Introduction

Cybersecurity is a major concern of banks and banking regulators. Data breaches at large financial institutions and credit reporting agencies have increased concern about the privacy and security of the large amounts of consumer financial information that these companies gather, use, and store.¹ Many in Congress have demonstrated an interest in data privacy and cybersecurity, as evidenced by a number of hearings on large-scale data breaches in prior Congresses. In the 118^th Congress, the Chair of the House Financial Services Committee identified data privacy as a legislative priority for the current session.² This report examines the existing legislative framework for financial cybersecurity, and provides some context for how regulators currently promulgate, supervise, and enforce various data privacy provisions.

The implementation of cybersecurity policy among banking regulators is fragmented, and potential risks to the financial system have emerged as new technologies evolve. This report focuses on the cybersecurity regulatory framework among the federal banking regulators—the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and the Federal Reserve—as well as the National Credit Union Administration (NCUA) and the Consumer Financial Protection Bureau (CFPB).

Cybersecurity Risks to the Banking System

Cybersecurity means protecting systems, networks, devices, and data from digital attacks by criminals and other adversaries.³ Cybersecurity threats pose operational risk, reputational risk, and, potentially, systemic risk.⁴

Operational risk is the threat that an event such as a natural disaster, pandemic, or cyberattack limits or completely obstructs an institution's ability to do business. Banks face risk from cyber threats, which could interrupt their daily operations.

Reputational risk is the threat that customers will avoid future business with an institution due to an event such as a cyberattack. The financial system depends on trust. For example, if a breach at a bank results in the release of personal data, customers may be reluctant to continue their relationship with the bank. They may choose to pull their deposits out from the bank and close their accounts. Without trust that customers' money and personal data are safe, the financial system cannot operate smoothly.

Systemic risk is the threat that a cyberattack may affect more than just the institution targeted and may jeopardize an industry or the entire economy. Banks, particularly large ones, can be highly interconnected, and many institutions depend on the same technological infrastructure. Thus, an attack on one information technology (IT) system could result in significant losses across the entire industry, both by costing the bank money to repair damages, and also the correlated risks that stem from consumers avoiding future business with the bank or other banks with similar exposure. Financial regulators consider the systemic risks to the entire industry. In doing so, they seek to ensure the safety and soundness not only of individual organizations but also their partners. The Financial Stability Oversight Council (FSOC) has identified three channels through which a cybersecurity event could threaten the stability of the U.S. financial system:⁵

• 1. Disrupting a key financial service or a financial market utility for which there are few substitutes (e.g., the central bank, securities and derivatives exchanges, and payment clearing and settlement institutions);
• 2. Causing a loss of confidence among a broad set of customers or market participants; and
• 3. Compromising the integrity of critical data (e.g., altering balance sheets), rendering information critical to financial firms either inaccurate or unusable.

Systemic risk from cybersecurity may have increased in 2020, as the pandemic has increased reliance on technology (e.g., remote payment systems, among others).

Current Legislative Framework

No single law provides a framework for regulating cybersecurity in the United States. Instead, multiple laws cover different industries or cover aspects of cybersecurity for the broader financial system, while others apply more directly to banks. Some of these laws require financial regulators to establish cybersecurity standards for financial institutions, and provide regulators the authority to ensure compliance with such standards. Other laws provide broad authority to regulators to supervise some financial institutions for safety and soundness.

The Gramm-Leach-Bliley Act of 1999 (GLBA; P.L. 106-102) is the most comprehensive of these laws and directs financial regulators to implement disclosure requirements and mandate security measures to safeguard private information. Specifically, Subtitle A of Title V of GLBA provides a framework for regulating data privacy and security practices for financial institutions.

The Sarbanes-Oxley Act of 2002 (P.L. 107-204) requires certain corporations, including banks, to identify internal and external risks to their business and the ways that the company guards against those risks.

The Fair and Accurate Credit Transactions Act of 2004 (FACT Act; P.L. 108-159) amended the Fair Credit Reporting Act to require regulatory agencies to develop identity theft guidelines, which outline "patterns, practices, and specific forms of activity that indicate the possible existence of identity theft" (15 U.S.C. §1681).

There are also two relevant laws specific to banks.

The Bank Protection Act (1968) (P.L. 90-389), as amended in 2010, directs the federal bank regulators to establish minimum security standards for banks and savings associations to "discourage robberies, burglaries, and larcenies" (12 U.S.C. §§1881-1884). Although the law does not mention cybersecurity specifically, the statutory language is broad enough to include protection against cyber threats.⁶

Other federal laws, such as the Bank Service Company Act of 1962 (BSCA; P.L. 87-856) and the laws that establish the authorities for financial regulators to conduct safety and soundness examinations, allow regulators to supervise financial institution activities and partnerships (e.g., with technology service providers). Regulators rely on these broad authorities to shape and impose cybersecurity regulations on the institutions they regulate. For example, the banking regulators conduct on-site examinations under their authority to examine banks for safety and soundness and can require banks to take remedial action if their cybersecurity policies are deficient.

