Financial regulators would get more authority over tech providers under House bill

Two under-the-radar financial agencies currently have no power to oversee technology providers used by the entities they regulate, making them outliers among their federal peers. A new bill in the House would change that.

The Strengthening Oversight for the Financial Sector Act (H.R.10230) from Rep. Bill Foster would grant those authorities to the National Credit Union Administration and the Federal Housing Finance Agency, a move that the Illinois Democrat believes is essential in the artificial intelligence age.

“As AI makes cyberattacks more sophisticated, it is even more important to ensure that third-party vendors don’t become a weak link in our financial system,” Foster, ranking member of the House Financial Services Subcommittee on Financial Institutions, said in a press release Wednesday.

The NCUA was previously granted temporary oversight of third-party vendors used by the financial services sector. Those powers have since lapsed, however, leaving what Foster’s office referred to in the press release as a “dangerous gap in oversight” due to the “new risks” financial services companies face amid the proliferation of AI-fueled cyberattacks. 

The legislation would amend requirements in the Federal Credit Union Act for the “regulation and examination of credit union organizations and service providers,” per the bill text. The FHFA director would then be granted regulatory authority over services used by Federal Home Loan Banks and government-sponsored enterprises, among others.

The Defense Credit Union Council quickly came out against the bill, sending a letter to Foster’s office Thursday that made the case that the changes are more sweeping than the cybersecurity problems that the bill aims to address.

Anthony Hernandez, president of DCUC, argued that “Congress should first identify the specific regulatory gap, determine why existing authorities and interagency processes are insufficient, and consult directly with the credit unions that would bear the costs and operational consequences of this proposal.” 

The press release from Foster, a particle physicist by training who served on the House’s bipartisan AI task force, noted that previous NCUA and FHFA directors from both sides of the aisle have requested the authority to oversee third-party vendors. 

Additionally, the Government Accountability Office and the Financial Stability Oversight Council “have made similar recommendations regarding the need for oversight of third-party vendors’ vulnerabilities to AI risk,” the press release stated. 

A previous version of the bill advanced out of the House Financial Services Committee two Congresses ago, but never received a vote before the full chamber. 

“We have learned the hard way how much damage supply chain vulnerabilities can cause, and third-party vendors are attractive targets,” Foster said. “This bill will give regulators the tools they need to better protect Americans’ money and sensitive data as AI-assisted cyber threats grow.”