Federal Bank Regulators Approve New Cybersecurity Incident Notification Rule

On Nov. 18, 2021, federal bank regulatory agencies approved a final rule requiring banking organizations to notify regulators of "any significant computer-security incident" as soon as possible and no later than 36 hours after a determination that such an incident occurred.¹

The rule will take effect on April 1, 2022. Compliance is required for banking organizations and their bank service providers by May 1, 2022.

The Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corp. (FDIC) and the Board of Governors of the Federal Reserve System (Board) (together, the "agencies") issued the final rule, which will require a banking organization to notify its primary federal regulator of any "computer-security incident" that rises to the level of a "notification incident." A "computer-security incident" is defined as one that results in "actual harm to the confidentiality, integrity, or availability of an information system or the information