Recent Legislative Developments⁷

Division Y of the Consolidated Appropriations Act, 2022 (P.L. 117-103) requires that "covered entities" report a "covered cyber incident" to the Cybersecurity and Infrastructure Security Agency within 72 hours and a ransomware payment within 24 hours of occurrence, respectively.⁸ Covered incidents include, at a minimum, any incident that leads "to substantial loss of confidentiality, integrity, or availability of such information system or network, or a serious impact on the safety and resiliency of operational systems and processes."

On February 8, the House Financial Services Committee held a hearing⁹ on various efforts to update bank regulation, including a discussion draft on data privacy. On February 28, 2023, the committee held a markup of several bills, including the Data Privacy Act of 2023 (H.R. 1165), introduced by Chair McHenry.¹⁰ The bill would amend GLBA, clarify the inclusion of data aggregators¹¹ under the scope of the law, and give consumers some added control over certain data, such as the ability to access and remove it from financial institution records. Also, the draft includes a national preemption measure, which would supersede state law.¹² During the markup, a number of amendments were introduced. While all eight amendments introduced by Democrats were rejected, the committee adopted a substitute amendment that would "allow exceptions for disclosures of personal information permitted under the Gramm-Leach-Bliley Act. The amendment also would specify that disclosure of data retention policies would include the period of time data is held and the criteria the institution uses to determine that time."¹³ The bill was ordered to be reported to the full House, as amended, by a vote of 26-21.

Regulatory Framework

As mentioned earlier, this report focuses largely on the cybersecurity regulatory framework among the federal banking regulators—the FDIC, the OCC, and the Federal Reserve—as well as the NCUA and the CFPB. Together these agencies are responsible for implementing and ensuring compliance with banking laws.

Generally, banking institutions are regulated by a primary federal regulator (PFR). The PFR for each type of banking institution depends on its charter, as summarized in Table 1. In addition, the CFPB promulgates a number of consumer protection rules for a variety of financial institutions, including certain banks.

GLBA Data Privacy and Safeguards

As mentioned above, GLBA provides the most comprehensive framework for cybersecurity regulation among financial institutions. While this section largely focuses on the GLBA provisions for regulating data privacy and security practices for banks, GLBA applies to a broad range of financial institutions.¹⁴ This framework is built upon two pillars: (1) privacy standards that impose disclosure limitations concerning consumers' information, and (2) security standards that require institutions to implement certain practices to safeguard the information from unauthorized access, use, and disclosure. The two major rules for implementing this framework are known as the Privacy Rule (Regulation P) and the Safeguards Rule, respectively. Each rule is summarized below in Table 2.

These rules are promulgated by several government agencies, and the regulators generally have supervisory and enforcement authority over the entities in their jurisdiction. This is shown in Table 3 and Table 4.

GLBA Rulemaking Authorities

Rulemaking authority to implement the Privacy Rule through Regulation P is vested in four agencies. The CFPB promulgates the Privacy Rule for banks. The Federal Trade Commission (FTC) has the rulemaking authority for the Safeguards Rule. Table 4 provides an overview of federal agencies with GLBA rulemaking authority and which entities they regulate under each rule.

Recent Updates on Depository Regulation of GLBA Cybersecurity Provisions

Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank; P.L. 111-203) transferred rulemaking authority for most provisions of Subtitle A of Title V of GLBA to the CFPB. As can be seen in more detail in the following section, Dodd-Frank also granted authority to the CFPB to examine and enforce compliance with respect to entities, including banks, under its jurisdiction.¹⁵ In December 2011, the CFPB effectively recodified Regulation P in Title 12, Part 1016, of the Code of Federal Regulations.¹⁶ The most recent amendment to its rulemaking occurred in 2018, when a 2015 statutory amendment from the Fixing America's Surface Transportation (FAST Act; P.L. 114-94) provided an exception to the annual notice requirement for financial institutions that meet certain conditions.¹⁷

The FTC codified its implementation of the Safeguards Rule in 2002 in Title 16, Part 314, of the Code of Federal Regulations.¹⁸ In 2016, the FTC sought public comments on the Safeguards Rule to assess the economic impact and benefits of the rule; possible conflict between the rule and state, local, or other federal laws or regulations; and the effect on the rule of any technological, economic, or other industry changes.¹⁹

