Financial Services and Cybersecurity: The Federal Role
Released: 2016-03-23T00:00:00

Introduction

Cybersecurity is a major concern of financial services providers and their federal regulators. In many ways, it is an important extension of physical security. Providers of financial services are concerned about both physical and electronic theft of money and other assets such as intellectual property. They want to prevent the destruction of property, whether it is a building or a website. They do not want to be closed down by either a physical storm or an electronic denial-of-service attack. They want to minimize human error, whether it is someone failing to secure written documents or an employee falling victim to a phishing attack. When it comes to keeping unauthorized persons away from sensitive electronic equipment, physical security and cybersecurity often overlap.

There is a growing recognition by the federal government of the importance of cybersecurity in the financial services industry, as evidenced by the inclusion of financial services in the government's list of 16 critical infrastructure sectors. This report provides information on the landscape of federal laws and regulatory agencies directly regulating or establishing standards for financial services cybersecurity. Because each of the applicable federal laws contains specific implementation provisions, there are varying degrees and methods of regulatory oversight of cybersecurity in the financial sector. Some laws distribute authority to issue regulations and take enforcement actions among a number of agencies; others require one agency to issue implementing regulations and distribute enforcement authority among several agencies; and finally, some laws delegate all authority for issuing regulations and administrative enforcement to a single agency.

Some agencies have authority to issue notice and comment rules; others have authority to impose requirements on the institutions that they regulate by guidance that has the same legal force as notice and comment rulemaking. The federal bank supervisory agencies, which have broad general authority to issue regulations, also issue any number of types of guidance documents under a variety of names such as policy statements, supervision and regulatory (SR) letters, financial institution letters (FIL), letters, bulletins, and other forms of communication. Many of the regulators issue informal guidance and bring adjudicatory enforcement actions on a case-by-case basis that often are interpreted as precedential signals to the regulated community as to how the agency interprets aspects of its regulatory authority.

This report also provides brief descriptions and examples of the role of state law and of private sector initiatives. Its focus is, however, on the array of federal regulators and the varying ways in which federal laws impose information technology and cybersecurity requirements on financial services providers to protect the security, confidentiality, and integrity of data assembled and maintained in their businesses.

Acronyms and abbreviations are listed in a glossary at the end of this report.

Financial Services Regulation Takes Many Forms

Financial services are a critical part of any modern economy. These services include

accepting deposits; making loans; processing payments; providing insurance and other financial products to spread risks; dealing in securities such as stocks, bonds, and derivatives; and offering, administrating, or advising employee benefit programs.

Commercial and investment banks, stock and commodity markets, and insurance companies using various securities and commodity contracts, funds, trusts, and other financial vehicles provide these services.

Banking institutions are subject to comprehensive prudential regulation touching many aspects of their daily operations. Regulation of the financial sector is based on both form (the type of charter the entity has) and function (what the entity does). There are special and distinct institution-based regulatory regimes and regulators for depositories, securities firms, and insurance companies, as well as multiple regulations based on the services or products that a financial institution provides. In addition to the traditional type of financial regulation in which various financial organizations, functions, activities, or products are subjected to regulatory controls, the federal government also treats financial services as one of 16 critical infrastructure sectors with which it has arrangements to prevent disruptions to the nation's economy and harm to its wellbeing.

Distinctions are often made between commercial banking (accepting deposits and making loans to businesses and individuals) and investment banking (dealing in stocks, bonds, and related securities on the bank's account or for customers). In this report, the term "bank" will be used as a general term for depository institutions. The term will be employed to cover banks, savings associations, thrifts, and credit unions with federally insured deposits. The term will also be used to cover the companies that own or control banks or thrifts (i.e., bank holding companies, financial holding companies, and savings and loan holding companies). The term "commercial bank" will be used to refer to national banks and state-chartered banks but not savings and loans or thrifts or credit unions. When focusing on a nonbank subsidiary of a holding company, however, "bank" will not be used, but the report will indicate the type of organization in question (i.e., stock exchange, insurance company, securities firm, mortgage broker, etc.).

Currently there are four federal commercial bank regulators, two federal securities regulators, one credit union federal regulator, but no primary federal regulator of insurance companies. Although primary regulation of insurance companies is the prerogative of the states, publicly traded insurance companies must comply with various securities laws and certain insurance company subsidiaries of financial holding companies may be subjected to requirements imposed by the Board of Governors of the Federal Reserve System (the Fed).

