US banking organizations must notify their primary federal regulator no later than 36 hours after determining that a notification incident has occurred. A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, the bank's operations, core business lines or critical operations.
This is general information, not legal advice.
Where it comes from
The OCC, Federal Reserve and FDIC issued the final rule in November 2021. The preamble gives an effective date of 1 April 2022 and a compliance date of 1 May 2022.
Key terms
A computer-security incident is an occurrence that results in actual harm to an information system or the information in it. The "violation or imminent threat" prong from the proposal was dropped in the final rule.
A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the bank's operations, core business lines or critical operations. The agencies changed "could" to "reasonably likely to" and moved to a determination standard.
What starts the clock
The clock starts when the bank determines a notification incident has occurred, not when the first alert fired. Notice should also go as soon as possible.
| Event | Does it start the 36-hour clock? |
|---|---|
| Alert triggers, investigation underway | No, until a determination is made |
| Bank determines a notification incident occurred | Yes |
| Vendor tells bank about a disruption | The bank still decides whether it is a notification incident |
How a bank decides
The rule leaves the determination to the bank, so each bank writes its own internal process for deciding when an incident meets the threshold. Ask your bank customer how its team will judge a vendor outage, and what facts it needs from you to decide.
Related duties exist elsewhere. Securities firms follow different clocks, for example the 30 day customer notice in Regulation S-P, compared in this post on notification clocks.
What it means for software vendors
Banks need timely, factual signals from vendors to make that determination. A vendor that sends vague or late notices makes the bank's job harder. Separate vendor duties exist for bank service providers, covered in the post on the four-hour provider notice.
Practical steps: agree a contact, a channel and a template with each bank customer, and describe impact in terms of service availability and data affected.
Quick check
Does every security incident need a 36-hour notice?
No. A notification incident is a narrower category, and it must reach a materiality threshold on operations, core business lines or critical operations.
Who receives the notice?
The bank's primary federal regulator. The rule's details on method are in the final text, so check it.
Sources
Last reviewed: 19 October 2026.
