12 CFR Ch. III (1-1-25 Edition) — Part 364 — Standards for Safety and Soundness
Summary
Part 364 of Title 12 of the Code of Federal Regulations, 1-1-25 edition, sets standards for safety and soundness. Section 364.101 applies the Interagency Guidelines Establishing Standards for Safety and Soundness, prescribed under section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p–1), to insured state nonmember banks, state-licensed insured branches of foreign banks and state savings associations. Appendix A covers internal controls and information systems, internal audit, credit underwriting, interest rate exposure, asset growth, asset quality, earnings, and compensation, fees and benefits, and treats excessive compensation as an unsafe and unsound practice. Appendix B sets the Interagency Guidelines Establishing Information Security Standards. The pages open with the end of a Part 363 sample letter and stop at the start of Part 365, Real Estate Lending Standards.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Pt. 364 12 CFR Ch. III (1–1–25 Edition)
BCD Holding Company (the ‘‘Company’’) is sessment of and the independent public ac-
filing two copies of the Part 363 Annual Re- countant’s attestation report on internal
port for the fiscal year ended December 31, control over financial reporting. The chart
20XX, on behalf of its insured depository in- below also indicates the level (institution or
stitution subsidiaries listed in the chart holding company) at which the requirements
below that are subject to Part 363. The Part of Part 363 are being satisfied for each listed
363 Annual Report contains audited com- insured depository institution subsidiary. [If
parative annual financial statements, the applicable] The Company’s other insured de-
independent public accountant’s report on
pository institution subsidiaries that are
the audited financial statements, manage-
subject to Part 363, which comply with all of
ment’s statement of responsibilities, man-
agement’s assessment of compliance with the Part 363 annual reporting requirements
the Designated Laws and Regulations per- at the institution level, have filed [or will
taining to insider loans and dividend restric- file] their Part 363 Annual Reports sepa-
tions, and [if applicable] management’s as- rately.
Management’s as- Independent audi-
Management’s sessment of com- Management’s
Institutions subject Audited financial tor’s internal con-
statement of pliance with des- internal control
to Part 363 statements trol
responsibilities ignated laws and assessment attestation report
regulations
ABC Depository In- Holding Company Holding Company Holding Company Holding Company Holding Company
stitution. Level. Level. Level. Level. Level.
DEF Depository In- Holding Company Institution Level ..... Institution Level ..... Institution Level ..... Institution Level.
stitution. Level.
If you have any questions regarding the lishes safety and soundness standards
annual report [or reports] of the Company’s by guideline.
insured depository institution subsidiaries
subject to Part 363 or if you need any further § 364.101 Standards for safety and
information, you may contact me at 987–654– soundness.
3210.
(a) General standards. The Inter-
BCD Holding Company agency Guidelines Establishing Stand-
llllllllllllllllllllllll ards for Safety and Soundness pre-
Date: llllllllllllllllllll scribed pursuant to section 39 of the
[Insert officer’s name and title.] Federal Deposit Insurance Act (12
U.S.C. 1831p–1), as set forth as appendix
A to this part, apply to all insured
PART 364—STANDARDS FOR state nonmember banks, to state-li-
SAFETY AND SOUNDNESS censed insured branches of foreign
banks, that are subject to the provi-
Sec.
sions of section 39 of the Federal De-
364.100 Purpose.
364.101 Standards for safety and soundness. posit Insurance Act, and to state sav-
APPENDIX A TO PART 364—INTERAGENCY
ings associations (in aggregate, bank
GUIDELINES ESTABLISHING STANDARDS or banks and savings association or
FOR SAFETY AND SOUNDNESS savings associations).
APPENDIX B TO PART 364—INTERAGENCY (b) Interagency Guidelines Establishing
GUIDELINES ESTABLISHING INFORMATION Information Security Standards. The
SECURITY STANDARDS Interagency Guidelines Establishing
AUTHORITY: 12 U.S.C. 1818 and 1819 (Tenth), Information Security Standards pre-
1831p–1; 15 U.S.C. 1681b, 1681s, 1681w, 6801(b), scribed pursuant to section 39 of the
6805(b)(1). Federal Deposit Insurance Act (12
SOURCE: 80 FR 65907, Oct. 28, 2015, unless U.S.C. 1831p–1), and sections 501 and
otherwise noted. 505(b) of the Gramm-Leach-Bliley Act
(15 U.S.C. 6801, 6805(b)), and with re-
§ 364.100 Purpose. spect to the proper disposal of con-
Section 39 of the Federal Deposit In- sumer information requirements pursu-
surance Act requires the Federal De- ant to section 628 of the Fair Credit Re-
posit Insurance Corporation to estab- porting Act (15 U.S.C. 1681w), as set
lish safety and soundness standards. forth in appendix B to this part, apply
Pursuant to section 39, this part estab- to all insured state nonmember banks,
238
Federal Deposit Insurance Corporation Pt. 364,App. A
insured state licensed branches of for- valuation that the agencies determine to be
eign banks, any subsidiaries of such en- appropriate.
tities (except brokers, dealers, persons iii. Section 39(c) requires the agencies to
establish standards prohibiting as an unsafe
providing insurance, investment com- and unsound practice any compensatory ar-
panies, and investment advisers), and rangement that would provide any executive
to state savings associations. The officer, employee, director, or principal
interagency regulations and guidelines shareholder of the institution with excessive
on identity theft detection, prevention, compensation, fees or benefits and any com-
and mitigation prescribed pursuant to pensatory arrangement that could lead to
section 114 of the Fair and Accurate material financial loss to an institution.
