Cyber Incident Reporting Requirements Final Rule Approved by NCUA Board

With a unanimous vote Thursday, NCUA board members approved the cyber incident reporting requirement final rule in which federally insured credit unions must report to the agency when a “reportable cyber incident has occurred.” The incident must be reported to the NCUA within 72 hours.

According to the final rule, “federally insured credit unions are required to report a cyber incident that leads to a substantial loss of confidentiality, integrity or availability of a network or member information system as a result of the exposure of sensitive data, disruption of vital member services, or that has a serious impact on the safety and resiliency of operational systems and processes.”

Cyberattacks that cause a disruption of credit union services and/or business operations must be reported back to the NCUA within 72 hours once there is a reasonable belief that the credit union has experienced a cyberattack.

NCUA Board Chairman Todd Harper said, “Each of us in the financial system has an obligation to protect our nation’s economic and financial infrastructure. And, credit unions must be included in conversations about critical infrastructure, as a whole. This final rule will facilitate such dialogue. Through these high-level early warning notifications, the NCUA will be able to work with other agencies and the private sector to respond to cyber threats before they become systemic and threaten the broader financial services sector. This final rule will also align the NCUA’s reporting requirements with those of the federal banking agencies and the Cyber Incident Reporting for Critical Infrastructure Act.”

According to the NCUA, the 72-hour notification requirement window will help give the agency an early alert to the issue. NCUA officials clarified that during the early warning requirement window of 72 hours, credit unions do not need to give a full incident assessment to the agency at that time.

While the NCUA will be providing more reporting guidance to this new rule in the coming months, the final rule goes into effect on Sept. 1, 2023.

READ MORE: The Cyber Incident Reporting Requirement Final Rule. 

Chartering & Field of Membership Proposed Rule

The NCUA board also approved, with a 3-0 vote, a proposed rule to amend the field-of-membership and chartering rules to “streamline and strengthen” the process in order to serve more members, especially those in unbanked or under-banked communities.

The proposed changes would reduce duplicative or superfluous documentation and administrative requirements.

According to the NCUA, the proposed rule would do the following:

• Make four changes to the rules for underserved areas that multiple common-bond federal credit unions may seek to add to their fields of membership. The changes would streamline existing application requirements and clarify the role of data and criteria that other federal agencies provide relating to underserved areas.
• Eliminate the business and marketing plan requirement for certain federally insured, state-chartered credit unions that seek to convert to a federal charter while serving the same community field of membership.
• Expand the community-based field-of-membership affinities — relationships between a person and the geographic community — to recognize the growth of telecommuting and remote work for companies headquartered in a community.

Harper said, “Ultimately, it’s Congress’s decision whether to amend the Federal Credit Union Act’s field-of-membership requirements to achieve greater parity with the rules in many states,” Chairman Harper said. “However, where we can within our existing rules and the law’s current requirements, the NCUA board should take appropriate and tailored action to simplify, streamline, and strengthen federal chartering options.”

The proposal includes a provision to allow all federal credit unions to better capture the ongoing bond between individuals within a field of membership and their immediate family members following the death of a member, according to the NCUA.

Comments on the proposed rule are due no later than 90 days following publication in the Federal Register.

READ MORE: The Chartering and Field of Membership Proposed Rule.