1.    Upon request of the commissioner, a financial institution must submit a compliance self-critical analysis audit document to the commissioner, or the commissioner’s designee, as a confidential document under the provisions of section 6-01-07, without waiving the privilege set forth in this chapter to which the financial institution would otherwise be entitled. However, the provisions of section 6-01-07 permitting the commissioner to release confidential documents and make them accessible to federal financial institution regulatory agencies does not apply to the compliance self-critical analysis audit documents voluntarily submitted. To the extent the commissioner has the authority to compel the disclosure of a compliance self-critical analysis audit document under other provisions of applicable law, any report furnished to the commissioner may not be provided to any other person or entity and must be accorded the same confidentiality and other protections as provided above for voluntarily submitted documents. Any use of a compliance self-critical analysis audit document furnished as a result of a request of the commissioner, whether under a claim of authority to compel disclosure or not, is limited to determining whether any disclosed defects in a financial institution’s policies or procedures or inappropriate treatment of customers has been remedied or that an appropriate plan for their remedy is in place. The commissioner may not impose any type of administrative fine or penalty as to any area addressed or matter covered in a compliance self-critical analysis audit document furnished at the commissioner’s request, except when there is clear and convincing evidence that the financial institution failed to undertake reasonable corrective action, eliminate inappropriate treatment of customers, or failed to implement an appropriate plan to rectify any noncompliance with state and federal statutes, rules, and orders.

2.    A financial institution’s compliance self-critical analysis audit document submitted to the commissioner remains subject to all applicable statutory or common-law privileges, including the work product doctrine, attorney-client privilege, or the subsequent remedial measures exclusion. A compliance self-critical analysis audit document submitted to and in the possession of the commissioner remains the property of the financial institution and is not subject to any disclosure or production under section 44-04-18.

3.    Disclosure of a compliance self-critical analysis audit document to a governmental agency, whether voluntary or pursuant to compulsion of law, does not constitute a waiver of the privilege with respect to any other person or any other governmental agency.