The federal bank supervisory agencies, which have broad general authority to issue regulations, also issue any number of types of guidance documents under a variety of names such as policy statements, supervision and regulatory (SR) letters, financial institution letters (FIL), letters, bulletins, and other forms of communication. Office of the Comptroller of the Currency

Today, the Office of the Comptroller of the Currency (OCC) is the chartering authority and primary federal regulator of national banks and federal savings associations, and it relies on general authority under organic legislation to impose cybersecurity requirements on the institutions it regulates and their service providers. Federal Deposit Insurance Corporation

The Federal Deposit Insurance Corporation (FDIC) is the primary regulator of federally insured, state-chartered banks that are not members of the Federal Reserve System and all federally insured, state-chartered thrifts and savings associations. Consumer Financial Protection Bureau

The Consumer Financial Protection Act of 2010 (CFP Act), which is Title X of Dodd-Frank, created the Consumer Financial Protection Bureau (CFPB) within the Federal Reserve System. This authority is similar to authority that the Federal Trade Commission (FTC) has used to bring enforcement actions based on cybersecurity inadequacies. Nonbank Federal Regulators

In addition to federal bank regulators, other federal regulators oversee securities, markets, government-sponsored enterprises in the secondary mortgage market, agricultural credit, and certain aspects of consumer protection. Federal Regulators of Securities and Commodities

There are two federal regulators of securities and commodities: the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). As a consequence of its responsibilities, the SEC oversees financial disclosures of both financial and nonfinancial publicly traded companies, such as large nationwide retailers. Self-Regulatory Organizations

Certain self-regulatory organizations (SROs)—private organizations empowered by law or regulation to create and enforce industry rules—also are concerned about cybersecurity. These include FINRA, which, to protect investors, oversees stock exchanges and those who trade on them. The National Futures Association (NFA) has a similar role for U.S. futures exchanges and in the retail foreign exchange market

				Financial Industry Regulatory Authority

FINRA is "an independent, not-for-profit organization authorized by Congress to protect America's investors by making sure the securities industry operates fairly and honestly ... by ... writing and enforcing rules governing the activities of more than 3,957 securities firms with approximately 643,322 brokers; examining firms for compliance with those rules; fostering market transparency; and educating investors." FHFA has general safety-and-soundness regulatory authority over the three GSEs. In examining an institution's security, examiners "[d]etermine if the board and management have established and maintained effective security over the institution's facilities, systems, and media that process and store vital information for business operations.... " The examination is based on the FFIEC Examination Handbook and focuses on risk management and assessment, board and management oversight, and internal controls

	Selected Financial Services Data Security Laws and Implementing Regulations

Major laws that include data security provisions affecting the financial services industry include Dodd-Frank, the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act of 1970, the Fair and Accurate Credit Transactions Act of 2003, and the Sarbanes-Oxley Act of 2002. Authority to issue regulations under these provisions has been delegated to the CFPB; enforcement authority is shared among the federal banking regulators, the federal security regulators, the state insurance commissioners, and the CFPB, with respect to the "financial institutions" which they regulate. Bank holding companies, thrift holding companies, and insured depositories are required to file similar reports with their regulators. Executive Orders

Currently, one presidential directive and two executive orders address the critical role of financial services in the national economy. It is beyond the scope of this report to discuss state regulation of financial services. However, the overwhelming majority of the states have enacted laws requiring consumer notification of data breaches compromising PII. New York State

Because Wall Street and many related financial activities are located in New York City, New York State law has notable influence over the national and international financial system. There is every indication that there will be increased attention to cybersecurity at both the federal and state levels.
Multiple federal and state regulators oversee companies in the financial services industry. Regulatory authority is often directed at particular functions or financial services activities rather than at particular entities or companies. It is, therefore, likely that a financial services company with multiple product lines—deposits, securities, insurance—will find that it must answer to different regulators with respect to particular aspects of its operations. Five federal agencies oversee depository institutions, two regulate securities, several agencies have discrete authority over various segments of the financial sector, and several self-regulatory organizations monitor entities in the securities business.
Federal banking regulators (the Office of the Comptroller of the Currency, the Federal Reserve, and the Federal Deposit Insurance Corporation) are required to promulgate safety and soundness standards for all federally insured depository institutions to protect the stability of the nation's banking system. Some of these standards pertain to cybersecurity issues, including information security, data breaches, and destruction or theft of business records.
The federal securities regulators (the Securities and Exchange Commission and the Commodity Futures Trading Commission) have asserted authority over various aspects of cybersecurity in securities markets and those who trade in them. This includes requiring publicly traded financial and nonfinancial corporations to file annual and quarterly reports that provide investors with material information, a category which could include information about cybersecurity risks or breaches.
In addition, overseeing the securities industry are certain self-regulatory organizations—private organizations empowered by law or regulation to create and enforce industry rules, including those covering cybersecurity. These include the Financial Industry Regulatory Authority, which protects investors and oversees stock exchanges and those who trade on them. The National Futures Association has a similar role for U.S. futures exchanges and in the retail foreign exchange market.
The Consumer Financial Protection Bureau issues and enforces federal consumer financial protection regulations, and it has certain consumer financial protection supervisory authority over depositories and consumer finance companies not otherwise federally regulated. The Federal Trade Commission has asserted authority over certain consumer finance operations of nonfinancial companies such as retailers and hotels.
The basic authority that the federal regulators use to establish cybersecurity standards emanates from the organic legislation that established them and delineated the scope of their authority and functions. In addition, certain other laws such as the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, the Gramm-Leach-Bliley Act of 1999, and the Sarbanes-Oxley Act of 2002 include provisions affecting cybersecurity of financial services. Moreover, two executive orders address the critical role of financial services in the national economy. Complementing the laws and regulations, the regulators issue guidance under a variety of names, such as policy statements, supervision and regulatory letters, financial institution letters, bulletins, and other forms of communications.
Not all regulation (or cybersecurity regulation) is done at the federal level. State governments charter and regulate state banks and all insurance companies. State securities regulators oversee securities sold within their state, and many states have laws requiring consumer notification of financial data breaches. In addition, New York State has taken advantage of the fact that the nation's financial center, Wall Street, is located in the state to be very active in certain aspects of cybersecurity regulation. This report focuses on federal laws, regulations, and executive orders.