Credit Transactions Act of 2003, 15 Section 39(c) also requires that the agencies
establish standards that specify when com-
U.S.C. 1681m(e), are set forth in pensation is excessive.
§§ 334.90, 334.91, and appendix J of part iv. If an agency determines that an institu-
334. tion fails to meet any standard established
by guidelines under subsection (a) or (b) of
APPENDIX A TO PART 364—INTERAGENCY section 39, the agency may require the insti-
GUIDELINES ESTABLISHING STAND- tution to submit to the agency an acceptable
ARDS FOR SAFETY AND SOUNDNESS plan to achieve compliance with the stand-
ard. In the event that an institution fails to
I. Introduction. submit an acceptable plan within the time
A. Preservation of existing authority. allowed by the agency or fails in any mate-
B. Definitions. rial respect to implement an accepted plan,
II. Operational and Managerial Standards. the agency must, by order, require the insti-
A. Internal controls and information sys- tution to correct the deficiency. The agency
tems. may, and in some cases must, take other su-
B. Internal audit system. pervisory actions until the deficiency has
C. Loan documentation. been corrected.
D. Credit underwriting. v. The agencies have adopted amendments
E. Interest rate exposure. to their rules and regulations to establish
F. Asset growth. deadlines for submission and review of com-
G. Asset quality. pliance plans.2
H. Earnings. vi. The following Guidelines set out the
I. Compensation, fees and benefits. safety and soundness standards that the
III. Prohibition on Compensation That Con- agencies use to identify and address prob-
stitutes an Unsafe and Unsound Practice. lems at insured depository institutions be-
A. Excessive compensation. fore capital becomes impaired. The agencies
B. Compensation leading to material finan- believe that the standards adopted in these
cial loss. Guidelines serve this end without dictating
how institutions must be managed and oper-
I. INTRODUCTION ated. These standards are designed to iden-
i. Section 39 of the Federal Deposit Insur- tify potential safety and soundness concerns
ance Act 1 (FDI Act) requires each Federal and ensure that action is taken to address
banking agency (collectively, the agencies) those concerns before they pose a risk to the
to establish certain safety and soundness Deposit Insurance Fund.
standards by regulation or by guidelines for A. Preservation of Existing Authority
all insured depository institutions. Under
section 39, the agencies must establish three Neither section 39 nor these Guidelines in
types of standards: (1) Operational and man- any way limits the authority of the agencies
agerial standards; (2) compensation stand- to address unsafe or unsound practices, vio-
ards; and (3) such standards relating to asset lations of law, unsafe or unsound conditions,
quality, earnings, and stock valuation as or other practices. Action under section 39
they determine to be appropriate. and these Guidelines may be taken independ-
ii. Section 39(a) requires the agencies to es- ently of, in conjunction with, or in addition
tablish operational and managerial stand- to any other enforcement action available to
ards relating to: (1) Internal controls, infor- the agencies. Nothing in these Guidelines
mation systems and internal audit systems, limits the authority of the FDIC pursuant to
in accordance with section 36 of the FDI Act section 38(i)(2)(F) of the FDI Act (12 U.S.C.
(12 U.S.C. 1831m); (2) loan documentation; (3) 1831o) and part 324 of title 12 of the Code of
credit underwriting; (4) interest rate expo- Federal Regulations.
sure; (5) asset growth; and (6) compensation,
B. Definitions
fees, and benefits, in accordance with sub-
section (c) of section 39. Section 39(b) re- 1. In general. For purposes of these Guide-
quires the agencies to establish standards re- lines, except as modified in the Guidelines or
lating to asset quality, earnings, and stock unless the context otherwise requires, the
239
Pt. 364,App. A 12 CFR Ch. III (1–1–25 Edition)
terms used have the same meanings as set C. Loan documentation. An institution
forth in sections 3 and 39 of the FDI Act (12 should establish and maintain loan docu-
U.S.C. 1813 and 1831p–1). mentation practices that:
2. Board of directors, in the case of a state- 1. Enable the institution to make an in-
licensed insured branch of a foreign bank and formed lending decision and to assess risk, as
in the case of a federal branch of a foreign necessary, on an ongoing basis;
bank, means the managing official in charge 2. Identify the purpose of a loan and the
of the insured foreign branch. source of repayment, and assess the ability
3. Compensation means all direct and indi- of the borrower to repay the indebtedness in
rect payments or benefits, both cash and a timely manner;
non-cash, granted to or for the benefit of any 3. Ensure that any claim against a bor-
executive officer, employee, director, or rower is legally enforceable;
principal shareholder, including but not lim- 4. Demonstrate appropriate administration
ited to payments or benefits derived from an and monitoring of a loan; and
employment contract, compensation or ben- 5. Take account of the size and complexity
efit agreement, fee arrangement, perquisite, of a loan.