On October 27, 2021, the FTC announced that it had issued a new final rulemaking²⁰ to specify safeguards financial institutions must implement as part of their information security programs—including limiting who can access consumer data and requiring encryption to secure the data. Under the updated Safeguards Rule, institutions must also explain the administrative, technical, and physical safeguards used to "access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle" customer information. Further, the definition of financial institution was expanded to include institutions that charge fees to connect consumers to potential lenders. In addition, the rule requires a financial institution to designate a single qualified individual to oversee its information security program and provide periodic reports to the institution's board or information security officials. The FTC also announced that it is seeking comment in a supplemental notice of proposed rulemaking on an additional change to the Safeguards Rule to require financial institutions to report certain data breaches and other security events to the FTC.²¹

Other Regulatory Developments

In November 2021, the OCC, Federal Reserve, and FDIC announced a joint final rulemaking that imposed rapid notification requirements on banking organizations and bank service providers following "significant" computer-security incidents.²² The rule requires a financial institution to notify its supervisor as soon as possible and no later than 36 hours after the banking organization believes in good faith that the incident occurred. This notification requirement is intended to serve as an early alert to a banking organization's primary federal regulator and is not meant to provide an assessment of the incident. Additionally, a bank service provider is required to notify each affected banking organization customer immediately after the provider experiences a computer security incident that has caused or is likely to cause a material service disruption for four or more hours.

Supervisory Process

In addition to writing rules to implement provisions of law, banking regulators have authority to conduct examinations or supervise institutions in their jurisdiction to ensure they are complying with the rules. As noted earlier, cybersecurity threats pose operational risk, reputational risk, and potentially systemic risk. Banking regulators together monitor these risks through the Federal Financial Institutions Examination Council (FFIEC).²³ FSOC monitors systemic risks to the financial system, including cyber threats. The FFIEC coordinates bank examinations for safety and soundness, as well as for compliance and information technology. Further, bank partnerships with third-party service providers are subject to the supervisory processes set forth in the BSCA.

GLBA Supervision

Agencies responsible for privacy and safeguard rulemaking are sometimes not the same agencies responsible for implementing and enforcing these rules for a particular entity. For instance, while the FTC has rulemaking authority for the Safeguards Rule, the banking and credit union regulators share supervisory authority for the rule. Further, most of the financial regulators have some supervisory or enforcement authority to ensure that the institutions in their respective jurisdictions comply with the Privacy and Safeguards Rules (see Table 4).

Depository Institution Supervision

Bank and credit union regulators have dedicated teams of examiners who conduct both routine and special examinations of depository institutions to ensure that they are operating in a safe and sound manner, complying with relevant laws, and maintaining adequate information technology systems. Each of the regulators inform the financial institutions under their jurisdiction about their supervisory expectations. In addition, while the regulatory framework for banks and credit unions is complex and fragmented among several agencies, the examination procedures among these agencies are largely coordinated through the FFIEC.

The depository regulators each approach cybersecurity examinations and supervision in different ways. Table 5 illustrates the general approaches and resources that each agency has established with respect to cybersecurity and information security. While each agency has developed its own approaches, tools, and resources, each agency relies on the FFIEC resources as well. The basic approaches include providing guidance to industry on how certain activities will be treated, policy manuals and handbooks that lay out the guidelines for examinations, and technical assistance.

Third-Party Service Providers

As banks facilitate more transactions through digital channels, financial institutions are increasingly relying on third-party vendors, specifically technology service providers (TSPs), to provide software and technical support. In light of this development, regulators are scrutinizing how banks manage their operational risks.²⁴ Rising operational risks—particularly cyber risks (e.g., data breaches, insufficient customer data backups, and operating system hijackings)—have compelled regulators to scrutinize banks' security programs. Regulators require an institution that uses a TSP to ensure that the TSP performs in a safe and sound manner, and activities performed by a TSP for a bank must meet the same regulatory requirements as if they were performed by the bank itself.

The BSCA gives regulators a broad set of authorities to supervise TSPs that have contractual relationships with banks. The BSCA directs the regulators to treat all activities performed by contract as if they were performed by the bank and grants them the authority to examine and regulate third-party vendors that provide services to banks, including check and deposit sorting and posting, statement preparation, notices, bookkeeping, and accounting.

