# FDIC FIL-74-2021: Computer-Security Incident Notification Final Rule

> Federal · Agency guidance · In force

URL: https://www.frixlaw.com/law-library/statutes/FDIC_FIL21074

## Section

- **Citation:** FDIC FIL-74-2021
- **Heading:** Computer-Security Incident Notification Final Rule
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** FDIC Financial Institution Letters / Computer-Security Incident Notification Final Rule

## Text

66424
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
1 For the OCC, ‘‘banking organizations’’ includes
national banks, Federal savings associations, and
Federal branches and agencies of foreign banks. For
the Board, ‘‘banking organizations’’ includes all
U.S. bank holding companies and savings and loan
holding companies; state member banks; the U.S.
operations of foreign banking organizations; and
Edge and agreement corporations. For the FDIC,
‘‘banking organizations’’ includes all insured state
nonmember banks, insured state-licensed branches
of foreign banks, and insured State savings
associations. Each agency’s definition excludes
financial market utilities (FMUs) designated under
Title VIII of the Dodd-Frank Wall Street Reform and
Consumer Protection Act (designated FMUs).
Signed in Washington, DC, on November
18, 2021.
Treena V. Garrett,
Federal Register Liaison Officer, U.S.
Department of Energy.
[FR Doc. 2021–25537 Filed 11–22–21; 8:45 am]
BILLING CODE 6450–01–P
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the
Currency
12 CFR Part 53
[Docket ID OCC–2020–0038]
RIN 1557–AF02
FEDERAL RESERVE SYSTEM
12 CFR Part 225
[Docket No. R–1736]
RIN 7100–AG06
FEDERAL DEPOSIT INSURANCE
CORPORATION
12 CFR Part 304
RIN 3064–AF59
Computer-Security Incident
Notification Requirements for Banking
Organizations and Their Bank Service
Providers
AGENCY: The Office of the Comptroller
of the Currency (OCC), Treasury; the
Board of Governors of the Federal
Reserve System (Board); and the Federal
Deposit Insurance Corporation (FDIC).
ACTION: Final rule.
SUMMARY: The OCC, Board, and FDIC
are issuing a final rule that requires a
banking organization to notify its
primary Federal regulator of any
‘‘computer-security incident’’ that rises
to the level of a ‘‘notification incident,’’
as soon as possible and no later than 36
hours after the banking organization
determines that a notification incident
has occurred
(FDIC).
ACTION: Final rule.
SUMMARY: The OCC, Board, and FDIC
are issuing a final rule that requires a
banking organization to notify its
primary Federal regulator of any
‘‘computer-security incident’’ that rises
to the level of a ‘‘notification incident,’’
as soon as possible and no later than 36
hours after the banking organization
determines that a notification incident
has occurred. The final rule also
requires a bank service provider to
notify each affected banking
organization customer as soon as
possible when the bank service provider
determines that it has experienced a
computer-security incident that has
caused, or is reasonably likely to cause,
a material service disruption or
degradation for four or more hours.
DATES: Effective date: April 1, 2022;
Compliance date: May 1, 2022.
FOR FURTHER INFORMATION CONTACT:
OCC: Patrick Kelly, Director, Critical
Infrastructure Policy, (202) 649–5519,
Carl Kaminski, Assistant Director, (202)
649–5490, or Priscilla Benner, Senior
Attorney, Chief Counsel’s Office, (202)
649–5490, Office of the Comptroller of
the Currency, 400 7th Street SW,
Washington, DC 20219.
Board: Thomas Sullivan, Senior
Associate Director, (202) 475–7656, Julia
Philipp, Lead Financial Institution
Cybersecurity Policy Analyst, (202)
452–3940, Don Peterson, Supervisory
Cybersecurity Analyst, (202) 973–5059,
Systems and Operational Resiliency
Policy, of the Supervision and
Regulation Division; Jay Schwarz,
Assistant General Counsel, (202) 452–
2970, Claudia Von Pervieux, Senior
Counsel (202) 452–2552, Christopher
Danello, Senior Attorney, (202) 736–
1960, Legal Division, Board of
Governors of the Federal Reserve
System, 20th and C Streets NW,
Washington, DC 20551, or https://
www.federalreserve.gov/apps/
ContactUs/feedback.aspx, and click on
Staff Group, Regulations.
FDIC: Rob Drozdowski, Special
Assistant to the Deputy Director (202)
898–3971, rdrozdowski@fdic.gov,
Division of Risk Management
Supervision; or John Dorsey, Counsel
1960, Legal Division, Board of
Governors of the Federal Reserve
System, 20th and C Streets NW,
Washington, DC 20551, or https://
www.federalreserve.gov/apps/
ContactUs/feedback.aspx, and click on
Staff Group, Regulations.
FDIC: Rob Drozdowski, Special
Assistant to the Deputy Director (202)
898–3971, rdrozdowski@fdic.gov,
Division of Risk Management
Supervision; or John Dorsey, Counsel
(202) 898–3807, jdorsey@fdic.gov,
Graham Rehrig, Senior Attorney, (202)
898–3829, grehrig@fdic.gov, Legal
Division.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Introduction
II. Background
A. Overview of Comments
III. Discussion of Final Rule
A. Overview of Final Rule
B. Definitions
i. Definition of Banking Organization
ii. Definition of Bank Service Provider
iii. Definition of Computer-Security
Incident
iv. Definition of Notification Incident
v. Examples of Notification Incidents
C. Banking Organization Notification to
Agencies
i. Timing of Notification to Agencies
ii. Method of Notification to Agencies
D. Bank Service Provider Notification to
Banking Organization Customers
i. Scope of Bank Service Provider
Notification
ii. Timing of Bank Service Provider
Notification
iii. Bank Service Provider Notification to
Customers
iv. Bank Service Provider Agreements—
Contract Notice Provisions
IV. Other Rulemaking Considerations
A. Bank Service Provider Material
Incidents Consideration
B. Methodology for Determining Number of
Incidents Subject to the Rule
C. Voluntary Information Sharing
D. Utilizing Prompt Corrective Action
Capital Classifications
E. Ability To Rescind Notification and
Obtain Record of Notice
F. Single Notification Definition
G. Affiliated Banking Organizations
Considerations
H. Consideration of the Number of Bank
Service Providers
V. Impact Analysis
VI. Alternatives Considered
VII. Effective Date
VIII. Administrative Law Matters
A. Paperwork Reduction Act
B. Regulatory Flexibility Act
C
apital Classifications
E. Ability To Rescind Notification and
Obtain Record of Notice
F. Single Notification Definition
G. Affiliated Banking Organizations
Considerations
H. Consideration of the Number of Bank
Service Providers
V. Impact Analysis
VI. Alternatives Considered
VII. Effective Date
VIII. Administrative Law Matters
A. Paperwork Reduction Act
B. Regulatory Flexibility Act
C. Riegle Community Development and
Regulatory Improvement Act of 1994
D. Congressional Review Act
E. Use of Plain Language
F. Unfunded Mandates Reform Act
I. Introduction
The OCC, Board, and FDIC (together,
the agencies) are issuing a final rule to
require that a banking organization 1
promptly notify its primary Federal
regulator of any ‘‘computer-security
incident’’ that rises to the level of a
‘‘notification incident,’’ as those terms
are defined in the final rule. As
described in more detail below, these
incidents may have many causes.
Examples include a large-scale
distributed denial of service attack that
disrupts customer account access for an
extended period of time and a computer
hacking incident that disables banking
operations for an extended period of
time.
Under the final rule, a banking
organization’s primary Federal regulator
must receive this notification as soon as
possible and no later than 36 hours after
the banking organization determines
that a notification incident has
occurred. This requirement will help
promote early awareness of emerging
threats to banking organizations and the
broader financial system. This early
awareness will help the agencies react
to these threats before they become
systemic
r
must receive this notification as soon as
possible and no later than 36 hours after
the banking organization determines
that a notification incident has
occurred. This requirement will help
promote early awareness of emerging
threats to banking organizations and the
broader financial system. This early
awareness will help the agencies react
to these threats before they become
systemic. The final rule separately
requires a bank service provider to
notify each affected banking
organization customer as soon as
possible when the bank service provider
determines it has experienced a
computer-security incident that has
caused, or is reasonably likely to cause,
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00022
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66425
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
2 See, e.g., Financial Crimes Enforcement
Network, SAR Filings by Industry (Jan. 1, 2014–Dec.
31, 2020) (last accessed Oct. 11, 2021), https://
www.fincen.gov/reports/sar-stats/sar-filings-
industry. (Trend data may be found by downloading
the Excel file ‘‘Depository Institution’’ and selecting
the tab marked ‘‘Exhibit 5.’’).
3 As defined by the final rule, a computer-security
incident is an occurrence that results in actual harm
to the confidentiality, integrity, or availability of an
information system or the information that the
system processes, stores, or transmits. To promote
uniformity of terms, the agencies have sought to
align this term generally with an existing definition
from the National Institute of Standards and
Technology (NIST). See NIST, Computer Security
Resource Center, Glossary (last accessed Sept. 20,
2021), available at https://csrc.nist.gov/glossary/
term/Dictionary
or the information that the
system processes, stores, or transmits. To promote
uniformity of terms, the agencies have sought to
align this term generally with an existing definition
from the National Institute of Standards and
Technology (NIST). See NIST, Computer Security
Resource Center, Glossary (last accessed Sept. 20,
2021), available at https://csrc.nist.gov/glossary/
term/Dictionary.
4 These computer-security incidents may include
major computer-system failures; cyber-related
interruptions, such as distributed denial of service
and ransomware attacks; or other types of
significant operational interruptions.
5 As defined in the final rule, a notification
incident is a computer-security incident that has
materially disrupted or degraded, or is reasonably
likely to materially disrupt or degrade, a banking
organization’s: (i) Ability to carry out banking
operations, activities, or processes, or deliver
banking products and services to a material portion
of its customer base, in the ordinary course of
business; (ii) business line(s), including associated
operations, services, functions, and support, that
upon failure would result in a material loss of
revenue, profit, or franchise value; or (iii)
operations, including associated services, functions
and support, as applicable, the failure or
discontinuance of which would pose a threat to the
financial stability of the United States.
6 OCCIP coordinates with U.S. Government
agencies to provide agreed-upon assistance to
banking and other financial services sector
organizations on computer-incident response and
recovery efforts. These activities may include
providing remote or in-person technical support to
an organization experiencing a significant cyber
event to protect assets, mitigate vulnerabilities,
recover and restore services, identify other entities
at risk, and assess potential risk to the broader
community
other financial services sector
organizations on computer-incident response and
recovery efforts. These activities may include
providing remote or in-person technical support to
an organization experiencing a significant cyber
event to protect assets, mitigate vulnerabilities,
recover and restore services, identify other entities
at risk, and assess potential risk to the broader
community. The Federal Financial Institutions
Examination Council’s Cybersecurity Resource
Guide for Financial Institutions (Oct. 2018)
identifies additional information available to
banking organizations. Available at: https://
www.ffiec.gov/press/pdf/FFIEC%20Cybersecurity%
20Resource%20Guide%20for%20Financial%20
Institutions.pdf (last accessed Oct. 15, 2021).
7 See 31 U.S.C. 5311 et seq.; 31 CFR subtitle B,
chapter X.
8 See 15 U.S.C. 6801; 12 CFR part 30, appendix
B, supplement A (OCC); 12 CFR part 208, appendix
D–2, supplement A, 12 CFR 211.5(l), 12 CFR part
225, appendix F, supplement A (Board); 12 CFR
part 364, appendix B, supplement A (FDIC).
9 Banking organizations that experience a
computer-security incident that may be criminal in
nature are expected to contact relevant law
enforcement or security agencies, as appropriate,
after the incident occurs. This rule does not change
that expectation.
10 86 FR 2299 (Jan. 12, 2021).
11 These computer-security incidents may include
major computer-system failures, cyber-related
interruptions, such as distributed denial of service
and ransomware attacks, or other types of
significant operational interruptions.