Federal Banking Regulations, Regulators, and Examinations

Prudential regulation of depositories and holding companies for safety and soundness now includes concern for cybersecurity. Prudential regulation of depository institutions and their holding companies involves virtually every aspect of their capitalization, management, operations, activities, and services, as well as periodic on-site examination and continuing supervision. It is generally based upon organic legislation that establishes each regulator to charter and supervise banks, savings and loans, holding companies, or credit unions. These laws have been amended over time to provide regulators with authority to deal with changing issues and circumstances as they have arisen.

Office of the Comptroller of the Currency

Today, the Office of the Comptroller of the Currency (OCC) is the chartering authority and primary federal regulator of national banks and federal savings associations, and it relies on general authority under organic legislation to impose cybersecurity requirements on the institutions it regulates and their service providers. Congress created the OCC to charter and to oversee national banks. (States can also charter banks.) The Home Owners' Loan Act of 1933 established a separate depository charter for savings and loan associations. However, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank) transferred responsibility for chartering and regulating federal savings and loans to the OCC.

Federal Reserve System

The Board of Governors of the Federal Reserve System has regulatory authority over an array of financial institutions and systems, and it relies on broad authority in its organic legislation to impose cybersecurity requirements on the institutions it regulates.

The Federal Reserve Act of 1913 created the Fed, headed by a Board of Governors, and gave it regulatory authority over state-chartered banks that are members of the Federal Reserve System. In 1956, the Bank Holding Company Act added regulation of bank holding companies to the Fed's responsibilities. Savings and loan holding companies were added in 2010 by the Dodd-Frank Act.

The Fed is the primary regulator of

state banks that are members of the Federal Reserve System; U.S. branches and agencies of foreign banks; international operations of U.S. banks; companies that own banks (bank and financial holding companies); securities holding companies that elect to be supervised by the Fed; savings and loan holding companies; and any firm designated as a systemically significant financial institution (SIFI) by the Financial Stability Oversight Council (FSOC).

In addition, it regulates the payment, clearing, and settlement systems designated as systemically significant by the FSOC, unless regulated by the Securities and Exchange Commission (SEC) or Commodity Futures Trading Commission (CFTC).

The Fed regulates wholesale payment systems, which are used by financial institutions to transfer large-value funds and to communicate with each other. The two primary domestic interbank payment and messaging systems are the Fedwire Funds Service (operated by the Fed) and the Clearing House Interbank Payments System (CHIPS, operated by The Clearing House Payments Company, L.L.C., which is based in New York).

The Fed has oversight or supervisory responsibility over designated financial market utilities, which include systemically important private sector payment systems, securities settlement systems, central securities depositories, and central counterparties. While the Fed cooperates with the other central banks in the Group of 10 to oversee SWIFT—the Society for Worldwide Interbank Financial Telecommunication, a Brussels-based entity owned by financial organizations worldwide that provides secure international messaging among banks and other financial institutions—for the purposes of critical infrastructure protection, discussed later, SWIFT is considered a communications system, and, therefore, it is overseen for cybersecurity purposes by the Department of Homeland Security.

Federal Deposit Insurance Corporation

The Federal Deposit Insurance Corporation (FDIC) is the primary regulator of federally insured, state-chartered banks that are not members of the Federal Reserve System and all federally insured, state-chartered thrifts and savings associations. It relies on broad general authority under its organic legislation to impose cybersecurity requirements on the institutions it regulates.

The Banking Act of 1933 created the FDIC to insure bank deposits and to act as primary federal regulator of state-chartered banks that are not members of the Federal Reserve System. Except for a few small, state-chartered banks, all banks are required to have their deposits insured by the FDIC.

National Credit Union Administration

The National Credit Union Administration (NCUA) is the federal regulator of federal credit unions and state-chartered, federally insured credit unions. It relies on broad authority under its organic legislation to impose cybersecurity requirements on the institutions it regulates. Credit unions are chartered as cooperative organizations of individuals with a common bond that accept deposits of members' savings and transaction balances in the form of share accounts, pay dividends, and offer consumer credit.

The Federal Credit Union Act of 1934 authorized federally chartered credit unions and created the Bureau of Federal Credit Unions to oversee them. The Financial Institutions Regulatory and Interest Rate Control Act of 1978 replaced the bureau with the National Credit Union Administration.

