Is a bank, in the United States

31 U.S.C. § 5318(g)(2); 31 CFR § 1020.320 · Read the law's page

• It reaches you if you operate as a bank as 31 CFR 1010.100 defines the term: each agent, agency, branch or office within the United States of a person doing business as a commercial bank or trust company, a private bank, a savings and loan association or building and loan association, an insured institution, a savings bank, industrial bank or other thrift institution, a credit union, or another listed capacity. File a SAR with FinCEN for a transaction conducted or attempted by, at, or through the bank that involves or aggregates at least $5,000 in funds or other assets and that the bank knows, suspects, or has reason to suspect falls within 31 CFR 1020.320(a)(2)(i), (ii) or (iii). A bank is not required to file a SAR for a robbery or burglary committed or attempted that is reported to appropriate law enforcement authorities, or for lost, missing, counterfeit, or stolen securities with respect to which the bank files a report under 17 CFR 240.17f-1 (31 CFR 1020.320(c)).
• File the SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing; where no suspect was identified on that date you may delay filing an additional 30 calendar days to identify a suspect, but never more than 60 calendar days after initial detection (31 CFR 1020.320(b)(3)).
• Where a violation requires immediate attention, such as an ongoing money laundering scheme, notify an appropriate law enforcement authority by telephone immediately, in addition to filing a SAR on time (31 CFR 1020.320(b)(3)).
• Keep a copy of every SAR filed and the original or business record equivalent of the supporting documentation for five years from the date of filing; identify and maintain the supporting documentation as such, since it is deemed filed with the SAR, and make it available on request to FinCEN, to any Federal, State, or local law enforcement agency, and to the regulators named in paragraph (d) (31 CFR 1020.320(d)).
• Do not notify any person involved in the transaction that it has been reported, and do not otherwise reveal any information that would reveal that it has been reported; the prohibition binds the bank, its directors, officers, employees and agents, and any current or former contractor for the bank (31 U.S.C. 5318(g)(2)(A)(i)).
• Treat a SAR, and any information that would reveal the existence of a SAR, as confidential: no bank, and no director, officer, employee, or agent of any bank, may disclose either except as paragraph (e) authorizes (31 CFR 1020.320(e)(1)(i)).
• Disclose a SAR, or information that would reveal that one exists, only to the recipients paragraph (e)(1)(ii) allows: FinCEN; a Federal, State, or local law enforcement agency; a Federal regulatory authority that examines the bank for compliance with the Bank Secrecy Act; a State regulatory authority administering a State law that requires the bank to comply with it; or, within the bank's corporate organizational structure, for purposes consistent with Title II of the Bank Secrecy Act. The underlying facts, transactions and documents on which a SAR is based may be disclosed, including to another financial institution for a joint SAR and in certain employment references or termination notices to the full extent 31 U.S.C. 5318(g)(2)(B) authorizes, provided that no person involved in the reported transaction is notified that it has been reported (31 CFR 1020.320(e)(1)(ii)).
• If you are subpoenaed or otherwise requested to disclose a SAR or information that would reveal one, decline to produce it, citing 31 CFR 1020.320 and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and your response (31 CFR 1020.320(e)(1)(i)).

12 U.S.C. § 1831p-1; 12 CFR part 30, appendix A; 12 CFR part 208, appendix D-1; 12 CFR part 364, appendix A · Read the law's page

• It reaches you if you are an insured depository institution, the class of institution for which section 39 of the Federal Deposit Insurance Act requires each appropriate Federal banking agency to prescribe safety and soundness standards.
• An institution should have internal controls and information systems appropriate to the size of the institution and the nature, scope and risk of its activities, providing for clear lines of authority and responsibility for monitoring adherence to established policies, effective risk assessment, timely and accurate financial, operational and regulatory reports, adequate procedures to safeguard and manage assets, and compliance with applicable laws and regulations (Guidelines section II.A).
• An institution should have an internal audit system appropriate to its size and the nature and scope of its activities, providing for adequate monitoring of the system of internal controls through an internal audit function (or, where its size, complexity or scope of operations does not warrant a full scale internal audit function, a system of independent reviews of key internal controls), independence and objectivity, qualified persons, adequate testing and review of information systems, adequate documentation of tests and findings and any corrective actions, verification and review of management actions to address material weaknesses, and review by its audit committee or board of directors of the effectiveness of the internal audit systems (Guidelines section II.B).