stock option plan, postemployment benefit, D. Credit underwriting. An institution
or other compensatory arrangement. should establish and maintain prudent credit
4. Director shall have the meaning de- underwriting practices that:
scribed in 12 CFR 215.2(d).3 1. Are commensurate with the types of
5. Executive officer shall have the meaning loans the institution will make and consider
described in 12 CFR 215.2(e).4 the terms and conditions under which they
6. Principal shareholder shall have the will be made;
meaning described in 12 CFR 215.2(m).5 2. Consider the nature of the markets in
which loans will be made;
II. OPERATIONAL AND MANAGERIAL 3. Provide for consideration, prior to credit
STANDARDS commitment, of the borrower’s overall finan-
A. Internal controls and information systems. cial condition and resources, the financial
An institution should have internal controls responsibility of any guarantor, the nature
and information systems that are appro- and value of any underlying collateral, and
priate to the size of the institution and the the borrower’s character and willingness to
nature, scope and risk of its activities and repay as agreed;
that provide for: 4. Establish a system of independent, ongo-
1. An organizational structure that estab- ing credit review and appropriate commu-
lishes clear lines of authority and responsi- nication to management and to the board of
bility for monitoring adherence to estab- directors;
lished policies; 5. Take adequate account of concentration
2. Effective risk assessment; of credit risk; and
3. Timely and accurate financial, oper- 6. Are appropriate to the size of the insti-
ational and regulatory reports; tution and the nature and scope of its activi-
4. Adequate procedures to safeguard and ties.
manage assets; and E. Interest rate exposure. An institution
5. Compliance with applicable laws and should:
regulations. 1. Manage interest rate risk in a manner
B. Internal audit system. An institution that is appropriate to the size of the institu-
should have an internal audit system that is tion and the complexity of its assets and li-
appropriate to the size of the institution and abilities; and
the nature and scope of its activities and 2. Provide for periodic reporting to man-
that provides for: agement and the board of directors regarding
1. Adequate monitoring of the system of interest rate risk with adequate information
internal controls through an internal audit for management and the board of directors
function. For an institution whose size, com- to assess the level of risk.
plexity or scope of operations does not war- F. Asset growth. An institution’s asset
rant a full scale internal audit function, a growth should be prudent and consider:
system of independent reviews of key inter- 1. The source, volatility and use of the
nal controls may be used; funds that support asset growth;
2. Independence and objectivity; 2. Any increase in credit risk or interest
3. Qualified persons; rate risk as a result of growth; and
4. Adequate testing and review of informa- 3. The effect of growth on the institution’s
tion systems; capital.
5. Adequate documentation of tests and G. Asset quality. An insured depository in-
findings and any corrective actions; stitution should establish and maintain a
6. Verification and review of management system that is commensurate with the insti-
actions to address material weaknesses; and tution’s size and the nature and scope of its
7. Review by the institution’s audit com- operations to identify problem assets and
mittee or board of directors of the effective- prevent deterioration in those assets. The in-
ness of the internal audit systems. stitution should:
240
Federal Deposit Insurance Corporation Pt. 364, App. B
1. Conduct periodic asset quality reviews 4. Comparable compensation practices at
to identify problem assets; comparable institutions, based upon such
2. Estimate the inherent losses in those as- factors as asset size, geographic location,
sets and establish reserves that are sufficient and the complexity of the loan portfolio or
to absorb estimated losses; other assets;
3. Compare problem asset totals to capital; 5. For postemployment benefits, the pro-
4. Take appropriate corrective action to re- jected total cost and benefit to the institu-
solve problem assets; tion;
5. Consider the size and potential risks of 6. Any connection between the individual
material asset concentrations; and and any fraudulent act or omission, breach
6. Provide periodic asset reports with ade- of trust or fiduciary duty, or insider abuse
quate information for management and the with regard to the institution; and
board of directors to assess the level of asset 7. Any other factors the agencies deter-
risk. mine to be relevant.
H. Earnings. An insured depository institu- B. Compensation Leading to Material Finan-
tion should establish and maintain a system cial Loss
that is commensurate with the institution’s Compensation that could lead to material
size and the nature and scope of its oper- financial loss to an institution is prohibited
ations to evaluate and monitor earnings and as an unsafe and unsound practice.
ensure that earnings are sufficient to main- 1 Section 39 of the Federal Deposit Insur-
tain adequate capital and reserves. The insti-
tution should: ance Act (12 U.S.C. 1831p–1) was added by sec-
1. Compare recent earnings trends relative tion 132 of the Federal Deposit Insurance
to equity, assets, or other commonly used Corporation Improvement Act of 1991
benchmarks to the institution’s historical (FDICIA), Pub. L. 102–242, 105 Stat. 2236
results and those of its peers; (1991), and amended by section 956 of the
2. Evaluate the adequacy of earnings given Housing and Community Development Act of
the size, complexity, and risk profile of the 1992, Pub. L. 102–550, 106 Stat. 3895 (1992) and
institution’s assets and operations; section 318 of the Riegle Community Devel-
3. Assess the source, volatility, and sus- opment and Regulatory Improvement Act of
tainability of earnings, including the effect 1994, Pub. L. 103–325, 108 Stat. 2160 (1994).
2 For the Office of the Comptroller of the
of nonrecurring or extraordinary income or
expense; Currency, these regulations appear at 12 CFR
4. Take steps to ensure that earnings are Part 30; for the Board of Governors of the
sufficient to maintain adequate capital and Federal Reserve System, these regulations
reserves after considering the institution’s appear at 12 CFR Part 263; and for the Fed-
asset quality and growth rate; and eral Deposit Insurance Corporation, these
5. Provide periodic earnings reports with regulations appear at 12 CFR Part 308, sub-
adequate information for management and part R.
3 In applying these definitions for savings
the board of directors to assess earnings per-
formance. associations, pursuant to 12 U.S.C. 1464, sav-
I. Compensation, fees and benefits. An insti- ings associations shall use the terms ‘‘sav-
tution should maintain safeguards to pre- ings association’’ and ‘‘insured savings asso-
vent the payment of compensation, fees, and ciation’’ in place of the terms ‘‘member
benefits that are excessive or that could lead bank’’ and ‘‘insured bank’’.
