What is the 36-hour incident notification rule for banks?

A banking organization supervised by the OCC, the Federal Reserve or the FDIC must notify its primary federal regulator as soon as possible and no later than 36 hours after it determines a notification incident has occurred. The joint rule was published November 23, 2021 and required compliance from May 1, 2022. The clock starts at the bank's determination, not the first alert, but a bank that waits days while it "investigates" will struggle to show it had not yet determined anything.

What counts as a notification incident for a bank?

A computer-security incident, meaning actual harm to the confidentiality, integrity or availability of a system or its data, that has materially disrupted or degraded, or is reasonably likely to, the bank's ability to carry out banking operations, a business line whose failure would cause material loss, or operations whose failure would threaten U.S. financial stability. Examples include ransomware and DDoS. It is not limited to attacks: a failed system change that locks customers out can qualify.

How is the credit union 72-hour rule different?

A federally insured credit union must notify the NCUA within 72 hours after it reasonably believes it has experienced a reportable cyber incident (12 CFR 748.1(c), effective September 1, 2023). That trigger is earlier and looser than a bank's determination. For a compromise at a service organization or cloud host, the 72 hours can run from the time the third party notifies the credit union. Events carried out at the owner's request, such as a hired penetration test, are excluded.

What does the regulator notice have to contain?

Very little. The agencies say the bank rule sets no specific content or format, and the NCUA says its notice does not require a detailed incident assessment. Both are early alerts, sent by email, telephone or similar methods the regulator may prescribe. In practice a first notice states who you are, what happened as far as you know, when it began, what is affected, what you are doing and who the contact is. Writing that template in advance, with legal review, is far easier than doing it during an outage.

What must a bank's service provider tell the bank?

Under the same interagency rule, a bank service provider must notify at least one bank-designated contact at each affected customer as soon as possible after it determines an incident has materially disrupted or degraded, or is reasonably likely to, covered services for four or more hours. Without a designated contact, it notifies the bank's CEO and CIO or equivalents. Scheduled maintenance is excluded. Give every critical vendor a monitored contact and test it.

Can Clayton Cybernetics decide whether our incident is reportable?

No. That judgment belongs to your management, compliance staff and counsel. Our Cybersecurity practice helps you get to a decision faster: incident response plans with a named decision-maker and deputy, a determination log, printed regulator contacts for when systems are down, a pre-written first notice, and tabletop exercises with ransomware and vendor-outage scenarios. This is general information, not legal advice.

Bank and Credit Union Incident Reporting

Key takeaways

OCC, Federal Reserve and FDIC rule (published November 23, 2021; effective April 1, 2022; compliance May 1, 2022): a banking organization must notify its primary federal regulator as soon as possible and no later than 36 hours after it determines that a notification incident has occurred.
NCUA rule (12 CFR 748.1(c); effective September 1, 2023): a federally insured credit union must notify the NCUA as soon as possible and no later than 72 hours after it reasonably believes it has experienced a reportable cyber incident.
Both notices are early alerts. The agencies say the bank notice needs no assessment or analysis and sets no content or format; the NCUA says its notice does not require a detailed incident assessment.
Bank service providers must tell affected bank customers as soon as possible when an incident has materially disrupted or degraded covered services for four or more hours.
The hard part is not the phone call. It is deciding quickly who may declare a notification incident, recording when that decision was made, and reaching the regulator when your own systems are down.

Two rules, two clocks

Cyber incident reporting for U.S. financial institutions is not one rule. Banks supervised by the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corporation (FDIC) follow a joint final rule published in the Federal Register on November 23, 2021. Federally insured credit unions follow a separate National Credit Union Administration (NCUA) rule published on March 1, 2023. Both ask for a short, early alert. They do not use the same trigger, the same definitions or the same deadline.

This article summarizes both from the Federal Register texts and the OCC's own bulletin. It covers regulatory notification only. Other duties, such as notice to customers, suspicious activity reporting, state breach laws, contract notices and insurer notice, are separate and are outside this article. Your counsel and your compliance officer own those questions.