12 NIST is an agency of the U.S. Department of
Commerce that works to develop and apply
technology, measurements, and standards.
13 12 U.S.C. 1861–67.
a material service disruption or
degradation for four or more hours
omputer-system failures, cyber-related
interruptions, such as distributed denial of service
and ransomware attacks, or other types of
significant operational interruptions.
12 NIST is an agency of the U.S. Department of
Commerce that works to develop and apply
technology, measurements, and standards.
13 12 U.S.C. 1861–67.
a material service disruption or
degradation for four or more hours. This
separate requirement will ensure that a
banking organization receives prompt
notification of a computer-security
incident that materially disrupts or
degrades, or is reasonably likely to
materially disrupt or degrade, covered
services provided by a bank service
provider. This notification will allow
the banking organization to assess
whether the incident has or is
reasonably likely to have a material
impact on the banking organization and
thus trigger the banking organization’s
own notification requirement.
II. Background
Computer-security incidents can
result from destructive malware or
malicious software (cyberattacks), as
well as non-malicious failure of
hardware and software, personnel
errors, and other causes. Cyberattacks
targeting the financial services industry
have increased in frequency and
severity in recent years.2 These
cyberattacks can adversely affect
banking organizations’ networks, data,
and systems, and ultimately their ability
to resume normal operations.
Given the frequency and severity of
cyberattacks on the financial services
industry, the agencies believe that it is
important that a banking organization’s
primary Federal regulator be notified as
soon as possible of a significant
computer-security incident 3 that
disrupts or degrades, or is reasonably
likely to disrupt or degrade, the viability
of the banking organization’s operations,
result in customers being unable to
access their deposit and other accounts,
or impact the stability of the financial
sector.4 The final rule refers to these
significant computer-security incidents
as ‘‘notification i
a significant
computer-security incident 3 that
disrupts or degrades, or is reasonably
likely to disrupt or degrade, the viability
of the banking organization’s operations,
result in customers being unable to
access their deposit and other accounts,
or impact the stability of the financial
sector.4 The final rule refers to these
significant computer-security incidents
as ‘‘notification incidents.’’ 5 Timely
notification is important as it would
allow the agencies to (1) have early
awareness of emerging threats to
banking organizations and the broader
financial system, (2) better assess the
threat a notification incident poses to a
banking organization and take
appropriate actions to address the
threat, (3) facilitate and approve
requests from banking organizations for
assistance through U.S. Treasury Office
of Cybersecurity and Critical
Infrastructure Protection (OCCIP),6 (4)
provide information and guidance to
banking organizations, and (5) conduct
horizontal analyses to provide targeted
guidance and adjust supervisory
programs.
Notification under the Bank Secrecy
Act 7 and the Interagency Guidance on
Response Programs for Unauthorized
Access to Customer Information and
Customer Notice 8 provide the agencies
with awareness of certain computer-
security incidents.9 Nonetheless, these
standards do not include all computer-
security incidents of which the
agencies, as supervisors, need to be
alerted and would not always result in
timely notification to the agencies
nteragency Guidance on
Response Programs for Unauthorized
Access to Customer Information and
Customer Notice 8 provide the agencies
with awareness of certain computer-
security incidents.9 Nonetheless, these
standards do not include all computer-
security incidents of which the
agencies, as supervisors, need to be
alerted and would not always result in
timely notification to the agencies.
To ensure that the agencies receive
timely alerts of all relevant material and
adverse incidents, the agencies issued a
notice of proposed rulemaking (NPR or
proposal) to establish computer-security
incident notification requirements for
banking organizations and their bank
service providers.10
The proposal would have required
banking organizations to notify their
primary Federal regulator within 36
hours of when they believed in good
faith that a ‘‘computer-security
incident’’ that rises to the level of a
‘‘notification incident’’ had occurred. As
proposed, a ‘‘notification incident’’ was
a computer-security incident that could
materially disrupt, degrade, or impair
the viability of the banking
organization’s operations, result in
customers being unable to access their
deposit and other accounts, or impact
the stability of the financial sector.11
When drafting these proposed
definitions, the agencies sought to align
the terminology as much as possible
with language used in the National
Institute of Standards and Technology’s
(NIST) Computer Security Resource
Center glossary.12 This approach was
intended to promote consistency with
known cybersecurity terms and
definitions and thereby reduce burden
ility of the financial sector.11
When drafting these proposed
definitions, the agencies sought to align
the terminology as much as possible
with language used in the National
Institute of Standards and Technology’s
(NIST) Computer Security Resource
Center glossary.12 This approach was
intended to promote consistency with
known cybersecurity terms and
definitions and thereby reduce burden.
The proposal separately would have
required a bank service provider that
provided services subject to the Bank
Service Company Act (BSCA) 13 to
notify at least two individuals at each
affected banking organization customer
immediately after the bank service
provider experiences a computer-
security incident that it believes in good
faith could disrupt, degrade, or impair
services provided subject to the BSCA
for four or more hours. This standard
reflected the agencies’ conclusion that
the impact of computer-security
incidents at bank service providers can
flow through to their banking
organization customers. The agencies
also recognized, however, that a bank
service provider may not be able to
readily assess whether an incident rises
to the level of a notification incident for
a particular banking organization
customer.
The notification requirement for bank
service providers is important because
banking organizations have become
increasingly reliant on third parties to
provide essential services. Such third
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00023
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1
for
a particular banking organization
customer.
The notification requirement for bank
service providers is important because
banking organizations have become
increasingly reliant on third parties to
provide essential services. Such third
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00023
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66426
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
14 Comments can be accessed at: https://
www.regulations.gov/document/OCC-2020-0038-
0001 (OCC); https://www.federalreserve.gov/apps/
foia/ViewComments.aspx?doc_id=R-1736&doc_
ver=1 (Board); and https://www.fdic.gov/resources/
regulations/federal-register-publications/2021/
2021-computer-security-incident-notification-3064-
af59.html (FDIC).
15 A commenter suggested that if a banking
organization had mitigation strategies in place to
offset the impact to a banking organization or its
customers, the incident should not be considered a
significant or critical incident and therefore should
not be considered a notification incident. The
commenter also stated that the agencies should
indicate that an outage that lasts less than 48-hours
in duration does not represent a ‘‘notification
incident.’’
16 Commenters contended that the ‘‘good faith’’
standard may be unclear, and the agencies should
provide guidance on how to make the good faith
determination. However, some commenters
preferred the good faith standard over a ‘‘reasonably
likely’’ standard.
17 The rule defines ‘‘designated financial market
utility’’ as having the same meaning as set forth at
12 U.S.C. 5462(4).
parties may also experience computer-
security incidents that could disrupt or
degrade the provision of services to
their banking organization customers or
have other significant impacts on a
banking organization
d faith standard over a ‘‘reasonably
likely’’ standard.
17 The rule defines ‘‘designated financial market
utility’’ as having the same meaning as set forth at
12 U.S.C. 5462(4).
parties may also experience computer-
security incidents that could disrupt or
degrade the provision of services to
their banking organization customers or
have other significant impacts on a
banking organization. Therefore, a
banking organization needs to receive
prompt notification of computer-
security incidents that materially
disrupt or degrade, or are reasonably
likely to materially disrupt or degrade,
these services because prompt
notification will allow the banking
organization to assess whether the
incident has or is reasonably likely to
have a material impact and trigger its
own notification requirement.
A. Overview of Comments
The agencies collectively received 35
comments from banking and financial
sector entities, third-party service
providers, industry groups, and other
individuals.14 This section provides an
overview of the general themes raised
by commenters. The comments received
on the proposal are further discussed
below in the sections describing the
final rule, including any changes that
the agencies have made to the proposal
in response to comments.
General Reaction and Need for a Rule
A majority of commenters supported
the proposal, agreeing that providing
prompt notice of significant incidents is
an important aspect of safety and
soundness, and they supported
transparent and consistent notification
from bank service providers to their
banking organization customers. A
number of these commenters offered
suggestions to clarify certain aspects of
the requirements or lessen the perceived
burden. Commenters also generally
supported the agencies’ efforts to
harmonize with existing definitions and
notification standards
soundness, and they supported
transparent and consistent notification
from bank service providers to their
banking organization customers. A
number of these commenters offered
suggestions to clarify certain aspects of
the requirements or lessen the perceived
burden. Commenters also generally
supported the agencies’ efforts to
harmonize with existing definitions and
notification standards. Four commenters
opposed the proposal, contending that
compliance would be burdensome or
duplicative of existing requirements,
and may impede banking organizations’
and bank service providers’ abilities to
respond effectively to incidents.
‘‘Computer-Security Incidents’’ That
Can Trigger Potential Reporting
As described above, the proposal
would have required reporting of certain
‘‘computer-security incidents,’’ defined
to be consistent with the NIST
definition. While several commenters
supported aligning the definition with
NIST’s definition, most commenters
asserted that the proposed definition
was overly broad, could be tailored, and
suggested different revisions to the
proposed definition of computer-
security incident. Specifically, a number
of these commenters asserted that the
definition should be based on actual,
rather than ‘‘potential,’’ harm and
exclude violations of a banking
organization’s or a bank service
provider’s policies and procedures.
‘‘Notification Incidents’’ Required To Be
Reported
As described above, notification
incidents are computer-security
incidents that require notification to the
agencies. Most commenters argued that
the proposed definition of ‘‘notification
incident’’ was overly broad and should
be narrowed and only require reporting
of incidents involving actual harm.15
Commenters asserted that any definition
should incorporate time, risk, and scale
elements, which commenters viewed as
critical
ts are computer-security
incidents that require notification to the
agencies. Most commenters argued that
the proposed definition of ‘‘notification
incident’’ was overly broad and should
be narrowed and only require reporting
of incidents involving actual harm.15
Commenters asserted that any definition
should incorporate time, risk, and scale
elements, which commenters viewed as
critical. In addition, commenters urged
the agencies to replace the ‘‘good faith’’
standard with a banking organization’s
or a bank service provider’s
‘‘determination’’ or a reasonable basis to
conclude that an incident had occurred,
to provide a more objective and concrete
standard.16
Timeframes for Notification
The agencies received comments on
the timeframes described in the
proposal for banking organizations to
provide notification to their regulator
and for bank service providers to
provide notification to their banking
organization customers. These
comments focused both on the amount
of time provided to make the
notification and the trigger that caused
the time period to begin being
measured. Commenters made a wide
variety of suggestions, including
recommendations to lengthen and
shorten the periods and to provide
further clarity regarding when they
commenced.
Means of Bank Service Provider
Notification
Commenters raised questions
regarding the requirement in the
proposal that a bank service provider
must notify two individuals at each
affected banking organization. Notably,
some commenters raised concerns that
such a requirement would override
contractual notification provisions with
which both the bank service providers
and banking organizations are
comfortable
Provider
Notification
Commenters raised questions
regarding the requirement in the
proposal that a bank service provider
must notify two individuals at each
affected banking organization. Notably,
some commenters raised concerns that
such a requirement would override
contractual notification provisions with
which both the bank service providers
and banking organizations are
comfortable.
Applicability to Financial Market
Utilities
Commenters suggested that the
proposal would cause unintended
regulatory overlap for those financial
market utilities that are designated as
systemically important under Title VIII
of the Dodd-Frank Act (designated
FMUs) and regulated by the Securities
and Exchange Commission (SEC) or
Commodity Futures Trading
Commission (CFTC). In addition,
designated FMUs regulated by the Board
are subject to Regulation HH, which
includes risk-management standards.
