Title 12—Banks and Banking--Volume 1
PART 225—BANK HOLDING COMPANIES AND CHANGE IN BANK CONTROL (REGULATION Y)
§ 225.195   Requirements for Federally regulated appraisal management companies.
(a) Requirements in providing services. To provide appraisal management services for a creditor or secondary mortgage market participant relating to a covered transaction, a Federally regulated AMC must comply with the requirements in § 225.193(b)(2) through (5).
(b) Ownership limitations. (1) A Federally regulated AMC shall not be included on the AMC National Registry if such AMC, in whole or in part, directly or indirectly, is owned by any person who has had an appraiser license or certificate refused, denied, cancelled, surrendered in lieu of revocation, or revoked in any State for a substantive cause, as determined by the ASC.
(2) A Federally regulated AMC is not barred by this paragraph (b) from being included on the AMC National Registry if the license or certificate of the appraiser with an ownership interest was not revoked for a substantive cause and has been reinstated by the State or States in which the appraiser was licensed or certified.
(c) Reporting information for the AMC National Registry. A Federally regulated AMC must report to the State or States in which it operates the information required to be submitted by the State to the Appraisal Subcommittee pursuant to the Appraisal Subcommittee's policies regarding the determination of the AMC National Registry fee, including but not necessarily limited to the collection of information related to the limitations set forth in this section.
§ 225.196   Information to be presented to the Appraisal Subcommittee by participating States.
Each State electing to register AMCs for purposes of permitting AMCs to provide appraisal management services relating to covered transactions in the State must submit to the Appraisal Subcommittee the information required to be submitted by Appraisal Subcommittee regulations or guidance concerning AMCs that operate in the State.
§ 225.300   Authority, purpose, and scope.
(a) Authority. This subpart is issued under the authority of 12 U.S.C. 1, 321-338a, 1467a(g), 1818(b), 1844(b), 1861-1867, and 3101 et seq.
(b) Purpose. This subpart promotes the timely notification of computer-security incidents that may materially and adversely affect Board-supervised entities.
(c) Scope. This subpart applies to all U.S. bank holding companies and savings and loan holding companies; state member banks; the U.S. operations of foreign banking organizations; and Edge and agreement corporations. This subpart also applies to their bank service providers, as defined in § 225.301(b)(2).
§ 225.301   Definitions.
(a) Except as modified in this subpart, or unless the context otherwise requires, the terms used in this subpart have the same meanings as set forth in 12 U.S.C. 1813.
(b) For purposes of this subpart, the following definitions apply.
(1) Banking organization means a U.S. bank holding company; U.S. savings and loan holding company; state member bank; the U.S. operations of foreign banking organizations; and an Edge or agreement corporation; provided, however, that no designated financial market utility shall be considered a banking organization.
(2) Bank service provider means a bank service company or other person that performs covered services; provided, however, that no designated financial market utility shall be considered a bank service provider.
(3) Business line means a product or service offered by a banking organization to serve its customers or support other business needs.
(4) Computer-security incident is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.
(5) Covered services are services performed, by a person, that are subject to the Bank Service Company Act (12 U.S.C. 1861-1867).
(6) Designated financial market utility has the same meaning as set forth at 12 U.S.C. 5462(4).
(7) Notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's—
(i) Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business;
(ii) Business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or
(iii) Operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.
(8) Person has the same meaning as set forth at 12 U.S.C. 1817(j)(8)(A).
§ 225.302   Notification.
A banking organization must notify the appropriate Board-designated point of contact about a notification incident through email, telephone, or other similar methods that the Board may prescribe. The Board must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.
§ 225.303   Bank service provider notification.
(a) A bank service provider is required to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours.
(1) A bank-designated point of contact is an email address, phone number, or any other contact(s), previously provided to the bank service provider by the banking organization customer.
(2) If the banking organization customer has not previously provided a bank-designated point of contact, such notification shall be made to the Chief Executive Officer and Chief Information Officer of the banking organization customer, or two individuals of comparable responsibilities, through any reasonable means.
(b) The notification requirement in paragraph (a) of this section does not apply to any scheduled maintenance, testing, or software update previously communicated to a banking organization customer.