The bank rule: 36 hours after a determination

The OCC's Bulletin 2021-55 summarizes the interagency rule. A bank must notify the OCC as soon as possible and no later than 36 hours after the bank determines that a computer-security incident that rises to the level of a notification incident has occurred. The Federal Reserve's version applies to bank holding companies and state member banks, and the FDIC's to the banks it supervises. The OCC notes that the rule applies to community banks. The effective date was April 1, 2022, and the compliance date was May 1, 2022.

Two definitions matter. A computer-security incident is an occurrence that results in actual harm to the confidentiality, integrity or availability of an information system or the information it processes, stores or transmits. A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, one of three things: the bank's ability to carry out banking operations or deliver products and services to a material portion of its customers in the ordinary course of business; a business line whose failure would cause a material loss of revenue, profit or franchise value; or operations whose failure would threaten the financial stability of the United States.

The OCC bulletin gives examples of what this generally includes: a major computer-system failure, a distributed denial-of-service attack, a ransomware attack, or another significant operational interruption. Note that the definition is not limited to attacks. A failed system change that keeps customers out of their accounts can meet it.

When the 36 hours start

The clock starts when the bank determines that a notification incident has occurred, not when it first sees an alert. In the preamble, the agencies say they do not expect a bank to make that determination immediately on becoming aware of an incident. They expect a reasonable amount of time to determine it. They also say 36 hours is reasonable because the notice does not require an assessment or analysis.

That gives a bank room, but not unlimited room. A bank that sits on a severe outage for days while it "investigates" will have trouble showing that it had not yet made a determination. The defensible approach is a written rule for who decides, what they look at, and how fast, plus a log that shows when the decision was made and why.

What the notice has to contain

Very little is prescribed. The OCC rule text says the bank notifies the appropriate OCC supervisory office, or an OCC-designated point of contact, through email, telephone or other similar methods the OCC may prescribe. In the preamble the agencies state that the rule sets no specific content or format, because they want timely notice without burdening banks with detailed reporting while facts are still unknown. The agencies also say the notices and related information are subject to their confidentiality rules.

In practice, a first notice is a few plain facts: who you are, what happened as far as you know, when it began, what is affected, what you are doing, and who the contact is. Writing that template in advance costs an hour. Writing it for the first time at 2 a.m. during a ransomware event costs much more.

Bank service providers: four hours and a named contact

The same rule puts a duty on bank service providers, meaning companies that perform services subject to the Bank Service Company Act. A provider must notify at least one bank-designated point of contact at each affected bank customer as soon as possible when it determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours.

A bank-designated point of contact is an email address, phone number or other contact the bank has already given the provider. If the bank has not designated one, the provider must notify the bank's chief executive officer and chief information officer, or two people with comparable responsibilities, by any reasonable means. Scheduled maintenance, testing or software updates that were communicated to the bank in advance are excluded.

Two lessons follow for banks. First, give every critical vendor a current, monitored contact, and test it. If you have not designated one, the notice may go to your CEO and CIO. Second, your regulator clock may start only when you determine you have a notification incident. A vendor that tells you late gives you less time to act, so contract terms matter. Our related article on vendor risk covers that side.

The credit union rule: 72 hours after a reasonable belief

The NCUA's final rule added paragraph (c) to 12 CFR 748.1 and took effect September 1, 2023. A federally insured credit union must notify the NCUA as soon as possible and no later than 72 hours after it reasonably believes that it has experienced a reportable cyber incident. The NCUA describes the notice as an early alert and says it does not require a detailed incident assessment within the 72 hours. Notification is by email, telephone or other similar methods the NCUA may prescribe.

The trigger is a reasonable belief, which is earlier and looser than a bank's determination. A reportable cyber incident is any substantial cyber incident that leads to one or more of three outcomes. The first is a substantial loss of confidentiality, integrity or availability of a network or member information system from unauthorized access to or exposure of sensitive data, a disruption of vital member services, or a serious impact on the safety and resiliency of operational systems. The second is a disruption of business operations, vital member services or a member information system from a cyberattack or exploitation of vulnerabilities. The third is a disruption of operations or unauthorized access to sensitive data through a compromise of a credit union service organization, cloud service provider or other third-party data hosting provider, or through a supply chain compromise.

