OSHA Reporting Software for Banks When the 300 Log Is Exempt

A teller is hospitalized after an incident at a branch on a Friday evening. Your bank does not keep a 300 log, because credit intermediation sits on the partial-exemption list, and the branch manager knows that. What that manager may not know is that a separate clock started the moment somebody learned of the admission.

The gap this creates is narrow and it matters. That gap exists because an exemption from the routine paperwork leaves the severe-injury reporting duty untouched, and the 2 are easy to confuse. A network that has stopped thinking about the duty will meet the difference at the worst possible moment.

What the Exemption Covers

That exemption is set out in Appendix A to Subpart B of Part 1904, which lists the industries excused from routine recordkeeping, and banks appear on it. Those codes are NAICS 5221, 5222 and 5223, covering depository and nondepository credit intermediation and the activities related to them. A bank whose establishments fall in any of those codes does not maintain the Form 300 log, the 300A summary or the 301 incident report as routine practice.

The injury data behind that listing explains the reasoning. Those codes record very few injuries. Finance and insurance came in at 0.3 total recordable cases per 100 full-time equivalent workers in 2024, and credit intermediation at 0.5, against 2.3 across private industry. These are low-hazard workplaces by the measure the regulator uses.

29 CFR 1904.2(a)(1) says so in a single sentence. An establishment in a listed industry keeps no records unless the government asks for them, and every employer must still report a fatality, in-patient hospitalization, amputation or loss of an eye. Those 2 carve-outs are the whole of what a bank has left to manage.

The Deadlines Are Short and They Run From Learning

That reporting duty sits in 29 CFR 1904.39 and it sets 2 short windows. A work-related fatality goes to the agency within 8 hours of the employer learning of the death. An in-patient hospitalization, an amputation or the loss of an eye goes within 24 hours of the employer learning of that outcome.

Those windows start from the moment somebody at the bank knows. A slip on Friday that becomes an admission on Sunday starts a 24-hour clock on Sunday, and a branch manager who assumes the exemption covers everything will not start counting at all. The report itself is a phone call to the area office, the toll-free number, or the agency's online reporting application.

What Triggers the Obligation in a Branch

Branch work produces fewer incidents than a plant, and the ones it does produce reach those windows only when they go badly. A robbery that results in an in-patient hospitalization is reportable. So is a fall on a wet floor that puts somebody in hospital overnight, and an overexertion injury that leads to an admission.

What decides it is the outcome and never the event. A robbery that produces no qualifying injury triggers nothing here, and a slip on a wet floor that produces an admission triggers the full obligation. That inversion is the practical rule a branch operations team needs to carry.

Most branch networks have no procedure covering any of that, because the exemption has been treated as a complete answer for years. Writing one takes an afternoon and it is mostly about who escalates to whom. The regulation supplies the deadline, and the bank supplies the name.

Those 2 names, the escalator and the caller, are what the procedure has to fix. Give your branches 4 instructions and the rest follows:

• Record every incident, including the ones nobody thinks are reportable.
• Capture the date and time somebody first learned of a hospital admission.
• Escalate any admission, amputation or loss of an eye to one named person.
• Keep the record after the event closes, because a survey can ask for it.

A tabletop test is the cheapest way to find out whether those instructions landed. Pick a branch, describe a Friday evening admission, and time how long it takes the team to reach the person who would make the call. Most networks are surprised by the answer the first time.

Ask your branch managers what would happen if an employee were admitted to hospital tomorrow. Who makes the report, and by when? The answer should be a name and a number of hours. Where it is "we are exempt", the exemption has been read as covering more than it does.

OSHA and BLS Can Still Ask for Your Records

The second half of the exemption is the part most banks have never tested. Under 29 CFR 1904.41(a)(3) an employer must electronically submit the requested information from its records upon notification, and under 1904.42 it must complete and return a BLS survey form it receives. Both of those powers assume the records already exist when the letter arrives.

That survey is also where the numbers in this article come from, including the 0.3 rate for finance and insurance. An employer selected for it has to produce a year of incident history on request, which is difficult for a network that records incidents branch by branch in email. The request arrives with its own deadline attached to it.