Interagency Guidelines Establishing Information Security Standards, 12 CFR Part 30 Appendix B, 12 CFR Part 225 Appendix F and 12 CFR Part 364 Appendix B · Read the law's page

• This instrument reaches your organization only if it is a national bank, Federal savings association, Federal branch or agency of a foreign bank, bank holding company, FDIC-insured bank that is not a member of the Federal Reserve System, FDIC-insured state savings association, insured state branch of a foreign bank, or a subsidiary of one of them (other than a broker, dealer, person providing insurance, investment company or investment adviser). Declare is_bank where that holds.
• Implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to your size and complexity and the nature and scope of your activities, designed to ensure the security and confidentiality of customer information, protect against anticipated threats or hazards to its security or integrity, protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer, and ensure the proper disposal of customer and consumer information.
• Have your board of directors or an appropriate committee of the board approve the written information security program and oversee its development, implementation, and maintenance, and report to the board or committee at least annually on the status of the program and your compliance.
• Identify reasonably foreseeable internal and external threats to customer information and customer information systems, assess their likelihood and potential damage, and assess the sufficiency of your controls.
• Consider whether the security measures the Guidelines list, among them access controls, encryption of electronic customer information, monitoring to detect actual and attempted attacks and intrusions, and response programs that include appropriate reports to regulatory and law enforcement agencies, are appropriate and, if so, adopt those you conclude are appropriate.
• Exercise appropriate due diligence in selecting your service providers, require them by contract to implement appropriate measures designed to meet the objectives of the Guidelines, and, where your risk assessment indicates, monitor them to confirm that they have met their obligations.

NCUA Security Program and Guidelines for Safeguarding Member Information, 12 CFR 748.0 and Appendix A to Part 748 · Read the law's page

• This instrument reaches your organization only if it is a federally insured credit union, or if it maintains or has access to member information on behalf of one as a service provider. Declare is_bank where either holds.
• If your organization is a federally insured credit union, develop a written security program within 90 days of the effective date of insurance, designed to ensure the security and confidentiality of member records, protect against anticipated threats or hazards to the security or integrity of those records, and protect against unauthorized access to or use of them that could result in substantial harm or serious inconvenience to a member.
• Design the security program to respond to incidents of unauthorized access to or use of member information that could result in substantial harm or serious inconvenience to a member.
• Under the Guidelines in Appendix A, a comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.
• The Guidelines say the board of directors or an appropriate committee should approve the written information security policy and program, and should receive a report on its status and the credit union's compliance at least annually.
• Each credit union must consider whether the security measures the Guidelines list, among them access controls, encryption of electronic member information, monitoring to detect attacks and intrusions, and response programs including appropriate reports to regulatory and law enforcement agencies, are appropriate and, if so, adopt those it concludes are appropriate.
• The Guidelines say a credit union should exercise appropriate due diligence in selecting its service providers, require them by contract to implement appropriate measures designed to meet the objectives of the Guidelines, and, where its risk assessment indicates, monitor them.

