Rule Recently Enacted by Bank Regulators May be Model for NCUA

 ALEXANDRIA, Va.–A rule enacted by the bank regulatory agencies in late 2021 that requires notification by banks of “any significant computer-security incidents” may become a model for a similar rule from NCUA.

In November 2021, the FDIC, OCC and the Federal Reserve approved a rule that requires banking organizations to notify them of such incidents as soon as possible and no later than 36 hours after a determination that such an incident has occurred.

The rule went into effect April 1 with compliance by banking organizations and their service providers required by May 1.

The bank regulators defined a “computer-security incident” as one that results in “actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.”

During the NCUA board meeting on Thursday, NCUA Chairman Todd Harper asked Kelly Lay, director of the Office of Examination and Insurance, about whether the agency is considering a similar rule.

Lay responded by saying yes, the agency’s staff is now reviewing what the banking industry regulators have implemented and are exploring whether a similar rule should be considered for credit unions.