The banking regulators issued interagency guidelines in 2001 regarding information security programs. The guidance requires banks to provide continuous oversight of third-party vendors such as TSPs. The regulators periodically update guidance and have since released additional guidance pertaining to third-party vendors.²⁵ For example, the Federal Reserve, FDIC, and OCC have each issued guidance addressing third-party relationships and appropriate risk management practices in 2008 and 2013, respectively.²⁶ In July 2021, the FDIC, Federal Reserve, and OCC issued joint proposed guidance on third-party relationships.²⁷ The proposed guidance assists banking organizations in managing third-party relationships. Further, in August 2021, the OCC issued guidance on financial technology third-party relationships.²⁸

Policy Issues for Congress

Oversight of financial services and bank cybersecurity reflects a complex and sometimes overlapping array of state and federal laws, regulators, regulations, and guidance—many of which predate the emergence of cybersecurity risk. Whether this framework provides adequate protection against cyberattacks without imposing undue cost burdens on banks is an open question. Successful hacks of banks and other financial institutions, in which large amounts of personal information were stolen or compromised, highlight arguments about the importance of ensuring bank cybersecurity.

That several regulators implement, supervise, and enforce federal provisions has also raised questions over the patchwork nature of regulatory standards for consumer privacy and security. With so many agencies involved with the cybersecurity of financial institutions, the Government Accountability Office (GAO) has raised concerns over interagency cooperation and tracking the success of agency efforts.²⁹ Some argue that a unified and modernized legislative framework could improve this patchwork approach.

As Congress continues to explore this issue, a few policy considerations, detailed below, may be informative.

Data Privacy

GLBA's financial data privacy provisions covers only nonpublic personal information held by financial institutions significantly engaged in financial activities. However, as the industry's data use has grown, some have debated whether the law covers all sensitive individual financial information. For example, data brokers can compile public and private data from different sources, many of which may not be subject to GLBA's provisions; combining these data might reveal financially sensitive information about a consumer. Further, consumers have a limited ability to know, control, or correct financial data, which can make it difficult to obtain redress for violations such as data breaches.

Technology Service Providers

Regulation aimed at banks' relationships with third-party vendors such as TSPs has benefits in mitigating operational risks but also imposes costs on banks. Some banks, particularly community banks and small credit unions, may find it difficult to comply with regulatory standards applicable to their relationship with third-party vendors. For example, certain institutions may be unable to conduct appropriate due diligence when selecting TSPs or to structure contracts that adequately protect against potential TSPs-related risks. Some banks may also lack the resources to monitor whether the TSPs are adhering to GLBA and other regulatory or contract requirements. Regulatory compliance costs are sometimes cited as a factor in banking industry consolidation, because compliance costs may be subject to economies of scale that incentivize small banks to merge with larger ones or other small banks to combine their resources to meet their compliance obligations.³⁰

Cloud Computing

Financial institutions may outsource the management of different controls over information assets and operations to cloud service providers (CSPs).³¹ Banks pay CSPs to use their computing resources (e.g., servers and mainframes), rather than purchasing and maintaining their own. This relationship is referred to as a shared responsibility model, in which banks and CSPs are responsible for discrete tasks of a shared work stream. Failure to implement an effective risk management process could put sensitive information at risk.

The BSCA gives bank regulators supervisory authority over service providers.³² Exercising this authority over CSPs, however, may raise challenges. Despite the integration of cloud services by the banking industry, different expectations from bank regulators and the cloud service industry,—such as what to expect during bank-like examinations—may persist.

Large, systemically important banks are reportedly moving significant portions of their operations onto cloud services, which could exacerbate the effects of a disruption at a CSP.³³ The cloud market is concentrated in three major CSPs—Amazon Web Services, Microsoft Azure, and Google Cloud—that collectively account for between 60%³⁴ and 70%³⁵ of market share and perhaps more among banks. In its 2022 annual report, FSOC identified "the financial sector's concentrated dependency on a limited number of service providers, such as cloud service providers, for critical information technology services as a potential risk to financial stability."³⁶ Traditional bank risks such as market and liquidity risks—not normally cloud computing concerns—can arise if the banks' abilities to transact are impeded by cloud-related disruptions. Banking regulators are concerned with risks to financial stability, so policymakers may choose to consider whether their authorities to regulate CSPs are appropriately calibrated.

Considering this close relationship, the scope of bank supervision may expand to CSPs. This may lead to technical resource mismatches, and regulators, like banks,³⁷ may find themselves with a shortage of cloud skills necessary to examine CSPs. CSPs may also not be familiar with or amenable to audits or bank-like examinations.³⁸ The Federal Reserve Bank of Richmond performed a formal exam of Amazon Web Services in April 2019, which reportedly exposed this culture clash.³⁹ Close integration between banks and CSPs may accelerate regulators' call for regular examination of CSPs to monitor aspects of their relationships with banks, including security and financial system stability risks.

Obstacles to data portability, such as proprietary technology and restrictive vendor contracts, may make switching CSPs difficult. Therefore, banks may adopt multi-cloud strategies—contracts with multiple CSPs—to avoid lock-in risk.⁴⁰ In addition to increasing costs, this introduces potentially two or more providers in the form of CSPs, and banks must manage these relationships effectively to ensure cybersecurity.