FTC Safeguards Rule, 16 CFR 314.1 to 314.4(i) and 314.6 · Read the law's page

• This instrument reaches your organization only if it is a financial institution over which the Federal Trade Commission has jurisdiction: an entity whose business is an activity that is financial in nature or incidental to such an activity and that is not subject to another regulator's enforcement authority under the Gramm-Leach-Bliley Act, such as a mortgage lender, mortgage broker, finance company, payday lender, account servicer, check casher, collection agency or tax preparation firm. Declare provides_financial_services where that holds; a bank or federally insured credit union answers to its own regulator's standards instead.
• Develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a Qualified Individual responsible for overseeing, implementing and enforcing the program, and base the program on a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, reassessed periodically.
• Implement access controls, identify and manage the data, personnel, devices, systems and facilities that matter to your business, encrypt customer information in transit over external networks and at rest unless your Qualified Individual approves effective alternative compensating controls, adopt secure development practices, and implement multi-factor authentication for any individual accessing any information system unless your Qualified Individual approves in writing a reasonably equivalent or more secure control.
• Monitor and log the activity of authorized users, and regularly test the effectiveness of the safeguards' key controls, systems, and procedures: absent effective continuous monitoring, conduct annual penetration testing and vulnerability assessments at least every six months and whenever material changes occur.
• Provide security awareness training, use qualified information security personnel, oversee service providers by selecting capable ones, requiring safeguards by contract and periodically assessing them, and evaluate and adjust the program in light of testing, material changes and risk assessments.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control, and have your Qualified Individual report in writing at least annually to your board of directors or equivalent governing body.
• If you maintain customer information concerning fewer than five thousand consumers, the written risk assessment requirement of section 314.4(b)(1), the testing requirement of section 314.4(d)(2), the written incident response plan of section 314.4(h) and the board reporting of section 314.4(i) do not apply to you.

12 CFR 1016.4 to 1016.6, 1016.8 and 1016.9 · Read the law's page

• If you are a financial institution that Regulation P covers, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give a consumer who is not a customer that notice before you disclose any nonpublic personal information about the consumer to a nonaffiliated third party, other than as sections 1016.14 and 1016.15 authorize.
• You may give a customer the initial notice within a reasonable time after you establish the customer relationship if establishing it is not at the customer's election, or if giving it earlier would substantially delay the customer's transaction and the customer agrees to receive it later.
• Give each customer the notice again at least once in any period of 12 consecutive months during the customer relationship, unless you provide nonpublic personal information to nonaffiliated third parties only as sections 1016.13, 1016.14 or 1016.15 allow and have not changed the disclosure policies and practices in your most recent notice.
• If you lose the annual notice exception, give an annual notice: when you were required to give a revised notice, on the annual schedule treating the revised notice as an initial notice; otherwise within 100 days of the change in your policies or practices.
• Except as otherwise authorized in the rule, do not disclose nonpublic personal information about a consumer to a nonaffiliated third party other than as described in your initial notice unless you have given a clear and conspicuous revised notice that accurately describes your policies and practices and a new opt out notice, have given a reasonable opportunity to opt out, and the consumer does not opt out; give a revised notice before you disclose a new category of information, disclose to a new category of nonaffiliated third party, or disclose information about a former customer who has not had the chance to opt out. A revised notice is not required for a new nonaffiliated third party that your prior notice adequately described.
• State in each notice the categories of nonpublic personal information you collect and disclose; the categories of affiliates and nonaffiliated third parties to which you disclose it; the categories of information about former customers you disclose and the parties you disclose it to; a separate statement of the categories of information and of third parties under contract where you disclose to a service provider or joint marketing partner without an opt out; the consumer's right to opt out and how to exercise it; any notice about opting out of affiliate sharing under the Fair Credit Reporting Act; and your policies and practices for protecting the confidentiality and security of the information. Where you disclose to third parties as sections 1016.14 and 1016.15 authorize, you need not list those exceptions; it is enough to say that you disclose to other nonaffiliated companies for your everyday business purposes, or as permitted by law.
• Deliver each notice so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically; an oral explanation alone does not meet the rule. For customers, provide the initial, annual and revised notices so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

