Free reference 21 obligations

Which federal and regulator incident notice deadlines apply to banks and fintechs?

Name: Federal incident notification deadlines
Creator: RiskTemplates
License: https://creativecommons.org/licenses/by/4.0/

Short answer

This table lists 21 federal, regulator and contract notice obligations that an incident at a US bank or fintech can trigger, separate from state breach laws. The shortest fixed clocks are measured in hours: 24 hours for NYDFS extortion payment notice (24 hours); 36 hours for Bank regulator 36-hour notice (banking organization); 72 hours for Regulation S-P service provider 72-hour notice (contract term) and NYDFS 72-hour cybersecurity incident notice.

Which ones apply depends on what you are: a bank supervised by the OCC, Federal Reserve or FDIC must notify its primary federal regulator no later than 36 hours after determination; a bank service provider must notify its bank customers as soon as possible once 4+ hours of disruption is determined or reasonably likely; a non-bank financial institution under the FTC must notify the FTC no later than 30 days after discovery (500+ consumers). CIRCIA: proposed rule, not in effect as of September 30, 2026.

Last verified: September 30, 2026

Download CSV JSON

How to use this Sources

The clocks, shortest first

Each clock runs from its own trigger (see the table), so two obligations in the same column do not necessarily start at the same moment.

24 hours
- NYDFS extortion payment notice (24 hours)
36 hours
- Bank regulator 36-hour notice (banking organization)
72 hours
- Regulation S-P service provider 72-hour notice (contract term)
- NYDFS 72-hour cybersecurity incident notice
4 business days
- SEC Form 8-K Item 1.05 (material cybersecurity incident)
30 days
60 days
60 days after year-end
- HIPAA notice to HHS (fewer than 500, annual log)

As soon as possible (no fixed clock)

Bank service provider notice to bank customers
Interagency Guidance notice to primary federal regulator

Set by contract or policy

Card brands / acquirer notice (contract)
Bank partner notice (program agreement)
Cyber insurance notice (policy)

Before any ransom payment

OFAC sanctions check before any ransom payment

Not in effect

CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)

Which ones apply to me?

Grouped by the "applies to" text of each obligation. If you hold more than one role, combine the lists.

Bank supervised by the OCC, Federal Reserve or FDIC (2)

Bank regulator 36-hour notice (banking organization) — No later than 36 hours after determination
Applies to: Banking organizations supervised by the OCC, Federal Reserve or FDIC (not a non-bank fintech; its partner bank files this).
Interagency Guidance notice to primary federal regulator — As soon as possible - no fixed clock
Applies to: Banks and other institutions subject to the 2005 Interagency Guidance on Response Programs.

Bank service provider (Bank Service Company Act) (1)

Bank service provider notice to bank customers — As soon as possible once 4+ hours of disruption is determined or reasonably likely
Applies to: Bank service providers performing covered services (Bank Service Company Act) for a banking organization.

Non-bank fintech under the FTC Safeguards Rule (1)

FTC Safeguards Rule notice to the FTC — No later than 30 days after discovery (500+ consumers)
Applies to: Non-bank financial institutions under FTC jurisdiction (for example lenders, money transmitters, payment apps).

Fintech in a bank partnership or BaaS program (1)

Bank partner notice (program agreement) — Program agreement hours
Applies to: Fintechs in bank partnership and banking-as-a-service (BaaS) programs.

SEC registrant, public company, or service provider to an SEC covered institution (3)

SEC Form 8-K Item 1.05 (material cybersecurity incident) — 4 business days after the materiality determination
Applies to: Public companies that file reports with the SEC.
SEC Regulation S-P customer notice — No later than 30 days after becoming aware
Applies to: Broker-dealers, investment companies, and investment advisers and transfer agents registered with the SEC (covered institutions).
Regulation S-P service provider 72-hour notice (contract term) — No later than 72 hours after becoming aware (contract term)
Applies to: Service providers to SEC covered institutions.

NYDFS-covered entity (23 NYCRR 500) (3)

NYDFS 72-hour cybersecurity incident notice — No later than 72 hours after determination
Applies to: Entities licensed or regulated by the New York State Department of Financial Services (23 NYCRR 500 covered entities).
NYDFS extortion payment notice (24 hours) — Within 24 hours of the payment
Applies to: NYDFS covered entities.
NYDFS extortion payment written explanation (30 days) — Within 30 days of the payment
Applies to: NYDFS covered entities.

