US Federal Regulators Propose Binding Rules To Enhance Banks' Cybersecurity Practices

On October 19, 2016, three US financial regulators – the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation (collectively, the "Agencies") – issued a joint Advance Notice of Proposed Rulemaking ("ANPR") seeking comments by all stakeholders on enhanced cyber risk management standards. Historically, US regulators have provided non-mandatory guidelines for cybersecurity best practices for voluntary compliance by financial institutions to ensure preparedness in face of cyber threats. For the first time, the ANPR outlines proposals for minimum binding standards that would be applicable to some of the largest regulated institutions in the US with consolidated assets of US$50 billion or more on an enterprise-wide basis. These binding standards indicate a shift in the approach adopted by US regulators from a lenient oversight to one that is more prescriptive.