12 CFR 1016.7 and 1016.10 to 1016.15 · Read the law's page

• If you are a financial institution that Regulation P covers, then, except as otherwise authorized in this part, do not, directly or through an affiliate, disclose nonpublic personal information about a consumer to a nonaffiliated third party unless you have given the consumer the initial notice and an opt out notice, have given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out; this applies whether or not the consumer is your customer.
• Give each consumer a clear and conspicuous opt out notice stating that you disclose or reserve the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to do so, such as check-off boxes, a reply form, an electronic means or a toll-free telephone number; requiring the consumer to write his or her own letter is not a reasonable means.
• Allow a reasonable opportunity to opt out, such as 30 days from the date you mailed the notices or, for an online account, 30 days after the customer acknowledges receipt of the notices.
• Honor an opt out for all nonpublic personal information you have collected about the consumer, whether you collected it before or after the direction to opt out.
• Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it; let a consumer opt out at any time; treat the direction as effective until the consumer revokes it in writing or, if the consumer agrees, electronically; after a customer relationship ends, the direction continues to apply to the information you collected during or related to that relationship, but it does not apply to a new customer relationship.
• Do not disclose an account number or similar access number or access code for a consumer's credit card, deposit, share or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency. This does not bar disclosure to your agent or service provider solely to perform marketing for your own products or services if it is not authorized to initiate charges to the account, or to a participant in a private label credit card program or an affinity or similar program where the participants are identified to the customer when the customer enters the program. A number or code in encrypted form is not an account number if you give the recipient no means to decode it.
• To provide nonpublic personal information to a nonaffiliated third party that performs services or functions on your behalf without an opt out, give the initial notice and enter into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed it.
• The notice to a consumer who is not a customer under section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13 do not apply when you disclose nonpublic personal information as necessary to effect, administer or enforce a transaction a consumer requests or authorizes, or in connection with servicing or processing a requested financial product or service, maintaining or servicing the consumer's account, or a proposed or actual securitization or secondary market sale (section 1016.14(a)); the notice you owe a customer under section 1016.4(a)(1) still applies.
• The same three requirements (the initial notice requirement in section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13) also do not apply to a disclosure made with the consumer's consent or at the consumer's direction (until revoked); to protect the confidentiality or security of your records or against fraud; for required institutional risk control or to resolve consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer or acting in a fiduciary or representative capacity for the consumer; to insurance rate advisory organizations, guaranty funds or agencies, agencies rating you, persons assessing your compliance with industry standards, and your attorneys, accountants and auditors; to law enforcement agencies, self-regulatory organizations and for an investigation on a matter related to public safety, to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978; to a consumer reporting agency under the Fair Credit Reporting Act; in connection with a sale, merger, transfer or exchange of a business or operating unit that concerns solely its consumers; or to comply with law, a properly authorized investigation, subpoena or summons, or judicial process (section 1016.15(a)).
• If you receive nonpublic personal information from a nonaffiliated financial institution under an exception, disclose and use it only as section 1016.11 permits: to that institution's affiliates, to your affiliates (which may use it only as you may), and under an exception to carry out the activity covered by the exception under which you received it.
• If you receive nonpublic personal information from a nonaffiliated financial institution outside an exception, disclose it only to that institution's affiliates, to your affiliates (which may disclose it only as you may), and to any other person if the disclosure would be lawful if made directly to that person by the institution that gave it to you.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes. The rule also reaches third parties that are not financial institutions but that receive nonpublic personal information from financial institutions with whom they are not affiliated.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

17 CFR 162.30 · Read the law's page

• This binds a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission, which includes a futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer or major swap participant that directly or indirectly holds a transaction account belonging to a consumer (17 CFR 162.30(a) and (b)(7)).
• Periodically determine whether you offer or maintain covered accounts, conducting a risk assessment that considers the methods you provide to open your accounts, the methods you provide to access them, and your previous experiences with identity theft (17 CFR 162.30(c)).
• If you offer or maintain one or more covered accounts, develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account, appropriate to your size and complexity and the nature and scope of your activities (17 CFR 162.30(d)(1)).
• Include in the program reasonable policies and procedures to identify relevant Red Flags, detect them, respond appropriately to them, and update the program periodically (17 CFR 162.30(d)(2)).
• Obtain approval of the initial written program from your board of directors or an appropriate committee, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements (17 CFR 162.30(e)).
• Consider the guidelines in the appendix to the subpart and include in the program those that are appropriate (17 CFR 162.30(f)).