HIPAA covered entity or business associate (5)

HIPAA business associate notice to covered entity — No later than 60 calendar days after discovery
Applies to: HIPAA business associates (for example a fintech processing health-plan payments for a covered entity).
HIPAA covered entity notice to individuals — No later than 60 calendar days after discovery
Applies to: HIPAA covered entities.
HIPAA notice to HHS (500 or more individuals) — With individual notice (no later than 60 days after discovery)
Applies to: HIPAA covered entities.
HIPAA notice to HHS (fewer than 500, annual log) — 60 days after the end of the calendar year
Applies to: HIPAA covered entities.
HIPAA media notice (more than 500 residents of a state) — No later than 60 calendar days after discovery
Applies to: HIPAA covered entities.

Health app or personal health record vendor outside HIPAA (1)

FTC Health Breach Notification Rule notice to the FTC (500 or more) — With individual notice (no later than 60 calendar days)
Applies to: Vendors of personal health records and related entities not covered by HIPAA.

Anyone (card data, cyber insurance, ransom decisions) (3)

Card brands / acquirer notice (contract) — Contract hours
Applies to: Merchants and service providers that store, process or transmit payment card data.
Cyber insurance notice (policy) — Policy notice hours
Applies to: Policyholders.
OFAC sanctions check before any ransom payment — Checklist item before any payment
Applies to: Anyone considering, making or facilitating a ransomware payment.

Critical infrastructure (future CIRCIA rule) (1)

CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) — Proposed rule - not in effect
Applies to: Covered entities to be defined in the final rule from the Cybersecurity and Infrastructure Security Agency (CISA).

All 21 obligations

The deadline column is the short form; open "Full rule" for the rule text from the review. Contract rows have no public source: the terms are in your agreement or policy.

