Financial agency rule changes leave banks open to cyber threats, Elizabeth Warren warns
The Senate Banking Committee’s top Democrat is pushing three financial regulatory agencies to reverse course on recent policy changes that she says could make the U.S. banking system more vulnerable to cyberattacks.
In letters sent Friday, Sen. Elizabeth Warren, D-Mass., asked the Federal Reserve, the Federal Deposit Insurance Corp., and the Office of the Comptroller of the Currency to rescind those policy changes, which limit the ability of bank examiners to deliver supervisory warnings and pursue certain enforcement actions.
The Fed’s Updated Statement of Supervisory Operating Principles, published last month, said that supervisory staff can only issue enforcement actions to financial institutions based on “unsafe or unsound” practices if they believe those practices “create an abnormal probability of abnormal harm to the financial condition of the banking organization.”
In her letter to Fed Vice Chair for Supervision Michelle Bowman, Warren wrote that cybersecurity assessments consider “a variety of probability estimates.” That fact, combined with rapid developments in artificial intelligence that fuel cyberthreats, means that it “may not be easily quantifiable” to determine if a risk is “abnormal.”
“This supervisory policy may prevent a bank examiner from taking supervisory or enforcement action when identifying unsafe cybersecurity practices and undermines incentives for banks to maintain rigorous policies, procedures, and internal controls related to cybersecurity,” the Senate Banking Committee ranking member wrote.
Warren’s letter to FDIC Chairman Travis Hill and OCC chief Jonathan Gould took issue with a final rule from the agencies titled Unsafe or Unsound Practices, Matters Requiring Attention. The 73-page document includes what Warren called a “narrow” definition of unsafe or unsound practices.
Per the rule, bank examiners can only take action on a cybersecurity vulnerability if it is “likely” unsafe or unsound, as opposed to being “possible” or “plausible” that a cyber incident could “materially harm the financial condition of an institution,” Warren wrote.
The Massachusetts Democrat cited recent AI-enabled cyberattacks in which models accessed unauthorized systems, most notably the Hugging Face breach via OpenAI agents.
“Allowing cybersecurity vulnerabilities to fester, instead of remediating them early, could lead to more frequent and severe cyberattacks, threaten the sensitive financial data of businesses and households, and undermine the stability of the financial system,” Warren wrote.
If the Fed, FDIC and OCC “refuse” to rescind their policies and rules, she added, those agencies “will share responsibility for the potential harm wrought by future cyberattacks on the banking system.”
A Fed spokesperson confirmed that the central bank received the letter but did not comment further. The FDIC and OCC didn’t respond to a request for comment by the time of publication.
