Cybersecurity is a major concern of financial services providers and their federal regulators. In many ways, it is an important extension of physical security. Providers of financial services are concerned about both physical and electronic theft of money and other assets such as intellectual property. They want to prevent the destruction of property, whether it is a building or a website. They do not want to be closed down by either a physical storm or an electronic denial-of-service attack. They want to minimize human error, whether it is someone failing to secure written documents or an employee falling victim to a phishing attack. When it comes to keeping unauthorized persons away from sensitive electronic equipment, physical security and cybersecurity often overlap. There is a growing recognition by the federal government of the importance of cybersecurity in the financial services industry, as evidenced by the inclusion of financial services in the government's list of 16 critical infrastructure sectors. This report provides information on the landscape of federal laws and regulatory agencies directly regulating or establishing standards for financial services cybersecurity. Because each of the applicable federal laws contains specific implementation provisions, there are varying degrees and methods of regulatory oversight of cybersecurity in the financial sector. Some laws distribute authority to issue regulations and take enforcement actions among a number of agencies; others require one agency to issue implementing regulations and distribute enforcement authority among several agencies; and finally, some laws delegate all authority for issuing regulations and administrative enforcement to a single agency. Some agencies have authority to issue notice and comment rules; others have authority to impose requirements on the institutions that they regulate by guidance that has the same legal force as notice and comment rulemaking. The federal bank supervisory agencies, which have broad general authority to issue regulations, also issue any number of types of guidance documents under a variety of names such as policy statements, supervision and regulatory (SR) letters, financial institution letters (FIL), letters, bulletins, and other forms of communication. Many of the regulators issue informal guidance and bring adjudicatory enforcement actions on a case-by-case basis that often are interpreted as precedential signals to the regulated community as to how the agency interprets aspects of its regulatory authority. This report also provides brief descriptions and examples of the role of state law and of private sector initiatives. Its focus is, however, on the array of federal regulators and the varying ways in which federal laws impose information technology and cybersecurity requirements on financial services providers to protect the security, confidentiality, and integrity of data assembled and maintained in their businesses. Acronyms and abbreviations are listed in a glossary at the end of this report. Financial services are a critical part of any modern economy. These services include accepting deposits; making loans; processing payments; providing insurance and other financial products to spread risks; dealing in securities such as stocks, bonds, and derivatives; and offering, administrating, or advising employee benefit programs. Commercial and investment banks, stock and commodity markets, and insurance companies using various securities and commodity contracts, funds, trusts, and other financial vehicles provide these services. Banking institutions are subject to comprehensive prudential regulation touching many aspects of their daily operations. Regulation of the financial sector is based on both form (the type of charter the entity has) and function (what the entity does). There are special and distinct institution-based regulatory regimes and regulators for depositories, securities firms, and insurance companies, as well as multiple regulations based on the services or products that a financial institution provides. In addition to the traditional type of financial regulation in which various financial organizations, functions, activities, or products are subjected to regulatory controls, the federal government also treats financial services as one of 16 critical infrastructure sectors with which it has arrangements to prevent disruptions to the nation's economy and harm to its wellbeing. Distinctions are often made between commercial banking (accepting deposits and making loans to businesses and individuals) and investment banking (dealing in stocks, bonds, and related securities on the bank's account or for customers). In this report, the term "bank" will be used as a general term for depository institutions. The term will be employed to cover banks, savings associations, thrifts, and credit unions with federally insured deposits. The term will also be used to cover the companies that own or control banks or thrifts (i.e., bank holding companies, financial holding companies, and savings and loan holding companies). The term "commercial bank" will be used to refer to national banks and state-chartered banks but not savings and loans or thrifts or credit unions. When focusing on a nonbank subsidiary of a holding company, however, "bank" will not be used, but the report will indicate the type of organization in question (i.e., stock exchange, insurance company, securities firm, mortgage broker, etc.). Currently there are four federal commercial bank regulators, two federal securities regulators, one credit union federal regulator, but no primary federal