; and (ii) may not require, to be included in such notification, information that is unavailable to a covered U.S. financial institution, based on good-faith efforts of such institution to provide information. (3) Waiver The President may waive the requirements of paragraph (2) with respect to a covered U.S. financial institution if the President determines that the waiver is in the national interest of the United States and notifies such institution and the appropriate members of Congress of such waiver. (4) Safe harbor with respect to ransomware payment authorizations and good-faith determinations (A) In general With respect to a ransomware payment made under paragraph (2)(B) or a waiver issued under paragraph (3)— (i) a U.S. financial institution shall not be liable under subchapter II of chapter 53 of title 31, United States Code, or chapter 2 of title I of Public Law 91–508 ( 12 U.S.C. 1951 et seq. ) for making a ransomware payment consistent with the parameters and timing of a ransomware payment authorization; and (ii) no Federal or State department or agency may take any adverse supervisory action with respect to the U.S. financial institution solely for making a ransomware payment consistent with the parameters and timing of the authorization. (B) Good-faith efforts to assess ransomware attacks A covered U.S. financial institution may not be held liable for deficiencies in describing a ransomware attack in a notification described under paragraph (2) if such institution engaged in good-faith efforts to determine the nature of the ransomware attack. (C) Rule of construction Nothing in this paragraph may be construed— (i) to prevent a Federal or State department or agency from verifying the validity of a ransomware payment authorization with the law enforcement agency submitting that authorization; (ii) to relieve a U.S. financial institution from complying with any other provision of law, including the reporting of suspicious transactions under section 5318(g) of title 31, United States Code