BANKS AND CREDIT UNIONS
Five supervisors, two vendor regimes, and two different incident clocks.
Your charter decides your examiner, guideline, vendor regime and incident clock. The work in each: long vendor chains, controls without dated artifacts, counterparties on a shorter clock than a supervisor's.
Your charter decides your supervisor.
The five share no vendor guidance, incident clock or rating instrument.
| If you are | Your supervisor |
|---|---|
| A national bank or federal savings association | The OCC |
| A state member bank | The Federal Reserve and your state |
| A state nonmember bank | The FDIC and your state |
| A federal credit union | The NCUA |
| A federally insured state chartered credit union | The NCUA and your state supervisory authority |
A state charter answers to two: examinations are alternated or joint depending on the state and agency, findings come from either, and a corrective action plan generally must satisfy both. For Louisiana charters: the Louisiana Office of Financial Institutions.
Examined against the guideline, not the statute.
Your charter, not your size, decides the rule.
GLBA Title V, 15 U.S.C. 6801 to 6809, and the rules it allocates
| Institution | Rule | Citation |
|---|---|---|
| National banks | Interagency Guidelines Establishing Information Security Standards | 12 CFR Part 30 Appendix B |
| FDIC supervised institutions | Interagency Guidelines | 12 CFR Part 364 Appendix B |
| Federal Reserve supervised institutions | Interagency Guidelines | 12 CFR Part 208 Appendix D-2; 12 CFR Part 225 Appendix F |
| Federally insured credit unions | NCUA 12 CFR Part 748 | Appendix A, member information security program; Appendix B, incident response and member notification |
- Guidelines require
- Board oversight; a written program driven by a risk assessment; testing of key controls conducted or reviewed by independent third parties or by staff independent of those who develop or maintain the program; service provider oversight; an annual report to the board.
- Size
- Every covered institution; no size threshold, no exemption; scaled to size and complexity, not excused.
GLBA has no threshold of its own; the implementing rules carry them. The FTC Safeguards Rule, 16 CFR Part 314, reaches nonbank lenders and brokers, not banks or credit unions, and has its own exception: Mortgage.
An internal audit function independent of IT can meet the Guidelines' independent testing in house. Many community institutions have none and buy it: the Security Assessment. A counterparty requirement for a qualified and independent third party, as in the Freddie Mac Guide, cannot be met internally.
The examination procedures are published.
Readiness is evidence against published questions: Examination and Evidence Readiness.
FFIEC Information Technology Examination Handbook
Bank and credit union IT examinations run against these published booklets, among them Architecture, Infrastructure, and Operations (June 2021), Business Continuity Management (November 2019) and Information Security.
Banks, credit unions and technology service providers. Guidance, not a rule; no independent legal obligation. No size threshold; scope scaled and risk based.
NCUA Information Security Examination
Since 2023, how NCUA examines a federally insured credit union's security program, tiered by size and complexity into SCUEP, CORE and CORE+. The Automated Cybersecurity Evaluation Toolbox remains a voluntary self assessment the ISE did not replace.
Federally insured credit unions, state charters with their state supervisory authority. Procedures revised without rulemaking, not a rule; scope risk based.
The retired assessment tool
What goes to the board now: the post CAT board packet.
FFIEC Cybersecurity Assessment Tool sunset, 31 August 2025
The FFIEC removed the Cybersecurity Assessment Tool from its website on 31 August 2025 without designating a successor. Its Sunset Statement points to existing resources: NIST Cybersecurity Framework 2.0, the CISA Cybersecurity Performance Goals, the Cyber Risk Institute Cyber Profile and the Center for Internet Security Critical Security Controls.
Voluntary throughout; its retirement imposes no obligation. None of the four is endorsed, recommended or required. We name none as the successor because the FFIEC named none, and our advice on which to adopt is tied to no product sale.
Banks and credit unions answer different vendor regimes.
Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920
OCC, Federal Reserve and FDIC, June 2023. Vendor oversight as a life cycle: planning, due diligence, contracting, ongoing monitoring, termination.
- Issued as
- OCC Bulletin 2023-17, SR 23-4, FIL-29-2023, each rescinding its agency's prior guidance; community bank companion, May 2024.
- OCC rescissions
- 2023-17 rescinds OCC Bulletin 2013-29 and Bulletin 2020-10; Bulletin 2020-10 had rescinded Bulletin 2017-21 in March 2020.
- Examined with
- The FFIEC Development, Acquisition and Maintenance booklet of August 2024, most relevant to acquiring AI enabled software.
