Federal Register / Vol. 87, No. 68 / Friday, April 8, 2022 / Notices 20933 

1 12 CFR part 30, appendix B, supplement A. 

collection of information, before 

submitting the collection to OMB for 

approval. To comply with this 

requirement, the OCC is publishing 

notice of the proposed collection of 

information set forth in this document. 

Title: Guidance Regarding 

Unauthorized Access to Customer 

Information. 

OMB Control No.: 1557–0227. 

Description: Section 501(b) of the 

Gramm-Leach-Bliley Act (15 U.S.C. 

6801(b)) requires the OCC to establish 

appropriate standards for national banks 

relating to administrative, technical, and 

physical safeguards: (1) To insure the 

security and confidentiality of customer 

records and information; (2) to protect 

against any anticipated threats or 

hazards to the security or integrity of 

such records; and (3) to protect against 

unauthorized access to, or use of, such 

records or information that could result 

in substantial harm or inconvenience to 

any customer. 

The Interagency Guidelines 

Establishing Information Security 

Standards, 12 CFR part 30, appendix B 

(Security Guidelines), which implement 

section 501(b), require each entity 

supervised by the OCC (supervised 

institution) to consider and adopt a 

response program, as appropriate, that 

specifies actions to be taken when the 

supervised institution suspects or 

detects that unauthorized individuals 

have gained access to customer 

information systems. 

The Interagency Guidance on 

Response Programs for Unauthorized 

Access to Customer Information and 

Customer Notice (Breach Notice 

Guidance),1 which interprets the 

Security Guidelines, states that, at a 

minimum, a supervised institution’s 

response program should contain 

procedures for: 

(1) Assessing the nature and scope of 

an incident, and identifying what 

customer information systems and types 

of customer information have been 

accessed or misused; 

(2) Notifying its primary Federal 

regulator as soon as possible when the 

supervised institution becomes aware of 

an incident involving unauthorized 

access to, or use of, sensitive customer 

information; 

(3) Notifying appropriate law 

enforcement authorities in situations 

involving Federal criminal violations 

requiring immediate attention, such as 

when a reportable violation is congoing, 

consistent with the OCC’s Suspicious 

Activity Report regulations; 

(4) Taking appropriate steps to 

contain and control the incident in an 

effort to prevent further unauthorized 

access to, or use of, customer 

information, for example, by 

monitoring, freezing, or closing affected 

accounts, while preserving records and 

other evidence; and 

(5) Notifying customers when 

warranted. 

The Breach Notice Guidance states 

that, when a financial institution 

becomes aware of an incident of 

unauthorized access to sensitive 

customer information, the institution 

should conduct a reasonable 

investigation to promptly determine the 

likelihood that the information has been 

or will be misused. If the institution 

determines that the misuse of its 

information about a customer has 

occurred or is reasonably possible, it 

should notify the affected customer as 

soon as possible. 

Type of Review: Regular. 

Affected Public: Businesses or other 

for-profit. 

Estimated Number of Respondents: 

20. 

Total Estimated Annual Burden: 720 

hours. 

Frequency of Response: On occasion. 

Comments submitted in response to 

this notice will be summarized and 

included in the request for OMB 

approval. All comments will become a 

matter of public record. Comments are 

invited on: 

(a) Whether the collection of 

information is necessary for the proper 

performance of the functions of the 

OCC, including whether the information 

has practical utility; 

(b) The accuracy of the OCC’s 

estimate of the burden of the 

information collection; 

(c) Ways to enhance the quality, 

utility, and clarity of the information to 

be collected; 

(d) Ways to minimize the burden of 

the collection on respondents, including 

through the use of automated collection 

techniques or other forms of information 

technology; and 

(e) Estimates of capital or start-up 

costs and costs of operation, 

maintenance, and purchase of services 

to provide information. 

Theodore J. Dowd, 

Deputy Chief Counsel, Office of the 

Comptroller of the Currency. 

[FR Doc. 2022–07478 Filed 4–7–22; 8:45 am] 

BILLING CODE 4810–33–P 

DEPARTMENT OF THE TREASURY 

Office of the Comptroller of the 

Currency 

Agency Information Collection 

Activities: Information Collection 

Renewal; Comment Request; 

Disclosure and Reporting of CRARelated Agreements 

AGENCY: Office of the Comptroller of the 

Currency, Treasury. 

ACTION: Notice and request for comment. 