regulator of insurance companies. Although primary regulation of insurance companies is the prerogative of the states, publicly traded insurance companies must comply with various securities laws and certain insurance company subsidiaries of financial holding companies may be subjected to requirements imposed by the Board of Governors of the Federal Reserve System (the Fed). Prudential regulation of depositories and holding companies for safety and soundness now includes concern for cybersecurity. Prudential regulation of depository institutions and their holding companies involves virtually every aspect of their capitalization, management, operations, activities, and services, as well as periodic on-site examination and continuing supervision. It is generally based upon organic legislation that establishes each regulator to charter and supervise banks, savings and loans, holding companies, or credit unions. These laws have been amended over time to provide regulators with authority to deal with changing issues and circumstances as they have arisen. Today, the Office of the Comptroller of the Currency (OCC) is the chartering authority and primary federal regulator of national banks and federal savings associations, and it relies on general authority under organic legislation to impose cybersecurity requirements on the institutions it regulates and their service providers. Congress created the OCC to charter and to oversee national banks. (States can also charter banks.) The Home Owners' Loan Act of 1933 established a separate depository charter for savings and loan associations. However, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank) transferred responsibility for chartering and regulating federal savings and loans to the OCC. The Board of Governors of the Federal Reserve System has regulatory authority over an array of financial institutions and systems, and it relies on broad authority in its organic legislation to impose cybersecurity requirements on the institutions it regulates. The Federal Reserve Act of 1913 created the Fed, headed by a Board of Governors, and gave it regulatory authority over state-chartered banks that are members of the Federal Reserve System. In 1956, the Bank Holding Company Act added regulation of bank holding companies to the Fed's responsibilities. Savings and loan holding companies were added in 2010 by the Dodd-Frank Act. The Fed is the primary regulator of state banks that are members of the Federal Reserve System; U.S. branches and agencies of foreign banks; international operations of U.S. banks; companies that own banks (bank and financial holding companies); securities holding companies that elect to be supervised by the Fed; savings and loan holding companies; and any firm designated as a systemically significant financial institution (SIFI) by the Financial Stability Oversight Council (FSOC). In addition, it regulates the payment, clearing, and settlement systems designated as systemically significant by the FSOC, unless regulated by the Securities and Exchange Commission (SEC) or Commodity Futures Trading Commission (CFTC). The Fed regulates wholesale payment systems, which are used by financial institutions to transfer large-value funds and to communicate with each other. The two primary domestic interbank payment and messaging systems are the Fedwire Funds Service (operated by the Fed) and the Clearing House Interbank Payments System (CHIPS, operated by The Clearing House Payments Company, L.L.C., which is based in New York). The Fed has oversight or supervisory responsibility over designated financial market utilities, which include systemically important private sector payment systems, securities settlement systems, central securities depositories, and central counterparties. While the Fed cooperates with the other central banks in the Group of 10 to oversee SWIFT—the Society for Worldwide Interbank Financial Telecommunication, a Brussels-based entity owned by financial organizations worldwide that provides secure international messaging among banks and other financial institutions—for the purposes of critical infrastructure protection, discussed later, SWIFT is considered a communications system, and, therefore, it is overseen for cybersecurity purposes by the Department of Homeland Security. The Federal Deposit Insurance Corporation (FDIC) is the primary regulator of federally insured, state-chartered banks that are not members of the Federal Reserve System and all federally insured, state-chartered thrifts and savings associations. It relies on broad general authority under its organic legislation to impose cybersecurity requirements on the institutions it regulates. The Banking Act of 1933 created the FDIC to insure bank deposits and to act as primary federal regulator of state-chartered banks that are not members of the Federal Reserve System. Except for a few small, state-chartered banks, all banks are required to have their deposits insured by the FDIC. The National Credit Union Administration (NCUA) is the federal regulator of federal credit unions and state-chartered, federally insured credit unions. It relies on broad authority under its organic legislation to impose cybersecurity requirements on the institutions it regulates. Credit unions are chartered as cooperative organizations of individuals with a common bond that accept deposits of members' savings and transaction balances in the form of share accounts, pay dividends, and offer consumer credit. The Federal Credit Union Act of 1934 authorized federally chartered credit unions and created the Bureau of Federal Credit Unions to oversee them.