I 

118TH CONGRESS 

2D SESSION H. R. 7965 

To include requirements relating to ransomware attack deterrence for a covered U.S. financial institution in the Consolidated Appropriations Act, 

2021, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 11, 2024 

Ms. PETTERSEN (for herself and Mr. MCHENRY) introduced the following bill; 

which was referred to the Committee on Financial Services 

A BILL 

To include requirements relating to ransomware attack deterrence for a covered U.S. financial institution in the Consolidated Appropriations Act, 2021, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Ransomware and Fi5 nancial Stability Act of 2024’’. 

6 SEC. 2. RANSOMWARE ATTACK DETERRENCE. 

7 (a) IN GENERAL.—Section 108 of title I of division 

8 Q of the Consolidated Appropriations Act, 2021 (Public 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 7965 IH

1 Law 116–260; 135 Stat. 2173; 12 U.S.C. 1811 note) is 

2 amended— 

3 (1) in the subsection heading, by striking ‘‘RE4 PORT’’; 

5 (2) by redesignating subsections (d) and (e) as 

6 subsections (e) and (f), respectively; 

7 (3) by inserting the following after subsection 

8 (c): 

9 ‘‘(d) RANSOMWARE ATTACK DETERRENCE.— 

10 ‘‘(1) REQUIREMENTS.— 

11 ‘‘(A) IN GENERAL.—A covered U.S. finan12 cial institution subject to a ransomware attack 

13 may not make a ransomware payment in re14 sponse to such ransomware attack— 

15 ‘‘(i) before submitting the notification 

16 described in paragraph (2); and 

17 ‘‘(ii) in an amount greater than 

18 $100,000, unless the payment is subject to 

19 a ransomware payment authorization. 

20 ‘‘(B) RULE OF CONSTRUCTION.—Nothing 

21 in this subsection shall be construed to permit 

22 a ransomware payment that is otherwise pro23 hibited by law. 

24 ‘‘(2) NOTIFICATION DESCRIBED.— 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 7965 IH

1 ‘‘(A) IN GENERAL.—The notification de2 scribed in this paragraph shall be submitted by 

3 a covered U.S. financial institution to the Di4 rector of the Financial Crimes Enforcement 

5 Network and shall include— 

6 ‘‘(i) a determination by such institu7 tion that such institution is subject to a 

8 ransomware attack; and 

9 ‘‘(ii) a description of the ransomware 

10 attack and any associated ransomware 

11 payment demanded. 

12 ‘‘(B) CONTENTS.—To ensure efficient noti13 fication and resolution of a ransomware attack, 

14 the Secretary of the Treasury— 

15 ‘‘(i) shall, in consultation with inter16 ested persons, issue guidance specifying in17 formation required to be included in the 

18 notification described in this paragraph; 

19 and 

20 ‘‘(ii) may not require, to be included 

21 in such notification, information that is 

22 unavailable to a covered U.S. financial in23 stitution, based on good-faith efforts of 

24 such institution to provide information. 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 7965 IH

1 ‘‘(3) WAIVER.—The President may waive the 

2 requirements of paragraph (2) with respect to a cov3 ered U.S. financial institution if the President deter4 mines that the waiver is in the national interest of 

5 the United States and notifies such institution and 

6 the appropriate members of Congress of such waiv7 er. 

8 ‘‘(4) SAFE HARBOR WITH RESPECT TO

9 RANSOMWARE PAYMENT AUTHORIZATIONS AND

10 GOOD-FAITH DETERMINATIONS.— 

11 ‘‘(A) IN GENERAL.—With respect to a 

12 ransomware payment made under paragraph 

13 (2)(B) or a waiver issued under paragraph 

14 (3)— 

15 ‘‘(i) a U.S. financial institution shall 

16 not be liable under subchapter II of chap17 ter 53 of title 31, United States Code, or 

18 chapter 2 of title I of Public Law 91–508 

19 (12 U.S.C. 1951 et seq.) for making a 

20 ransomware payment consistent with the 

21 parameters and timing of a ransomware 

22 payment authorization; and 

23 ‘‘(ii) no Federal or State department 

24 or agency may take any adverse super25 visory action with respect to the U.S. fiVerDate Sep 11 2014 19:18 Apr 23, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H7965.IH H7965

ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 7965 IH

1 nancial institution solely for making a 

2 ransomware payment consistent with the 

3 parameters and timing of the authoriza4 tion. 