III. Discussion of Final Rule
A. Overview of the Final Rule
In response to comments received on
the NPR, the final rule reflects changes
to key definitions and notification
provisions applicable to both banking
organizations and bank service
providers. These changes include (1)
narrowing the definition of computer-
security incident by focusing on actual,
rather than potential, harm and by
removing the second prong of the
proposed definition relating to
violations of internal policies or
procedures; (2) substituting the phrase
‘‘reasonably likely to’’ in place of
‘‘could’’ in the definition of notification
incident; and (3) replacing the ‘‘good
faith belief’’ notification standard with a
determination standard. Changes to the
bank service provider notification
provision include (1) adding a
definition of ‘‘covered services’’ and (2)
requiring that notice be provided to a
bank-designated point of contact, rather
than to at least two individuals at each
banking organization customer
fication
incident; and (3) replacing the ‘‘good
faith belief’’ notification standard with a
determination standard. Changes to the
bank service provider notification
provision include (1) adding a
definition of ‘‘covered services’’ and (2)
requiring that notice be provided to a
bank-designated point of contact, rather
than to at least two individuals at each
banking organization customer. The
final rule also excludes designated
FMUs from the definitions of ‘‘banking
organization’’ and ‘‘bank service
provider.’’ 17 Such changes are intended
to address comments and reduce over-
and unnecessary notification by both
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00024
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66427
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
18 See 12 U.S.C. 1, 93a, 161, 481, 1463, 1464,
1861–1867, and 3102 (OCC); 12 U.S.C. 321–338a,
1467a(g), 1818(b), 1844(b), 1861–1867, and 3101 et
seq. (Board); 12 U.S.C. 1463, 1811, 1813, 1817,
1819, and 1861–1867 (FDIC).
19 As also noted below, however, the agencies
would encourage those banking organizations
providing sector-critical services that currently
notify their primary Federal regulator of these types
of incidents on a same-day basis to continue to do
so.
20 As a general matter, ‘‘bank service provider’’
refers to a company or person that performs services
for a banking organization that are subject to the
Bank Service Company Act (12 U.S.C. 1861–1867).
However, for the purpose of this final rule, the term
‘‘bank service provider’’ does not include any
person or company that is a designated FMU, as
that term is defined at 12 U.S.C. 5462(4).
21 Under the final rule, ‘‘designated financial
market utility’’ has the same meaning as set forth
at 12 U.S.C. 5462(4)
anization that are subject to the
Bank Service Company Act (12 U.S.C. 1861–1867).
However, for the purpose of this final rule, the term
‘‘bank service provider’’ does not include any
person or company that is a designated FMU, as
that term is defined at 12 U.S.C. 5462(4).
21 Under the final rule, ‘‘designated financial
market utility’’ has the same meaning as set forth
at 12 U.S.C. 5462(4).
22 For example, FMUs for which the SEC is the
Primary Agency under Title VIII of the Dodd-Frank
Act are subject to the SEC’s Regulation SCI
(Systems Compliance and Integrity) for certain
financial intermediaries.
23 An FMU is ‘‘any person that manages or
operates a multilateral system for the purpose of
transferring, clearing, or settling payments,
securities, or other financial transactions among
financial institutions or between financial
institutions and the person.’’ 12 U.S.C. 5462(6).
24 Title VIII of the Dodd-Frank Act authorizes the
Financial Stability Oversight Council to designate
certain FMUs as systemically important. Depending
on the functions that it serves in the financial
markets, a designated FMU is subject to risk-
management regulations promulgated by the Board
(i.e., Regulation HH), the SEC, or the CFTC.
25 The rule defines ‘‘designated financial market
utility’’ as having the same meaning as set forth at
12 U.S.C. 5462(4).
26 Specifically, SEC-supervised designated FMUs
are subject to the SEC’s Regulation SCI, which
generally requires covered entities to notify the SEC
and their members or participants in the event of
an SCI event. See 17 CFR 242.1000 (defining ‘‘SCI
Event’’) and 242.1002 (imposing notification
requirements related to SCI Events). Similarly, a
CFTC-supervised designated FMU must notify the
CFTC in the event of an ‘‘exceptional event’’ or the
activation of the designated FMU’s business
continuity and disaster recovery plan. See 17 CFR
39.18(g)
heir members or participants in the event of
an SCI event. See 17 CFR 242.1000 (defining ‘‘SCI
Event’’) and 242.1002 (imposing notification
requirements related to SCI Events). Similarly, a
CFTC-supervised designated FMU must notify the
CFTC in the event of an ‘‘exceptional event’’ or the
activation of the designated FMU’s business
continuity and disaster recovery plan. See 17 CFR
39.18(g). An ‘‘exceptional event’’ includes ‘‘[a]ny
hardware or software malfunction, security
incident, or targeted threat that materially impairs,
or creates a significant likelihood of material
impairment, of automated system operation,
reliability, security, or capacity.’’ Id.
banking organizations and bank service
providers.
The final rule establishes two primary
requirements, which promote the safety
and soundness of banking organizations
and are consistent with the agencies’
authorities to supervise these entities,
and with their authorities pursuant to
the BSCA.18 First, the final rule requires
a banking organization to notify its
primary Federal regulator of a
notification incident. In particular, a
banking organization must notify its
primary Federal regulator of any
computer-security incident that rises to
the level of a notification incident as
soon as possible and no later than 36
hours after the banking organization
determines that a notification incident
has occurred.19 Second, the final rule
requires a bank service provider 20 to
notify at least one bank-designated point
of contact at each affected banking
organization customer as soon as
possible when the bank service provider
determines it has experienced a
computer-security incident that has
materially disrupted or degraded, or is
reasonably likely to materially disrupt
or degrade, covered services provided to
such banking organization customer for
four or more hours. Each of these
requirements is discussed in more detail
below.
B. Definitions
i
n customer as soon as
possible when the bank service provider
determines it has experienced a
computer-security incident that has
materially disrupted or degraded, or is
reasonably likely to materially disrupt
or degrade, covered services provided to
such banking organization customer for
four or more hours. Each of these
requirements is discussed in more detail
below.
B. Definitions
i. Definition of Banking Organization
The final rule applies to the following
banking organizations:
• For the OCC, ‘‘banking
organizations’’ includes national banks,
Federal savings associations, and
Federal branches and agencies of foreign
banks.
• For the Board, ‘‘banking
organizations’’ includes all U.S. bank
holding companies and savings and
loan holding companies; state member
banks; the U.S. operations of foreign
banking organizations; and Edge and
agreement corporations.
• For the FDIC, ‘‘banking
organizations’’ includes all insured state
nonmember banks, insured state-
licensed branches of foreign banks, and
insured State savings associations.
• For all three agencies, ‘‘banking
organizations’’ does not include
designated FMUs, for the reasons
discussed below.21
With respect to the proposed
definition of ‘‘banking organization,’’
commenters suggested that this term
should include additional entities, such
as financial technology firms and non-
bank OCC-chartered financial services
entities, to the extent the agencies have
jurisdiction over those firms. Further,
commenters contended that the agencies
should consider other regulatory
frameworks to which banking
organizations and bank service
providers may already be subject and
exclude entities subject to other, similar,
regulatory reporting requirements.22
The agencies have defined the term
banking organization in a manner that is
consistent with the agencies’
supervisory authorities
. Further,
commenters contended that the agencies
should consider other regulatory
frameworks to which banking
organizations and bank service
providers may already be subject and
exclude entities subject to other, similar,
regulatory reporting requirements.22
The agencies have defined the term
banking organization in a manner that is
consistent with the agencies’
supervisory authorities.
The NPR solicited comment on the
scope of entities that should be included
as ‘‘banking organizations’’ for purposes
of the rule, and specifically noted that
the proposed rule’s definition of
‘‘banking organizations’’ and ‘‘bank
service providers’’ would include FMUs
that are chartered as a State member
bank or Edge corporation, or perform
services subject to regulation and
examination under the Bank Service
Company Act.23 24 In that regard, the
agencies asked whether there were
unique factors that the agencies should
consider in determining how
notification requirements should apply
to these FMUs. In addition, the agencies
asked whether notification requirements
would be best conveyed through the
proposed rule or through amendments
to the Board’s Regulation HH for
designated FMUs for which the Board is
the Supervisory Agency under Title VIII
of the Dodd-Frank Act.
In response to these requests for
comment, two commenters opposed the
application of the proposed rule to SEC-
supervised FMUs that are designated as
systemically important under Title VIII
of the Dodd-Frank Act, arguing that the
proposed rule would subject these
designated FMUs to unintended
regulatory overlap and duplicative
compliance burdens. One of these
commenters argued that SEC-supervised
designated FMUs should be deemed to
comply with the rule to the extent they
comply with incident notification
requirements under existing SEC
regulations
mportant under Title VIII
of the Dodd-Frank Act, arguing that the
proposed rule would subject these
designated FMUs to unintended
regulatory overlap and duplicative
compliance burdens. One of these
commenters argued that SEC-supervised
designated FMUs should be deemed to
comply with the rule to the extent they
comply with incident notification
requirements under existing SEC
regulations. Another commenter argued
that applying the proposed rule to
Board-supervised designated FMUs
would be preferable to amending
Regulation HH to include a designated
FMU-specific incident notification
requirement, but this commenter did
not provide a detailed rationale for that
position. Finally, several commenters
suggested that the final rule should
exempt all FMUs that qualify as a
banking organization or a bank service
provider, including FMUs that have not
been designated as systemically
important under Title VIII of the Dodd-
Frank Act, from these incident
notification requirements, arguing that
the existing practice among FMUs is to
alert supervisors directly in the case of
computer-security incidents.
As noted above, the final rule
excludes designated FMUs from the
definitions of ‘‘banking organization’’
and ‘‘bank service provider.’’ 25 In the
case of SEC- and CFTC-supervised
designated FMUs, the agencies
determined that excluding these
designated FMUs from the final rule is
appropriate because these designated
FMUs are already subject to incident
notification requirements in other
Federal regulations.26
Board-supervised designated FMUs
are subject to the Board’s Regulation
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00025
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1
esignated FMUs from the final rule is
appropriate because these designated
FMUs are already subject to incident
notification requirements in other
Federal regulations.26
Board-supervised designated FMUs
are subject to the Board’s Regulation
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00025
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66428
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
27 12 CFR 234.3(a)(17).
28 This narrow exclusion would not apply to a
Board-supervised designated FMU with respect to
its operation of non-systemically important services
that are not subject to Regulation HH.
29 The Federal Reserve Banks also operate the
Fedwire Funds Service and Fedwire Securities
Service, which play a critical role in the financial
system. The Board generally requires these services
to meet or exceed the risk-management standards
applicable to designated FMUs under Regulation
HH. See Federal Reserve Policy on Payment System
Risk (as amended effective Mar. 19, 2021), https://
www.federalreserve.gov/paymentsystems/files/psr_
policy.pdf. See also Press Release, Federal Reserve
Board Reaffirms Long-Standing Policy of Applying
Relevant International Risk-Management Standards
to Fedwire Funds and Fedwire Securities Services
(July 19, 2012), https://www.federalreserve.gov/
newsevents/pressreleases/bcreg20120719a.htm.
30 The rule defines ‘‘designated financial market
utility’’ as having the same meaning as set forth at
12 U.S.C. 5462(4).
31 The final rule states that ‘‘person’’ has the same
meaning as set forth at 12 U.S.C. 1817(j)(8)(A).
HH, which includes a set of risk-
management standards for addressing
areas such as legal risk, governance,
credit and liquidity risks, and
operational risk
19a.htm.
30 The rule defines ‘‘designated financial market
utility’’ as having the same meaning as set forth at
12 U.S.C. 5462(4).
31 The final rule states that ‘‘person’’ has the same
meaning as set forth at 12 U.S.C. 1817(j)(8)(A).
HH, which includes a set of risk-
management standards for addressing
areas such as legal risk, governance,
credit and liquidity risks, and
operational risk. Regulation HH requires
generally that a Board-supervised
designated FMU effectively identify and
manage operational risks.27 Although
Regulation HH does not currently
impose specific incident-notification
requirements, the Board believes that it
is important for designated FMUs to
inform Federal Reserve supervisors of
operational disruptions on a timely
basis and has generally observed such
practice by the designated FMUs. The
Board will continue to review
Regulation HH in light of designated
FMUs’ existing practices and may
propose amendments to Regulation HH
in the future to formalize its incident-
notification expectations and promote
consistency between requirements
applicable to Board-, SEC-, and CFTC-
supervised designated FMUs.