Every bank the three agencies supervise, no asset size threshold, practices commensurate with its risk profile. Guidance, not a rule. Not credit unions: NCUA is not a party.
NCUA third party expectations, Part 748 Appendix A and Letter to Credit Unions 07-CU-13
Part 748 Appendix A, section III.D, examined through the ISE, with Letter to Credit Unions 07-CU-13 and Supervisory Letter 07-01, Evaluating Third Party Relationships, which examiners cite.
Every federally insured credit union, no asset size exemption. Not banks.
A bank handed a vendor list has less than the guidance expects; a credit union handed the interagency life cycle has a bank's program. AI vendors, and AI features inside existing ones, are reached like any third party, with no AI specific instrument: AI Vendor and Third Party Review.
We sponsor a fintech program. Who owes the diligence?
The bank does, under the interagency guidance, at any size. The fintech meets the bank's standard through the bank's program, before any regulator asks.
The 36 hour and 72 hour clocks start differently.
- Banking organization, any size
- Notice to its primary federal regulator within 36 hours of determining a notification incident occurred.
- Federally insured credit union, any size
- Notice to NCUA within 72 hours of reasonably believing a reportable cyber incident occurred.
A determination and a reasonable belief are not the same moment, so one procedure for both charters is wrong for one.
Computer-Security Incident Notification Rule, 12 CFR Part 53
- Banking organizations
- The primary federal regulator, as soon as possible, no later than 36 hours after determining a notification incident has occurred.
- Bank service providers
- Affected bank customers, as soon as possible, on determining that an incident has caused, or is reasonably likely to cause, a material disruption or degradation of covered services for four or more hours. Scheduled maintenance, testing or software updates previously communicated to the bank are excluded.
OCC 12 CFR Part 53, Federal Reserve 12 CFR Part 225 Subpart N, FDIC 12 CFR Part 304 Subpart C; in force since 1 May 2022. Any size: the threshold sits in the materiality definition. Not credit unions.
NCUA cyber incident notification, 12 CFR 748.1(c)
Since 1 September 2023: NCUA, as soon as possible and no later than 72 hours after reasonably believing a reportable cyber incident has been experienced. Good faith activity at the system owner's or operator's request, including authorized penetration testing, is excluded.
Every federally insured credit union, no size exemption. The threshold sits in the definition; what is substantial is the credit union's reasonable judgment. Not banks.
A bank that is also a Fannie Mae seller, Freddie Mac Seller/Servicer, Ginnie Mae Issuer, FHA approved mortgagee or New York Covered Entity carries those clocks too, plus state breach duties: the clock map.
Do the SEC cybersecurity disclosure rules apply to us?
Not if you are privately held. A reporting company discloses a material cybersecurity incident on Form 8-K, Item 1.05, within four business days of determining it is material, and describes risk management and board oversight annually under Regulation S-K Item 106. The rules reach Exchange Act registrants, foreign private issuers and business development companies only.
Generative AI has no framework here. Scoring models still do.
Revised interagency model risk management guidance, SR 26-2 and OCC Bulletin 2026-13
On 17 April 2026, SR 26-2 and OCC Bulletin 2026-13 replaced the agencies' 2011 model risk guidance. It narrowed its definition of a model to complex quantitative methods, excluding simple arithmetic calculations and deterministic rule based processes; traditional statistical and non generative machine learning models stay in scope. The agencies state it is most relevant above $30 billion in total assets; generative and agentic AI models are outside it.
So a community bank's generative AI tool has no model risk or AI specific supervisory framework written for it yet. Its scoring models remain subject to governance appropriate to size and risk profile, examined under safety and soundness and the FFIEC IT Handbook.
The agencies plan a request for information on model risk management and banks' use of AI; none was published at this page's last review.
Banking organizations the three agencies supervise. The agencies state that noncompliance with the guidance alone will not result in supervisory criticism. Not credit unions.
The vendor program, the security program and the board record of who approved what still reach the AI, and an AI governance program is built from them. Explaining a model's lending decisions: AI in Regulated Decisions.
What changes.
| Before | After |
|---|---|
| A program mapped to a withdrawn framework. | Against the instruments that reach the charter now. |
| Vendor oversight held as a list. | A documented review, decision and named owner per relationship. |
| An incident procedure written to one clock. | Each clock the charter carries, and what starts it. |
| Evidence assembled after the request. | Assembled before it, and dated. |
Start with your date or your finding.
Tell us your charter and what drives the question: an examination date, a Matter Requiring Attention, a Document of Resolution, an audit item or a board paper on the retired tool.