For that third outcome the rule also sets a 72‑hour limit that runs from the time a third party notifies the credit union, if that is sooner than the credit union's own reasonable belief. The NCUA says the rule does not require a credit union to report an incident at a third party that, unknown to and unrelated to the credit union, merely holds information about its members. It also excludes an event performed in good faith at the system owner's request. The NCUA's example is a penetration test the credit union hired.

Side by side

Who: banking organizations supervised by the OCC, Federal Reserve and FDIC, versus federally insured credit unions.
Deadline: 36 hours after a determination, versus 72 hours after a reasonable belief (or after a third party's notice, for the third-party outcome).
Trigger: a notification incident with material effect on operations, a core business line or financial stability, versus a substantial cyber incident with one of three listed outcomes.
Content: neither rule prescribes a form. Both treat the notice as an early alert, not a full report.
Third parties: banks have a separate duty on their service providers to notify them, with a four-hour threshold. Credit unions treat a third-party compromise as one of the reportable outcomes.

What to prepare before an incident

None of this needs new technology. It needs decisions made in advance and written down.

Name the decision-maker and a deputy. Someone must be able to declare a notification incident (bank) or form a reasonable belief (credit union) at any hour. Put the names, the criteria and a one-page decision guide in the incident response plan.
Keep a determination log. Record when the first alert arrived, who reviewed it, what was known, and the time and reason for each decision. This is your evidence that the clock was handled in good faith.
Store the regulator contacts. Keep the current supervisory office or designated point of contact, with phone numbers, somewhere you can reach when email and the file server are down. Print them.
Pre-write the first notice. A short template with blanks for the time, scope, impact, actions and contact is enough. Have legal and the CEO review it once, in calm conditions.
Plan for out-of-band communication. The NCUA noted the rule's flexibility partly because communication channels may themselves be hit by the incident. Do not rely on a mailbox on the network that is encrypted.
Review vendor contracts. For each critical provider, confirm the incident notice clause, the named contact on both sides, and the time commitment. A four-hour regulatory threshold means a four-hour vendor promise is too slow if it only starts after the vendor finishes its own investigation.
Map your critical operations. Know which systems support deposits, payments, lending, online and mobile banking and member access, so you can judge quickly whether an outage is material.
Rehearse. Run a tabletop exercise with a ransomware scenario and a vendor-outage scenario, and time how long it takes to reach a determination and a first notice. Fix what slows you down.

Where outside help fits

A firm like ours cannot decide for you that an incident is reportable. That judgment belongs to your management, compliance and legal advisers. What an outside team can do is shorten the time between the first alert and a clear picture: monitoring that raises the right alarm, an on-call engineer who can say what is affected, a tested restore path, and a plain written timeline that your decision-maker can act on. The Cybersecurity practice at Clayton Cybernetics designs and tests incident response plans and runs tabletop exercises for this purpose.

If you are a bank or credit union with a mixed set of vendors, start with two lists: the systems whose failure would trigger a notice, and the vendors that run them. Most gaps appear where those two lists meet.

Sources

This article is general information, not legal or compliance advice. Whether an event is a notification incident or a reportable cyber incident depends on the facts and on your regulator's guidance. Confirm with your compliance officer, counsel and primary regulator. Rules and guidance change; check the current text before relying on it. Last reviewed November 8, 2026.

Keep reading

Next · SecurityVendor and Third-Party Risk for Mid-Size Firms: The 2023 Interagency Guidance, NIST SP 800-161 and CSF 2.0Most firms now run on vendors: email, payments, hosting, line-of-business software, managed IT. Regulators and NIST agree on the shape of a sensible program. Know your vendors, rank them by criticality, check them before you sign, put security terms in the contract, watch them, and plan the exit. This article maps those steps to the 2023 bank guidance, NIST SP 800-161 Rev. 1 and CSF 2.0, and notes that the bank agencies proposed replacing their guidance in September 2026.9 min read

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity

Bank and Credit Union Cyber Incident Reporting: The 36‑Hour and 72‑Hour Rules, and What to Prepare