Federal, regulator and contract incident notification obligations, last verified September 30, 2026
Obligation	Applies to	What starts the clock	Deadline	Citation	Status	Last verified
Bank regulator 36-hour notice (banking organization)	Banking organizations supervised by the OCC, Federal Reserve or FDIC (not a non-bank fintech; its partner bank files this).	Determination that a notification incident occurred (a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, the bank's operations, business lines or services).	No later than 36 hours after determination Hours after trigger Full rule Primary federal regulator must receive notice as soon as possible and no later than 36 hours after the determination.	12 CFR 53.3; 12 CFR 225.302; 12 CFR 304.23 (Computer-Security Incident Notification rule) Notes Compliance date May 1, 2022 (86 FR 66424, Nov 23, 2021). Often called the "36-hour rule".	In effect	2026-09-30
Bank service provider notice to bank customers	Bank service providers performing covered services (Bank Service Company Act) for a banking organization.	Determination that a computer-security incident has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for 4 or more hours.	As soon as possible once 4+ hours of disruption is determined or reasonably likely As soon as possible - no fixed clock Full rule Notify at least one bank-designated point of contact at each affected bank as soon as possible. No designated contact: notify the CEO and CIO (or two individuals of comparable responsibility).	12 CFR 53.4; 12 CFR 225.303; 12 CFR 304.24 Notes Does not apply to scheduled maintenance, testing or software updates previously communicated to the bank.	In effect	2026-09-30
SEC Form 8-K Item 1.05 (material cybersecurity incident)	Public companies that file reports with the SEC.	Determination that the cybersecurity incident is material.	4 business days after the materiality determination Business days after trigger (federal holidays excluded) Full rule File Form 8-K within 4 business days after the materiality determination (the U.S. Attorney General can authorize a national-security delay).	Form 8-K Item 1.05; 17 CFR 229.106 (annual Form 10-K disclosure) Notes Adopted Jul 26, 2023; effective Sep 5, 2023; Item 1.05 compliance began Dec 18, 2023 (smaller reporting companies 180 days later). A 2025 petition to rescind Item 1.05 (SEC file 4-856) is pending; the Federal Register shows no SEC proposal to amend or rescind it through Sep 30, 2026, so the rule is in force. Business days skip weekends and federal holidays.	In effect	2026-09-30
SEC Regulation S-P customer notice	Broker-dealers, investment companies, and investment advisers and transfer agents registered with the SEC (covered institutions).	Becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.	No later than 30 days after becoming aware Calendar days after trigger Full rule Notify affected individuals as soon as practicable, but not later than 30 days. Not required if a reasonable investigation determines sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.	17 CFR 248.30 (Regulation S-P, as amended 2024) Notes Compliance dates: larger entities Dec 3, 2025; smaller entities Jun 3, 2026 (89 FR 47688).	In effect	2026-09-30
Regulation S-P service provider 72-hour notice (contract term)	Service providers to SEC covered institutions.	Becoming aware of a breach in security resulting in unauthorized access to a customer information system the service provider maintains.	No later than 72 hours after becoming aware (contract term) Hours after trigger Full rule Notify the covered institution as soon as possible, no later than 72 hours. The rule makes the covered institution require this of its providers (policies and contracts); it is not imposed on the provider directly.	17 CFR 248.30 (service provider oversight) Notes Check your contract with the covered institution for the exact term.	In effect	2026-09-30
FTC Safeguards Rule notice to the FTC	Non-bank financial institutions under FTC jurisdiction (for example lenders, money transmitters, payment apps).	Discovery of a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers.	No later than 30 days after discovery (500+ consumers) Calendar days after trigger Full rule Notify the FTC electronically as soon as possible, and no later than 30 days after discovery.	16 CFR 314.4(j); 16 CFR 314.2 (notification event) Notes Effective May 13, 2024 (88 FR 77499). A written incident response plan is a separate requirement (314.4(h), from the 2021 amendment, 86 FR 70272).	In effect	2026-09-30
NYDFS 72-hour cybersecurity incident notice	Entities licensed or regulated by the New York State Department of Financial Services (23 NYCRR 500 covered entities).	Determination that a cybersecurity incident occurred at the entity, an affiliate or a third-party service provider.	No later than 72 hours after determination Hours after trigger Full rule Notify DFS as promptly as possible, no later than 72 hours after the determination. A cybersecurity incident (500.1(g)) is a cybersecurity event that (1) impacts the covered entity and requires it to notify a government body, self-regulatory agency or other supervisory body (for example a state attorney general or regulator, or the FTC; a notice to consumers alone does not count), (2) is reasonably likely to materially harm a material part of normal operations, or (3) deploys ransomware in a material part of information systems.	23 NYCRR 500.17(a) (as amended Nov 1, 2023)	In effect	2026-09-30
NYDFS extortion payment notice (24 hours)	NYDFS covered entities.	An extortion payment made in connection with a cybersecurity event.	Within 24 hours of the payment Hours after trigger Full rule Notify DFS of the payment within 24 hours of the payment.	23 NYCRR 500.17(c)(1)	In effect	2026-09-30
NYDFS extortion payment written explanation (30 days)	NYDFS covered entities.	An extortion payment made in connection with a cybersecurity event.	Within 30 days of the payment Calendar days after trigger Full rule Within 30 days of the payment, file a written description of why payment was necessary, alternatives considered, diligence to find alternatives, and diligence to ensure compliance with applicable rules, including OFAC (Office of Foreign Assets Control) rules.	23 NYCRR 500.17(c)(2)	In effect	2026-09-30