Although some commenters suggested
that the final rule should exempt all
FMUs that qualify as a banking
organization or a bank service provider,
the agencies have adopted a narrower
exclusion for designated FMUs.28 FMUs
that are not designated and that
otherwise meet the definition of banking
organization or bank service provider
are within the rule’s scope. The agencies
determined that excluding all FMUs
from the rule would be overly broad and
would result in the inconsistent
regulatory treatment of FMUs that are
not designated relative to other bank
service providers. In addition, a broad
FMU exclusion could create uncertainty
because there is no defined list of
FMUs, other than designated FMUs
service provider
are within the rule’s scope. The agencies
determined that excluding all FMUs
from the rule would be overly broad and
would result in the inconsistent
regulatory treatment of FMUs that are
not designated relative to other bank
service providers. In addition, a broad
FMU exclusion could create uncertainty
because there is no defined list of
FMUs, other than designated FMUs.
One commenter suggested that the
Board should hold Federal Reserve
Bank Services to an equivalent standard
as a matter of fairness and competitive
equality. Given that designated FMUs
are scoped out of this rule, the Federal
Reserve Banks’ retail payment and
settlement services are the only relevant
Federal Reserve Bank Services that
compete with those private-sector FMUs
that are subject to the final rule.29 These
retail services currently include check
collection services for depository
institutions and an automated
clearinghouse service that enables
depository institutions to send batches
of debit and credit transfers. For these
services, the Federal Reserve Banks
follow protocols to ensure timely
communication of incidents to both
depository institution customers and the
Board. The Board believes these
protocols are comparable to those
required by this final rule. With respect
to future Federal Reserve Bank Services
that compete with private-sector FMUs
subject to the final rule (such as the
FedNow Service), the Board intends to
similarly hold the Federal Reserve
Banks to protocols comparable to those
required by this final rule.
ii. Definition of Bank Service Provider
The agencies sought feedback on the
scope of third-party services covered
under the proposed rule and whether
the proposed rule’s definition of ‘‘bank
service provider’’ appropriately
captured the services about which
banking organizations should be
informed in the event of disruptions
s to protocols comparable to those
required by this final rule.
ii. Definition of Bank Service Provider
The agencies sought feedback on the
scope of third-party services covered
under the proposed rule and whether
the proposed rule’s definition of ‘‘bank
service provider’’ appropriately
captured the services about which
banking organizations should be
informed in the event of disruptions.
The agencies further sought comment
on whether all services covered under
the BSCA should be included for
purposes of the notification requirement
or whether only a subset of the BSCA
services should be included. The
agencies also sought comment on
whether only examined bank service
providers should be subject to the
notification requirement.
With respect to the definition of
‘‘bank service provider,’’ commenters
expressed varied opinions on the scope
of entities included in the definition of
‘‘bank service provider.’’ Some
commenters argued that the definition
should be revised to clarify that only
service providers providing services that
are subject to the BSCA would be
subject to the rule, and one commenter
suggested that the agencies provide a
non-exclusive list of categories of bank
service providers subject to the
regulation. Other commenters urged that
bank service providers should include
entities with access to bank customer
information or systems, whether or not
formally within the scope of the BSCA,
while one commenter recommended
excluding banking organization
subsidiaries and affiliates. Some
suggested that the agencies narrow the
scope to apply only to significant
service providers, bank service
providers that present a higher risk, or
those that provide technology services.
Other commenters suggested excluding
bank service providers from the rule
entirely, observing that incident
notification is, and should be, addressed
in contracts.
The agencies agree that bank service
providers providing services that are
subject to the BSCA should be subject
to the rule
iders, bank service
providers that present a higher risk, or
those that provide technology services.
Other commenters suggested excluding
bank service providers from the rule
entirely, observing that incident
notification is, and should be, addressed
in contracts.
The agencies agree that bank service
providers providing services that are
subject to the BSCA should be subject
to the rule. The agencies disagree with
the rest of these suggestions to modify
the scope of entities included in the
definition of bank service provider. As
previously explained, bank service
providers play an increasingly
important role in banking organization
operations. Significant incidents
affecting the services they provide have
the potential to cause notification
incidents for their banking organization
customers. This risk is not limited to
specific bank service providers, and
therefore, the agencies decline to modify
the scope of entities included in the
definition in the manners suggested by
the comments above.
Furthermore, while the agencies agree
that incident notification is generally
addressed by contract, we believe that
this issue is important enough to
warrant an independent regulatory
requirement that ensures consistency
and enforceability, without the
necessity of revising contractual
provisions.
In response to comments that the
agencies should clarify the scope of
bank service providers that would be
subject to the rule, the agencies made
changes to the final rule that do so.
First, the agencies added a new
definition in the final rule, ‘‘covered
services,’’ which definition is intended
to clarify that services performed subject
to the BSCA would be covered by the
rule
visions.
In response to comments that the
agencies should clarify the scope of
bank service providers that would be
subject to the rule, the agencies made
changes to the final rule that do so.
First, the agencies added a new
definition in the final rule, ‘‘covered
services,’’ which definition is intended
to clarify that services performed subject
to the BSCA would be covered by the
rule. Second, as noted above, the
agencies excluded designated FMUs
from the definition of ‘‘bank service
provider’’ and from the definition of
‘‘banking organization.’’ 30 The final rule
defines ‘‘bank service provider’’ as a
bank service company or other person
who performs covered services;
provided, however, that no designated
FMU shall be considered a bank service
provider. ‘‘Covered services’’ are
services performed by a ‘‘person’’ 31 that
are subject to the Bank Service
Company Act (12 U.S.C. 1861–1867).
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00026
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66429
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
32 One commenter requested clarification as to
whether a ‘‘near-miss’’ incident would constitute a
computer-security incident under the rule. A ‘‘near-
miss’’ incident would constitute a computer-
security incident only to the extent that such a
‘‘near-miss’’ results in actual harm to an
information system or the information contained
within it. Another commenter stated that the
definition of ‘‘computer-security incident’’ should
be limited to information systems that can cause a
‘‘notification incident.’’ For clarification, the
definition of ‘‘computer-security incident’’ includes
all occurrences that result in actual harm to an
information system or the information contained
within it. However, only those computer-security
incidents that fall within the definition of
‘‘notification incident’’ are required to be reported
ited to information systems that can cause a
‘‘notification incident.’’ For clarification, the
definition of ‘‘computer-security incident’’ includes
all occurrences that result in actual harm to an
information system or the information contained
within it. However, only those computer-security
incidents that fall within the definition of
‘‘notification incident’’ are required to be reported.
Two commenters advocated for excluding
computer-security incidents due to non-security
and non-malicious causes. For clarity, the
definition includes incidents from whatever cause.
33 In response to comments, the agencies also
considered whether to incorporate the NIST
definition of ‘‘cybersecurity incident’’ instead and
determined that this definition would
inappropriately narrow the scope of incidents
covered by the rule.
34 A commenter suggested that if a banking
organization had mitigation strategies in place to
offset the impact to a bank or its customers, the
incident should not be considered a significant or
critical incident and therefore should not be
considered a notification incident. The commenter
also stated that the agencies should indicate that an
outage that lasts less than 48-hours in duration does
not represent a ‘‘notification incident.’’
35 Two commenters supported maintaining the
‘‘good faith’’ standard, with one commenter noting
that a reasonable belief standard could introduce
too much uncertainty and invite questioning of
decisions that are made quickly out of necessity and
potentially without key facts known. One of those
commenters stated that the final rule should reflect
that information may not be available to make an
assessment ‘‘immediately’’ after an occurrence.
36 Commenters contended that the ‘‘good faith’’
standard may be unclear, and the agencies should
provide guidance on how to make the good faith
determination
made quickly out of necessity and
potentially without key facts known. One of those
commenters stated that the final rule should reflect
that information may not be available to make an
assessment ‘‘immediately’’ after an occurrence.
36 Commenters contended that the ‘‘good faith’’
standard may be unclear, and the agencies should
provide guidance on how to make the good faith
determination. An alternative would be for the rule
text to state ‘‘an incident that a banking
organization determines is reasonably likely to
disrupt’’ instead of ‘‘believes in good faith could
disrupt.’’ However, some commenters preferred the
Continued
iii. Definition of Computer-Security
Incident
In the NPR, the agencies generally
incorporated the principal definition
employed by NIST to define ‘‘computer-
security incident’’ as an occurrence that:
• Results in actual or potential harm
to the confidentiality, integrity, or
availability of an information system or
the information that the system
processes, stores, or transmits; or
• Constitutes a violation or imminent
threat of violation of security policies,
security procedures, or acceptable use
policies.
Although commenters generally
supported the agencies’ use of a
standard industry term rather than a
new, and potentially inconsistent, term
and definition, they suggested revisions
to more closely tailor the definition to
the purposes of the rule. For example,
many commenters recommended that
the definition focus on incidents that
result in actual, rather than potential,
harm to an information system.
Commenters were concerned that the
tracking and notification of incidents
that could potentially harm a banking
organization would create an undue
regulatory burden, possibly result in
over-notification, and overlook the fact
that many potential incidents can be
effectively remediated
finition focus on incidents that
result in actual, rather than potential,
harm to an information system.
Commenters were concerned that the
tracking and notification of incidents
that could potentially harm a banking
organization would create an undue
regulatory burden, possibly result in
over-notification, and overlook the fact
that many potential incidents can be
effectively remediated. In addition,
various commenters recommended
deleting the second prong of the
proposed definition, reasoning that
violations of internal policies and
procedures would be unlikely ever to
result in incidents significant enough to
warrant prompt notification; however,
some commenters supported keeping
actual violations of applicable security
policies. Commenters also suggested
introducing materiality thresholds or
excluding non-security related outages
or incidents. One commenter objected to
narrowing the definition to ‘‘actual’’
harm and supported broadening the
definition to include incidents causing
‘‘serious,’’ but not necessarily
‘‘imminent,’’ harm. Another commenter
stated that the standard for determining
whether an incident rises to the level to
trigger mandated notices should be
based on its impact to banking
organizations or the financial system
and be agnostic as to cause. One
commenter stated that the definition
should expressly exclude scheduled
outages. The same commenter suggested
that the term computer-security incident
be changed to encompass two types of
outages and align more with the NIST
definition of cybersecurity incident to
provide greater uniformity and clarity
about what constitutes an incident and
a reportable incident. Another
commenter also suggested substituting
the term cybersecurity incident from
NIST in lieu of computer-security
incident. A commenter also suggested
narrowing the term ‘‘incident’’ to
exclude non-malicious data
communications incidents or those
occurring outside of the regulated
entity’s own network
niformity and clarity
about what constitutes an incident and
a reportable incident. Another
commenter also suggested substituting
the term cybersecurity incident from
NIST in lieu of computer-security
incident. A commenter also suggested
narrowing the term ‘‘incident’’ to
exclude non-malicious data
communications incidents or those
occurring outside of the regulated
entity’s own network.
While the agencies continue to
recognize that there is value in adopting
an existing, standard definition, the
agencies agree that the NIST definition
does not wholly align with the purposes
of the rule. The agencies have therefore
narrowed the final rule’s definition of
‘‘computer-security incident,’’ as
suggested by the foregoing comments.
Specifically, the final rule defines
‘‘computer-security incident’’ as an
occurrence that results in actual harm to
an information system or the
information contained within it.32
Furthermore, the agencies have removed
the second prong of the proposed
computer-security incident definition
relating to violations of internal policies
or procedures. These changes narrow
the focus of the final rule to those
incidents most likely to materially and
adversely affect banking organizations,
while still retaining general consistency
with the NIST definition.33
iv. Definition of Notification Incident
The NPR defined a ‘‘notification
incident’’ as a computer-security
incident that a banking organization
believes in good faith could materially
disrupt, degrade, or impair—
• The ability of the banking
organization to carry out banking
operations, activities, or processes, or
deliver banking products and services to
a material portion of its customer base,
in the ordinary course of business;
• Any business line of a banking
organization, including associated
operations, services, functions and
support, and would result in a material
loss of revenue, profit, or franchise
value; or
• Those operations of a banking
organization, including associated
servic
, or
deliver banking products and services to
a material portion of its customer base,
in the ordinary course of business;
• Any business line of a banking
organization, including associated
operations, services, functions and
support, and would result in a material
loss of revenue, profit, or franchise
value; or
• Those operations of a banking
organization, including associated
services, functions and support, as
applicable, the failure or discontinuance
of which would pose a threat to the
financial stability of the United States.