Consumer Financial Protection Bureau

The Consumer Financial Protection Act of 2010 (CFP Act), which is Title X of Dodd-Frank, created the Consumer Financial Protection Bureau (CFPB) within the Federal Reserve System. The CFPB has rulemaking, enforcement, and supervisory powers over many consumer financial products and services, as well as the entities that sell them. It has rulemaking authority over financial consumer protection laws that have cybersecurity implications, including authority to develop identity theft guidelines under the Fair and Accurate Credit Transactions Act (FACT Act) and to issue regulations under the privacy provisions of the Gramm-Leach-Bliley Act (GLBA). Unlike the other bank regulators, however, it does not have authority under GLBA to promulgate administrative, technical, and physical safeguards (1) to insure the security and confidentiality of "customer" records and information; (2) to protect against any anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. The CFPB has published a Supervision and Examination Manual; examinations cover the protection of personally identifiable information (PII) covered by the privacy title of GLBA and the Fair Credit Reporting Act (FCRA) with respect to sharing of nonpublic personal information with nonaffiliated third parties.

Under its organic legislation, the CFPB has authority to issue rules declaring certain acts or practices to be unlawful because they are unfair, deceptive, or abusive. This authority is similar to authority that the Federal Trade Commission (FTC) has used to bring enforcement actions based on cybersecurity inadequacies. This authority was used on March 2, 2016, by the CFPB in a cybersecurity-related enforcement action against an online payment platform. However, the CFPB's authority with respect to unfair, deceptive, or abusive practices is confined to the CFPB's general regulatory jurisdiction.

The CFPB's supervisory powers include the authority to examine larger depositories for consumer compliance. The CFPB also has authority over certain nonbanks as follows:

[t]he CFPB is authorized to supervise three groups of nonbanks. First, the CFPB supervises nonbanks, regardless of size, in three specific markets—mortgage companies (such as lenders, brokers, and servicers), payday lenders, and private education lenders. Second, the CFPB may supervise "larger participants" in certain consumer financial markets. The CFPB has some discretion to determine what those markets are and what constitutes a larger participant.... Third, the CFPB may supervise a nonbank if, based on consumer complaints or other sources, the CFPB has reasonable cause to determine that the nonbank poses risks to consumers in offering its financial services or products.

The CFPB views protection of customer data as part of its responsibilities and has joined with the federal banking regulators to issue a cybersecurity assessment tool for financial services firms to use.

Federal Financial Institutions Examination Council: Bank Examination

The Federal Financial Institutions Examination Council (FFIEC) was created by Title X of the Financial Institutions Regulatory and Interest Rate Control Act of 1978, to "prescribe uniform principles for the Federal examination of financial institutions by the ... [federal bank regulators] and make recommendations to promote uniformity in the supervision of these financial institutions."

All five federal depository institution regulators are members of the FFIEC. The federal agency members of the FFIEC examine institutions they supervise for safety and soundness. Included in their examinations, as discussed later, is a comprehensive review of information technology and cybersecurity.

Under the privacy title of GLBA, all of the federal banking regulators, except (as previously noted) the CFPB, have authority to promulgate administrative, technical, and physical safeguards (1) to insure the security and confidentiality of "customer" records and information; (2) to protect against any anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any "customer."

Banks are subject to periodic on-site examination designed to maintain the safety and soundness of the individual institutions and of the entire banking system. Although every federally insured bank is evaluated on the same set of six factors that measure components of an institution's financial condition and operations, the degree of federal oversight of a bank varies with the size of a bank, and the variety and scope of its operations.

One component of a bank examination is the information technology examination, which is based on the Interagency Guidelines Establishing Information Security Standards. In addition, the federal banking agencies have issued guidance advising banks that when a bank detects a breach of security involving customer information, it must promptly notify law enforcement and its regulators. Customers must be notified if a reasonable investigation determines that a breach of customer information has occurred or is reasonably likely to occur. The FFIEC has issued an information technology (IT) examination handbook for use by examiners of the member agencies. This handbook consists of 11 separate booklets that cover specific cybersecurity areas:

audit, business continuity planning, development and acquisition, electronic banking, information security, management, operations, outsourcing technology services, retail payment systems, supervision of technology service providers, and wholesale payment systems.

Nonbank Federal Regulators

In addition to federal bank regulators, other federal regulators oversee securities, markets, government-sponsored enterprises in the secondary mortgage market, agricultural credit, and certain aspects of consumer protection.

Federal Regulators of Securities and Commodities

There are two federal regulators of securities and commodities: the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). The SEC was created by the Securities Exchange Act of 1934; the CFTC was created by the Commodity Futures Trading Commission Act of 1974. The SEC oversees securities exchanges, brokers and dealers, investment advisors, and mutual funds; the CFTC regulates designated contract markets, swap execution facilities, derivatives clearing organizations, swap data repositories, swap dealers, futures commission merchants, commodity pool operators, and other intermediators.