SUMMARY: The Office of the Comptroller 

of the Currency (OCC), as part of its 

continuing effort to reduce paperwork 

and respondent burden, invites the 

general public and other Federal 

agencies to comment on a continuing 

information collection, as required by 

the Paperwork Reduction Act of 1995 

(PRA). Pursuant to the PRA, an agency 

may not conduct or sponsor, and a 

respondent is not required to respond 

to, an information collection unless it 

displays a currently valid Office of 

Management and Budget (OMB) control 

number. The OCC is soliciting comment 

concerning its information collection 

titled ‘‘Disclosure and Reporting of 

CRA-Related Agreements.’’ 

DATES: Comments must be received by 

June 7, 2022. 

ADDRESSES: Commenters are encouraged 

to submit comments by email, if 

possible. You may submit comments by 

any of the following methods: 

• Email: prainfo@occ.treas.gov. 

• Mail: Chief Counsel’s Office, 

Attention: Comment Processing, Office 

of the Comptroller of the Currency, 

Attention: 1557–0219, 400 7th Street 

SW, Suite 3E–218, Washington, DC 

20219. 

• Hand Delivery/Courier: 400 7th 

Street SW, Suite 3E–218, Washington, 

DC 20219. 

• Fax: (571) 465–4326. 

Instructions: You must include 

‘‘OCC’’ as the agency name and ‘‘1557– 

0219’’ in your comment. In general, the 

OCC will publish comments on 

www.reginfo.gov without change, 

including any business or personal 

information provided, such as name and 

address information, email addresses, or 

phone numbers. Comments received, 

including attachments and other 

supporting materials, are part of the 

public record and subject to public 

disclosure. Do not include any 

information in your comment or 

supporting materials that you consider 

confidential or inappropriate for public 

disclosure. 

Following the close of this notice’s 

60-day comment period, the OCC will 


jspears on DSK121TN23PROD with NOTICES1
20934 Federal Register / Vol. 87, No. 68 / Friday, April 8, 2022 / Notices 

1 12 U.S.C. 1831y. 

2The definition includes groups of substantially 

related agreements that satisfy these amounts in the 

aggregate. 

3 12 U.S.C. 1831y(e). The statutory definition of 

‘‘agreement’’ excludes any agreement entered into 

with an NGEP ‘‘who has not commented on, 

testified about, or discussed with the institution, or 

otherwise contacted the institution, concerning the 

[CRA].’’ Id. 

4 12 U.S.C. 1831y(a). 

5 12 U.S.C. 1831y(b)–(c). 

6 If providing a list of covered agreements, the IDI 

or affiliate must provide a copy and public version 

of any agreement referenced in the list to any 

relevant supervisory agency within seven calendar 

days of receiving a request from the agency. 

7 12 CFR 35.6(b)(2), 35.8; see 12 U.S.C. 

1831y(h)(2)(A). 

publish a second notice with a 30-day 

comment period. You may review 

comments and other related materials 

that pertain to this information 

collection beginning on the date of 

publication of the second notice for this 

collection by the method set forth in the 

next bullet. 

• Viewing Comments Electronically: 

Go to www.reginfo.gov. Hover over the 

‘‘Information Collection Review’’ tab 

and click on ‘‘Information Collection 

Review’’ dropdown. Underneath the 

‘‘Currently under Review’’ section 

heading, from the drop-down menu 

select ‘‘Department of Treasury’’ and 

then click ‘‘submit.’’ This information 

collection can be located by searching 

by OMB control number ‘‘1557–0219’’ 

or ‘‘Disclosure and Reporting of CRARelated Agreements.’’ 

Upon finding the appropriate 

information collection, click on the 

related ‘‘ICR Reference Number.’’ On the 

next screen, select ‘‘View Supporting 

Statement and Other Documents’’ and 

then click on the link to any comment 

listed at the bottom of the screen. 

• For assistance in navigating 

www.reginfo.gov, please contact the 

Regulatory Information Service Center 

at (202) 482–7340. 

FOR FURTHER INFORMATION CONTACT: 

Shaquita Merritt, OCC Clearance 

Officer, (202) 649–5490, Chief Counsel’s 

Office, Office of the Comptroller of the 

Currency, Washington, DC 20219. If you 

are deaf, hard of hearing, or have a 

speech disability, please dial 7–1–1 to 

access telecommunications relay 

services. 

SUPPLEMENTARY INFORMATION: Under the 

PRA (44 U.S.C. 3501 et seq.), Federal 

agencies must obtain approval from the 

OMB for each collection of information 

that they conduct or sponsor. 

