US Agencies Finalize Rule on Security Incident Reporting
US Agencies decided to terminate the temporary supervisory and enforcement flexibility that was announced for the mortgage servicing rule in April 2020, amid the COVID-19 pandemic. These agencies are Board of Governors of the Federal Reserve System (FED), Consumer Financial Protection Bureau (CFPB), Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), Office of the Comptroller of the Currency (OCC), and the state financial regulators. Additionally, FDIC, FED, and OCC approved a final rule that requires a banking organization to notify its primary federal regulator of any “computer-security incident” that rises to the level of a notification incident. The final rule takes effect on April 01, 2022, with full compliance extended to May 01, 2022.
The final rule on security incident notification requires a banking organization to notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines that a cyber incident has occurred. The rule defines computer-security incident as an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits. Notification is required for incidents that have materially affected—or are reasonably likely to materially affect—the viability of a banking organization's operations, its ability to deliver banking products and services, or the stability of the financial sector. The final rule also requires a bank service provider to notify the affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours.
With respect to the Joint Statement on mortgage servicing rules, in April 2020, the US Agencies (including CFPB, FDIC, FED, NCUA, OCC) had announced that, until further notice, they would not take supervisory or enforcement action against mortgage servicers for failing to meet certain timing requirements under the mortgage servicing rules as long as the servicers made good faith efforts to provide those required notices or disclosures and took the related actions within a reasonable period of time. More than 18 months have passed since issuance of the April 2020 Joint Statement. While the COVID-19 pandemic continues to affect consumers and mortgage servicers, the US Agencies believe the temporary flexibility described in the April 2020 Joint Statement is no longer necessary because servicers have had sufficient time to adjust their operations by, among other things, taking steps to work with consumers affected by the COVID-19 pandemic and developing more robust business continuity and remote work capabilities. The agencies will now apply their respective supervisory and enforcement authorities, where appropriate, to address any noncompliance or violations of the Regulation X mortgage servicing rules that occur after the date of issuance of this statement.
Related Links
- Statement on Mortgage Servicing Rule (PDF)
- Press Release on Security Incident Reporting
- FDIC Letter on Incident Reporting Rule
- Final Rule on Security Incident Reporting (PDF)
Effective Date: April 01, 2022 (Final Rule)
Keywords: Americas, US, Banking, Mortgage Servicing Rules, COVID-19, Cyber Risk, Lending, Incident Reporting, US Agencies
Featured Experts

Victor Calanog, Ph.D.
Leading economist; commercial real estate; performance forecasting, econometric infrastructure; data modeling; credit risk modeling; portfolio assessment; custom commercial real estate analysis; thought leader.
Previous Article
MAS Proposes Amendments to Notices on Residential Property LoansRelated Articles
EBA Proposes Standards for IRRBB Reporting Under Basel Framework
The European Banking Authority (EBA) proposed implementing technical standards on the interest rate risk in the banking book (IRRBB) reporting requirements, with the comment period ending on May 02, 2023.
FED Issues Further Details on Pilot Climate Scenario Analysis Exercise
The U.S. Federal Reserve Board (FED) set out details of the pilot climate scenario analysis exercise to be conducted among the six largest U.S. bank holding companies.
US Agencies Issue Several Regulatory and Reporting Updates
The Board of Governors of the Federal Reserve System (FED) adopted the final rule on Adjustable Interest Rate (LIBOR) Act.
ECB Issues Multiple Reports and Regulatory Updates for Banks
The European Central Bank (ECB) published an updated list of supervised entities, a report on the supervision of less significant institutions (LSIs), a statement on macro-prudential policy.
HKMA Keeps List of D-SIBs Unchanged, Makes Other Announcements
The Hong Kong Monetary Authority (HKMA) published a circular on the prudential treatment of crypto-asset exposures, an update on the status of transition to new interest rate benchmarks.
EU Issues FAQs on Taxonomy Regulation, Rules Under CRD, FICOD and SFDR
The European Commission (EC) adopted the standards addressing supervisory reporting of risk concentrations and intra-group transactions, benchmarking of internal approaches, and authorization of credit institutions.
CBIRC Revises Measures on Corporate Governance Supervision
The China Banking and Insurance Regulatory Commission (CBIRC) issued rules to manage the risk of off-balance sheet business of commercial banks and rules on corporate governance of financial institutions.
HKMA Publications Address Sustainability Issues in Financial Sector
The Hong Kong Monetary Authority (HKMA) made announcements to address sustainability issues in the financial sector.
EBA Updates Address Basel and NPL Requirements for Banks
The European Banking Authority (EBA) published regulatory standards on identification of a group of connected clients (GCC) as well as updated the lists of identified financial conglomerates.
ESMA Publishes 2022 ESEF XBRL Taxonomy and Conformance Suite
The General Board of the European Systemic Risk Board (ESRB), at its December meeting, issued an updated risk assessment via the quarterly risk dashboard and held discussions on key policy priorities to address the systemic risks in the European Union.