application-guide/faqs.
16 5 U.S.C. § 552(b)(6).
17 Id.
18 See Multi Ag Media LLC v. USDA, 515 F.3d 1224, 1229 (D.C. Cir. 2008).
19 See NARA v. Favish, 541 U.S. 157, 172 (2004).
20 5 U.S.C. §552(b)(6); see also Favish, 541 U.S. 157 at 172.
21 U.S. Dep’t of State v. Washington Post Co., 456 U.S. 595, 602 (1982).
22 See, e.g., Wadhwa v. VA, 707 F. App’x 61, 63-64 (3d Cir. 2017) (protecting personally identifying information, including names, phone numbers, and email addresses, concerning individuals involved in adjudication of discrimination complaints in absence of any FOIA public interest).
23 Int’l Brotherhood of Elec. Workers Loc. Union No. 5, 852 F.2d at 89.
24 See NARA v. Favish, 541 U.S. 157 (2004).
25 Sheet Metal Workers Int’l Ass’n, Local Union No. 19 v. U.S. Dep't of Veterans Affairs, 135 F.3d 891, 897 (3d Cir. 1998) (citing U.S. Dep’t of Defense et al. v. Federal Labor Relations Auth., 510 U.S. 487, 495–496 (1994)); see also Dep’t of the Air Force v. Rose, 425 U.S. 352, 372 (1976) (noting information that serves the “basic purpose” of the FOIA to “open agency action to the light of public scrutiny” constitutes a FOIA public interest in disclosure).
26 Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 773 (1989) (quoting Rose, 425 U.S. at 360–361).
27 Nat'l Ass'n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 879 (D.C. Cir. 1989); see also Int’l Brotherhood of Elec. Workers Loc. Union No. 5 v. HUD, 852 F.2d 87, 89 (3d Cir. 1988) (perceiving no public interest in disclosure and therefore protecting employees’ social security numbers); Pubien v. EOUSA, No. 18-0172, 2018 WL 5923917, at *5 (D.D.C. Nov. 13, 2018) (finding names subject to withholding because plaintiff failed to identify any FOIA public interest in disclosure); Maryland v. VA, 130 F. Supp. 3d 342, 353 (D.D.C. 2015) (protecting identifying portions of email addresses of individuals whose businesses were not selected for inclusion in small business database because public interest in such information was “practically nonexistent”).
28 5 U.S.C. §552(b)(8).
29 Pentagon Fed. Credit Union v. Nat’l Credit Union Admin., No. 95-1475, 1996 U.S. Dist. LEXIS 22841, at *11 (E.D. Va. June 7, 1996).
30 Consumers Union of the U.S., Inc. v. Heimann, 589 F.2d 531, 533 (D.C. Cir. 1978).
31 James Madison Project v. Dep’t of the Treasury, 478 F. Supp. 3d 8, 14 (D.D.C. 2020) (internal citation omitted); see also McKinley v. FDIC, 744 F. Supp. 2d 128, 144 (D.D.C. 2010).
32 See Consumers Union, 589 F.2d at 534; see also Fagot v. FDIC, 584 F. Supp. 1168, 1173 (D.P.R. 1984) (recognizing Exemption 8’s secondary purpose “to provide banks and financial institutions supervised by the federal government sufficient assurance of confidentiality to promote full cooperation with the regulatory agencies”).
33 McCullough v. FDIC, No. 79-1132, 1980 U.S. Dist. LEXIS 17685, at **7-8 (D.D.C. July 28, 1980) (quoting legislative history).
34 See Gregory v. FDIC, 631 F. 2d 896, 899 (D.C. Cir. 1980).
35 Id.; see also Berliner, Zisser, Walter & Gallegos v. SEC, 962 F. Supp. 1348, 1353 (D. Colo. 1997).
36 5 U.S.C. § 552(a)(8)(A)(ii).
37 Mead Data Cent., Inc. v. United States Dep't of the Air Force, 566 F.2d 242, 260 (D.C. Cir. 1977).
38 Perioperative Servs. & Logistics, LLC v. U.S. Dep’t of Veterans Affairs, 57 F.4th 1061, 1069 (D.C. Cir. 2023) (citing Mead Data Center, Inc. v. Dep’t of the Air Force, 566 F.2d 242, 261 n.55 (D.C. Cir. 1977)).
39 See Vaughn v. Rosen, 484 F.2d 820 (D.C. Cir.1973), cert. denied, 415 U.S. 977 (1974).