Commenters addressed several
aspects of the proposed definition. First,
multiple commenters observed that the
term ‘‘could’’ in the phrase ‘‘could . . .
disrupt, degrade, or impair’’ was
imprecise and overbroad. Multiple
commenters suggested substituting the
phrase ‘‘could’’ with ‘‘reasonably likely
to or will’’ materially disrupt certain
business lines or operations or ‘‘has
resulted in or will result in’’ material
disruptions to certain business lines or
operations in its place. Some
commenters also suggested that
‘‘notification incident’’ should be
narrowed even further to incidents that
actually materially disrupt or degrade.34
The agencies also received a number
of comments on the NPR’s ‘‘believes in
good faith’’ language. Various
commenters expressed support for the
phrase, with at least one noting that the
more subjective ‘‘good faith’’ standard
gave some flexibility to an organization
that might honestly, albeit mistakenly,
conclude that an occurrence did not rise
to the level of a notification incident
and thereby fail to provide notice.35
Other commenters suggested that
‘‘believe in good faith’’ was too
subjective and stated that the final rule
should substitute a clearer term, such as
‘‘determined.’’ 36 And one commenter
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00027
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1
cation incident
and thereby fail to provide notice.35
Other commenters suggested that
‘‘believe in good faith’’ was too
subjective and stated that the final rule
should substitute a clearer term, such as
‘‘determined.’’ 36 And one commenter
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00027
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66430
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
good faith standard over a ‘‘reasonably likely’’
standard.
37 Section 165(d) of the Dodd-Frank Act and 12
CFR parts 363 and 381 (the Resolution Planning
Rule) require certain financial companies to report
periodically to the FDIC and the Board their plans
for rapid and orderly resolution in the event of
material financial distress or failure. On November
1, 2019, the FDIC and the Board published in the
Federal Register amendments to the Resolution
Planning Rule. See 84 FR 59194.
38 Elements of both the ‘‘core business lines’’ and
‘‘critical operations’’ definitions from the
Resolution Planning Rule are incorporated in the
‘‘notification incident’’ definition. Under the
Resolution Planning Rule, ‘‘core business lines’’
means those business lines of the covered company,
including associated operations, services, functions
and support, that, in the view of the covered
company, upon failure would result in a material
loss of revenue, profit, or franchise value, and
‘‘critical operations’’ means those operations of the
covered company, including associated services,
functions, and support, the failure or
discontinuance of which would pose a threat to the
financial stability of the United States. See 12 CFR
363.2, 381.2.
suggested that the agencies change the
‘‘in good faith’’ belief notification
standard to apply to critical, not
significant, incidents
critical operations’’ means those operations of the
covered company, including associated services,
functions, and support, the failure or
discontinuance of which would pose a threat to the
financial stability of the United States. See 12 CFR
363.2, 381.2.
suggested that the agencies change the
‘‘in good faith’’ belief notification
standard to apply to critical, not
significant, incidents.
In addition, commenters suggested
that the final rule should specifically
exclude from the notification
requirement incidents where the impact
is limited to certain types of computer
systems (e.g., compromises to a bank’s
marketing or personnel systems) or
otherwise provide specific exclusions
(e.g., any incident lasting less than 48
hours), because they would be very
unlikely to cause the kinds of harm that
the agencies would regard as warranting
notification. Another commenter
suggested that the agencies include a
requirement that a notification incident
involve an information system operated
by, or on behalf of, a banking
organization, because it would be
unduly burdensome and potentially
unrealistic for covered entities to be
responsible for systems operated by
third parties, whereas another
commenter believed the term
‘‘notification incident’’ should be
revised to include incidents occurring at
third-party service provider information
systems and the sub-contractors (fourth-
party providers) of those third-party
service providers that collect banking-
related information. One commenter
recommended that the agencies use the
same definition of notification incident
for bank service providers and banking
organizations, whereas another
commenter stated that only
‘‘notification incidents’’ should be
reported under the rule to ensure that
high volumes of less significant or easily
remediated occurrences and incidents
that do not result in actual harm are not
reported
menter
recommended that the agencies use the
same definition of notification incident
for bank service providers and banking
organizations, whereas another
commenter stated that only
‘‘notification incidents’’ should be
reported under the rule to ensure that
high volumes of less significant or easily
remediated occurrences and incidents
that do not result in actual harm are not
reported. In addition, one commenter
stated that banking organizations should
not be required to publicly disclose core
business lines and critical operations to
avoid inviting attacks. Another
commenter supported the definition and
suggested that the definition of
notification incident be expanded to
include events that involve infiltration
of third-party systems that collect
banking related information, such as
password managers or browsers.
Another commenter requested that the
agencies clarify that voluntary reporting
of incidents falling outside of the scope
of the definition is permitted, and that
the rule also distinguish between
mandatory reporting of notification
incidents and nondisruptive events that
could be reported through an
alternative, voluntary mechanism and
timeline.
Following analysis and careful
consideration of the various comments,
the agencies are finalizing the definition
largely as proposed, with modifications
to address a number of commenters’
concerns to clarify the rule and make it
easier to administer.
The definition of ‘‘notification
incident’’ includes language that is
consistent with the ‘‘core business line’’
and ‘‘critical operation’’ definitions
included in the Resolution Planning
Rule issued by the Board and FDIC
under section 165(d) of the Dodd-Frank
Act.37 In particular, the second prong of
the notification incident definition
identifies incidents that impact core
business lines, and the third prong
identifies incidents that impact critical
operations
tent with the ‘‘core business line’’
and ‘‘critical operation’’ definitions
included in the Resolution Planning
Rule issued by the Board and FDIC
under section 165(d) of the Dodd-Frank
Act.37 In particular, the second prong of
the notification incident definition
identifies incidents that impact core
business lines, and the third prong
identifies incidents that impact critical
operations. Banking organizations
subject to the Resolution Planning Rule
may use the ‘‘core business lines’’ and
‘‘critical operations’’ identified in their
resolution plans 38 to identify
notification incidents under the second
and third prongs of the final rule.
The final rule does not require
banking organizations that are not
subject to the Resolution Planning Rule
to identify ‘‘core business lines’’ or
‘‘critical operations,’’ or to develop
procedures to determine whether they
engage in any operations, the failure or
discontinuance of which would pose a
threat to the financial stability of the
United States. However, all banking
organizations must have a sufficient
understanding of their lines of business
to be able to determine which business
lines would, upon failure, result in a
material loss of revenue, profit, or
franchise value to the banking
organization, so that they can meet their
notification obligations.
Commenters also requested that the
agencies clarify that the material loss of
revenue, profit, or franchise value
addressed by the second prong of the
definition should be evaluated on an
enterprise-wide basis. The agencies
agree; a banking organization should
evaluate whether the loss is material to
the organization as a whole.
The agencies have concluded that
there is substantial benefit to receiving
notification of both computer-security
incidents that have materially disrupted
or degraded, and incidents that are
reasonably likely to materially disrupt
or degrade, a banking organization
sis. The agencies
agree; a banking organization should
evaluate whether the loss is material to
the organization as a whole.
The agencies have concluded that
there is substantial benefit to receiving
notification of both computer-security
incidents that have materially disrupted
or degraded, and incidents that are
reasonably likely to materially disrupt
or degrade, a banking organization.
Accordingly, the agencies are not
narrowing the definition of ‘‘notification
incident’’ to only include computer-
security incidents that have resulted in
a material disruption or degradation in
the final rule.
However, the agencies are narrowing
the scope of covered computer-security
incidents by substituting the phrase
‘‘reasonably likely to’’ in place of
‘‘could.’’ The agencies agree that the
term ‘‘could’’ encompasses more, and
more speculative, incidents than the
agencies intended in promulgating the
rule. Accordingly, and in keeping with
commenters’ suggestions, the agencies
have substituted the term ‘‘reasonably
likely to’’ in place of ‘‘could.’’ Under the
‘‘reasonably likely’’ standard, a banking
organization will be required to notify
its primary Federal regulator when it
has suffered a computer-security
incident that has a reasonable likelihood
of materially disrupting or degrading the
banking organization or its operations,
but at the same time would not be
required to make such a notification for
adverse outcomes that are merely
possible, or within imagination. The
‘‘reasonably likely’’ standard for
notification is clearer and more in line
with the agencies’ intentions for the
rule. Finally, the agencies believe that
banking organizations are well-
positioned to assess the likelihood that
a computer-security incident will result
in the significant adverse effects
described in the definition.
Some commenters also observed that
the term ‘‘impair’’ was redundant of
‘‘disrupt’’ and ‘‘degrade;’’ that it was not
a term defined by NIST; and that it
should be removed
rule. Finally, the agencies believe that
banking organizations are well-
positioned to assess the likelihood that
a computer-security incident will result
in the significant adverse effects
described in the definition.
Some commenters also observed that
the term ‘‘impair’’ was redundant of
‘‘disrupt’’ and ‘‘degrade;’’ that it was not
a term defined by NIST; and that it
should be removed. The agencies agree
the term would be redundant with
‘‘disrupt or degrade,’’ and have removed
the term ‘‘impair’’ from the definition.
After considering the comments
carefully, the agencies are replacing the
‘‘good faith belief’’ standard with a
banking organization’s determination.
The agencies agree with commenters
who criticized the proposed ‘‘believes in
good faith’’ standard as too subjective
and imprecise. Accordingly, the
agencies have removed the good faith
language from the definition of
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00028
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66431
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
39 As previously explained, the agencies have
considered whether existing reporting standards
meet the purposes of this rule and concluded that
they do not. For example, ransom malware
incidents that do not involve unauthorized access
to or use of sensitive customer information would
not be subject to the Gramm-Leach-Bliley Act
(GLBA) notification standard.
40 This is to clarify that example 6 addresses
malware on a banking organization’s system that
poses an imminent threat to the banking
organization’s core business lines or critical
operations or that requires the banking organization
to disengage any compromised products or
information systems that support the banking
organization’s core business lines or critical
operations from internet-based network
connections
example 6 addresses
malware on a banking organization’s system that
poses an imminent threat to the banking
organization’s core business lines or critical
operations or that requires the banking organization
to disengage any compromised products or
information systems that support the banking
organization’s core business lines or critical
operations from internet-based network
connections.
41 One commenter suggested that notification
obligations should begin ‘‘36 hours after the
banking organization confirms a notification
incident has occurred, and has completed urgent
measures to end the threat and protect its assets,’’
to include time for a banking organization to take
necessary measures.
‘‘notification incident’’ and have
substituted a determination standard in
the final notification requirement.
Finally, the agencies decline to
exclude particular incidents or
incidents that impact certain types of
computer systems from the notification
requirements. The agencies believe that
the focus on the material adverse effects
of a computer-security incident is a
simpler and clearer way to ensure that
they receive notification of the most
significant computer-security incidents.
v. Examples of Notification Incidents
The NPR included a non-exhaustive
list of incidents that would be
considered notification incidents under
the proposed rule and the agencies
invited comment on specific examples
of computer-security incidents that
should or should not constitute
notification incidents. The agencies
received a few general comments about
the list of incidents.
One commenter suggested that the
agencies include additional details in
the illustrative examples that would
identify the type of information systems
that would not require incident
notification and another suggested more
broadly that the final rule include
illustrative examples of both incidents
that would and would not be subject to
the final rule
comments about
the list of incidents.
One commenter suggested that the
agencies include additional details in
the illustrative examples that would
identify the type of information systems
that would not require incident
notification and another suggested more
broadly that the final rule include
illustrative examples of both incidents
that would and would not be subject to
the final rule. The agencies believe that
the criteria set forth in the notification
incident definition make clear that the
focus of the rule is on incidents that
materially and adversely impact a
banking organization rather than on
specific types of information systems.