Securities and Exchange Commission

The Securities Exchange Act of 1934 requires publicly traded companies to disclose material financial and other information to the public, primarily by filing this information with the Commission. The securities laws

are broadly aimed at (1) investor protection; (2) maintaining fair, orderly, and efficient markets; and (3) facilitating capital formation. They do so by providing clear rules for honest dealing among securities market participants, including antifraud provisions, and a disclosure regime that requires the various entities involved in securities markets to disclose information deemed necessary for informed investment decision making.

As a consequence of its responsibilities, the SEC oversees financial disclosures of both financial and nonfinancial publicly traded companies, such as large nationwide retailers. It enforces prohibitions against insider trading, accounting fraud, and providing false or misleading information about securities and the companies that issue them.

Two key SEC regulations on cybersecurity are Regulation Systems Compliance and Integrity (Regulation SCI) and Regulation Privacy of Consumer Financial Information (Regulation S-P). Broadly speaking, Regulation SCI requires self-regulatory organizations (SROs), such as the Financial Industry Regulatory Authority (FINRA), to implement comprehensive policies and procedures for their technological systems and to notify the SEC of any problems. Regulation S-P implements the provision of the privacy title of GLBA, which requires the SEC to promulgate administrative, technical, and physical safeguards (1) to insure the security and confidentiality of "customer" records and information; (2) to protect against any anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any "customer." This regulation applies to brokers and dealers, investment companies, and investment advisers registered with the SEC.

The SEC's Office of Compliance Inspections and Examinations (OCIE) issues Risk Alert s to notify regulated entities of new emphases in their inspections and examinations. A recent alert highlighted six areas of concern: governance and risk assessment, access rights and controls, data loss prevention, vendor management, training, and incident response. In 2015, the OCIE alerted the securities industry to the importance of cybersecurity by publishing its "summary observations" of examinations it had conducted on approximately 100 broker-dealers or registered investment advisors for vulnerability to cyberattacks. Among OCIE's 2016 examination priorities are cybersecurity and Regulation SCI compliance.

Commodity Futures Trading Commission

Under the Commodity Futures Modernization Act of 2000, the CFTC is required to impose requirements on the entities that it regulates to comply with the privacy title of the Gramm-Leach-Bliley Act. This includes promulgating administrative, technical, and physical safeguards (1) to ensure the security and confidentiality of customer records and information; (2) to protect against any anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

Under CFTC regulations, "[e]very futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, major swap participant, and swap dealer subject to the jurisdiction of the Commission must adopt policies and procedures that address administrative, technical and physical safeguards for the protection of customer records and information." The CFTC has listed best practices that are generally consistent with regulations and guidance promulgated by the FTC, the SEC, and the banking regulators.

At a discussion held for securities industry participants, CFTC Chairman Timothy Massod summarized CFTC's cybersecurity regulatory efforts as follows:

We have incorporated cybersecurity standards into our regulations, [and] required clearing houses and exchanges to maintain system safeguards and risk management programs, to notify us promptly of incidents, to have recovery procedures in place. And we also made this a priority in our examinations.

Self-Regulatory Organizations

Certain self-regulatory organizations (SROs)—private organizations empowered by law or regulation to create and enforce industry rules—also are concerned about cybersecurity. These include FINRA, which, to protect investors, oversees stock exchanges and those who trade on them. The National Futures Association (NFA) has a similar role for U.S. futures exchanges and in the retail foreign exchange market

Financial Industry Regulatory Authority

FINRA is "an independent, not-for-profit organization authorized by Congress to protect America's investors by making sure the securities industry operates fairly and honestly ... by ... writing and enforcing rules governing the activities of more than 3,957 securities firms with approximately 643,322 brokers; examining firms for compliance with those rules; fostering market transparency; and educating investors." FINRA was created by the merger of the National Association of Securities Dealers, Inc. and the regulatory arm of the New York Exchange.

FINRA has published a directory of SROs.

National Futures Association

Among the SROs subject to the CFTC's jurisdiction, the NFA oversees those individuals and companies trading on U.S. futures exchanges and in the retail foreign exchange market. Under the general category of risk management, it considers operation risk, including computer systems.

The NFA manual provides guidance for members' cybersecurity programs.

Federal Insurance Regulation

There are no federal insurance regulators with roles parallel to those of the federal banking or securities agencies. The business of insurance is subject to state regulation, and when there is a data breach involving an insurance company state regulators are likely to conduct an investigation. However, certain federal laws, such as the privacy title of the Gramm-Leach-Bliley Act, specifically impose cybersecurity requirements on insurance providers and services. These laws are generally enforced by the state authorities.