4 See footnote 3 in section I.B.4. of this ap-
to material financial loss to the institution.
pendix.
5 See footnote 3 in section I.B.4. of this ap-
III. PROHIBITION ON COMPENSATION THAT CON-
STITUTES AN UNSAFE AND UNSOUND PRAC- pendix.
TICE
[80 FR 65907, Oct. 28, 2015, as amended at 83
A. Excessive Compensation FR 17742, Apr. 24, 2018]
Excessive compensation is prohibited as an APPENDIX B TO PART 364—INTERAGENCY
unsafe and unsound practice. Compensation GUIDELINES ESTABLISHING INFORMA-
shall be considered excessive when amounts
TION SECURITY STANDARDS
paid are unreasonable or disproportionate to
the services performed by an executive offi- TABLE OF CONTENTS
cer, employee, director, or principal share-
holder, considering the following: I. Introduction
1. The combined value of all cash and A. Scope
noncash benefits provided to the individual; B. Preservation of Existing Authority
2. The compensation history of the indi- C. Definitions
vidual and other individuals with com- II. Standards for Safeguarding Customer In-
parable expertise at the institution; formation
3. The financial condition of the institu- A. Information Security Program
tion; B. Objectives
241
Pt. 364, App. B 12 CFR Ch. III (1–1–25 Edition)
III. Development and Implementation of port or is derived from a consumer report
Customer Information Security Program and that is maintained or otherwise pos-
A. Involve the Board of Directors sessed by or on behalf of the institution for
B. Assess Risk a business purpose. Consumer information
C. Manage and Control Risk also means a compilation of such records.
D. Oversee Service Provider Arrangements The term does not include any record that
E. Adjust the Program does not personally identify an individual.
F. Report to the Board i. Examples: (1) Consumer information in-
G. Implement the Standards cludes:
(A) A consumer report that an institution
I. INTRODUCTION obtains;
The Interagency Guidelines Establishing (B) information from a consumer report
Information Security Standards (Guidelines) that the institution obtains from its affiliate
set forth standards pursuant to section 39 of after the consumer has been given a notice
the Federal Deposit Insurance Act, 12 U.S.C. and has elected not to opt out of that shar-
1831p–1, and sections 501 and 505(b), 15 U.S.C. ing;
6801 and 6805(b), of the Gramm-Leach-Bliley (C) information from a consumer report
Act. These Guidelines address standards for that the institution obtains about an indi-
developing and implementing administra- vidual who applies for but does not receive a
tive, technical, and physical safeguards to loan, including any loan sought by an indi-
protect the security, confidentiality, and in- vidual for a business purpose;
tegrity of customer information. These (D) information from a consumer report
Guidelines also address standards with re- that the institution obtains about an indi-
spect to the proper disposal of consumer in- vidual who guarantees a loan (including a
formation pursuant to sections 621 and 628 of loan to a business entity); or
the Fair Credit Reporting Act (15 U.S.C. 1681s (E) information from a consumer report
and 1681w). that the institution obtains about an em-
A. Scope. The Guidelines apply to customer ployee or prospective employee.
information maintained by or on behalf of, (2) Consumer information does not include:
and to the disposal of consumer information (A) aggregate information, such as the
by or on the behalf of, entities over which mean score, derived from a group of con-
the Federal Deposit Insurance Corporation sumer reports; or
(FDIC) has authority. Such entities, referred (B) blind data, such as payment history on
to as ‘‘insured depository institution’’ or accounts that are not personally identifi-
‘‘institution’’ are banks insured by the FDIC able, that may be used for developing credit
(other than members of the Federal Reserve scoring models or for other purposes.
System), state savings associations insured c. Consumer report has the same meaning as
by the FDIC, insured state branches of for- set forth in the Fair Credit Reporting Act, 15
eign banks, and any subsidiaries of such en- U.S.C. 1681a(d).
tities (except brokers, dealers, persons pro- d. Customer means any customer of the in-
viding insurance, investment companies, and stitution as defined in § 332.3(h) of this chap-
investment advisers). ter.
B. Preservation of Existing Authority. Nei- e. Customer information means any record
ther section 39 nor these Guidelines in any containing nonpublic personal information,
way limit the authority of the FDIC to ad- as defined in § 332.3(n) of this chapter, about
dress unsafe or unsound practices, violations a customer, whether in paper, electronic, or
of law, unsafe or unsound conditions, or other form, that is maintained by or on be-
other practices. The FDIC may take action half of the institution.
under section 39 and these Guidelines inde- f. Customer information systems means any
pendently of, in conjunction with, or in addi- methods used to access, collect, store, use,
tion to, any other enforcement action avail- transmit, protect, or dispose of customer in-
able to the FDIC. formation.
C. Definitions. 1. Except as modified in the g. Service provider means any person or en-
Guidelines, or unless the context otherwise tity that maintains, processes, or otherwise
requires, the terms used in these Guidelines is permitted access to customer information
have the same meanings as set forth in sec- or consumer information through its provi-
tions 3 and 39 of the Federal Deposit Insur- sion of services directly to the institution.
ance Act (12 U.S.C. 1813 and 1831p–1).
