Federal Bank Exam Data Breach Notices: What the 72-Hour Commitment Means for Banks

Federal banking agencies have issued a joint statement on how they will handle highly sensitive information during bank examinations. The headline issue for compliance teams is the notice commitment: affected banks will be notified as soon as practicable and within no more than 72 hours after the impacted agency has a reasonable basis to believe a material compromise of confidential supervisory information occurred and determines which banks are affected.

NETBankAudit helps financial institutions prepare for examinations, evaluate IT and cybersecurity controls, and reduce regulatory uncertainty. If this guidance raises questions for your institution, please reach out to our team.

What Changed in the Federal Banking Agencies’ Approach

The agencies are aligning how exam teams handle sensitive materials

The Board of Governors of the Federal Reserve System and the Federal Deposit Insurance Corporation are part of a coordinated approach for handling highly sensitive information during examinations of supervised banks.

The Office of the Comptroller of the Currency is also included, so banks should expect the same core concepts across federal examination teams. The approach is designed to reduce cybersecurity risk while preserving examiner access to information needed for supervision.

This is not a rule that allows banks to deny examiner requests. It is a process for identifying sensitive materials and considering stronger handling protocols before information is collected, transmitted, or stored by an agency.

The 72-hour notice commitment has defined triggers

The agencies committed to notify affected banks of a potential or confirmed material compromise of confidential supervisory information. The notice must be provided as soon as practicable and within no more than 72 hours once the impacted agency has a reasonable basis to believe a compromise occurred and determines which banks are affected.

That timing is subject to applicable legal considerations. It also depends on the agency identifying both the compromise and the affected banks. Compliance teams should not treat the 72-hour language as a substitute for their own tracking and response procedures.

The practical takeaway is simple. Banks should know what sensitive examination materials they provided, how they were provided, and whether a full, redacted, or summarized version was used.

What Counts as Highly Sensitive Information During a Bank Exam?

The joint statement does not create a fixed list of highly sensitive information. Instead, it identifies examples of data and documents with additional sensitivity and heightened risk from disclosure. That flexible approach matters because the risk profile of examination materials varies by institution.

Bank management has the first role in the process. The agencies will rely on management to identify requested data and documents that management believes should be treated as highly sensitive. Examiners or primary agency contacts will then discuss whether enhanced handling methods should apply.

Banks should convert the agency examples into internal tagging and escalation criteria. These categories should be reviewed before examination materials are uploaded or transmitted. The goal is controlled handling, not delay.

• Technology and network diagrams or schematics that show architecture, connectivity, system relationships, or other technical design details.
• Detailed penetration test results, especially reports that identify exploitable weaknesses, attack paths, or remediation gaps.
• Technical details of specific information technology control weaknesses, including weaknesses in access, configuration, monitoring, patching, or resilience.
• Succession planning documents that contain sensitive leadership, governance, staffing, or continuity information.

How Banks Should Build a Pre-Exam Handling Workflow

Classification should happen before production

The most useful control is timing. If a bank waits until the production deadline to classify sensitive materials, staff may upload documents before the right people review them. A pre-exam workflow gives teams a repeatable process under time pressure.

The workflow should be clear, short, and documented. It should identify who reviews request lists, who can flag highly sensitive information, who contacts the examiner, and how the agreed handling method is recorded.

Internal training should match examiner training

The agencies will provide written guidance and training to examiners. Banks should do the same for employees who respond to examination requests. Training should focus on practical recognition and escalation.

The right audience includes compliance, IT, information security, internal audit, operations, executive administration, and any business unit that provides examination materials. Staff should understand that examiner access remains required, but certain materials may need additional handling steps.

Training should cover the bank’s examples of highly sensitive information, the internal owner for classification questions, and the approved path for raising concerns with the examiner or primary agency contact.

Enhanced Review Options Banks Should Be Ready to Discuss

The agencies may consider options that minimize agency collection and storage of highly sensitive information. Banks should be prepared to propose methods that protect sensitive details while still allowing examiners to complete their work. The best time to discuss these options is when the request is identified, not after the document has already been sent.

Each method has a different use case. Some materials may be suitable for on-site review only. Others may support a redacted copy or a summary if legal requirements are satisfied and the examiner agrees.

