US Congress Report Examines Data Privacy and Cybersecurity Regulations
The U.S. Congressional Research Service published a report on banking, data privacy, and cybersecurity regulation. The report examines the existing legislative framework for financial cybersecurity, in addition to providing context on how regulators currently promulgate, supervise, and enforce various data privacy provisions. The report also presents a few policy considerations as Congress continues to explore the issue of a unified and modernized legislative framework in this area.
The report highlights that most of the legislative and regulatory data privacy framework established for banks and credit unions is constructed from a patchwork of cybersecurity provisions. Similarly, the implementation of cybersecurity supervisory programs among financial institution regulators is fragmented and potential risks to the financial system have emerged as new technologies evolve. The report focuses on the cybersecurity regulatory framework among the federal banking regulators—the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (FED), the National Credit Union Administration (NCUA), and the Consumer Financial Protection Bureau (CFPB). Together, these agencies are responsible for implementing and ensuring compliance with banking laws.
The report findings show that cybersecurity threats pose operational, reputational, and systemic risks, which are a major concern for banks and banking regulators. Banking regulators implement the cybersecurity legislative framework through rulemaking and then supervise institutions to ensure that banks are following regulations. The findings reveal that no single law provides a framework for regulating cybersecurity in the United States. Instead, multiple laws require financial regulators to establish cybersecurity standards for financial institutions and provide regulators the authority to ensure compliance with such standards. The Gramm-Leach-Bliley Act of 1999 (GLBA) is the most comprehensive law which directs financial regulators to implement disclosure requirements and mandate security measures to safeguard private information. Other laws—such as the Sarbanes-Oxley Act of 2002, Fair and Accurate Credit Transactions Act (FACT Act), Bank Protection Act, and Bank Service Company Act of 1962—complete the general legislative framework for cybersecurity.
The report also identifies several policy issues that address regulator concern over the patchwork nature of regulatory standards for consumer privacy and security. The policy issues relate to how new technologies that facilitate financial data-sharing should be treated under the existing cybersecurity framework. Another issue relates to how and whether the data privacy protections that exist for data-sharing should also apply to data collection. The Data Privacy Act of 2023 (H.R. 1165), which the House Financial Services Committee ordered to be reported as amended in February 2023, examines several of these issues. Moreover, the report notes that technology partnerships, particularly at smaller banks, with institutions such as cloud management companies, have led to new cybersecurity risks to the banking system. This has raised concerns among policymakers about the capacity of the existing framework to address new risks. To that end, the report notes that, considering the financial stability, concentration, and systemic risks stemming from the increasing bank reliance on cloud services, the scope of bank supervision may expand to cloud service providers. This may lead to technical resource mismatches, and regulators, like banks, may find themselves with a shortage of cloud skills necessary to examine cloud service providers. These service providers may also not be familiar with or amenable to audits or bank-like examinations. It is also expected that banks may adopt multi-cloud strategies—contracts with multiple cloud service providers—to avoid lock-in risk. In addition to increasing costs, this introduces potentially two or more providers in the form of cloud service providers, and banks must manage these relationships effectively to ensure cybersecurity.
Related Link: Report (PDF)
Keywords: Americas, US, Banking, Regtech, Data Privacy, Operational Risk, Systemic Risk, Cloud Service Providers, Disclosures, Cyber Risk, Operational Resilience, US CRS
Featured Experts

Blake Coules
Across 35 years in banking, Blake has gained deep insights into the inner working of this sector. Over the last two decades, Blake has been an Operating Committee member, leading teams and executing strategies in Credit and Enterprise Risk as well as Line of Business. His focus over this time has been primarily Commercial/Corporate with particular emphasis on CRE. Blake has spent most of his career with large and mid-size banks. Blake joined Moody’s Analytics in 2021 after leading the transformation of the credit approval and reporting process at a $25 billion bank.
Related Articles
ECB Finds Banks Unprepared for Pillar 3 Climate Risk Disclosures
The European Central Bank (ECB) published results of the 2022 supervisory assessment of climate-related and environmental risk disclosures among significant institutions (103) and a selected number of less significant institutions (28).
NCUA Assesses Credit Union Exposure to Climate-Related Physical Risks
The National Credit Union Administration (NCUA) released a Research Note that examines the exposure of credit unions to climate-related physical risks. In a related development
EBA Issues Multiple Regulatory and Reporting Updates for Banks
The European Banking Authority (EBA) is seeking comments, until July 31, 2023, on the draft Guidelines on the proposed common approach to the resubmission of historical data under the EBA reporting framework.
EC Adopts Regulation on Own Funds, Issues Other Updates
The European Commission adopted Delegated Regulations on own funds and eligible liabilities, on requirements for the internal methodology under the internal default risk model
CDP Platform to Report Plastic-Related Impact, Issues Other Updates
The Carbon Disclosure Project (CDP) announced that its global environmental disclosure platform has enabled reporting on plastic-related impact for nearly 7,000 companies worldwide
IASB to Enhance Reporting of Climate Risks, Proposes IFRS 9 Amendments
The International Accounting Standards Board (IASB) updated its work plan to enhance the reporting of climate-related risks in the financial statements,
BIS Addresses Data Gaps and Macro-Prudential Policy for Climate Risks
The Financial Stability Institute (FSI) of the Bank for International Settlements (BIS) published a brief paper that examines challenges associated with the use of macro-prudential policies to address climate-related financial risks.
FCA Sets Out Business Plan, Launches TechSprint on Greenwashing
The Financial Conduct Authority (FCA) published its business plan for 2023-24. The plan sets out details of the work planned for the next 12 months to achieve better outcomes for consumers and markets
UK Committee Sets Out Recommendations for Next Phase of Open Banking
The Joint Regulatory Oversight Committee (JROC), comprising the Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR) as co-chairs and the HM Treasury and the Competition and Markets Authority (CMA) as members
ECB Publishes Multiple Regulatory Updates for Banking Institutions
The European Central Bank (ECB) published the results of the 2022 climate risk stress test of the Eurosystem balance sheet,