According to CRS In Focus IF10043, Introduction to Financial Services: Insurance Regulation , by [author name scrubbed],

Each state government has a department or other entity charged with licensing and regulating insurance companies and those individuals and companies selling insurance products. States regulate the solvency of the companies and the content of insurance products as well as the market conduct of companies. Although each state sets its own laws and regulations for insurance, the National Association of Insurance Commissioners (NAIC) acts as a coordinating body that sets national standards through model laws and regulations. Models adopted by the NAIC, however, must be enacted by the states before having legal effect. The states have also developed a coordinated system of guaranty funds, designed to protect policyholders in the event of insurer insolvency.

*********

The Dodd-Frank Act ( P.L. 111-203 ) in 2010 significantly altered the overall financial regulatory structure in the United States, but it largely left the state-centered insurance regulatory structure intact. The areas where the act did affect insurance regulation include (1) enhanced systemic risk regulatory authority, including authority over insurers, was vested in the Federal Reserve and in the Financial Services Oversight Council (FSOC), a new council of regulators headed by the Treasury Secretary; (2) oversight of bank and thrift holding companies, including companies with insurance subsidiaries, was consolidated in the Federal Reserve with new capital requirements added; and (3) the creation of a new Federal Insurance Office (FIO) within the Treasury Department. The Dodd-Frank Act also included measures affecting the states' oversight of surplus lines insurance and reinsurance.

Other Regulators

Federal Trade Commission

The Federal Trade Commission Act (FTC Act) established the FTC in 1914 to protect consumers from deceptive or unfair business practices. The FTC has used this authority to bring enforcement actions against various entities, such as hotels, for failing to protect consumer information stored on computer systems.

The FTC also enforces the privacy provisions of GLBA and other consumer protection statutes. Under GLBA, FTC's authority covers "financial institutions," a term that is broadly defined to include all businesses "significantly engaged" in providing financial products or services other than those subject to primary regulation by other federal regulators (i.e., the federal banking or security regulators or state insurance authorities).

The FTC has promulgated a regulation requiring "all financial institutions subject to its jurisdiction" to adopt administrative, technical, and physical standards to safeguard nonpublic customer information. The FTC's authority to proceed against unfair and deceptive practices, which does not extend to banks, savings associations, or credit unions, among others, has been the basis of over 50 cases that the FTC has brought against companies, some of which may be financial companies, accused of engaging in unfair or deceptive practices by failing to protect personal data. After complaints that its criteria for taking action on data breaches are unclear, the FTC published a guide for businesses that offers "10 practical lessons businesses can learn from the FTC's 50+ data security settlements" and briefly discusses specific breaches and explains why the FTC did or did not take action.

Federal Housing Finance Agency

The Housing and Economic Recovery Act of 2008 created the Federal Housing Finance Agency (FHFA) to replace the previous regulators of the three housing government-sponsored enterprises (GSEs) (i.e., Fannie Mae, Freddie Mac, and the Federal Home Loan Banks). FHFA has general safety-and-soundness regulatory authority over the three GSEs.

In addition, on September 6, 2008, FHFA placed Fannie Mae and Freddie Mac in voluntary conservatorship. As conservator, FHFA assumes the authority of the boards of directors and management and has broad control and oversight over the two enterprises.

FHFA has issued an Advisory Bulletin on Cyber Risk Management, applicable to Fannie Mae, Freddie Mac, and the Federal Home Loan Banks. It provides seven "principles-based and technology-neutral" components for cyber risk management. Included are management participation, inclusion of overall risk management, assessment of third-party relationships, and protection of sensitive, confidential, or personally identifiable information.

Farm Credit Administration

The federal government has long been interested in assuring that credit is available in rural areas. The Federal Farm Loan Act of 1916 created what is today the Farm Credit Administration (FCA), which oversees two government-sponsored enterprises (GSEs) created by the federal government to make and to facilitate financing of agricultural loans: the Farm Credit System (FCS) and the Federal Agricultural Mortgage Corporation (Farmer Mac). The Farm Credit Act of 1971 consolidated and revised several farm credit provisions into a coordinated Farm Credit System, designed to extend credit to farmers and ranchers through cooperatively owned banks and credit associations. This system is administered and supervised by the Farm Credit Administration.

The other agricultural GSE, Farmer Mac, is stockholder-owned and makes a secondary market in agricultural real estate mortgages, rural housing mortgages, and rural utility cooperative loans. It was created by the Agricultural Credit Act of 1987 "to establish a secondary market for agricultural real estate and rural home mortgages." The Farm Credit System Reform Act of 1996 gave Farmer Mac further authority to purchase and pool loans and issue mortgage-backed securities with guaranteed payment of principal and interest, rather than just guarantee such securities issued by other retail lenders.

