The federal banking agencies, the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency, have issued a joint statement establishing a coordinated approach for the handling of highly sensitive information during bank examinations. While the statement does not impose new supervisory expectations, it represents an important acknowledgment that the examination process itself can create cybersecurity and information security risks if highly sensitive information is not handled appropriately.

Why the Statement Was Issued

The agencies recognize that financial institutions increasingly maintain information whose unauthorized disclosure could have serious consequences not only for the institution itself but also for its customers and the stability of the financial system. As cyber threats continue to grow in sophistication, the traditional practice of routinely transmitting large volumes of sensitive information to regulators has come under increased scrutiny.

The joint statement seeks to strike a balance between two important objectives:

  • ensuring that examiners continue to have timely access to information needed to perform effective supervision; and
  • minimizing the cybersecurity risks associated with collecting, transmitting, storing, and accessing highly sensitive information. 

A Risk-Based, Flexible Approach

Rather than prescribing a single method for providing examination materials, the agencies describe a flexible, risk-based framework.

The statement provides that banks and examiners should work together to identify information that should be treated as “highly sensitive.” At the beginning of an exam, the examiners are to notify the bank that management may identify to examiners any information considered highly sensitive. They are also to explain the process the bank may follow to escalate any concerns management may have about the identification and handling of that information.

The onus is then on bank management to identify all data and documents considered highly sensitive, to discuss their concerns with the examiner-in-charge or their primary agency contact, and to raise those concerns with more senior officials, if necessary. Once identified, the agencies may employ a variety of alternatives designed to reduce unnecessary collection or storage of such information.

Among the approaches specifically identified are:

  • on-site review of documents rather than transferring copies to agency systems;
  • direct digital access to information maintained on the institution’s own systems;
  • review of redacted or summarized documents where appropriate; and
  • other enhanced safeguards governing the transmission and access of sensitive information. 

Importantly, the agencies emphasize that the appropriate method will depend on the nature of the information and the circumstances of the particular examination.

Commitment to Prompt Data Breach Notification

Perhaps the most noteworthy aspect of the statement is the agencies’ commitment regarding cybersecurity incidents affecting supervisory information.

The agencies state that they will notify an affected supervised institution as soon as practicable, and no later than 72 hours after discovering a potential or confirmed material data breach involving confidential supervisory information of the affected institution.

The 72-hour clock begins running once the agency has a reasonable basis to believe information has been compromised and has identified the appropriate institution. The commitment is subject to “applicable legal considerations,” a phrase the agencies do not define.

Although many financial institutions already operate under various breach-notification requirements, this commitment is significant because it establishes a reciprocal obligation on the part of the federal banking agencies themselves.

Practical Implications for Financial Institutions

Although the statement expressly notes that it creates no new regulatory expectations, supervised institutions should nevertheless consider whether their examination preparation processes remain appropriate.

Banks may wish to:

  • identify categories of information that should be designated as highly sensitive before an examination begins;
  • establish internal protocols for discussing handling procedures with examination teams;
  • evaluate whether on-site review or direct system access may be preferable for certain categories of information;
  • review internal procedures governing the transmission of confidential supervisory information; and
  • ensure that personnel responsible for regulatory examinations understand the new framework.

Advance planning should help minimize delays during examinations while reducing cybersecurity risks.

Looking Ahead

The joint statement is another indication that federal banking regulators are incorporating cybersecurity considerations into every aspect of the supervisory process, not merely into examinations of banks’ own cybersecurity programs.

It also reflects a broader regulatory trend toward risk-based supervision. Rather than requiring a one-size-fits-all approach to information sharing, the agencies acknowledge that different categories of information warrant different levels of protection and that examination practices should adapt accordingly.

While the guidance currently applies only to examinations conducted by the federal banking agencies, other financial regulators may ultimately adopt similar practices as concerns over cybersecurity and protection of confidential information continue to grow.

For supervised institutions, the message is clear: effective supervision and strong information security are no longer competing objectives, they are complementary ones.