The agencies recognize that many
banking organizations manage
computer-security incidents every day
that would not require notification
under the final rule and have focused on
illustrative examples of the type of
incidents that would require
notification.
One commenter suggested that the
example discussing a ransom malware
attack that encrypts a banking
organization’s core system is
‘‘duplicative of various federal and state
breach notification laws.’’ The agencies
continue to conclude that any incident
of ransom malware that disrupts a
banking organization’s ability to carry
out banking operations meets the
definition of a notification incident, and
as such, have retained this example,
notwithstanding any potential overlap
between the final rule and other Federal
and state requirements for incident
reporting.39
Another commenter suggested that
some of the examples provided were
‘‘inconsistent with’’ the term computer-
security incident, as incidents such as
failed system upgrades or unrecoverable
system failures are not technically
computer-security incidents. The
agencies disagree with this comment
and believe that the commenter is
reading the definition of computer-
security incident too narrowly to focus
on malicious incidents
e of the examples provided were
‘‘inconsistent with’’ the term computer-
security incident, as incidents such as
failed system upgrades or unrecoverable
system failures are not technically
computer-security incidents. The
agencies disagree with this comment
and believe that the commenter is
reading the definition of computer-
security incident too narrowly to focus
on malicious incidents.
The agencies believe the examples in
the proposed rule provide an
appropriate perspective on the critical
nature of the type of incidents that
banking organizations should consider
notification incidents. Having received
only general comments and no specific
new examples of notification incidents
that should be included in the list, the
agencies are retaining the illustrative
examples provided in the NPR with
some minor edits.40
The following is a non-exhaustive list
of incidents that generally are
considered ‘‘notification incidents’’
under the final rule:
1. Large-scale distributed denial of
service attacks that disrupt customer
account access for an extended period of
time (e.g., more than 4 hours);
2. A bank service provider that is used
by a banking organization for its core
banking platform to operate business
applications is experiencing widespread
system outages and recovery time is
undeterminable;
3. A failed system upgrade or change
that results in widespread user outages
for customers and banking organization
employees;
4. An unrecoverable system failure
that results in activation of a banking
organization’s business continuity or
disaster recovery plan;
5. A computer hacking incident that
disables banking operations for an
extended period of time;
6
y time is
undeterminable;
3. A failed system upgrade or change
that results in widespread user outages
for customers and banking organization
employees;
4. An unrecoverable system failure
that results in activation of a banking
organization’s business continuity or
disaster recovery plan;
5. A computer hacking incident that
disables banking operations for an
extended period of time;
6. Malware on a banking
organization’s network that poses an
imminent threat to the banking
organization’s core business lines or
critical operations or that requires the
banking organization to disengage any
compromised products or information
systems that support the banking
organization’s core business lines or
critical operations from internet-based
network connections; and
7. A ransom malware attack that
encrypts a core banking system or
backup data.
While the agencies have included
these illustrative examples to help
clarify the scope of notification
incidents, the final rule requires
banking organizations to consider, on a
case-by-case basis, whether any
significant computer-security incidents
they experience constitute notification
incidents for purposes of notifying the
appropriate agency. If a banking
organization is in doubt as to whether
it is experiencing a notification incident
for purposes of notifying its primary
Federal regulator, the agencies
encourage it to contact its regulator. The
agencies recognize that a banking
organization may file a notification,
from time to time, upon a mistaken
determination that a notification
incident has occurred, and the agencies
generally do not expect to take
supervisory action in such situations.
C. Banking Organization Notification to
Agencies
i. Timing of Notification to Agencies
The proposed rule would have
required banking organizations to
provide the mandated notification to the
agencies as soon as possible and no later
than 36 hours. The agencies asked
whether this timeframe should be
modified, and if so, how
lly do not expect to take
supervisory action in such situations.
C. Banking Organization Notification to
Agencies
i. Timing of Notification to Agencies
The proposed rule would have
required banking organizations to
provide the mandated notification to the
agencies as soon as possible and no later
than 36 hours. The agencies asked
whether this timeframe should be
modified, and if so, how.
One commenter suggested that the
agencies eliminate the ‘‘as soon as
possible’’ requirement and simply
require notification within 36 hours,
which would eliminate an apparent
tension between the permission for an
organization to take a reasonable
amount of time to determine that it has
experienced a notification incident and
the requirement for immediate
reporting. Some commenters supported
the 36-hour timeframe as an appropriate
balance between the potential burden
on institutions and the agencies’ need
for prompt information.41 However,
other commenters expressed concerns,
viewing the 36-hour timeframe as too
short to allow a banking organization to
fully understand a computer-security
incident and to provide a complete
assessment of the situation. Commenters
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00029
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66432
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
42 Effective March 1, 2017, the NYDFS
Superintendent promulgated 23 NYCRR Part 500, a
regulation establishing cybersecurity requirements
for financial services companies
:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00029
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66432
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
42 Effective March 1, 2017, the NYDFS
Superintendent promulgated 23 NYCRR Part 500, a
regulation establishing cybersecurity requirements
for financial services companies. Section 500.17
Notices to superintendent requires each ‘‘covered
entity’’ to notify the NYDFS Superintendent ‘‘as
promptly as possible but in no event later than 72
hours from a determinantion that a cybersecurity
event has occurred.’’ The NYDFS regulation is
available at:https://govt.westlaw.com/nycrr/Browse/
Home/NewYork/NewYorkCodesRulesand
Regulations?guid=I5be30d2007f811e79d43a037eef
d0011&origination&Context
documenttoc&transitionTypeDefault&context
Data=(sc.Default).
43 In particular, Article 33, Section 1 of the GDPR
provides that, in the case of a personal data breach,
the data controller ‘‘shall without undue delay and,
where feasible, not later than 72 hours after having
become aware of it,’’ notify the competent
supervisory authority of the personal data breach.
Moreover, Article 33, Section 2 requires data
processors to ‘‘notify the [data] controller without
undue delay after becoming aware of a personal
data breach.’’ The full version of Regulation (EU)
2016/679 (GDPR) is available at: https://eur-
lex.europa.eu/legal-content/EN/TXT/PDF/
?uri=CELEX:32016R0679.
44 See id.
45 As noted above, the agencies recognize that a
banking organization may file a notification, from
time to time, upon a mistaken determination that
a notification incident has occurred, and the
agencies generally do not expect to take supervisory
action in such situations.
noted that the 36-hour timeframe is only
workable when it commences after a
banking organization determines that a
notification incident has occurred
ecognize that a
banking organization may file a notification, from
time to time, upon a mistaken determination that
a notification incident has occurred, and the
agencies generally do not expect to take supervisory
action in such situations.
noted that the 36-hour timeframe is only
workable when it commences after a
banking organization determines that a
notification incident has occurred. In
this regard, two commenters requested
that the agencies expressly articulate in
the final rule the explanation included
in the NPR that the 36-hour timeframe
commences at the point when a banking
organization has determined that a
notification incident has
occurred.Several commenters suggested
that the agencies consider a 72-hour
window to provide banking
organizations with additional time to
assess potential incidents and to align
the proposed rule with other regulatory
requirements such as the New York
State Department of Financial Services’
(NYDFS) cybersecurity event
notification requirement,42 or the
European Union’s General Data
Protection Regulation (GDPR),43 both of
which require covered entities to report
relevant cyber-related incidents within
72 hours.44 A few commenters
suggested that the notification
timeframe should be increased to 48
hours, with one suggesting that any
timeline align with business day
processing, and another observing that
community banks ‘‘need the additional
12 hours to evaluate the situation and
implement an appropriate incident
response plan.’’ One commenter
suggested that the notification
timeframe be extended to a minimum of
five business days for banks under $20
billion in assets in order to ‘‘provide
banks adequate time to work with
vendors and their core processors to
provide accurate notifications.’’ Another
commenter observed that, ‘‘for a 36-hour
notification timeframe to be potentially
workable and achievable, it is
imperative that the scope of the
notification requirement be tailored.’’
The agencies continue to believe that
36
under $20
billion in assets in order to ‘‘provide
banks adequate time to work with
vendors and their core processors to
provide accurate notifications.’’ Another
commenter observed that, ‘‘for a 36-hour
notification timeframe to be potentially
workable and achievable, it is
imperative that the scope of the
notification requirement be tailored.’’
The agencies continue to believe that
36 hours is the appropriate timeframe,
given the simplicity of the notification
requirement and the severity of
incidents captured by the definition of
‘‘notification incident.’’ 45 In developing
the NPR and final rule, the agencies
reviewed a number of existing security
incident reporting requirements cited by
the commenters and found that many of
them involved detailed, prescriptive
reporting requirements, often mandating
that specific information be reported
and including filing instructions. For
example, the NYDFS rule requires that
covered entities submit an annual
statement certifying their compliance
with the rule and keep all documents
supporting their certification for five
years, among other things. In contrast,
the final rule sets forth no specific
content or format for the simple
notification it requires. The final rule is
designed to ensure that the appropriate
agency receives timely notice of
significant emergent incidents, while
providing flexibility to the banking
organization to determine the content of
the notification. Such a limited
notification requirement will alert the
agencies to such incidents without
unduly burdening banking
organizations with detailed reporting
requirements, especially when certain
information may not yet be known to
the banking organizations.
In addition, changes to the definitions
of ‘‘computer-security incident’’ and
‘‘notification incident’’ described above
narrow the range, and reduce the
speculative or uncertain nature of,
incidents subject to the notification
requirement
ing banking
organizations with detailed reporting
requirements, especially when certain
information may not yet be known to
the banking organizations.
In addition, changes to the definitions
of ‘‘computer-security incident’’ and
‘‘notification incident’’ described above
narrow the range, and reduce the
speculative or uncertain nature of,
incidents subject to the notification
requirement.
The narrowed scope of notification
incidents, however, makes it even more
important for the agencies to receive
notice as soon as possible. Additionally,
the agencies recognize that a banking
organization may be working
expeditiously to resolve the notification
incident—either directly or through a
bank service provider—at the time it
would be expected to notify its primary
Federal regulator. The agencies believe,
however, that 36 hours is a reasonable
amount of time after a banking
organization has determined that a
notification incident has occurred to
notify its primary Federal regulator, as
it does not require an assessment or
analysis.
The agencies do not expect that a
banking organization would typically be
able to determine that a notification
incident has occurred immediately
upon becoming aware of a computer-
security incident. Rather, the agencies
anticipate that a banking organization
would take a reasonable amount of time
to determine that it has experienced a
notification incident. For example, some
notification incidents may occur outside
of normal business hours. Only once the
banking organization has made such a
determination would the 36-hour
timeframe begin.
Accordingly, the agencies have
determined that the final rule will retain
the requirement that banking
organizations provide notice as soon as
possible and no later than 36 hours. The
agencies note, however, that even
within the 36-hour notification window,
banking organizations’ notification
practices should take into account their
criticality to the sector in which they
operate and provide services
the agencies have
determined that the final rule will retain
the requirement that banking
organizations provide notice as soon as
possible and no later than 36 hours. The
agencies note, however, that even
within the 36-hour notification window,
banking organizations’ notification
practices should take into account their
criticality to the sector in which they
operate and provide services. An
effective practice of banking
organizations that provide sector-critical
services is to provide same-day
notification to their primary Federal
regulator of a notification incident. The
agencies encourage this practice to
continue among these banking
organizations.
ii. Method of Notification to Agencies
The proposed rule would have
required a banking organization to
notify the appropriate agency of a
notification incident through any form
of written or oral communication,
including through any technological
means, to a designated point of contact
identified by the agency.
The agencies requested comments on
how banking organizations should
provide notifications to the agencies and
sought comment on whether they
should ‘‘adopt a process of joint
notification’’ where multiple banking
organization affiliates have differing
notification obligations. Further, the
agencies requested feedback on how
such a joint notification should be done
and why.