II. STANDARDS FOR INFORMATION SECURITY
2. For purposes of the Guidelines, the fol-
lowing definitions apply: A. Information Security Program. Each in-
a. Board of directors, in the case of a branch sured depository institution shall implement
or agency of a foreign bank, means the man- a comprehensive written information secu-
aging official in charge of the branch or rity program that includes administrative,
agency. technical, and physical safeguards appro-
b. Consumer Information means any record priate to the size and complexity of the in-
about an individual, whether in paper, elec- stitution and the nature and scope of its ac-
tronic, or other form, that is a consumer re- tivities. While all parts of the institution are
242
Federal Deposit Insurance Corporation Pt. 364, App. B
not required to implement a uniform set of storage facilities to permit access only to
policies, all elements of the information se- authorized individuals;
curity program must be coordinated. c. Encryption of electronic customer infor-
B. Objectives. An institution’s information mation, including while in transit or in stor-
security program shall be designed to: age on networks or systems to which unau-
1. Ensure the security and confidentiality thorized individuals may have access;
of customer information; d. Procedures designed to ensure that cus-
2. Protect against any anticipated threats
tomer information system modifications are
or hazards to the security or integrity of
consistent with the institution’s information
such information;
security program;
3. Protect against unauthorized access to
or use of such information that could result e. Dual control procedures, segregation of
in substantial harm or inconvenience to any duties, and employee background checks for
customer; and employees with responsibilities for or access
4. Ensure the proper disposal of customer to customer information;
information and consumer information. f. Monitoring systems and procedures to
detect actual and attempted attacks on or
III. DEVELOPMENT AND IMPLEMENTATION OF intrusions into customer information sys-
INFORMATION SECURITY PROGRAM tems;
A. Involve the Board of Directors. The board g. Response programs that specify actions
of directors or an appropriate committee of to be taken when the institution suspects or
the board of each insured depository institu- detects that unauthorized individuals have
tion shall: gained access to customer information sys-
1. Approve the institution’s written infor- tems, including appropriate reports to regu-
mation security program; and latory and law enforcement agencies; and
2. Oversee the development, implementa- h. Measures to protect against destruction,
tion, and maintenance of the institution’s loss, or damage of customer information due
information security program, including as- to potential environmental hazards, such as
signing specific responsibility for its imple- fire and water damage or technological fail-
mentation and reviewing reports from man- ures.
agement.
2. Train staff to implement the institu-
B. Assess Risk.
tion’s information security program.
Each institution shall:
1. Identify reasonably foreseeable internal 3. Regularly test the key controls, systems
and external threats that could result in un- and procedures of the information security
authorized disclosure, misuse, alteration, or program. The frequency and nature of such
destruction of customer information or cus- tests should be determined by the institu-
tomer information systems. tion’s risk assessment. Tests should be con-
2. Assess the likelihood and potential dam- ducted or reviewed by independent third par-
age of these threats, taking into consider- ties or staff independent of those that de-
ation the sensitivity of customer informa- velop or maintain the security programs.
tion. 4. Develop, implement, and maintain, as
3. Assess the sufficiency of policies, proce- part of its information security program, ap-
dures, customer information systems, and propriate measures to properly dispose of
other arrangements in place to control risks. customer information and consumer infor-
C. Manage and Control Risk. Each institu- mation in accordance with each of the re-
tion shall: quirements of this paragraph III.
1. Design its information security program D. Oversee Service Provider Arrangements.
to control the identified risks, commensu- Each institution shall:
rate with the sensitivity of the information
1. Exercise appropriate due diligence in se-
as well as the complexity and scope of the in-
lecting its service providers;
stitution’s activities. Each institution must
consider whether the following security 2. Require its service providers by contract
measures are appropriate for the institution to implement appropriate measures designed
and, if so, adopt those measures the institu- to meet the objectives of these Guidelines;
tion concludes are appropriate: and
a. Access controls on customer informa- 3. Where indicated by the institution’s risk
tion systems, including controls to authen- assessment, monitor its service providers to
ticate and permit access only to authorized confirm that they have satisfied their obli-
individuals and controls to prevent employ- gations as required by paragraph D.2. As part
ees from providing customer information to of this monitoring, an institution should re-
unauthorized individuals who may seek to view audits, summaries of test results, or
obtain this information through fraudulent other equivalent evaluations of its service
means. providers.
b. Access restrictions at physical locations E. Adjust the Program. Each institution
containing customer information, such as shall monitor, evaluate, and adjust, as ap-
buildings, computer facilities, and records propriate, the information security program
243
Pt. 364, App. B 12 CFR Ch. III (1–1–25 Edition)
in light of any relevant changes in tech- formation Security Standards (the Security
nology, the sensitivity of its customer infor- Guidelines) 2 and describes response pro-
mation, internal or external threats to infor- grams, including customer notification pro-
mation, and the institution’s own changing cedures, that a financial institution should
business arrangements, such as mergers and develop and implement to address unauthor-
acquisitions, alliances and joint ventures, ized access to or use of customer information
outsourcing arrangements, and changes to that could result in substantial harm or in-
customer information systems. convenience to a customer. The scope of, and
F. Report to the Board. Each institution definitions of terms used in, this Guidance
shall report to its board or an appropriate are identical to those of the Security Guide-
committee of the board at least annually. lines. For example, the term ‘‘customer in-
This report should describe the overall sta- formation’’ is the same term used in the Se-
tus of the information security program and curity Guidelines, and means any record con-
the institution’s compliance with these taining nonpublic personal information
Guidelines. The report, which will vary de- about a customer, whether in paper, elec-
pending upon the complexity of each institu- tronic, or other form, maintained by or on
tion’s program should discuss material mat- behalf of the institution.