The FCA has no regulation that specifically addresses cybersecurity. Having said that, the agency's 2016 Regulatory Projects Plan includes consideration of "revisions to current information technology regulations to address information security, multifactor authentication, and cybersecurity."

The FCA is required to conduct a periodic examination of the institutions of the Farm Credit System (except for federal land bank associations). Cybersecurity is an inherent component of these examinations. The FCA Examination Manual includes an Information Technology component in those examinations. In examining an institution's security, examiners "[d]etermine if the board and management have established and maintained effective security over the institution's facilities, systems, and media that process and store vital information for business operations.... " The examination is based on the FFIEC Examination Handbook and focuses on risk management and assessment, board and management oversight, and internal controls

Selected Financial Services Data Security Laws and Implementing Regulations

Major laws that include data security provisions affecting the financial services industry include Dodd-Frank, the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act of 1970, the Fair and Accurate Credit Transactions Act of 2003, and the Sarbanes-Oxley Act of 2002. It might be noted that there are other laws, which are not specifically directed to the financial sector or to financial products, which may have an impact on the cybersecurity requirements of any financial institution. For example, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 impose privacy and security standards relating to health information. Financial institutions holding covered health information must comply with their requirements, which include data security standards.

Gramm-Leach-Bliley Act of 1999

Federal regulation of the financial sector's cybersecurity also includes laws that deal with specific concerns. One of these is the privacy title of GLBA, which prohibits "financial institutions" from sharing nonpublic personal information of their customers with unaffiliated third-parties. Section 501 of GLBA imposes obligations on "financial institutions" to "respect the privacy of ... [their] customers and to protect the security and confidentiality of those customers' nonpublic personal information." The term "financial institution" is defined broadly. Under this legislation, the federal banking and securities agencies, the FTC, and state insurance regulators are charged with imposing requirements on the entities that they regulate to comply with the privacy title of GLBA. This includes promulgating administrative, technical, and physical safeguards (1) to insure the security and confidentiality of "customer" records and information; (2) to protect against any anticipated threats or hazards to the security or integrity of such records; and (3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any "customer." Each of these agencies has promulgated a safeguards rule implementing this requirement.

There are also provisions in GLBA that generally prohibit, subject to certain exceptions, financial institutions from disclosing nonpublic personal information of their customers to nonaffiliated third parties. As discussed in the previous section, these provisions prohibit anyone from obtaining customer information of a financial institution by false pretenses. Authority to issue regulations under these provisions has been delegated to the CFPB; enforcement authority is shared among the federal banking regulators, the federal security regulators, the state insurance commissioners, and the CFPB, with respect to the "financial institutions" which they regulate. The FTC enforces these provisions with respect to "any institution engaged in the business of providing, financial services to customers who maintain a credit, deposit, trust, or other financial account or relationship with the institution on a nationwide basis." This includes, for example, check-cashing businesses, payday lenders, mortgage brokers, nonbank lenders, personal property or real estate appraisers, professional tax preparers, and courier services. The safeguards rule also applies to companies like credit reporting agencies and automatic teller machine (ATM) operators that receive information about the customers of other financial institutions.

Sarbanes-Oxley Act of 2002

Section 404 of the Sarbanes-Oxley Act of 2002 requires that annual reports filed with the SEC pursuant to the Securities Exchange Act of 1934 include a management evaluation of internal controls. There is some speculation that the SEC is considering this as a means of exercising "authority over the IT [information technology] controls of publicly-traded companies."

The disclosure provisions discussed here apply to corporations that are required to file reports under Sections 13(a) or 15(d) of the Securities Exchange Act of 1934. This includes companies with stock traded on national exchanges, foreign and domestic private issuers, and issuers of asset-backed securities. Bank holding companies, thrift holding companies, and insured depositories are required to file similar reports with their regulators. The bank regulators and the SEC have, by regulation, given those affected the option of filing one report that meets both sets of disclosure standards, or to file two reports.

Fair and Accurate Credit Transactions Act of 2003

The Fair and Accurate Credit Transactions Act (FACT Act) amended the Fair Credit Reporting Act to require regulatory agencies to develop identity theft guidelines. These "red flag" guidance and regulations outline "patterns, practices, and specific forms of activity that indicate the possible existence of identity theft." Pursuant to this legislation, the FTC and federal banking, credit union, and securities regulators have been required to issue regulations as well as regulations governing the disposal of customer information. The FCA has notified farm credit institutions that it may examine them for compliance with the FTC regulations.

