Document Headings

                    Document headings vary by document type but may contain                    the following:                  
                -                       the agency or agencies that issued and signed a document                    
                -                       the number of the CFR title and the number of each part                      the document amends, proposes to amend, or is directly                      related to                    
                -                       the agency docket number / agency internal file number                    
                -                       the RIN which identifies each regulatory action listed in                      the Unified Agenda of Federal Regulatory and Deregulatory                      Actions                    

                    See the                                          Document Drafting Handbook                                        for more details.                  

###### Federal Reserve System

# AGENCY:

Board of Governors of the Federal Reserve System.

# SUMMARY:

                        The Board of Governors of the Federal Reserve System (Board) is adopting a proposal to extend for three years, without revision, the Reporting, Recordkeeping, and Disclosure Requirements Associated with the Guidance on Response Programs for Unauthorized Access to Customer Information (FR 4100                        *;*                         OMB No. 7100-0309                        *).*

# FOR FURTHER INFORMATION CONTACT:

Federal Reserve Board Clearance Officer—Nuha Elmaghrabi—Office of the Chief Data Officer, Board of Governors of the Federal Reserve System, Washington, DC 20551 (202) 452-3829. Telecommunications Device for the Deaf (TDD) users may contact (202) 263-4869, Board of Governors of the Federal Reserve System, Washington, DC 20551. 

OMB Desk Officer—Shagufta Ahmed—Office of Information and Regulatory Affairs, Office of Management and Budget, New Executive Office Building, Room 10235, 725 17th Street NW, Washington, DC 20503 or by fax to (202) 395-6974.

# SUPPLEMENTARY INFORMATION:

On June 15, 1984, the Office of Management and Budget (OMB) delegated to the Board authority under the Paperwork Reduction Act (PRA) to approve of and assign OMB control numbers to collection of information requests and requirements conducted or sponsored by the Board. Board-approved collections of information are incorporated into the official OMB inventory of currently approved collections of information. Copies of the Paperwork Reduction Act Submission, supporting statements and approved collection of information instrument(s) are placed into OMB's public docket files. The Federal Reserve may not conduct or sponsor, and the respondent is not required to respond to, an information collection that has been extended, revised, or implemented on or after October 1, 1995, unless it displays a currently valid OMB control number.

## Final Approval Under OMB Delegated Authority of the Extension for Three Years, Without Revision, of the Following Report:

*Report title:*                     Reporting, Recordkeeping, and Disclosure Requirements Associated with the Guidance on Response Programs for Unauthorized Access to Customer Information.                

*Agency form number:*                     FR 4100.                

*OMB control number:*                     7100-0309.                

*Frequency:*                     On occasion.                

*Respondents:*                     State member banks (SMBs), bank holding companies (BHCs), affiliates and certain non-bank subsidiaries of bank holding companies, uninsured state agencies and branches of foreign banks, commercial lending companies owned or controlled by foreign banks, and Edge and agreement corporations.                

*Estimated number of respondents:*                     Develop response program: 1; Incident notification: 412.                

*Estimated average hours per response:*                     Develop response program: 24; Incident notification: 36.                

*Estimated annual burden hours:*                     Develop response program: 24; Incident notification: 14,832.                

*General description of report:*                     The ID-Theft Guidance is the information collection associated with the                     *Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice*                     (security guidelines), which was published in the                     **Federal Register**                     in March 2005.[1]                                          Trends in customer information theft and the accompanying misuse of that information led to the issuance of these security guidelines applicable to financial institutions. The security guidelines are designed to facilitate timely and relevant notification to affected customers and the appropriate regulatory authority (ARA) of the financial institutions. The security guidelines provide specific direction regarding the development of response programs and customer notifications.                

*Legal authorization and confidentiality:*                     The Board has determined that the reporting, recordkeeping, and disclosure requirements associated with the FR 4100 are authorized by the Gramm-Leach-Bliley Act and are mandatory (15 U.S.C. 6801(b)). Since the FR 4100 provides that a financial institution regulated by the Board should notify its designated Reserve Bank upon becoming aware of an incident of unauthorized access to sensitive customer information, issues of confidentiality may arise if the Board were to obtain a copy of a customer notice during the course of an examination, a copy of a Suspicious Activity Report (SAR), or other sensitive customer information. In such cases, the information would likely be exempt from disclosure to the public under the Freedom of Information Act (5 U.S.C 552(b)(3), (4), (6), and (8)). Also, a federal employee is prohibited by law from disclosing a SAR or the existence of a SAR (31 U.S.C. 5318(g)).                

*Current actions:*                     On September 12, 2017, the Federal Reserve published a notice in the                     **Federal Register**                     (82 FR 42814) requesting public comment for 60 days on the extension, without revision, of the Reporting, Recordkeeping, and Disclosure Requirements Associated with the Guidance on Response Programs for Unauthorized Access to Customer Information. The comment period for this notice expired on November 13, 2017. The Federal Reserve did not receive any comments.                

Board of Governors of the Federal Reserve System, January 17, 2018.

Ann E. Misback,

Secretary of the Board.

# Footnotes

1.                                                     *See*70 FR 15736
        Back to Citation      

[FR Doc. 2018-01113 Filed 1-22-18; 8:45 am]

 BILLING CODE 6210-01-P