Agencies issue joint statement on handling of highly sensitive information during bank examinations

July 16, 2026
Agencies issue joint statement on handling of highly sensitive information during bank examinations
- Board of Governors of the Federal Reserve System
- Federal Deposit Insurance Corporation
- Office of the Comptroller of the Currency
For release at 2:00 p.m. EDT
The federal bank regulatory agencies today issued a joint statement describing enhanced security procedures for review of highly sensitive information in connection with examinations of supervised banks, such as reviewing materials on-site rather than transferring them onto agency systems.
The statement discusses a coordinated approach to identifying highly sensitive data and documents and discusses enhanced procedures for the review of such information to reduce any cybersecurity risks while ensuring that the agencies have access to such information at all times during an examination.
The agencies recognize the importance of keeping a bank's highly sensitive information confidential and protecting it against disclosure to or from access by unauthorized persons as a result of cybersecurity vulnerabilities. The agencies have committed to notify affected banks of any potential or confirmed material data breach involving confidential supervisory information. They will do so as soon as practicable, and no later than 72 hours after discovery, unless legal restrictions apply.

Facts Only

* The Board of Governors of the Federal Reserve System issued a joint statement.
* The Federal Deposit Insurance Corporation issued a joint statement.
* The Office of the Comptroller of the Currency issued a joint statement.
* The statement concerns enhanced security procedures for reviewing highly sensitive information during bank examinations.
* The review process involves examining materials on-site rather than transferring them to agency systems.
* Agencies discussed identifying highly sensitive data and documents through a coordinated approach.
* Enhanced procedures were discussed to reduce cybersecurity risks while maintaining access during examinations.
* Agencies recognized the importance of keeping bank information confidential and protecting it from unauthorized access due to cybersecurity vulnerabilities.
* Agencies committed to notifying affected banks of material data breaches involving confidential supervisory information within 72 hours of discovery, unless legal restrictions apply.

Executive Summary

Federal bank regulatory agencies, including the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency, issued a joint statement on July 16, 2026. The statement outlined enhanced security procedures for reviewing highly sensitive information during examinations of supervised banks. A key procedural change involves reviewing materials on-site rather than transferring them to agency systems. The agencies emphasized a coordinated approach to identifying and reviewing highly sensitive data to reduce cybersecurity risks while ensuring access during examinations. Furthermore, the agencies committed to notifying affected banks of any potential or confirmed material data breaches involving confidential supervisory information within 72 hours of discovery, unless legal restrictions apply.

Full Take

The communication reflects a response by regulatory bodies to the persistent threat landscape where operational necessity (conducting examinations) must be balanced against security imperatives. The explicit focus on minimizing risk through on-site review suggests an acknowledgment that centralized data transfer introduces significant attack vectors, shifting the operational paradigm toward localized control for highly sensitive assets. The commitment to a strict 72-hour notification window establishes a baseline expectation for transparency regarding breaches, setting a procedural standard rooted in temporal accountability. This action implicitly frames the relationship between oversight and security as a shared responsibility where regulatory bodies must implement specific technical safeguards while maintaining access rights. The pattern emerging is the institutionalization of risk mitigation into mandated procedures, moving beyond general guidance to concrete, time-bound obligations for disclosure following a failure event. This reflects an effort to manage the tension between informational transparency required for oversight and the imperative of data confidentiality against external threats.

Sentinel — Human

Confidence

This text exhibits the clear, formal tone of a coordinated inter-agency statement, strongly suggesting human authorship within a standard regulatory communication framework.

Signals Detected

Moderate sentence length variance; professional but direct tone.

Clear, focused articulation of a regulatory policy statement without excessive hedging or abstract language.

Standard press release structure; attribution is direct and sourced from official bodies.

Content reflects typical regulatory communication style; no immediate signs of LLM confabulation.

Human Indicators

The text reads like an official, direct statement from established regulatory bodies, lacking the characteristic hedging or overly polished cadence often seen in purely synthetic narratives.