The Office of the Comptroller of the Currency Strengthens Cybersecurity Oversight for National Banks

The Office of the Comptroller of the Currency (OCC) is intensifying its regulatory focus on cybersecurity to protect the federal banking system from evolving digital threats. According to the agency’s Semiannual Risk Perspective, the OCC is prioritizing the resilience of critical infrastructure, third-party risk management, and the security of cloud-based services as banks increasingly integrate emerging technologies into their core operations.

Why is the OCC prioritizing cybersecurity now?

The OCC identifies cybersecurity as a primary operational risk due to the growing sophistication of threat actors and the interconnected nature of the financial services sector. As noted in the agency’s 2024 operating plan, banks are facing a persistent environment of ransomware attacks, supply chain vulnerabilities, and data breaches. By maintaining rigorous supervision, the OCC aims to ensure that national banks and federal savings associations have the governance, risk management, and internal controls necessary to withstand cyber incidents without compromising the stability of the broader financial system.

How does the OCC manage third-party risk?

Third-party risk management stands as a cornerstone of the OCC’s supervisory strategy. Because banks rely heavily on cloud service providers, fintech partners, and other technology vendors, a failure at a single provider could impact multiple financial institutions. The OCC’s Interagency Guidance on Third-Party Relationships emphasizes that banks remain responsible for the safety and soundness of their operations, regardless of whether they outsource functions to third parties. Examiners now require banks to conduct thorough due diligence, monitor vendor performance, and establish clear exit strategies for critical third-party services.

What are the primary areas of concern for bank examiners?

The OCC’s supervisory approach focuses on several technical and procedural domains to mitigate systemic risk. Based on recent agency cybersecurity resources, the following areas represent the current regulatory priority:

• Cloud Security: Ensuring that data encryption, identity management, and access controls are properly configured in shared cloud environments.
• Incident Response: Evaluating the effectiveness of a bank’s ability to detect, contain, and recover from cyberattacks, including ransomware.
• Systemic Interconnectivity: Assessing how risks within one bank might propagate to others through shared payment systems or common service providers.
• Operational Resilience: Testing whether critical banking functions can continue during a significant outage or cyber event.

Key Takeaways

• Regulatory Mandate: The OCC mandates that banks maintain robust cybersecurity programs as a core component of safety and soundness.
• Vendor Accountability: Banks must treat third-party technology providers with the same level of risk scrutiny as internal departments.
• Focus on Resilience: Supervision has shifted from purely preventative measures to prioritizing operational recovery and continuity.

Looking Ahead

As financial institutions continue to adopt artificial intelligence and machine learning, the OCC is expected to refine its guidance to address new attack vectors associated with these technologies. The agency continues to collaborate with the Federal Reserve and the FDIC to harmonize cybersecurity expectations across the U.S. banking system. Banks that fail to demonstrate adequate controls in these areas face increased regulatory scrutiny, potential enforcement actions, and mandatory remediation efforts to ensure the security of consumer data and the integrity of the financial markets.