SEC Regulation SCI SCI event notices, 17 CFR 242.1002(b) and (c) · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
• Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
• Until the SCI event is resolved and your investigation is closed, provide updates to the Commission on a regular basis, or at the frequency the Commission reasonably requests, to correct materially incorrect information or when new material information is discovered.
• If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
• For an SCI event with no or a de minimis impact, keep records and submit a quarterly report within 30 calendar days after the end of each calendar quarter summarizing the systems disruptions and systems intrusions.
• Promptly after responsible SCI personnel conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, disseminate the affected systems and a summary description to the members or participants who may have been affected, and to all members or participants for a major SCI event. For a systems intrusion, disseminate a summary description and the corrective action taken unless you determine and document that dissemination would likely compromise security or an investigation.

SEC Regulation SCI policies and procedures, 17 CFR 242.1000 and 242.1001 · Read the law's page

• This instrument reaches your organization only if it is an SCI entity: a national securities exchange, registered securities association or registered clearing agency (or the Municipal Securities Rulemaking Board), an alternative trading system that meets the volume thresholds, a plan processor, an exempt clearing agency subject to the Commission's Automation Review Policies, or a competing consolidator that meets the revenue threshold. Declare provides_financial_services where that holds; no role names a securities market infrastructure operator more closely.
• Establish, maintain, and enforce written policies and procedures reasonably designed to ensure that your SCI systems and, for security standards, your indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security adequate to maintain your operational capability and promote fair and orderly markets.
• Include in those policies and procedures, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters, and monitoring of the systems to identify potential SCI events.
• Include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.
• Periodically review the effectiveness of the policies and procedures and take prompt action to remedy deficiencies. Policies and procedures consistent with current SCI industry standards are deemed reasonably designed, though compliance with those standards is not the exclusive means to comply.

CFTC system safeguards notices, 17 CFR 39.18(g), 38.1051(e) and 37.1401(e) · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
• If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
• If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
• Give timely advance notice of material planned changes to automated systems that may impact their reliability, security, or capacity, and of material planned changes to your program of risk analysis and oversight.

CFTC system safeguards, 17 CFR 39.18, 38.1051 and 37.1401 · Read the law's page

• This instrument reaches your organization only if it is a derivatives clearing organization, a designated contract market or a swap execution facility registered with the Commodity Futures Trading Commission. Declare provides_financial_services where that holds; no role names a registered derivatives market more closely.
• If your organization is a derivatives clearing organization, establish and maintain a program of risk analysis and oversight with respect to your operations and automated systems that identifies and minimizes sources of operational risk, and that addresses information security, business continuity and disaster recovery, capacity and performance planning, systems operations, systems development and quality assurance, and physical security and environmental controls.
• If your organization is a derivatives clearing organization, follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems, and maintain a business continuity and disaster recovery plan with a recovery time objective of no later than the next business day following a disruption.
• If your organization is a designated contract market or a swap execution facility, maintain a program of risk analysis and oversight with respect to your operations and automated systems that addresses each category of risk analysis and oversight the rule lists, beginning with enterprise risk management and governance and information security.
• If your organization is a designated contract market or a swap execution facility, conduct regular, periodic, objective testing and review of your automated systems to ensure that they are reliable, secure, and have adequate scalable capacity, and regular, periodic testing and review of your business continuity-disaster recovery capabilities.

