Federal Banking Agencies Adopt New Computer-Security Incident Notification Requirements

The three federal banking agencies (i.e., the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency—collectively, the Agencies) published a final rule (the Rule) on November 23, 2021, requiring "banking organizations" to notify their primary federal regulator within 36 hours in the event of certain types of computer-security incidents. The Rule separately requires "bank service providers" to notify banking organization customers as soon as possible in the event of any incident that has or is reasonably likely to materially affect those customers for four or more hours.

The Rule applies to all national banks, insured state member and nonmember banks, federal and insured state savings associations, US bank holding companies and savings and loan holding companies, state and federal branches and agencies of foreign banks, and the US operations of foreign banking organizations. Bank service providers covered