(a) A financial institution or an affiliate of a financial institution, including its holding company, may establish a compliance review committee to test, review, or evaluate the financial institution’s conduct, transactions, or potential transactions for the purpose of monitoring and improving or enforcing compliance with:
(1) a statutory or regulatory requirement;
(2) financial reporting to a governmental agency;
(3) the policies and procedures of the financial institution or its affiliates; or
(4) safe, sound, and fair lending practices.
(b) Except as provided by Subsection (c):
(1) a compliance review document is confidential and is not discoverable or admissible in evidence in a civil action;
(2) an individual serving on a compliance review committee or acting under the direction of a compliance review committee may not be required to testify in a civil action as to:
(A) the contents or conclusions of a compliance review document; or
(B) an action taken or discussions conducted by or for a compliance review committee; and
(3) a compliance review document or an action taken or discussion conducted by or for a compliance review committee that is disclosed to a governmental agency remains confidential and is not discoverable or admissible in a civil action.

(c) Subsection (b)(2) does not apply to an individual who has management responsibility for the operations, records, employees, or activities being examined or evaluated by the compliance review committee.
(d) This section does not limit the discovery or admissibility in a civil action of a document that is not a compliance review document.