5 ‘‘(B) GOOD-FAITH EFFORTS TO ASSESS

6 RANSOMWARE ATTACKS.—A covered U.S. finan7 cial institution may not be held liable for defi8 ciencies in describing a ransomware attack in a 

9 notification described under paragraph (2) if 

10 such institution engaged in good-faith efforts to 

11 determine the nature of the ransomware attack. 

12 ‘‘(C) RULE OF CONSTRUCTION.—Nothing 

13 in this paragraph may be construed— 

14 ‘‘(i) to prevent a Federal or State de15 partment or agency from verifying the va16 lidity of a ransomware payment authoriza17 tion with the law enforcement agency sub18 mitting that authorization; 

19 ‘‘(ii) to relieve a U.S. financial institu20 tion from complying with any other provi21 sion of law, including the reporting of sus22 picious transactions under section 5318(g) 

23 of title 31, United States Code; or 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•HR 7965 IH

1 ‘‘(iii) to extend the safe harbor de2 scribed in this paragraph to any actions 

3 taken by the U.S. financial institution— 

4 ‘‘(I) before the date of issuance 

5 of ransomware payment authorization; 

6 or 

7 ‘‘(II) after any termination date 

8 stated in the ransomware payment au9 thorization. 

10 ‘‘(D) RANSOMWARE PAYMENT AUTHORIZA11 TION TERMINATION DATE.—Any ransomware 

12 payment authorization submitted under this 

13 subsection shall include a termination date after 

14 which that authorization shall no longer apply. 

15 ‘‘(E) RECORDS.—Any Federal law enforce16 ment agency that submits to a U.S. financial 

17 institution a ransomware payment authorization 

18 shall, not later than 2 business days after the 

19 date on which the authorization is submitted to 

20 the U.S. financial institution— 

21 ‘‘(i) submit to the Director of the Fi22 nancial Crimes Enforcement Network a 

23 copy of the authorization; and 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•HR 7965 IH

1 ‘‘(ii) alert the Director as to whether 

2 the U.S. financial institution has imple3 mented the request. 

4 ‘‘(F) GUIDANCE.—The Secretary of the 

5 Treasury, in coordination with the Attorney 

6 General, shall issue guidance on the required 

7 elements of a ransomware payment authoriza8 tion. 

9 ‘‘(5) CONFIDENTIALITY OF INFORMATION.— 

10 ‘‘(A) IN GENERAL.—Except as provided in 

11 paragraph (2), any information or document 

12 provided by a U.S. financial institution to a 

13 Federal law enforcement agency pursuant to 

14 this subsection— 

15 ‘‘(i) shall be exempt from disclosure 

16 under section 552 of title 5, United States 

17 Code; and 

18 ‘‘(ii) may not be made publicly avail19 able. 

20 ‘‘(B) EXCEPTIONS.—Paragraph (1) shall 

21 not prohibit the disclosure of the following: 

22 ‘‘(i) Information relevant to any ad23 ministrative or judicial action or pro24 ceeding. 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•HR 7965 IH

1 ‘‘(ii) Information requested by the ap2 propriate members of Congress or other3 wise required to be submitted to Congress. 

4 ‘‘(iii) Information required for Federal 

5 law enforcement or intelligence purposes 

6 (as determined by the Attorney General), 

7 in consultation with the Director of the Fi8 nancial Crimes Enforcement Network to be 

9 disclosed to a domestic governmental entity 

10 or to a governmental entity of a United 

11 States ally or partner, only to the extent 

12 necessary for such purposes, and subject to 

13 appropriate confidentiality and classifica14 tion requirements. 

15 ‘‘(iv) Anonymized information re16 quired for the production of aggregate data 

17 or statistical analyses. 

18 ‘‘(v) Information that the U.S. finan19 cial institution has consented to be dis20 closed to third parties. 

