Title 12—Banks and Banking--Volume 1
PART 304—FORMS, INSTRUCTIONS, AND REPORTS
§ 304.1   Purpose.
This subpart informs the public where it may obtain forms and instructions for reports, applications, and other submittals used by the Federal Deposit Insurance Corporation (FDIC), and describes certain forms that are not described elsewhere in FDIC regulations in this chapter.
§ 304.2   Where to obtain forms and instructions.
Forms and instructions used in connection with applications, reports, and other submittals used by the FDIC can be obtained by contacting the FDIC Public Information Center (550 17th Street NW, Washington, DC 20429; telephone: (877) 275-3342 or (703) 562-2200), except as noted in § 304.3. In addition, many forms and instructions can be obtained from FDIC regional offices. A list of FDIC regional offices can be obtained from the FDIC Public Information Center, or found at the FDIC's website at http://www.fdic.gov, or in the directory of FDIC Law, Regulations, Related Acts published by the FDIC.
§ 304.3   Reports.
(a) Consolidated Reports of Condition and Income, Forms FFIEC 031, 041, and 051. Pursuant to section 7(a) of the Federal Deposit Insurance Act (12 U.S.C. 1817(a)) and other applicable law, every insured depository institution is required to file Consolidated Reports of Condition and Income (also known as the Call Report) in accordance with the instructions for these reports. All assets and liabilities, including contingent assets and liabilities, must be reported in, or otherwise taken into account in the preparation of, the Call Report. The FDIC uses Call Report data from all insured depository institutions to calculate deposit insurance assessments and monitor the condition, performance, and risk profile of individual banks and the banking industry. Reporting banks must also submit annually such information on small business and small farm lending as the FDIC may need to assess the availability of credit to these sectors of the economy. The report forms and instructions can be obtained from the Division of Insurance and Research (DIR), FDIC, 550 17th Street NW, Washington, DC 20429 or through the website of the Federal Financial Institutions Examination Council, http://www.ffiec.gov/.
(b) Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks, Form FFIEC 002. Pursuant to section 7(a) of the Federal Deposit Insurance Act (12 U.S.C. 1817(a)) and other applicable law, every insured U.S. branch of a foreign bank is required to file a Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks in accordance with the instructions for the report. All assets and liabilities, including contingent assets and liabilities, must be reported in, or otherwise taken into account in the preparation of the report. The FDIC uses the reported data to calculate deposit insurance assessments and monitor the condition, performance, and risk profile of individual insured branches and the banking industry. Insured branches must also submit annually such information on small business and small farm lending as the FDIC may need to assess the availability of credit to these sectors of the economy. Because the Board of Governors of the Federal Reserve System collects and processes this report on behalf of the FDIC, the report forms and instructions can be obtained from Federal Reserve District Banks or through the website of the Federal Financial Institutions Examination Council, http://www.ffiec.gov/.
(c) Summary of Deposits, Form FDIC 8020/05. Form 8020/05 is a report on the amount of deposits for each authorized office of an insured depository institution with branches; institutions with only a main office are exempt from reporting. Reports as of June 30 of each year must be submitted no later than the immediately succeeding July 31. The report forms and the instructions for completing the reports will be furnished to all such institutions by, or may be obtained upon request from, the Division of Insurance and Research (DIR), FDIC, 550 17th Street NW, Washington, DC 20429.
(d) Notification of Performance of Bank Services, Form FDIC 6120/06. Pursuant to section 7 of the Bank Service Company Act (12 U.S.C. 1867), as amended, FDIC-supervised institutions must notify the agency about the existence of a service relationship within thirty days after the making of the contract or the performance of the service, whichever occurs first. Form FDIC 6120/06 may be used to satisfy the notice requirement. The form contains identification, location, and contact information for the institution, the servicer, and a description of the services provided. In lieu of the form, notification may be provided by letter. Either the form or the letter containing the notice information must be submitted to the regional director—Division of Risk Management Supervision (RMS) of the region in which the institution's main office is located.
§§ 304.4-304.10   [Reserved]
§ 304.11   Authority, purpose, and scope.
(a) Authority. This subpart is issued pursuant to 12 U.S.C. 1464(v), and section 7 (12 U.S.C. 1817(a)(12)) and section 9 (12 U.S.C. 1819 Tenth) of the Federal Deposit Insurance Act.
(b) Purpose. This subpart implements 12 U.S.C. 1817(a)(12) to allow reduced reporting for a covered depository institution when such institution makes its reports of condition for the first and third calendar quarters of a year.
(c) Scope. This subpart applies to an insured depository institution, as that term is defined in section 3(c) of the Federal Deposit Insurance Act, 12 U.S.C. 1813(c), that meets the definition of a covered depository institution under § 304.12.
(d) Preservation of authority. Nothing in this subpart in any way limits the authority of the Corporation under other provisions of applicable law and regulation.
§ 304.12   Definitions.
