Featured Product

    US Congress Report Examines Data Privacy and Cybersecurity Regulations

    March 13, 2023

    The U.S. Congressional Research Service published a report on banking, data privacy, and cybersecurity regulation. The report examines the existing legislative framework for financial cybersecurity, in addition to providing context on how regulators currently promulgate, supervise, and enforce various data privacy provisions. The report also presents a few policy considerations as Congress continues to explore the issue of a unified and modernized legislative framework in this area.

    The report highlights that most of the legislative and regulatory data privacy framework established for banks and credit unions is constructed from a patchwork of cybersecurity provisions. Similarly, the implementation of cybersecurity supervisory programs among financial institution regulators is fragmented and potential risks to the financial system have emerged as new technologies evolve. The report focuses on the cybersecurity regulatory framework among the federal banking regulators—the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (FED), the National Credit Union Administration (NCUA), and the Consumer Financial Protection Bureau (CFPB). Together, these agencies are responsible for implementing and ensuring compliance with banking laws.

    The report findings show that cybersecurity threats pose operational, reputational, and systemic risks, which are a major concern for banks and banking regulators. Banking regulators implement the cybersecurity legislative framework through rulemaking and then supervise institutions to ensure that banks are following regulations. The findings reveal that no single law provides a framework for regulating cybersecurity in the United States. Instead, multiple laws require financial regulators to establish cybersecurity standards for financial institutions and provide regulators the authority to ensure compliance with such standards. The Gramm-Leach-Bliley Act of 1999 (GLBA) is the most comprehensive law which directs financial regulators to implement disclosure requirements and mandate security measures to safeguard private information. Other laws—such as the Sarbanes-Oxley Act of 2002, Fair and Accurate Credit Transactions Act (FACT Act), Bank Protection Act, and Bank Service Company Act of 1962—complete the general legislative framework for cybersecurity.

    The report also identifies several policy issues that address regulator concern over the patchwork nature of regulatory standards for consumer privacy and security. The policy issues relate to how new technologies that facilitate financial data-sharing should be treated under the existing cybersecurity framework. Another issue relates to how and whether the data privacy protections that exist for data-sharing should also apply to data collection. The Data Privacy Act of 2023 (H.R. 1165), which the House Financial Services Committee ordered to be reported as amended in February 2023, examines several of these issues. Moreover, the report notes that technology partnerships, particularly at smaller banks, with institutions such as cloud management companies, have led to new cybersecurity risks to the banking system. This has raised concerns among policymakers about the capacity of the existing framework to address new risks. To that end, the report notes that, considering the financial stability, concentration, and systemic risks stemming from the increasing bank reliance on cloud services, the scope of bank supervision may expand to cloud service providers. This may lead to technical resource mismatches, and regulators, like banks, may find themselves with a shortage of cloud skills necessary to examine cloud service providers. These service providers may also not be familiar with or amenable to audits or bank-like examinations. It is also expected that banks may adopt multi-cloud strategies—contracts with multiple cloud service providers—to avoid lock-in risk. In addition to increasing costs, this introduces potentially two or more providers in the form of cloud service providers, and banks must manage these relationships effectively to ensure cybersecurity.

     

    Related Link: Report (PDF)


    Keywords: Americas, US, Banking, Regtech, Data Privacy, Operational Risk, Systemic Risk, Cloud Service Providers, Disclosures, Cyber Risk, Operational Resilience, US CRS

    Featured Experts
    Related Articles
    News

    ECB Finds Banks Unprepared for Pillar 3 Climate Risk Disclosures

    The European Central Bank (ECB) published results of the 2022 supervisory assessment of climate-related and environmental risk disclosures among significant institutions (103) and a selected number of less significant institutions (28).

    April 21, 2023 WebPage Regulatory News
    News

    NCUA Assesses Credit Union Exposure to Climate-Related Physical Risks

    The National Credit Union Administration (NCUA) released a Research Note that examines the exposure of credit unions to climate-related physical risks. In a related development

    April 21, 2023 WebPage Regulatory News
    News

    EBA Issues Multiple Regulatory and Reporting Updates for Banks

    The European Banking Authority (EBA) is seeking comments, until July 31, 2023, on the draft Guidelines on the proposed common approach to the resubmission of historical data under the EBA reporting framework.

    April 21, 2023 WebPage Regulatory News
    News

    EC Adopts Regulation on Own Funds, Issues Other Updates

    The European Commission adopted Delegated Regulations on own funds and eligible liabilities, on requirements for the internal methodology under the internal default risk model

    April 20, 2023 WebPage Regulatory News
    News

    CDP Platform to Report Plastic-Related Impact, Issues Other Updates

    The Carbon Disclosure Project (CDP) announced that its global environmental disclosure platform has enabled reporting on plastic-related impact for nearly 7,000 companies worldwide

    April 19, 2023 WebPage Regulatory News
    News

    IASB to Enhance Reporting of Climate Risks, Proposes IFRS 9 Amendments

    The International Accounting Standards Board (IASB) updated its work plan to enhance the reporting of climate-related risks in the financial statements,

    April 19, 2023 WebPage Regulatory News
    News

    BIS Addresses Data Gaps and Macro-Prudential Policy for Climate Risks

    The Financial Stability Institute (FSI) of the Bank for International Settlements (BIS) published a brief paper that examines challenges associated with the use of macro-prudential policies to address climate-related financial risks.

    April 17, 2023 WebPage Regulatory News
    News

    FCA Sets Out Business Plan, Launches TechSprint on Greenwashing

    The Financial Conduct Authority (FCA) published its business plan for 2023-24. The plan sets out details of the work planned for the next 12 months to achieve better outcomes for consumers and markets

    April 17, 2023 WebPage Regulatory News
    News

    UK Committee Sets Out Recommendations for Next Phase of Open Banking

    The Joint Regulatory Oversight Committee (JROC), comprising the Financial Conduct Authority (FCA) and the Payment Systems Regulator (PSR) as co-chairs and the HM Treasury and the Competition and Markets Authority (CMA) as members

    April 17, 2023 WebPage Regulatory News
    News

    ECB Publishes Multiple Regulatory Updates for Banking Institutions

    The European Central Bank (ECB) published the results of the 2022 climate risk stress test of the Eurosystem balance sheet,

    April 17, 2023 WebPage Regulatory News
    RESULTS 1 - 10 OF 8873