Bank Protection Act

The Bank Protection Act directs the federal bank regulators (the Fed, FDIC, and OCC) to establish minimum security standards for banks and savings associations "to discourage robberies, burglaries, and larcenies and to assist in the identification and apprehension of persons who commit such acts." It includes no mention of cybersecurity.

Bank Service Company Act of 1962

The Bank Service Company Act of 1962 authorizes the Fed, FDIC, and OCC to regulate and examine companies that provide certain services to banks (i.e., "check and deposit sorting and posting, computation and posting of interest and other credits and charges, preparation and mailing of checks, statements, notices, and similar items, or any other clerical, bookkeeping, accounting, statistical, or similar functions performed for a depository institution"). Many small banks outsource some or all of these activities. Relying on its general powers under the Federal Credit Union Act, the NCUA issued a similar regulation which requires federally insured credit unions to "develop a written security program."

The Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act of 2009

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), creates national standards for health care providers, health insurance plans, health care clearinghouses, and their business associates to comply with privacy and security requirements for paper and electronic medical records. It requires covered entities, some of which may be providing financial services for health care providers, to provide notification through first-class mail or email to individuals affected by a data breach. It also requires covered entities to notify the Secretary of the Department of Health and Human Services of breaches affecting 500 or more individuals; smaller breaches must be reported to the Secretary annually.

Executive Orders

Currently, one presidential directive and two executive orders address the critical role of financial services in the national economy.

First, Presidential Policy Directive 21 (PPD-21), "Critical Infrastructure Security and Resilience," issued on February 12, 2013, revoked Homeland Security Presidential Directive 7 (HSPD-7). It identified the current 16 critical infrastructure sectors, including financial services, and designated the Department of the Treasury as the sector-specific agency. PPD-21 set out three "strategic imperatives" as follows:

1. refine and clarify functional relationships across the federal government to advance the national unity of effort to strengthen critical infrastructure security and resilience, 2. enable efficient information exchange by identifying baseline data and systems requirements for the federal government, and 3. implement an integration and analysis function to inform planning and operational decisions regarding critical infrastructure.

Second, Executive Order 13636, "Improving Critical Infrastructure Cybersecurity," was issued on February 12, 2013. It ordered the National Institute of Standards and Technology (NIST) to develop a baseline cybersecurity framework that could be voluntarily adopted by the critical infrastructure sectors, including financial services. Additionally, as a sector-specific agency, Treasury was directed to consult with the Department of Homeland Security, Office of Management and Budget, and the National Security Staff to determine if existing cybersecurity regulations should be modified considering current and projected risks.

Third, Executive Order 13681, "Improving the Security of Consumer Financial Transactions," was issued on October 17, 2014. It directed federal agencies to improve the cybersecurity of their consumer financial transactions by purchasing chip and PIN payment terminals and by issuing chip and PIN payment cards for official purchases. Chip and PIN is generally considered more secure than the chip and signature system being adopted by private sector. The additional security is effective only if both payment terminals and payment cards have PINs. Except for official government payment cards, most new payment cards issued in the United States lack PINs.

State Laws

Basic State Authority

In addition to the array of federal laws, financial institutions might be subject to state consumer protection data security laws. It is more likely that such a law will be held to apply to federally insured state-chartered banks and to other financial institutions organized under state law. Moreover, state requirements are likely to apply to insurance companies and to other financial firms that are not comprehensively regulated by the federal government, including industrial loan companies, payday lenders, check cashers, finance companies, and mortgage loan originators. There are also state securities laws and regulation, generally covering securities not publicly traded and registration and reporting of broker-dealers and stock brokers. It is beyond the scope of this report to discuss state regulation of financial services. The Conference of State Bank Supervisors (CSBS) is a central source for information on state banking regulation. The website of the North American Association of Securities Administrators is a useful source for information about state securities regulations, including registration and reporting requirements regarding broker-dealers.

State Laws Requiring Consumer Notification of Data Breaches

Although there are at least two data breach bills in the 114 th Congress— H.R. 2205 , the Data Security Act of 2015, reported out of the Committee on Financial Services, and S. 961 , the Data Security Act of 2115, referred to the Committee on Commerce, Science, and Transportation—currently, there is no federal law that requires financial institutions to notify their customers of data breaches. However, the overwhelming majority of the states have enacted laws requiring consumer notification of data breaches compromising PII. According to the National Conference of State Legislatures (NCSL), 47 states plus the District of Columbia, Puerto Rico, Guam, and the Virgin Islands have data breach notification laws that in general affect financial services within the individual jurisdictions. State, commonwealth, and territorial laws define what information and how many records trigger notification requirements. Many of these laws differ in how and when consumers are to be notified.