ters related to its program, addressing issues
such as: Risk assessment; risk management A. Interagency Security Guidelines
and control decisions; service provider ar-
rangements; results of testing; security Section 501(b) of the GLBA required the
breaches or violations, and management’s re- Agencies to establish appropriate standards
sponses; and recommendations for changes in for financial institutions subject to their ju-
the information security program. risdiction that include administrative, tech-
G. Implement the Standards. 1. Effective date. nical, and physical safeguards, to protect the
Each institution must implement an infor- security and confidentiality of customer in-
mation security program pursuant to these formation. Accordingly, the Agencies issued
Guidelines by July 1, 2001. Security Guidelines requiring every finan-
2. Two-year grandfathering of agreements cial institution to have an information secu-
with service providers. Until July 1, 2003, a rity program designed to:
contract that an institution has entered into 1. Ensure the security and confidentiality
with a service provider to perform services of customer information;
for it or functions on its behalf, satisfies the 2. Protect against any anticipated threats
provisions of paragraph III.D., even if the or hazards to the security or integrity of
contract does not include a requirement that such information; and
the servicer maintain the security and con- 3. Protect against unauthorized access to
fidentiality of customer information as long or use of such information that could result
as the institution entered into the contract in substantial harm or inconvenience to any
on or before March 5, 2001. customer.
3. Effective date for measures relating to the
disposal of consumer information. Each institu- B. Risk Assessment and Controls
tion must satisfy these Guidelines with re-
spect to the proper disposal of consumer in- 1. The Security Guidelines direct every fi-
formation by July 1, 2005. nancial institution to assess the following
4. Exception for existing agreements with serv- risks, among others, when developing its in-
ice providers relating to the disposal of con- formation security program:
sumer information. Notwithstanding the re- a. Reasonably foreseeable internal and ex-
quirement in paragraph III.G.3., an institu- ternal threats that could result in unauthor-
tion’s contracts with its service providers ized disclosure, misuse, alteration, or de-
that have access to consumer information struction of customer information or cus-
and that may dispose of consumer informa- tomer information systems;
tion, entered into before July 1, 2005, must b. The likelihood and potential damage of
comply with the provisions of the Guidelines threats, taking into consideration the sensi-
relating to the proper disposal of consumer tivity of customer information; and
information by July 1, 2006. c. The sufficiency of policies, procedures,
customer information systems, and other ar-
rangements in place to control risks.3
SUPPLEMENT A TO APPENDIX B TO PART 364 2. Following the assessment of these risks,
INTERAGENCY GUIDANCE ON RESPONSE PRO- the Security Guidelines require a financial
GRAMS FOR UNAUTHORIZED ACCESS TO CUS- institution to design a program to address
TOMER INFORMATION AND CUSTOMER NO- the identified risks. The particular security
TICE measures an institution should adopt will de-
pend upon the risks presented by the com-
I. BACKGROUND
plexity and scope of its business. At a min-
This Guidance 1 interprets section 501(b) of imum, the financial institution is required
the Gramm-Leach-Bliley Act (GLBA) and to consider the specific security measures
the Interagency Guidelines Establishing In- enumerated in the Security Guidelines,4 and
244
Federal Deposit Insurance Corporation Pt. 364, App. B
adopt those that are appropriate for the in- service provider to take appropriate actions
stitution, including: to address incidents of unauthorized access
a. Access controls on customer informa- to the financial institution’s customer infor-
tion systems, including controls to authen- mation, including notification to the institu-
ticate and permit access only to authorized tion as soon as possible of any such incident,
individuals and controls to prevent employ- to enable the institution to expeditiously
ees from providing customer information to implement its response program.
unauthorized individuals who may seek to
obtain this information through fraudulent A. Components of a Response Program
means;
1. At a minimum, an institution’s response
b. Background checks for employees with
program should contain procedures for the
responsibilities for access to customer infor-
following:
mation; and
c. Response programs that specify actions a. Assessing the nature and scope of an in-
to be taken when the financial institution cident, and identifying what customer infor-
suspects or detects that unauthorized indi- mation systems and types of customer infor-
viduals have gained access to customer in- mation have been accessed or misused;
formation systems, including appropriate re- b. Notifying its primary Federal regulator
ports to regulatory and law enforcement as soon as possible when the institution be-
agencies.5 comes aware of an incident involving unau-
thorized access to or use of sensitive cus-
C. Service Providers tomer information, as defined below;
c. Consistent with the Agencies’ Suspicious
The Security Guidelines direct every fi-
Activity Report (‘‘SAR’’) regulations,12 noti-
nancial institution to require its service pro-
fying appropriate law enforcement authori-
viders by contract to implement appropriate
ties, in addition to filing a timely SAR in
measures designed to protect against unau-
situations involving Federal criminal viola-
thorized access to or use of customer infor-
tions requiring immediate attention, such as
mation that could result in substantial harm
when a reportable violation is ongoing;
or inconvenience to any customers.6
d. Taking appropriate steps to contain and
II. RESPONSE PROGRAM control the incident to prevent further unau-
thorized access to or use of customer infor-
Millions of Americans, throughout the mation, for example, by monitoring, freez-
country, have been victims of identity theft.7 ing, or closing affected accounts, while pre-
Identity thieves misuse personal information serving records and other evidence; 13 and
they obtain from a number of sources, in-
e. Notifying customers when warranted.
cluding financial institutions, to perpetrate
2. Where an incident of unauthorized ac-
identity theft. Therefore, financial institu-
cess to customer information involves cus-
tions should take preventative measures to
tomer information systems maintained by
safeguard customer information against at-
an institution’s service providers, it is the
tempts to gain unauthorized access to the in-
responsibility of the financial institution to
formation. For example, financial institu-
notify the institution’s customers and regu-
tions should place access controls on cus-
lator. However, an institution may authorize
tomer information systems and conduct
or contract with its service provider to no-
background checks for employees who are
tify the institutions’ customers or regulator
authorized to access customer information.8
However, every financial institution should on its behalf.