A substantial number of commenters
responded to various aspects of these
questions. While specific suggestions
varied, a consistent theme was a desire
for efficient and flexible options for
providing notice, with some
commenters observing that a
notification incident could also affect
normal communication channels. Other
commenters made recommendations to
enhance notification efficiency, such as
suggesting the use of automated
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00030
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1
providing notice, with some
commenters observing that a
notification incident could also affect
normal communication channels. Other
commenters made recommendations to
enhance notification efficiency, such as
suggesting the use of automated
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00030
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66433
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
46 See, e.g., 12 CFR part 4 (OCC); 12 CFR part 261
(Rules Regarding Availability of Information)
(Board); 12 CFR 309.6 (Disclosure of exempt
records) (FDIC).
47 While most commenters believe that notifying
all banking organizations subscribing to the
disrupted service may lead to potentially harmful
over-reporting, one commenter stated that notifying
all banking organizations using the service may be
appropriate since the service disruption may be
broader than originally expected.
electronic notifications. Two
commenters suggested that, consistent
with the agencies’ statement in the NPR,
the rule should explicitly state that no
specific information is required and that
the rule does not prescribe any
particular reporting form.
The agencies have concluded that
email and telephone are the best
methods currently available for effective
notification. Recognizing, however, that
agency processes may evolve and
technology will likely change (and
improve) available communication
options over time, the agencies have
also built flexibility into the final rule
by stating that the agencies may
prescribe other similar methods
pursuant to which notice may be
provided. The agencies believe that this
approach balances the need for banking
organizations to have some flexibility,
including if a communication channel is
impacted by the incident, with the
agencies’ need to ensure that they
actually receive the notifications
xibility into the final rule
by stating that the agencies may
prescribe other similar methods
pursuant to which notice may be
provided. The agencies believe that this
approach balances the need for banking
organizations to have some flexibility,
including if a communication channel is
impacted by the incident, with the
agencies’ need to ensure that they
actually receive the notifications.
The agencies also sought comments
on whether centralized points of
contact, regional offices, or banking
organization-specific supervisory teams
would be better suited to receive these
notifications. The comments from
banking organizations and bank service
providers differed on this issue.
Some banking organizations suggested
that the process should remain
‘‘flexible’’ and that the rule provide that
the notification requirement could be
‘‘satisfied by any of several methods,’’
including providing the notification to
the banking organization’s on-site or
supervisory teams, appropriate regional
offices, or an agency-designated point of
contact. Other commenters, including
bank service providers, suggested
creating a joint notification process, or
centralized portal or point of contact for
all agencies to receive all such
notifications directly. The agencies
believe that the provision of notice can
often be efficiently and effectively
achieved by communicating with the
appropriate agency supervisory office or
other designated agency contacts, which
may include designated supervisory
staff, call centers, incident response
teams, and other contacts to be
designated by the respective agency.
The agencies also received several
comments requesting further instruction
and guidance on the method and
manner of the required notifications.
Several other commenters requested
additional guidance on what a notice
must contain and the scope of
information that should be provided,
and even requested certain specific
exclusions
d other contacts to be
designated by the respective agency.
The agencies also received several
comments requesting further instruction
and guidance on the method and
manner of the required notifications.
Several other commenters requested
additional guidance on what a notice
must contain and the scope of
information that should be provided,
and even requested certain specific
exclusions.
The notification requirement is
intended to serve as an early alert to a
banking organization’s primary Federal
regulator about a notification incident.
The agencies anticipate that banking
organizations will share general
information about what is known at the
time of the incident. No specific
information is required in the
notification other than that a
notification incident has occurred. The
final rule does not prescribe any form or
template. A simple notice can be
provided to the appropriate agency
supervisory office, or other designated
point of contact, through email,
telephone, or other similar method that
the agency may prescribe. The
notifications, and any information
related to the incident, would be subject
to the agencies’ confidentiality rules.46
Accordingly, the agencies revised the
NPR language. The final rule provides
that a banking organization would
notify the appropriate agency-
designated point of contact through
email, telephone, or other similar
methods that the agency may prescribe.
D. Bank Service Provider Notification to
Banking Organization Customers
i
dent, would be subject
to the agencies’ confidentiality rules.46
Accordingly, the agencies revised the
NPR language. The final rule provides
that a banking organization would
notify the appropriate agency-
designated point of contact through
email, telephone, or other similar
methods that the agency may prescribe.
D. Bank Service Provider Notification to
Banking Organization Customers
i. Scope of Bank Service Provider
Notification
Commenters generally supported the
idea of only notifying affected
customers although some commenters
suggested that all banking organization
customers should be notified.47 One
commenter specifically suggested that
bank service provider notifications
should only go to banking organizations
that are ‘‘directly impacted by the
incident when a bank service provider
has made a determination that the
incident will or is reasonably likely to
materially impact the services provided
to the banking organization.’’ The
agencies agree with the ‘‘materiality’’
aspect of this comment and the focus on
‘‘reasonably likely’’ impacts.
Accordingly, the agencies are revising
the final rule to include the phrase
‘‘materially disrupted or degraded, or is
reasonably likely to materially disrupt
or degrade.’’ This change is also
responsive to comments that requested
the agencies further harmonize the bank
service provider notification
requirement with the banking
organization notification requirement.
The final rule does not require a bank
service provider to assess whether the
incident rises to the level of a
notification incident for a banking
organization customer, which remains
the responsibility of the banking
organization. The agencies anticipate
that bank service providers would make
a best effort to share general information
about what is known at the time
ication requirement.
The final rule does not require a bank
service provider to assess whether the
incident rises to the level of a
notification incident for a banking
organization customer, which remains
the responsibility of the banking
organization. The agencies anticipate
that bank service providers would make
a best effort to share general information
about what is known at the time. If, after
receiving notice from a bank service
provider, the banking organization
determines that a notification incident
has occurred, the banking organization
is required to notify its primary Federal
regulator in accordance with this final
rule. The agencies generally will not cite
a banking organization because a bank
service provider fails to comply with its
notification requirement.
Another commenter described the
potential for confusion that could ensue
if a bank service provider were to notify
all customers, when only some of them
were affected by the computer-security
incident. They advised that such an
overly broad notification to all
customers could ‘‘cause the banking
organization customers and the bank
service provider to respond to questions
and concerns from banking organization
customers [who were] not affected by
the computer-security incident.’’ The
agencies agree with these commenters
and are retaining in the final rule the
requirement that notice be provided
only to ‘‘each affected banking
organization customer.’’
Another commenter noted that the
final rule needs to account for the
distinction between cloud-based
services versus on-premises services
and a shared-responsibility service
delivery model. Under the final rule, the
agencies would require bank service
providers to continue to provide a
banking organization customer with
prompt notification of material
incidents regardless of current contract
language and irrespective of the chosen
service delivery model
distinction between cloud-based
services versus on-premises services
and a shared-responsibility service
delivery model. Under the final rule, the
agencies would require bank service
providers to continue to provide a
banking organization customer with
prompt notification of material
incidents regardless of current contract
language and irrespective of the chosen
service delivery model. Even under a
shared service model, a bank service
provider will still need to provide
notice to banking organization
customers if the bank service provider
has determined it has experienced a
computer-security incident that has
materially disrupted or degraded, or is
likely to materially disrupt or degrade,
covered services provided to such
banking organization customer for four
or more hours. Given the purposes of
the rule, the agencies believe this is a
reasonable requirement and are
adopting it in the final rule.
Whether the covered services are
being provided through a software-as-a-
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00031
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66434
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
48 Obstacles to immediate notification mentioned
by commenters included that bank service
providers need time to assess whether an incident
is a computer-security incident.
49 A commenter suggested that any timing for
notification should allow an opportunity for
reasonable investigation to help ensure that
material incidents are flagged to the regulators and
are not obfuscated by an influx of false positives or
non-material matter.
50 Commenters suggested that one contact should
be adequate, as smaller banking organizations may
not have two contacts available.
51 A commenter also recommended different
notification obligations for on-premises services
compared to cloud-based services
re that
material incidents are flagged to the regulators and
are not obfuscated by an influx of false positives or
non-material matter.
50 Commenters suggested that one contact should
be adequate, as smaller banking organizations may
not have two contacts available.
51 A commenter also recommended different
notification obligations for on-premises services
compared to cloud-based services. Commenters also
suggested a carve-out to the notification obligation
when a bank service provider is delayed or
prevented by law enforcement.
service (SaaS) arrangement, or through
some other service delivery method, a
bank service provider must provide
notification to banking organizations in
accordance with the standard in the
final rule. The banking organization
must then independently determine if a
notification incident has occurred.
Finally, in response to concerns
expressed by commenters, the agencies
are revising the final rule to specifically
exclude scheduled maintenance, testing,
or software updates previously
communicated to a banking
organization customer. This new
exception should reduce over- and
unnecessary notification. If, however,
the scheduled maintenance, testing, or
software update exceeds the parameters
communicated to the banking
organization customer and meets the
notification standard set forth in the
rule, this exception does not apply.
ii. Timing of Bank Service Provider
Notification
Several commenters favored
immediate notifications. Others were
concerned that immediate notifications
may result in over- and inaccurate
notification
sting, or
software update exceeds the parameters
communicated to the banking
organization customer and meets the
notification standard set forth in the
rule, this exception does not apply.
ii. Timing of Bank Service Provider
Notification
Several commenters favored
immediate notifications. Others were
concerned that immediate notifications
may result in over- and inaccurate
notification. For example, some
commenters objected to the requirement
that a bank service provider must
‘‘immediately’’ notify affected banking
organizations 48 and recommended that
the notification occur ‘‘as soon as
practicable,’’ within the first four hours
of the occurrence of a computer-security
incident, or in a ‘‘timely’’ manner (or a
similar standard) after a service
disruption to prevent over-reporting and
provide time for bank service providers
to assess the severity of an incident.49
One commenter noted that an
immediate notification standard may be
appropriate but only after the bank
service provider determines that a
notification incident has occurred,
while other commenters stated that
immediate notification was appropriate.
Another commenter expressed concern
that immediate notice may leave no
time lapse ‘‘between when a computer-
security incident occurred and when
notification has to happen.’’ While
expressing similar sentiments, some
commenters suggested substituting the
term ‘‘timely,’’ or ‘‘promptly’’ and
‘‘without undue delay,’’ in place of the
‘‘immediate’’ requirement. Another
commenter suggested that different
reporting obligations should be
permitted contingent upon the location
of the incident (on-premise services vs.
cloud services). The same commenter
suggested modifying the ‘‘good faith’’
standard to instead require ‘‘prompt’’
notification where a bank service
provider obtains actual knowledge of an
incident that impacts services for more
than four hours.
Other commenters drew distinctions
between security incidents and service
disruptions
upon the location
of the incident (on-premise services vs.
cloud services). The same commenter
suggested modifying the ‘‘good faith’’
standard to instead require ‘‘prompt’’
notification where a bank service
provider obtains actual knowledge of an
incident that impacts services for more
than four hours.
Other commenters drew distinctions
between security incidents and service
disruptions. One commenter observed
that ‘‘[u]nlike a ‘computer-security
incident’ which requires time to identify
and evaluate, a disruption in service is
instantaneously apparent and bank
service providers can immediately
notify banking organizations of the
disruption in service.’’ For similar
reasons, another commenter suggested
bifurcation of service provider
notifications: ‘‘one immediate notice
timeline if the incident affects the
security of the banking organization’s
systems and a second, longer time
period for disruption.’’
In response to these comments, the
agencies are revising the rule to provide
that a bank service provider must notify
affected banking organization customers
‘‘as soon as possible’’ when it
‘‘determines’’ it has experienced an
incident that meets the standard in the
rule. Use of the term ‘‘determined’’
allows the bank service provider time to
examine the nature of the incident and
assess the materiality of the disruption
or degradation of covered services.
Additionally, the ‘‘four or more hours’’
threshold should reduce notifications
concerning less material incidents
en it
‘‘determines’’ it has experienced an
incident that meets the standard in the
rule. Use of the term ‘‘determined’’
allows the bank service provider time to
examine the nature of the incident and
assess the materiality of the disruption
or degradation of covered services.