12 CFR Part 53 (OCC); 12 CFR Part 225, Subpart N (Federal Reserve Board); 12 CFR Part 304, Subpart C (FDIC) · Read the law's page

• This instrument reaches your organization only if it is a banking organization under this rule, meaning a national bank, Federal savings association, or Federal branch or agency of a foreign bank; a bank holding company, savings and loan holding company, state member bank, the United States operations of a foreign banking organization, or an Edge or agreement corporation; or an insured state nonmember bank, insured state licensed branch of a foreign bank, or insured State savings association, or if it is a bank service provider that performs services for one of them under the Bank Service Company Act. Declare provides_financial_services where either role holds; no activity stands in for either role, and a designated financial market utility is excluded from both.
• If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred. A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.when it serves a financial business
• If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more. This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.for a supplier to a financial business
• This bank service provider duty does not apply to scheduled maintenance, testing, or a software update you already communicated to the banking organization customer.for a supplier to a financial business

NCUA Cyber Incident Notification Requirements, 12 CFR 748.1(c) · Read the law's page

• This instrument reaches your organization only if it is a federally insured credit union. Declare is_bank where that holds; a credit union that is not federally insured is outside this paragraph.
• If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
• Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
• A cyber incident performed in good faith by an entity in response to a specific request by the owner or operators of the system is not a reportable cyber incident.

16 CFR Section 314.4(j) · Read the law's page

• Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.when it serves a financial business

12 CFR Part 1033 · Read the law's page

• If you are a data provider (a financial institution, a card issuer, or any other person that controls or possesses information about a Regulation E account, a Regulation Z credit card, or the facilitation of payments from either), make covered data available on request to the consumer and to an authorized third party in an electronic form they can use, including the most recently updated data you hold and information about authorized transactions not yet settled (12 CFR 1033.111, 1033.201(a), (b)).
• Maintain a consumer interface and a developer interface, make covered data available in a machine-readable file on request, and impose no fee or charge on a consumer or an authorized third party for the interfaces or for requests (12 CFR 1033.301(a) to (c)).
• Take no action with the intent of evading the rule, and no action you know or should know is likely to render covered data unusable or to prevent, interfere with, or materially discourage a consumer or authorized third party from accessing it (12 CFR 1033.201(a)(2)).
• If you are a third party seeking access to covered data on a consumer's behalf, give the consumer an authorization disclosure that is clear, conspicuous and segregated from other material, certify in it that you agree to the third party obligations, and obtain the consumer's express informed consent, signed electronically or in writing (12 CFR 1033.401, 1033.411).
• Limit your collection, use and retention of covered data to what is reasonably necessary to provide the consumer's requested product or service; targeted advertising, cross-selling of other products or services, and the sale of covered data are not reasonably necessary (12 CFR 1033.421(a)).
• Stop collecting covered data one year after the consumer's most recent authorization unless the consumer gives a new authorization no later than the anniversary of the most recent one (12 CFR 1033.421(b)).
• Apply to your systems for the collection, use and retention of covered data an information security program that satisfies the Gramm-Leach-Bliley Act safeguards rules or, if you are not subject to them, the Federal Trade Commission's Standards for Safeguarding Customer Information, 16 CFR part 314 (12 CFR 1033.421(e)).
• Give the consumer a method to revoke your authorization that is as easy to access and operate as the initial authorization, and notify the data provider, any data aggregator and other third parties holding the consumer's covered data when you receive a revocation request (12 CFR 1033.421(h)).

Pub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) · Read the law's page

• If you are a consumer reporting agency, do not furnish a consumer report to another person on the strength of a request made in connection with a credit transaction involving a residential mortgage loan unless the transaction consists of a firm offer of credit or insurance and that person has certified its authorization from the consumer, or has originated or services a current residential mortgage loan of the consumer, or is an insured depository institution or credit union holding a current account for the consumer (15 U.S.C. 1681b(c)(4)).

15 U.S.C. 1681 et seq. · Read the law's page

• If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.
• If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.
• If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.
• If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.
• If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
• If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.
• Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.