Compliance teams should document the method selected for each sensitive item. That record helps the bank understand what was reviewed, what was retained, and what may require follow-up if an agency notice is later received.

• On-site review: Examiners review materials at the bank rather than transferring them onto agency systems. This may be appropriate for documents that contain detailed technical or strategic information.
• Direct digital review: Examiners access materials directly from bank systems. This can reduce unnecessary copying or storage when configured and controlled appropriately.
• Redacted documents: The bank provides a version that removes sensitive details not needed for the supervisory purpose. This requires careful coordination so the remaining information still satisfies the request.
• Summarized documents: The bank provides a summary that captures the relevant supervisory information without exposing unnecessary technical or confidential detail. The statement notes that summaries may be accepted in some circumstances if legal requirements are met.
• Additional transmission and access controls: The bank and examiners may use added steps for transmission, access, or review. These controls should be documented so the handling decision is clear after the exam.

What Happens When Examiners Need the Information for the Supervisory Record?

Enhanced handling does not guarantee that sensitive information stays out of the supervisory record. After alternative review, examiners may determine there is a supervisory need to obtain the information. The statement says this decision may occur after approval through the appropriate supervisory chain.

Banks should prepare for that possibility. If a full report is highly sensitive, the bank may consider whether a redacted version or summary can meet the supervisory need. That discussion should happen with the examiner or primary agency contact.

The institution should also keep a record of what version was accepted. If the examiner retains a summary, the bank should retain the final version and the rationale. If the examiner retains a full document, the bank should record that as well.

How the 72-Hour Notice Commitment Affects Incident Response

An agency notice involving confidential supervisory information is different from an incident first detected inside the bank’s own systems. Still, it should trigger a defined internal response. The bank should know who receives the notice, who leads the response, and who informs senior management.

The response team may include executive management, compliance, legal, information security, privacy, internal audit, vendor management, and communications. The exact group depends on the material involved and the potential impact.

A current inventory of examination materials will speed that response. The bank should be able to identify which sensitive documents were provided, whether they included technical weaknesses or succession planning, and whether the agency retained full, redacted, or summarized versions.

The statement also says the memorandum does not create any enforceable right or benefit against the agencies or their personnel. Management and the board should understand that distinction. The notice commitment is an agency process commitment, not a private enforcement tool.

Board and Management Questions Before the Next Examination

Board members do not need to manage every examination document request. They do need confidence that the institution has a controlled process. That is especially true for penetration test results, network diagrams, and documents describing specific IT control weaknesses.

Management reporting should focus on readiness, ownership, and evidence. A short status update can identify whether procedures exist, whether staff have been trained, and whether prior examination production practices were documented. Internal audit can also test whether the process works as designed.

The following questions can help management identify gaps before the next examination begins. They should be assigned to accountable owners. Any gaps should be tracked through normal corrective action processes.

• Do we have a written process for identifying highly sensitive examination materials?
• Who reviews examination request lists before documents are uploaded or transmitted?
• Can staff identify network diagrams, penetration test results, technical IT weakness details, and succession planning documents?
• Who is authorized to discuss sensitive handling concerns with examiners?
• Do we document whether materials were reviewed on-site, reviewed digitally, redacted, summarized, transmitted, or retained?
• Do incident response procedures address an agency notice involving confidential supervisory information?
• Has internal audit tested examination production controls?

How NETBankAudit Can Support Exam Readiness

NETBankAudit works with financial institutions on IT general controls audits, cybersecurity assessments, operational audits, risk assessments, vulnerability testing, penetration testing, and regulatory audit support. Those services align directly with the documents most likely to require enhanced handling during examinations.

NETBankAudit can help banks review how sensitive examination materials are created, classified, controlled, and produced. That work may include evaluating request-list workflows, testing documentation practices, reviewing cybersecurity and information security programs, and preparing teams for examiner discussions.

NETBankAudit’s audit and assessment work is designed for financial institutions and supports alignment with FFIEC expectations and NIST based control practices where applicable. If your institution needs help strengthening examination readiness, IT audit controls, cybersecurity testing, or sensitive information handling, contact NETBankAudit.