U.S. keeps 36-hour incident reporting deadline

Update November 3, 2026: the note now includes that some financial institutions must also require their vendors to report data breaches within 72 hours under Regulation S-P. Those rules also require notice to affected individuals as soon as practicable and, at most, within 30 days, subject to limited exceptions.

Federal rules in the United States require certain banking organizations to notify regulators of cybersecurity incidents as soon as possible and, at most, within 36 hours of determining that a reportable incident has occurred. The requirement also extends to banking service providers when a material disruption or degradation of covered services lasts four hours or more, according to the Electronic Code of Federal Regulations.

Who is covered by the incident notification rule?

The rule covers bank holding companies, state member banks, Edge and agreement corporations, and the U.S. operations of foreign banking organizations under Federal Reserve jurisdiction. Separately, the OCC rule applies to national banks, federal savings associations, and federal branches and agencies of foreign banks.

Under the Federal Reserve regime, the notice requirement appears in 12 CFR Part 225 Subpart N, while the OCC rule is set out in 12 CFR Part 53. In both cases, notice must be sent as soon as possible and no later than 36 hours after determining that a reportable incident occurred.

What must banking service providers do?

Banking service providers must notify each affected banking organization when they determine that an incident has materially disrupted or degraded, or is likely to materially disrupt or degrade, covered services for four hours or more. That duty is separate from the primary notice to the regulator.

In addition, under Regulation S-P provisions described by Skadden, certain financial institutions must maintain procedures requiring their service providers to report data breaches within 72 hours. In that same framework, institutions must notify affected individuals as soon as practicable and no later than 30 days after becoming aware of the breach, subject to limited exceptions.

What do the interagency security guidelines require?

The U.S. interagency information security guidelines set administrative, technical, and physical standards to protect the security, confidentiality, and integrity of customer information. Those guidelines were issued under the Gramm-Leach-Bliley Act and appear in Appendix F to Part 225.

The available material does not show a recent change to those rules, but it does place them as the framework that sets safeguards for customer information at entities covered by federal banking rules. The applicable U.S. rules for certain financial institutions also require written information security programs with administrative, technical, and physical safeguards appropriate to the institution's size, complexity, and the nature of its activities, according to Appendix B to Part 30.

What did Banking Dive say about examiners?

According to Banking Dive, a change to the definition of unsafe or unsound practices would limit bank examiners' intervention in cybersecurity vulnerabilities to situations where material financial harm is probable, rather than possible or plausible. That account was presented in the context of criticism from Senator Elizabeth Warren.

That point is not confirmed in the regulatory documentation included in the research material, so it should be read as a reference attributed to the news coverage, not as a verified rule change.