Regulators: Banks Have 36 Hours to Report Cyber Incidents

U.S. federal banking regulators have approved a new rule that will require banks to notify regulators no later than 36 hours after the organization determines it has suffered a qualifying “computer-security incident,” the nation’s top financial agencies announced on Thursday. Regulators from the Department of the Treasury’s Office of the Comptroller of the Currency, the Federal Reserve, and the Federal Deposit Insurance Corp., say that effective April 1, 2022 – with full compliance extended to May 1, 2022 – banking organizations must provide incident notification to the appropriate FDIC supervisory office or an FDIC-designated point of contact, within a day and a half.