Additionally, the ‘‘four or more hours’’
threshold should reduce notifications
concerning less material incidents. Once
the bank service provider has made this
determination, it must provide notice
‘‘as soon as possible.’’
Some commenters recommended
revising the proposed rule to ‘‘allow for
service providers to satisfy their
notification requirement by providing
notification to their banking customer
consistent with any requirements and
by any methods set forth in their
contract with that customer, so long as
the method reasonably ensures that the
banking organization receives the
notification.’’ While the agencies believe
it is reasonable to assume that providing
notification to customers following a
determination that a material incident
has occurred should be consistent with
many existing contractual provisions,
the agencies conclude that an
independent regulatory requirement is
appropriate to ensure that banking
organizations receive consistent and
timely notification of the most
significant computer-security incidents
affecting covered services.
Other comments suggested that a 36-
or 72-hour notification timeframe would
be reasonable. For the reasons expressed
above, the agencies disagree that bank
service providers could (or should) wait
this long to alert banking organization
customers about a material disruption or
degradation in covered services.
Accordingly, the final rule requires bank
service providers to provide notice as
soon as possible when the bank service
provider has determined it has
experienced a notification incident.
iii
sed
above, the agencies disagree that bank
service providers could (or should) wait
this long to alert banking organization
customers about a material disruption or
degradation in covered services.
Accordingly, the final rule requires bank
service providers to provide notice as
soon as possible when the bank service
provider has determined it has
experienced a notification incident.
iii. Bank Service Provider Notification
to Customers
Some commenters stated that the
requirement in the proposal to notify
two individuals at each affected banking
organization of an incident was
appropriate. One commenter suggested
that a third notification be sent to a
banking organization’s general email or
telephone number. Several commenters
recommended the agencies allow the
notification through general channels
accessible by multiple employees at
affected banking organizations, and one
commenter suggested that ‘‘significant’’
bank service providers should directly
notify the agencies. Other commenters
asserted that requiring bank service
providers to notify two contacts at each
banking organization customer would
be overly prescriptive and
burdensome.50 Instead, these
commenters recommended that bank
service providers should work with
their banking organizations to designate
a central point of contact, but bank
service providers should not be required
to ensure that a contact at the banking
organization receive the notification.51
Regarding existing provisions in
contracts, a commenter contended that
‘‘contractual provisions with bank
service providers commonly provide
specific notice methods and generally
provide notice to two or more banking
organization employees.’’ This is
consistent with the agencies’
understandings of existing agreements
based on their broad-based review of
bank service provider agreements,
which was reflected in the language of
the proposed rule
ontended that
‘‘contractual provisions with bank
service providers commonly provide
specific notice methods and generally
provide notice to two or more banking
organization employees.’’ This is
consistent with the agencies’
understandings of existing agreements
based on their broad-based review of
bank service provider agreements,
which was reflected in the language of
the proposed rule.
As an alternative to the approach in
the proposed rule, a few commenters
suggested that the rule should ‘‘instead
focus on outcomes—ensuring that the
VerDate Sep<11>2014
16:32 Nov 22, 2021
Jkt 256001
PO 00000
Frm 00032
Fmt 4700
Sfmt 4700
E:\FR\FM\23NOR1.SGM
23NOR1
lotter on DSK11XQN23PROD with RULES1

66435
Federal Register / Vol. 86, No. 223 / Tuesday, November 23, 2021 / Rules and Regulations
52 A commenter stated that bank service providers
already subject to contractual breach reporting
obligations should be excluded from the rule while
a different commenter believed that as a matter of
fairness and competitive equality, if private sector
FMUs are required to provide mandated notices to
either their primary Federal regulator or their
banking organization customers, the Board should
publicly commit to hold Federal Reserve Bank
services to an equivalent standard.
appropriate individuals or entities at
banking organizations receive timely
notice.’’ Another commenter suggested
that ‘‘banking organizations should have
a central point of contact that would be
accessible by more than one person to
ensure that notifications to the banking
organization are timely received and
acted upon.’’ This approach was echoed
by another banking industry
commenter, who suggested that
‘‘notification through a medium or
channel that is accessed by and
available to multiple banking
organization employees’’ should be
allowed to meet the NPR’s notification
requirement. Some commenters
suggested using automated notifications
or centralized notification portals to
streamline the notification process
roach was echoed
by another banking industry
commenter, who suggested that
‘‘notification through a medium or
channel that is accessed by and
available to multiple banking
organization employees’’ should be
allowed to meet the NPR’s notification
requirement. Some commenters
suggested using automated notifications
or centralized notification portals to
streamline the notification process.
After consideration of the comments,
the agencies are revising the final rule
to keep the notification process simple
and flexible. Rather than requiring bank
service providers to notify two
individuals at each affected banking
organization customer, which may not
be effective for every banking
organization or bank service provider,
the final rule requires bank service
providers to notify ‘‘at least one bank-
designated point of contact at each
affected banking organization
customer.’’ The final rule states that a
banking organization-designated point
of contact is an email, phone number, or
any other contact(s), previously
provided to the bank service provider by
the banking organization customer.
The agencies determined effective
notice will be best achieved if banking
organizations and bank service
providers work collaboratively to
designate a method of communication
that is feasible for both parties and
reasonably designed to ensure that
banking organizations actually receive
the notice in a timely manner. The final
rule also provides flexibility for banking
organizations and bank service
providers to determine the appropriate
designated point of contact, and if a
banking organization customer has not
previously provided a bank-designated
point of contact, such notification shall
be made to the Chief Executive Officer
(CEO) and Chief Information Officer
(CIO) of the banking organization
customer, or two individuals of
comparable responsibilities, through
any reasonable means.
iv
s to determine the appropriate
designated point of contact, and if a
banking organization customer has not
previously provided a bank-designated
point of contact, such notification shall
be made to the Chief Executive Officer
(CEO) and Chief Information Officer
(CIO) of the banking organization
customer, or two individuals of
comparable responsibilities, through
any reasonable means.
iv. Bank Service Provider Agreements—
Contract Notice Provisions
Several commenters observed that
contracts between banking organizations
and bank service providers routinely
include incident notification
provisions.52 But other commenters
noted that current contractual
provisions may not align with the
proposed rule’s notification
requirements and, as such, would need
to be amended or revised, which may
take time to complete.
Commenters generally stated that
while contracts between banking
organizations and bank service
providers already have negotiated notice
provisions, such contracts would need
to be amended to ensure compliance
with the rule. In that regard,
commenters expressed the view that the
proposed rule should be revised to
allow for bank service providers to
satisfy their notification requirement by
providing notification to their banking
organization customer consistent with
any requirements and by any methods
set forth in their contract with that
customer, so long as the method
reasonably ensures that the banking
organization customer receives the
notification. Facilitating compliance
with the rule in this manner would
prevent banking organizations from
having to incur the costs to amend
existing contracts. Other commenters
expressed perceived challenges with
renegotiating contracts to comply with
the rule and commenters stated that
they should not be faulted for a bank
service provider’s failure to notify
on customer receives the
notification. Facilitating compliance
with the rule in this manner would
prevent banking organizations from
having to incur the costs to amend
existing contracts. Other commenters
expressed perceived challenges with
renegotiating contracts to comply with
the rule and commenters stated that
they should not be faulted for a bank
service provider’s failure to notify. One
commenter expressed concern that
community banks may hold little power
in these negotiations and recommended
extending the compliance date of the
rule for community banks. Relatedly, a
commenter argued that if FMUs are
required to provide mandated notices to
their banking organization customers,
the rule should require banking
organization customers to identify and
update their contacts for mandated
notices to their bank service providers,
rather than placing the burden on bank
service providers to request and seek
updates to these contacts. Commenters
also urged the agencies to accept the
notification methods specified in these
contracts and clarify contract
expectations. A few commenters
requested that the agencies provide
specific contract expectations and to
consider conducting a review of
contracts to confirm the notice
provisions were adequate.
The agencies believe many contracts
already address such notices to banking
organizations. Typically, existing bank
service provider agreements that
support operations that are critical to a
banking organization customer require
notification to the customer as soon as
possible in the event of a material
incident during the normal course of
business. If such notification provisions
satisfy the requirements of the final rule,
then notification under the contractual
provisions will satisfy a bank service
provider’s obligation under the rule as
well. The agencies note that existing
notification procedures may include
some redundancy with the final rule
as
possible in the event of a material
incident during the normal course of
business. If such notification provisions
satisfy the requirements of the final rule,
then notification under the contractual
provisions will satisfy a bank service
provider’s obligation under the rule as
well. The agencies note that existing
notification procedures may include
some redundancy with the final rule.
However, the agencies are requiring
notice in the final rule to ensure that a
notification occurs in the event of a
material computer-security incident. As
a result, the agencies are not
incorporating these recommendations.
The agencies also note that the
notification requirement created by this
rule is independent of any contractual
provisions, and therefore, bank service
providers must comply even where their
contractual obligations differ from the
notification requirement in this rule.
The agencies anticipate that banking
organizations and bank service
providers will work collaboratively to
designate a method of communication
that is feasible for both parties and
reasonably designed to ensure that
banking organizations actually receive
the notice in a timely manner, for
purposes of complying with the rule.
This final rule is not expected to add
significant burden on bank service
providers. The agencies’ experiences
with conducting bank service provider
contract reviews during examinations
indicate that many of these contracts
include incident-reporting provisions.
The agencies also observe that there are
effective automated systems for
notification currently.
In addition, for banking organizations
that have not already designated
individuals to be notified under
contractu

[Text truncated at 120,000 characters. The full text is on the page linked above.]

## Nearby sections

- [FDIC FIL-1-2002 FOREIGN ASSETS CONTROL ACT](https://www.frixlaw.com/law-library/statutes/FDIC_FIL02001.md)
- [FDIC FIL-1-2010 Employee Compensation Advance Notice of Proposed Rulemaking](https://www.frixlaw.com/law-library/statutes/FDIC_FIL10001.md)
- [FDIC FIL-1-2024 Consolidated Reports of Condition and Income for Fourth Quarter 2023](https://www.frixlaw.com/law-library/statutes/FDIC_FIL24001.md)
- [FDIC FIL-2-2004 Foreign Assets Control Act](https://www.frixlaw.com/law-library/statutes/FDIC_FIL04002.md)
- [FDIC FIL-2-2020 Consolidated Reports of Condition and Income for Fourth Quarter 2019](https://www.frixlaw.com/law-library/statutes/FDIC_FIL20002.md)
- [FDIC FIL-3-2003 FILING PROCEDURES](https://www.frixlaw.com/law-library/statutes/FDIC_FIL03003.md)
- [FDIC FIL-4-2006 Commercial Real Estate Lending Proposed Interagency Guidance](https://www.frixlaw.com/law-library/statutes/FDIC_FIL06004.md)
- [FDIC FIL-4-2021 Revised Guidelines for Appeals of Material Supervisory Determinations](https://www.frixlaw.com/law-library/statutes/FDIC_FIL21004.md)
- [FDIC FIL-4-2023 Guidance to Help Financial Institutions and Facilitate Recovery in Areas of California Affected by Severe Winter Storms, Flooding, Landslides and Mudslides](https://www.frixlaw.com/law-library/statutes/FDIC_FIL23004.md)
- [FDIC FIL-4-2025 FDIC Statement of Policy on Bank Merger Transactions](https://www.frixlaw.com/law-library/statutes/FDIC_FIL25004.md)
- [FDIC FIL-5-2000 Consumer Credit Reporting Practices](https://www.frixlaw.com/law-library/statutes/FDIC_FIL00005.md)
- [FDIC FIL-5-2003 LETTER TO STAKEHOLDERS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL03005.md)
- [FDIC FIL-5-2021 Frequently Asked Questions Regarding Suspicious Activity Reporting and Other Anti-Money Laundering (AML) Considerations](https://www.frixlaw.com/law-library/statutes/FDIC_FIL21005.md)
- [FDIC FIL-6-2000 Special Alert](https://www.frixlaw.com/law-library/statutes/FDIC_FIL00006.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/FDIC_FIL21074. Check the current official text before relying on it. Not legal advice.