‘‘Collection of information’’ is defined 

in 44 U.S.C. 3502(3) and 5 CFR 

1320.3(c) to include agency requests or 

requirements that members of the public 

submit reports, keep records, or provide 

information to a third party. Section 

3506(c)(2)(A) of title 44 requires federal 

agencies to provide a 60-day notice in 

the Federal Register concerning each 

proposed collection of information, 

including each proposed extension of an 

existing collection of information, 

before submitting the collection to OMB 

for approval. To comply with this 

requirement, the OCC is publishing 

notice of the extension of the collection 

of information set forth in this 

document. 

Title: Disclosure and Reporting of 

CRA-Related Agreements. 

OMB Control No.: 1557–0219. 

Description: National banks, Federal 

savings associations, and their affiliates 

occasionally enter into agreements with 

nongovernmental entities or persons 

(NGEPs) that are related to their 

Community Reinvestment Act (CRA) 

responsibilities. Section 48 of the 

Federal Deposit Insurance Act (FDI Act) 

requires disclosure of certain of these 

agreements and imposes related 

reporting requirements on insured 

depository institutions (IDIs), their 

affiliates, and NGEPs.1

Section 48 of the FDI Act generally 

applies to written agreements that: (1) 

Are made in fulfillment of the CRA; (2) 

involve funds or other resources of an 

IDI or affiliate with an aggregate value 

of more than $10,000 in a year or loans 

with an aggregate principal value of 

more than $50,000 in a year; 2 and (3) 

are entered into by an IDI or affiliate and 

an NGEP.3

Under section 48, the parties to a 

covered agreement must make the 

covered agreement available to the 

public and the appropriate Federal 

banking agency.4 This section also 

requires the parties to file a report 

annually with the appropriate Federal 

banking agency concerning the 

disbursement, receipt, and use of funds 

or other resources under the agreement.5

As mandated by the FDI Act, the OCC, 

the Federal Deposit Insurance 

Corporation, and the Board of Governors 

of the Federal Reserve System issued 

regulations to implement section 48. 

The OCC’s regulation, codified at 12 

CFR 35, is known as the ‘‘CRA 

Sunshine’’ regulation. The disclosure 

and reporting provisions of this 

regulation, which are collections of 

information under the PRA, implement 

the statutorily mandated disclosure and 

reporting requirements. 

The information collections are found 

in 12 CFR 35.4(b); 35.6; and 35.7, and 

they require: 

• IDIs or affiliates to notify each 

NGEP that is a party to a covered 

agreement that the agreement concerns 

a CRA affiliate; 

• NGEPs and IDIs or affiliates to make 

a copy of a covered agreement available 

to any individual or entity upon request; 

• NGEPs to provide a copy of the 

covered agreement within 30 days of 

receiving a request from the relevant 

supervisory agency; 

• Each IDI and affiliate to provide 

each relevant supervisory agency with a 

copy of each covered agreement or a list 

of all covered agreements entered into 

during a calendar quarter within 60 

days of the end of the calendar quarter; 6

and 

• Annual reporting by NGEPs, IDIs or 

affiliates concerning the disbursement, 

receipt, and uses of funds under each 

covered agreement. 

The parties to a covered agreement 

may request confidential treatment of 

proprietary and confidential 

information in a covered agreement or 

annual report and may withhold from 

public disclosure confidential or 

proprietary information in a covered 

agreement.7

Type of Review: Extension of a 

currently approved collection. 

Affected Public: Individuals; 

Businesses or other for-profit. 

Estimated Number of Respondents: 9. 

Estimated Total Annual Burden: 534. 

Comments submitted in response to 

this notice will be summarized, 

included in the request for OMB 

approval, and will become a matter of 

public record. Comments are invited on: 

(a) Whether the collection of 

information is necessary for the proper 

performance of the functions of the 

OCC, including whether the information 

has practical utility; 

(b) The accuracy of the OCC’s 

estimate of the information collection 

burden; 

(c) Ways to enhance the quality, 

utility, and clarity of the information to 

be collected; 

(d) Ways to minimize the burden of 

the collection on respondents, including 

through the use of automated collection 

techniques or other forms of information 

technology; and 

(e) Estimates of capital or start-up 

costs and costs of operation, 

maintenance, and purchase of services 

to provide information. 

Theodore J. Dowd, 

Deputy Chief Counsel, Office of the 

Comptroller of the Currency. 

[FR Doc. 2022–07479 Filed 4–7–22; 8:45 am] 

BILLING CODE P 


jspears on DSK121TN23PROD with NOTICES1