HIPAA business associate notice to covered entity	HIPAA business associates (for example a fintech processing health-plan payments for a covered entity).	Discovery of a breach of unsecured protected health information.	No later than 60 calendar days after discovery Calendar days after trigger Full rule Notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery.	45 CFR 164.410	In effect	2026-09-30
HIPAA covered entity notice to individuals	HIPAA covered entities.	Discovery of a breach of unsecured protected health information.	No later than 60 calendar days after discovery Calendar days after trigger Full rule Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery.	45 CFR 164.404	In effect	2026-09-30
HIPAA notice to HHS (500 or more individuals)	HIPAA covered entities.	Discovery of a breach of unsecured protected health information.	With individual notice (no later than 60 days after discovery) Calendar days after trigger Full rule Notify the Department of Health and Human Services (HHS) contemporaneously with individual notice (so no later than 60 calendar days after discovery).	45 CFR 164.408(b) Notes HIPAA does not require you to involve law enforcement; 164.412 only allows a delay when law enforcement asks for one.	In effect	2026-09-30
HIPAA notice to HHS (fewer than 500, annual log)	HIPAA covered entities.	Discovery of a breach of unsecured protected health information.	60 days after the end of the calendar year 60 days after the end of the calendar year Full rule Log the breach and report it to HHS no later than 60 days after the end of the calendar year of discovery.	45 CFR 164.408(c)	In effect	2026-09-30
HIPAA media notice (more than 500 residents of a state)	HIPAA covered entities.	Discovery of a breach involving more than 500 residents of a state or jurisdiction.	No later than 60 calendar days after discovery Calendar days after trigger Full rule Notify prominent media outlets serving the state no later than 60 calendar days after discovery.	45 CFR 164.406	In effect	2026-09-30
FTC Health Breach Notification Rule notice to the FTC (500 or more)	Vendors of personal health records and related entities not covered by HIPAA.	Discovery of a breach of security of unsecured personal health record information.	With individual notice (no later than 60 calendar days) Calendar days after trigger Full rule Notify the FTC contemporaneously with individual notice, which is due without unreasonable delay and within 60 calendar days. Fewer than 500: log and report within 60 calendar days after year-end.	16 CFR 318.4 (amended; effective July 29, 2024) Notes The older 10-business-day FTC notice is from the 2009 version and no longer applies.	In effect	2026-09-30
Interagency Guidance notice to primary federal regulator	Banks and other institutions subject to the 2005 Interagency Guidance on Response Programs.	Becoming aware of an incident of unauthorized access to sensitive customer information.	As soon as possible - no fixed clock As soon as possible - no fixed clock Full rule Notify the primary federal regulator as soon as possible (no fixed clock). Notify affected customers as soon as possible if misuse has occurred or is reasonably possible; a written law-enforcement request can delay customer notice.	12 CFR Part 30, App. B, Supplement A (Interagency Guidance on Response Programs, 2005) Notes Service-provider contracts should require notice to the institution as soon as possible.	In effect	2026-09-30
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)	Covered entities to be defined in the final rule from the Cybersecurity and Infrastructure Security Agency (CISA).	None yet.	Proposed rule - not in effect Information only Full rule Proposed rule only (published Apr 4, 2024, 89 FR 23644). No final rule as of September 30, 2026, so no reporting clock is in effect. Information only.	89 FR 23644 (proposed rule) Notes CISA held further town halls in 2026 (91 FR 6794; 91 FR 30498) and gives no final-rule date.	Proposed rule - not in effect	2026-09-30
Card brands / acquirer notice (contract)	Merchants and service providers that store, process or transmit payment card data.	As defined in card-brand rules and your acquirer or processor agreement.	Contract hours Contract or policy hours Full rule Per contract and card-brand rules; use the hours set in your contract. PCI DSS v4.0.1 itself sets no hour deadline.	Card-brand rules and acquirer/processor agreement; PCI DSS v4.0.1 Notes PCI DSS v4.0.1 (published Jun 11, 2024) is the only active version.	Contract or policy term	2026-09-30
Bank partner notice (program agreement)	Fintechs in bank partnership and banking-as-a-service (BaaS) programs.	As defined in the program agreement (often detection or confirmation of an incident).	Program agreement hours Contract or policy hours Full rule Notice within the hours set in your program agreement. Track follow-up deliverables such as a root-cause report separately.	Your bank partner program agreement	Contract or policy term	2026-09-30
Cyber insurance notice (policy)	Policyholders.	As defined in the policy.	Policy notice hours Contract or policy hours Full rule Notice within the policy's notice period. Check whether the policy requires panel vendors or insurer consent before you engage forensics or counsel.	Your cyber insurance policy	Contract or policy term	2026-09-30
OFAC sanctions check before any ransom payment	Anyone considering, making or facilitating a ransomware payment.	Before any payment is made or facilitated.	Checklist item before any payment Checklist item Full rule Checklist item, not a clock: screen the recipient for sanctions exposure and document the decision. OFAC treats proactive steps, including reporting to and cooperating with law enforcement, as mitigating factors.	OFAC Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sep 21, 2021) Notes Record when the check was completed.	Checklist item (no clock)	2026-09-30