State Plans Can Go Further Than the Federal Baseline

Jurisdiction is the third thing that survey exposes for a multi-state bank. There are 22 State Plans covering private sector employers, alongside 7 covering only state and local government workers. Each must be at least as effective as the federal program and may go beyond it.

So a branch in one state can have an obligation its sister branch does not. Checking that is a one-off exercise for most networks, and nobody does it twice. Competency mapping for retail banking roles covers keeping role requirements straight across a network, and the same discipline applies to jurisdictional ones.

What KC Safety Gives a Branch Network

Producing that history on request is where KC Safety earns its place, and it starts at intake. A branch employee reports through a form that captures what happened and when, including the date and time an outcome became known, which is the fact the 1904.39 clock depends on. The record then exists from the first report onward.

What it holds afterwards is the part that answers a notification. Incident history is retained with its dates, its contributing factors and its witness statements, so a bank that receives a survey or a records request produces the answer from one place. Anonymous reporting raises the number of incidents that reach the record at all.

Those forms are there when a jurisdiction or an acquisition brings an establishment into scope. The product generates the 300, 300A and 301 forms from the intake data, which matters for a bank that buys a business outside the exempt codes. Where an incident produces a corrective action, the CAPA workflow carries an owner, a due date and verification at 30, 60 and 90 days.

For banking and finance teams that owner-and-verification pattern is the discipline the rest of the control environment already runs on. It usually makes the internal argument an easy one. The safety record ends up looking like every other control record the bank keeps.

The reporting clock itself remains the bank's to run. Name the person who makes the call, write the 8-hour and 24-hour windows into your incident procedure, and test it on a tabletop this quarter. Ready-made compliance courses against custom ones covers training the branch staff who will make that first report.

Frequently Asked Questions

1. Are banks required to keep an OSHA 300 log?

Generally no. NAICS 5221, 5222 and 5223 appear on the partial-exemption list in Appendix A to Subpart B of Part 1904, so establishments in those codes are not required to maintain the Form 300 log, the 300A summary or the 301 report as routine practice. 29 CFR 1904.2(a)(1) preserves 2 exceptions: records on government request, and severe-injury reporting.

2. What injuries at a bank must be reported to OSHA?

Under 29 CFR 1904.39 every employer, including a partially exempt bank, must report a work-related fatality within 8 hours of learning of the death, and a work-related in-patient hospitalization, amputation or loss of an eye within 24 hours of learning of that outcome. The exemption from the 300 log does not affect those deadlines.

3. Can OSHA require a bank to produce injury records anyway?

Yes. 29 CFR 1904.41(a)(3) provides that upon notification an employer must electronically submit the requested information from its part 1904 records, and 29 CFR 1904.42(a) requires an employer receiving a BLS Survey of Occupational Injuries and Illnesses form to complete and return it. Both assume the underlying records exist.

4. Do State Plan states change a bank's obligations?

They can. OSHA reports 22 State Plans covering private sector employers, alongside 7 covering only state and local government workers. Each must be at least as effective as the federal program and may impose requirements that exceed the federal baseline, so a multi-state network should check obligations at jurisdiction level.

References

1. Legal Information Institute. Appendix A to Subpart B of Part 1904, Partially Exempt Industries. law.cornell.edu
2. Legal Information Institute. 29 CFR 1904.39, Reporting Fatalities, Hospitalizations, Amputations, and Losses of an Eye. law.cornell.edu
3. Legal Information Institute. 29 CFR 1904.41, Electronic Submission of Injury and Illness Records to OSHA. law.cornell.edu
4. Legal Information Institute. 29 CFR 1904.42, Requests From the Bureau of Labor Statistics for Data. law.cornell.edu
5. Bureau of Labor Statistics. Table 1, Incidence Rates of Nonfatal Occupational Injuries and Illnesses by Industry, 2024. bls.gov
6. Occupational Safety and Health Administration. State Plans. osha.gov