New York State

Because Wall Street and many related financial activities are located in New York City, New York State law has notable influence over the national and international financial system. The New York State Department of Financial Services (DFS) lists of over 35 separate types of financial institutions which it regulates. Among them are banks; insurance companies; credit unions; investment companies; bank holding companies; foreign bank agencies, branches, and representative offices; trusts; mortgage brokers and mortgage bankers; licensed lenders; check cashers, charitable foundations, and service contract providers; and budget planners, money transmitters, and bail bond agents. DFS has issued a number of reports on cybersecurity. It has expanded its examinations in the areas of cybersecurity and third-party service providers (including third-party information technology providers).

DFS has announced its intention to look more closely at cybersecurity policies and procedures, including third-party service provider management, multi-factor authentication, the role of the chief information security officer, application security, cybersecurity, personnel, auditing, and notifications to DFS of cybersecurity incidents. On November 9, 2015, DFS mentioned that it is considering proposing cybersecurity regulations for financial institutions, outlined the "key regulatory proposals," and invited feedback from state and federal regulators on how "to develop a comprehensive approach to cyber security regulation in the weeks and months ahead."

Payment Card Industry Data Security Standard

The Payment Card Industry's Security Standards Council, founded in 2006 by American Express, Discover, JCB International, MasterCard, and Visa Inc., develops, maintains, and updates Payment Card Industry Data Security Standards (PCI DSS). According to the Council,

[m]aintaining payment security is required for all entities that store, process or transmit cardholder data. Guidance for maintaining payment security is provided in PCI security standards. These set the technical and operational requirements for organizations accepting or processing payment transactions, and for software developers and manufacturers of applications and devices used in those transactions.

Banks issuing credit and debit cards, merchants accepting such cards, and others processing transactions involving card payments are subject to contractual obligations to comply with PCI DSS standards addressing data security. The 2015 version of the PCI DSS Standard for assessing security procedures runs 115 pages and "comprises a minimum set of requirements for protecting account data [but] does not supersede local or regional laws, government regulations, or other legal requirements." Among the "high level standards" are the following:

Do not use default passwords. Encrypt cardholder data when transmitted over open, public networks. Track and monitor all access to network resources and cardholder data. Regularly test security systems and processes.

Independent qualified security assessors are used to assess compliance with PCI DSS in most cases. The rules are enforced by a series of contracts.

One group of contracts is between a card brand, such as MasterCard, Visa, or American Express, and the banks that issue the payment cards or process payments. Another group of contracts is between these banks and those accepting the payment cards such as retailers and hotels. Since all of these contracts are private business transactions, relatively little is known about the terms. An exception to this occurs when the parties contest certain provisions in court. For example, in the litigation resulting from the Target data breach of 2013, the parties introduced some of these provisions into evidence.

Conclusion

Oversight of financial services cybersecurity reflects a complex and sometimes overlapping array of state and federal laws, regulators, regulations, and guidance. Cybersecurity is a critical component of protecting the vital services to the economy provided by the financial sector. Maintaining the confidentiality, security, and integrity of the data held by financial institutions is critical to sustaining the level of trust which allows businesses and consumers to rely on the financial services industry to supply services on which they depend. In recognition of the importance of the information systems that support financial services, regulators have increasingly devoted attention to cybersecurity concerns by issuing regulations and various forms of guidance.

As discussed herein, the federal government's oversight of the financial sector includes cybersecurity and involves at least four separate types of oversight and specific encouragement of voluntary cooperation.

Depository institutions are subjected to comprehensive prudential regulation and supervision for safety and soundness. The federal securities regulators, who administer a regime that mandates disclosure of material information by publicly traded companies, oversee the major components of the securities industry by means of a system of self-regulation. This consists of an array of SROs, such as the national securities exchanges and securities associations registered with the SEC. Some federal agencies are charged with specific aspects of consumer protections that apply to products of the financial services industry. Some federal laws, which apply broadly, require financial institutions to safeguard information. Both Congress, with the enactment of the Consolidated Appropriations Act of 2016, and the executive branch, pursuant to a series of executive orders, are encouraging voluntary cooperation among owners and operators of critical infrastructure, including financial services providers, to implement cybersecurity practices and procedures best suited to safeguard the information that they hold which is critical to U.S. national security.

There is every indication that there will be increased attention to cybersecurity at both the federal and state levels.