(a) Covered depository institution means an insured depository institution, as such term is defined in section 3 of the Federal Deposit Insurance Act, 12 U.S.C. 1813, for which the Corporation is the appropriate Federal banking agency and that meets all of the following criteria:
(1) Has less than $5 billion in total consolidated assets as reported in its report of condition for the second calendar quarter of the preceding year;
(2) Has no foreign offices, as defined in this section;
(3) Is not required to or has not elected to use 12 CFR part 324, subpart E, to calculate its risk-based capital requirements;
(4) Is not a large institution or highly complex institution, as such terms are defined in 12 CFR 327.8, or treated as a large institution, as requested under 12 CFR 327.16(f); and
(5) Is not a state-licensed insured branch of a foreign bank, as such terms are defined in section 3(s) of the Federal Deposit Insurance Act, 12 U.S.C. 1813(s).
(6) In determining whether an insured depository institution meets the asset threshold in paragraph (1) of the definition of “covered depository institution” in paragraph (a)(1) of this section, for purposes of a report required to be submitted for calendar year 2021, an insured depository institution may refer to the lesser of its total consolidated assets as reported in its report of condition as of December 31, 2019, and its total consolidated assets as reported in its report of condition for the second calendar quarter of 2020.
(b) Foreign country refers to one or more foreign nations, and includes the overseas territories, dependencies, and insular possessions of those nations and of the United States.
(c) Foreign office means:
(1) A branch or consolidated subsidiary in a foreign country, unless the branch is located on a U.S. military facility;
(2) An international banking facility as such term is defined in 12 CFR 204.8;
(3) A majority-owned Edge Act or Agreement subsidiary including both its U.S. and its foreign offices; and
(4) For an institution chartered or headquartered in any U.S. state or the District of Columbia, a branch or consolidated subsidiary located in a U.S. territory or possession.
(d) Report of condition means the FFIEC 031, FFIEC 041, or FFIEC 051 versions of the Consolidated Report of Condition and Income (Call Report) or the FFIEC 002 (Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks), as applicable, and as they may be amended or superseded from time to time in accordance with the Paperwork Reduction Act of 1995, 44 U.S.C. chapter 35.
(e) Total consolidated assets means total assets as reported in an insured depository institution's report of condition.
§ 304.13   Reduced reporting.
A covered depository institution may file the FFIEC 051 version of the report of condition, or any successor thereto, which shall provide for reduced reporting for the reports of condition for the first and third calendar quarters for a year.
§ 304.14   Reservation of authority.
Notwithstanding § 304.13, the Corporation, in consultation with the applicable state chartering authority, may require an otherwise eligible covered depository institution to file the FFIEC 041 version of the report of condition, or any successor thereto, based on an institution-specific determination. In making this determination, the Corporation may consider criteria including, but not limited to, whether the institution is significantly engaged in one or more complex, specialized, or other higher-risk activities, such as those for which limited information is reported in the FFIEC 051 version of the report of condition compared to the FFIEC 041 version of the report of condition. Nothing in this part shall be construed to limit the Corporation's authority to obtain information from insured depository institutions.
§§ 304.15-304.20   [Reserved]
§ 304.21   Authority, purpose, and scope.
(a) Authority. This subpart is issued under the authority of 12 U.S.C. 1463, 1811, 1813, 1817, 1819, and 1861-1867.
(b) Purpose. This subpart promotes the timely notification of computer-security incidents that may materially and adversely affect FDIC-supervised institutions.
(c) Scope. This subpart applies to all insured state nonmember banks, insured state licensed branches of foreign banks, and insured State savings associations. This subpart also applies to bank service providers, as defined in § 304.22(b)(2).
§ 304.22   Definitions.
(a) Except as modified in this subpart, or unless the context otherwise requires, the terms used in this subpart have the same meanings as set forth in 12 U.S.C. 1813.
(b) For purposes of this subpart, the following definitions apply.
(1) Banking organization means an FDIC-supervised insured depository institution, including all insured state nonmember banks, insured state-licensed branches of foreign banks, and insured State savings associations; provided, however, that no designated financial market utility shall be considered a banking organization.
(2) Bank service provider means a bank service company or other person that performs covered services; provided, however, that no designated financial market utility shall be considered a bank service provider.
(3) Business line means a product or service offered by a banking organization to serve its customers or support other business needs.
(4) Computer-security incident is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.
(5) Covered services are services performed, by a person, that are subject to the Bank Service Company Act (12 U.S.C. 1861-1867).
(6) Designated financial market utility has the same meaning as set forth at 12 U.S.C. 5462(4).
(7) Notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's—
(i) Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business;
(ii) Business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or
(iii) Operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.
(8) Person has the same meaning as set forth at 12 U.S.C. 1817(j)(8)(A).
§ 304.23   Notification.
A banking organization must notify the appropriate FDIC supervisory office, or an FDIC-designated point of contact, about a notification incident through email, telephone, or other similar methods that the FDIC may prescribe. The FDIC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.
§ 304.24   Bank service provider notification.
(a) A bank service provider is required to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours.
(1) A bank-designated point of contact is an email address, phone number, or any other contact(s), previously provided to the bank service provider by the banking organization customer.
(2) If the banking organization customer has not previously provided a bank-designated point of contact, such notification shall be made to the Chief Executive Officer and Chief Information Officer of the banking organization customer, or two individuals of comparable responsibilities, through any reasonable means.
(b) The notification requirement in paragraph (a) of this section does not apply to any scheduled maintenance, testing, or software update previously communicated to a banking organization customer.
§§ 304.25-304.30   [Reserved]