also develop and implement a risk-based re- III. CUSTOMER NOTICE
sponse program to address incidents of unau-
thorized access to customer information in Financial institutions have an affirmative
customer information systems 9 that occur duty to protect their customers’ information
nonetheless. A response program should be a against unauthorized access or use. Noti-
key part of an institution’s information se- fying customers of a security incident in-
curity program.10 The program should be ap- volving the unauthorized access or use of the
propriate to the size and complexity of the customer’s information in accordance with
institution and the nature and scope of its the standard set forth below is a key part of
activities. that duty. Timely notification of customers
In addition, each institution should be able is important to manage an institution’s rep-
to address incidents of unauthorized access utation risk. Effective notice also may re-
to customer information in customer infor- duce an institution’s legal risk, assist in
mation systems maintained by its domestic maintaining good customer relations, and
and foreign service providers. Therefore, con- enable the institution’s customers to take
sistent with the obligations in the Guide- steps to protect themselves against the con-
lines that relate to these arrangements, and sequences of identity theft. When customer
with existing guidance on this topic issued notification is warranted, an institution may
by the Agencies,11 an institution’s contract not forgo notifying its customers of an inci-
with its service provider should require the dent because the institution believes that it
245
Pt. 364, App. B 12 CFR Ch. III (1–1–25 Edition)
may be potentially embarrassed or inconven- mation is reasonably possible, it should no-
ienced by doing so. tify all customers in the group.
A. Standard for Providing Notice B. Content of Customer Notice
When a financial institution becomes 1. Customer notice should be given in a
aware of an incident of unauthorized access clear and conspicuous manner. The notice
to sensitive customer information, the insti- should describe the incident in general terms
tution should conduct a reasonable inves- and the type of customer information that
tigation to promptly determine the likeli- was the subject of unauthorized access or
hood that the information has been or will use. It also should generally describe what
be misused. If the institution determines the institution has done to protect the cus-
that misuse of its information about a cus- tomers’ information from further unauthor-
tomer has occurred or is reasonably possible, ized access. In addition, it should include a
it should notify the affected customer as telephone number that customers can call
soon as possible. Customer notice may be de- for further information and assistance.14 The
layed if an appropriate law enforcement notice also should remind customers of the
agency determines that notification will need to remain vigilant over the next twelve
interfere with a criminal investigation and to twenty-four months, and to promptly re-
provides the institution with a written re- port incidents of suspected identify theft to
quest for the delay. However, the institution the institution. The notice should include
should notify its customers as soon as notifi- the following additional items, when appro-
cation will no longer interfere with the in- priate:
vestigation. a. A recommendation that the customer
review account statements and immediately
1. Sensitive Customer Information report any suspicious activity to the institu-
Under the Guidelines, an institution must tion;
protect against unauthorized access to or use b. A description of fraud alerts and an ex-
of customer information that could result in planation of how the customer may place a
substantial harm or inconvenience to any fraud alert in the customer’s consumer re-
customer. Substantial harm or inconven- ports to put the customer’s creditors on no-
ience is most likely to result from improper tice that the customer may be a victim of
access to sensitive customer information be- fraud;
cause this type of information is most likely c. A recommendation that the customer
to be misused, as in the commission of iden- periodically obtain credit reports from each
tity theft. For purposes of this Guidance, nationwide credit reporting agency and have
sensitive customer information means a cus- information relating to fraudulent trans-
tomer’s name, address, or telephone number, actions deleted;
in conjunction with the customer’s social se- d. An explanation of how the customer
curity number, driver’s license number, ac- may obtain a credit report free of charge;
count number, credit or debit card number, and
or a personal identification number or pass- e. Information about the availability of the
word that would permit access to the cus- FTC’s online guidance regarding steps a con-
tomer’s account. Sensitive customer informa- sumer can take to protect against identity
tion also includes any combination of compo- theft. The notice should encourage the cus-
nents of customer information that would tomer to report any incidents of identity
allow someone to log onto or access the cus- theft to the FTC, and should provide the
tomer’s account, such as user name or pass- FTC’s Web site address and toll-free tele-
word or password and account number. phone number that customers may use to ob-
tain the identity theft guidance and report
2. Affected Customers suspected incidents of identity theft.15
If a financial institution, based upon its in- 2. The Agencies encourage financial insti-
vestigation, can determine from its logs or tutions to notify the nationwide consumer
other data precisely which customers’ infor- reporting agencies prior to sending notices
mation has been improperly accessed, it may to a large number of customers that include
limit notification to those customers with contact information for the reporting agen-
regard to whom the institution determines cies.
that misuse of their information has oc- C. Delivery of Customer Notice
curred or is reasonably possible. However,
there may be situations where the institu- Customer notice should be delivered in any
tion determines that a group of files has manner designed to ensure that a customer
been accessed improperly, but is unable to can reasonably be expected to receive it. For
identify which specific customers’ informa- example, the institution may choose to con-
tion has been accessed. If the circumstances tact all customers affected by telephone or
of the unauthorized access lead the institu- by mail, or by electronic mail for those cus-
tion to determine that misuse of the infor- tomers for whom it has a valid email address
246
Federal Deposit Insurance Corporation Pt. 365
and who have agreed to receive communica- Oct. 30, 2013; and FDIC FIL 44–08, Guidance
tions electronically. for Managing Third Party Risk, June 6, 2008
1 This Guidance was jointly issued by the and FIL 68–99, Risk Assessment Tools and
Practices for Information System Security,
Board of Governors of the Federal Reserve
System (Board), the Federal Deposit Insur- July 7, 1999.