21 ‘‘(6) DEFINITIONS.—In this subsection: 

22 ‘‘(A) COVERED U.S. FINANCIAL INSTITU23 TION.—The term ‘covered U.S. financial insti24 tution’ means— 


ssavage on LAPJG3WLY3PROD with BILLS
9 

•HR 7965 IH

1 ‘‘(i) any financial market utility that 

2 the Financial Stability Oversight Council 

3 has designated as systemically important 

4 under section 804 of the Dodd-Frank Wall 

5 Street Reform and Consumer Protection 

6 Act; 

7 ‘‘(ii) any exchange registered under 

8 section 6 of the Securities Exchange Act of 

9 1934 that facilitates trading in any na10 tional market system security, as defined 

11 in section 242.600 of title 17, Code of 

12 Federal Regulations (or any successor reg13 ulation), and which exchange during at 

14 least four of the preceding six calendar 

15 months had— 

16 ‘‘(I) with respect to all national 

17 market system securities that are not 

18 options, 10 percent or more of the av19 erage daily dollar volume reported by 

20 applicable transaction reporting plans; 

21 or 

22 ‘‘(II) with respect to all listed op23 tions, 15 percent or more of the aver24 age daily dollar volume reported by 

25 applicable national market system 


ssavage on LAPJG3WLY3PROD with BILLS
10 

•HR 7965 IH

1 plans for reporting transactions in 

2 listed options; and 

3 ‘‘(iii) any technology service provider 

4 in the Significant Service Provider Pro5 gram of the Financial Institutions Exam6 ination Council that provides core proc7 essing services that is determined by the 

8 Council to be a significant technology serv9 ice provider. 

10 ‘‘(B) MALICIOUS SOFTWARE.—The term 

11 ‘malicious software’ means software that, when 

12 deployed, results in the loss of access to data or 

13 the loss of functionality of an information and 

14 communications system or network of a U.S. fi15 nancial institution. 

16 ‘‘(C) RANSOMWARE ATTACK.—The term 

17 ‘ransomware attack’ means the deployment of 

18 malicious software for the purpose of demand19 ing payment in exchange for restoring critical 

20 access to, or the critical functionality of, an in21 formation and communications system or net22 work. 

23 ‘‘(D) RANSOMWARE PAYMENT.—The term 

24 ‘ransomware payment’ means a payment made 

25 by a U.S. financial institution (including a payVerDate Sep 11 2014 19:18 Apr 23, 2024 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H7965.IH H7965

ssavage on LAPJG3WLY3PROD with BILLS
11 

•HR 7965 IH

1 ment made through use of digital currency) to, 

2 at the request of, or for the benefit of a person 

3 responsible for a ransomware attack in ex4 change for restoration of the access or 

5 functionality of an information and communica6 tions system or network of the institution. 

7 ‘‘(E) RANSOMWARE PAYMENT AUTHORIZA8 TION.—The term ‘ransomware payment author9 ization’ means, with respect to a ransomware 

10 payment made by a U.S. financial institution, a 

11 written notice from a Federal law enforcement 

12 agency to authorize such ransomware pay13 ment.’’; 

14 (4) in subsection (f), as so redesignated, by 

15 striking ‘‘after the date of enactment of this Act’’ 

16 and inserting ‘‘after the date of enactment of the 

17 Ransomware and Financial Stability Act of 2024’’; 

18 and 

19 (5) by adding at the end the following new sub20 section: 

21 ‘‘(g) SHORT TITLE.—This section may be cited as the 

22 ‘Cybersecurity and Financial System Resilience Act’.’’. 

23 (b) APPLICABILITY.—The amendments made by this 

24 Act shall apply to a covered U.S. financial institution (as 

25 defined in subsection (d) of the Cybersecurity and FinanVerDate Sep 11 2014 19:18 Apr 23, 2024 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H7965.IH H7965

ssavage on LAPJG3WLY3PROD with BILLS
12 

•HR 7965 IH

1 cial System Resilience Act (Public Law 116–260; 135 

2 Stat. 2173; 12 U.S.C. 1811 note), as added by this Act) 

3 beginning on the earlier of the date that is— 

4 (1) 30 days after publication in the Federal 

5 Register of rules implementing this Act; or 

6 (2) 1 year after the date of the enactment of 

7 this Act. 

8 (c) SUNSET.—This Act and the amendments made 

9 by this Act shall be repealed 10 years after the applica10 bility date described in subsection (b). 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS