Lewis Roca Blog

The National Credit Union Administration (NCUA) approved a final rule that will require any Federally-Insured Credit Union (FICU)—including federally chartered corporate credit unions and federally insured state-chartered corporate credit unions—to report certain cyber incidents to the NCUA as soon as possible, and no later than 72 hours, after it “reasonably believes” it has experienced a reportable incident. The rule, which adds a new subsection (c) to 12 CFR Part 748.1, goes into effect September 1, 2023.

In issuing its new rule, the NCUA attempted to closely ...