A bank service provider covered by the US computer-security incident rule must notify affected banking organization customers as soon as possible after determining it has had an incident that materially disrupted or degraded covered services for four or more hours. Whether your SaaS is covered is a legal question to confirm.
This is general information, not legal advice.
What the rule says
The OCC, Federal Reserve and FDIC final rule says a bank service provider must notify customers when it experiences an incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours. Notice goes as soon as possible after the determination.
The final rule requires notice to at least one bank-designated point of contact at each affected customer. If none is designated, notice goes to the customer's CEO and CIO, or to two people with comparable responsibilities. The "two individuals" requirement in the proposal was not kept as a flat rule.
The compliance date was 1 May 2022.
Am I a bank service provider
The rule relies on the Bank Service Company Act concept. Under that statute, services a depository institution has performed by contract are subject to regulation and examination as if the institution performed them itself, and the institution must notify its agency of the relationship within thirty days.
Not every software vendor to a bank is automatically covered. Scope turns on the services and the legal definitions, so ask counsel rather than assuming.
If you might be covered
- Identify which services you provide to banks that fit the covered definition.
- Define internally what a four hour material disruption means for those services.
- Collect each bank's designated contact and keep it current.
- Build a short notice template: what happened, services affected, start time, next update time.
- Drill it twice a year.
If you are probably not covered
Contracts still often ask for prompt incident notice, because the bank's own 36-hour clock depends on facts you hold. Treat the four hour standard as a useful internal benchmark.
Quick check
Does the clock run from the start of the outage?
The rule speaks of an incident that has disrupted services for four or more hours, with notice as soon as possible after you make that determination. Read the final text for exact wording.
Who do we notify at the bank?
The bank-designated point of contact. If none, the CEO and CIO or equivalents.
Sources
- Computer-Security Incident Notification Requirements, Federal Register, 23 November 2021
- 12 U.S.C. 1867, Bank Service Company Act
Last reviewed: 19 October 2026.