12 An institution’s obligations to file a SAR
ance Corporation (FDIC), the Office of the
Comptroller of the Currency (OCC), and the is set out in the Agencies’ SAR regulations
Office of Thrift Supervision (OTS). Pursuant and Agency guidance. See, for example, 12
to 12 U.S.C. 5412, the OTS is no longer a CFR 21.11 (national banks, Federal branches
party to this Guidance. and agencies); 12 CFR 163.180 (Federal sav-
2 12 CFR part 30, app. B (OCC); 12 CFR part ings associations); 12 CFR 208.62 (State mem-
208, app. D–2 and part 225, app. F (Board); and ber banks); 12 CFR 211.5(k) (Edge and agree-
12 CFR part 364, app. B (FDIC). The ‘‘Inter- ment corporations); 12 CFR 211.24(f) (unin-
agency Guidelines Establishing Information sured State branches and agencies of foreign
Security Standards’’ were formerly known as banks); 12 CFR 225.4(f) (bank holding compa-
‘‘The Interagency Guidelines Establishing nies and their nonbank subsidiaries); and 12
Standards for Safeguarding Customer Infor- CFR part 353 (FDIC-supervised institutions).
mation.’’ National banks must file SARs in connection
3 See Security Guidelines, III.B. with computer intrusions and other com-
4 See Security Guidelines, III.C. puter crimes. See OCC Bulletin 2000–14, ‘‘In-
5 See Security Guidelines, III.C. frastructure Threats—Intrusion Risks’’ (May
6 See Security Guidelines, II.B, and III.D. 15, 2000); Advisory Letter 97–9, ‘‘Reporting
Further, the Agencies note that, in addition Computer Related Crimes’’ (November 19,
to contractual obligations to a financial in- 1997) (general guidance still applicable
stitution, a service provider may be required though instructions for new SAR form pub-
to implement its own comprehensive infor- lished in 65 FR 1229, 1230 (January 7, 2000)).
mation security program in accordance with See also Federal Reserve SR 01–11, Identity
the Safeguards Rule promulgated by the Theft and Pretext Calling, Apr. 26, 2001.
Federal Trade Commission (FTC), 12 CFR 13 See FFIEC Information Technology Ex-
part 314. amination Handbook, Information Security
7 The FTC estimates that nearly 10 million
Booklet, Dec. 2002, pp. 68–74.
Americans discovered they were victims of 14 The institution should, therefore, ensure
some form of identity theft in 2002. See The that it has reasonable policies and proce-
Federal Trade Commission. Identity Theft dures in place, including trained personnel,
Survey Report (September 2003), available at to respond appropriately to customer inquir-
http://www.ftc.gov/os/2003/09/synovatereport.pdf. ies and requests for assistance.
8 Institutions should also conduct back-
15 Currently, the FTC Web site for the ID
ground checks of employees to ensure that Theft brochure and the FTC Hotline phone
the institution does not violate 12 U.S.C. number are http://www.consumer.gov/idtheft
1829, which prohibits an institution from hir- and 1–877–IDTHEFT. The institution may
ing an individual convicted of certain crimi- also refer customers to any materials devel-
nal offenses or who is subject to a prohibi- oped pursuant to section 151(b) of the FACT
tion order under 12 U.S.C. 1818(e)(6). Act (educational materials developed by the
9 Under the Guidelines, an institution’s cus-
FTC to teach the public how to prevent iden-
tomer information systems consist of all of the tity theft).
methods used to access, collect, store, use,
transmit, protect, or dispose of customer in-
formation, including the systems maintained PART 365—REAL ESTATE LENDING
by its service providers. See Security Guide- STANDARDS
lines, I.C.2.d.
10 See FFIEC Information Technology Ex-
amination Handbook, Information Security
Subpart A—Real Estate Lending Standards
Booklet, Dec. 2002 available at http:// Sec.
ithandbook.ffiec.gov/it-booklets/information-se-
365.1 Purpose and scope.
curity.aspx. Federal Reserve SR 97–32, Sound
Practice Guidance for Information Security 365.2 Real estate lending standards.
for Networks, Dec. 4, 1997; OCC Bulletin 2000– APPENDIX A TO SUBPART A OF PART 365—
14, ‘‘Infrastructure Threats—Intrusion INTERAGENCY GUIDELINES FOR REAL ES-
Risks’’ (May 15, 2000), for additional guidance TATE LENDING POLICIES
on preventing, detecting, and responding to
intrusions into financial institutions com- Subpart B [Reserved]
puter systems.
11 See Federal Reserve SR Ltr. 13-19, Guid-
AUTHORITY: 12 U.S.C. 1828(o) and 5101 et seq.
ance on Managing Outsourcing Risk, Dec. 5,
2013; OCC Bulletin 2013–29, ‘‘Third-Party Re- SOURCE: 57 FR 62896, 62900, Dec. 31, 1992, un-
lationships—Risk Management Guidance,’’ less otherwise noted.
247
File and source
- File
- CFR-2025-title12-vol6-part364.pdf
- Size
- 192,059 bytes
- SHA-256
- ee97c72ea4b7e157880149590a47617997d11e73e914c78889a8d280f1628cb2
- Original
- www.govinfo.gov