I 
118TH CONGRESS 
2D SESSION 
H. R. 7965 
To include requirements relating to ransomware attack deterrence for a cov-
ered U.S. financial institution in the Consolidated Appropriations Act, 
2021, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 11, 2024 
Ms. PETTERSEN (for herself and Mr. MCHENRY) introduced the following bill; 
which was referred to the Committee on Financial Services 
A BILL 
To include requirements relating to ransomware attack deter-
rence for a covered U.S. financial institution in the Con-
solidated Appropriations Act, 2021, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Ransomware and Fi-
nancial Stability Act of 2024’’. 
SEC. 2. RANSOMWARE ATTACK DETERRENCE. 
(a) IN GENERAL.—Section 108 of title I of division 
Q of the Consolidated Appropriations Act, 2021 (Public 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
Law 116–260; 135 Stat. 2173; 12 U.S.C. 1811 note) is 
amended— 
(1) in the subsection heading, by striking ‘‘RE-
PORT’’; 
(2) by redesignating subsections (d) and (e) as 
subsections (e) and (f), respectively; 
(3) by inserting the following after subsection 
(c): 
‘‘(d) RANSOMWARE ATTACK DETERRENCE.— 
‘‘(1) REQUIREMENTS.— 
‘‘(A) IN GENERAL.—A covered U.S. finan-
cial institution subject to a ransomware attack 
may not make a ransomware payment in re-
sponse to such ransomware attack— 
‘‘(i) before submitting the notification 
described in paragraph (2); and 
‘‘(ii) in an amount greater than 
$100,000, unless the payment is subject to 
a ransomware payment authorization. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this subsection shall be construed to permit 
a ransomware payment that is otherwise pro-
hibited by law. 
‘‘(2) NOTIFICATION DESCRIBED.— 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(3) WAIVER.—The President may waive the 
requirements of paragraph (2) with respect to a cov-
ered U.S. financial institution if the President deter-
mines that the waiver is in the national interest of 
the United States and notifies such institution and 
the appropriate members of Congress of such waiv-
er. 
‘‘(4) 
SAFE
HARBOR
WITH
RESPECT
TO 
RANSOMWARE
PAYMENT
AUTHORIZATIONS
AND 
GOOD-FAITH DETERMINATIONS.— 
‘‘(A) IN
GENERAL.—With respect to a 
ransomware payment made under paragraph 
(2)(B) or a waiver issued under paragraph 
(3)— 
‘‘(i) a U.S. financial institution shall 
not be liable under subchapter II of chap-
ter 53 of title 31, United States Code, or 
chapter 2 of title I of Public Law 91–508 
(12 U.S.C. 1951 et seq.) for making a 
ransomware payment consistent with the 
parameters and timing of a ransomware 
payment authorization; and 
‘‘(ii) no Federal or State department 
or agency may take any adverse super-
visory action with respect to the U.S. fi-
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
nancial institution solely for making a 
ransomware payment consistent with the 
parameters and timing of the authoriza-
tion. 
‘‘(B) GOOD-FAITH
EFFORTS
TO
ASSESS 
RANSOMWARE ATTACKS.—A covered U.S. finan-
cial institution may not be held liable for defi-
ciencies in describing a ransomware attack in a 
notification described under paragraph (2) if 
such institution engaged in good-faith efforts to 
determine the nature of the ransomware attack. 
‘‘(C) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed— 
‘‘(i) to prevent a Federal or State de-
partment or agency from verifying the va-
lidity of a ransomware payment authoriza-
tion with the law enforcement agency sub-
mitting that authorization; 
‘‘(ii) to relieve a U.S. financial institu-
tion from complying with any other provi-
sion of law, including the reporting of sus-
picious transactions under section 5318(g) 
of title 31, United States Code; or 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(iii) to extend the safe harbor de-
scribed in this paragraph to any actions 
taken by the U.S. financial institution— 
‘‘(I) before the date of issuance 
of ransomware payment authorization; 
or 
‘‘(II) after any termination date 
stated in the ransomware payment au-
thorization. 
‘‘(D) RANSOMWARE PAYMENT AUTHORIZA-
TION
TERMINATION
DATE.—Any ransomware 
payment authorization submitted under this 
subsection shall include a termination date after 
which that authorization shall no longer apply. 
‘‘(E) RECORDS.—Any Federal law enforce-
ment agency that submits to a U.S. financial 
institution a ransomware payment authorization 
shall, not later than 2 business days after the 
date on which the authorization is submitted to 
the U.S. financial institution— 
‘‘(i) submit to the Director of the Fi-
nancial Crimes Enforcement Network a 
copy of the authorization; and 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(ii) alert the Director as to whether 
the U.S. financial institution has imple-
mented the request. 
‘‘(F) GUIDANCE.—The Secretary of the 
Treasury, in coordination with the Attorney 
General, shall issue guidance on the required 
elements of a ransomware payment authoriza-
tion. 
‘‘(5) CONFIDENTIALITY OF INFORMATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
paragraph (2), any information or document 
provided by a U.S. financial institution to a 
Federal law enforcement agency pursuant to 
this subsection— 
‘‘(i) shall be exempt from disclosure 
under section 552 of title 5, United States 
Code; and 
‘‘(ii) may not be made publicly avail-
able. 
‘‘(B) EXCEPTIONS.—Paragraph (1) shall 
not prohibit the disclosure of the following: 
‘‘(i) Information relevant to any ad-
ministrative or judicial action or pro-
ceeding. 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(ii) Information requested by the ap-
propriate members of Congress or other-
wise required to be submitted to Congress. 
‘‘(iii) Information required for Federal 
law enforcement or intelligence purposes 
(as determined by the Attorney General), 
in consultation with the Director of the Fi-
nancial Crimes Enforcement Network to be 
disclosed to a domestic governmental entity 
or to a governmental entity of a United 
States ally or partner, only to the extent 
necessary for such purposes, and subject to 
appropriate confidentiality and classifica-
tion requirements. 
‘‘(iv) Anonymized information re-
quired for the production of aggregate data 
or statistical analyses. 
‘‘(v) Information that the U.S. finan-
cial institution has consented to be dis-
closed to third parties. 
‘‘(6) DEFINITIONS.—In this subsection: 
‘‘(A) COVERED U.S. FINANCIAL INSTITU-
TION.—The term ‘covered U.S. financial insti-
tution’ means— 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(i) any financial market utility that 
the Financial Stability Oversight Council 
has designated as systemically important 
under section 804 of the Dodd-Frank Wall 
Street Reform and Consumer Protection 
Act; 
‘‘(ii) any exchange registered under 
section 6 of the Securities Exchange Act of 
1934 that facilitates trading in any na-
tional market system security, as defined 
in section 242.600 of title 17, Code of 
Federal Regulations (or any successor reg-
ulation), and which exchange during at 
least four of the preceding six calendar 
months had— 
‘‘(I) with respect to all national 
market system securities that are not 
options, 10 percent or more of the av-
erage daily dollar volume reported by 
applicable transaction reporting plans; 
or 
‘‘(II) with respect to all listed op-
tions, 15 percent or more of the aver-
age daily dollar volume reported by 
applicable national market system 
VerDate Sep 11 2014 
19:18 Apr 23, 2024
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H7965.IH
H7965
ssavage on LAPJG3WLY3PROD with BILLS