Run these clocks per incident in the Incident Response & Breach Notification Kit: its Regulatory Clocks tab calculates each fixed deadline from the trigger time you enter. State breach laws are on the state breach notification chart.

◆ How to use this

Read the row, then read the statute.

Decide which roles your company holds (bank, bank service provider, FTC-regulated non-bank, SEC registrant, NYDFS licensee, HIPAA entity, card merchant, BaaS partner). Several can apply at once.
For each obligation that applies, record the exact event in "What starts the clock" and its date and time. Hour-based clocks run from that moment.
Business-day rules (SEC Form 8-K) skip weekends and federal holidays; calendar-day rules do not.
Pull the hour counts for bank partner, card brand and cyber insurance notice from your contracts and policy; they are not set by regulation.
Read the full rule and citation before filing. The deadline column is a summary.

Methodology

Each obligation was checked against the regulation or regulator text on September 30, 2026 (eCFR, Federal Register, SEC, NYDFS, CISA and OFAC pages), and the row links to the source used. 16 of 21 are rules in effect; the rest are contract or policy terms, a checklist item, or a proposed rule.

Not legal advice

This is a reference summary for risk and compliance teams, not legal advice. Laws change and how they apply depends on your facts. Confirm each obligation against the cited text and with counsel before you rely on a deadline.

◆ FAQ

Common questions.

What is the 36-hour rule for banks?

Primary federal regulator must receive notice as soon as possible and no later than 36 hours after the determination. The clock starts on: determination that a notification incident occurred (a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, the bank's operations, business lines or services). Applies to: Banking organizations supervised by the OCC, Federal Reserve or FDIC (not a non-bank fintech; its partner bank files this). Citation: 12 CFR 53.3; 12 CFR 225.302; 12 CFR 304.23 (Computer-Security Incident Notification rule). Compliance date May 1, 2022 (86 FR 66424, Nov 23, 2021). Often called the "36-hour rule".

Does a fintech have to file the 36-hour notice with bank regulators?

The 36-hour notice is filed by the bank: "Banking organizations supervised by the OCC, Federal Reserve or FDIC (not a non-bank fintech; its partner bank files this)." A fintech that provides covered services to a bank has its own duty as a bank service provider: Notify at least one bank-designated point of contact at each affected bank as soon as possible. No designated contact: notify the CEO and CIO (or two individuals of comparable responsibility). Fintechs in bank partnership and banking-as-a-service (BaaS) programs also owe notice within the hours set in their program agreement.

What is the FTC Safeguards Rule breach notification deadline?

Notify the FTC electronically as soon as possible, and no later than 30 days after discovery. It applies to non-bank financial institutions under FTC jurisdiction (for example lenders, money transmitters, payment apps). The trigger is discovery of a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers. Citation: 16 CFR 314.4(j); 16 CFR 314.2 (notification event). Effective May 13, 2024 (88 FR 77499). A written incident response plan is a separate requirement (314.4(h), from the 2021 amendment, 86 FR 70272).

When must a public company file Form 8-K for a cybersecurity incident?

File Form 8-K within 4 business days after the materiality determination (the U.S. Attorney General can authorize a national-security delay). Trigger: determination that the cybersecurity incident is material. Citation: Form 8-K Item 1.05; 17 CFR 229.106 (annual Form 10-K disclosure).

What are the NYDFS cybersecurity incident notice deadlines?

NYDFS 72-hour cybersecurity incident notice: no later than 72 hours after determination, under 23 NYCRR 500.17(a) (as amended Nov 1, 2023). NYDFS extortion payment notice (24 hours): within 24 hours of the payment, under 23 NYCRR 500.17(c)(1). NYDFS extortion payment written explanation (30 days): within 30 days of the payment, under 23 NYCRR 500.17(c)(2). Notify DFS as promptly as possible, no later than 72 hours after the determination. A cybersecurity incident (500.1(g)) is a cybersecurity event that (1) impacts the covered entity and requires it to notify a government body, self-regulatory agency or other supervisory body (for example a state attorney general or regulator, or the FTC; a notice to consumers alone does not count), (2) is reasonably likely to materially harm a material part of normal operations, or (3) deploys ransomware in a material part of information systems.

Is CIRCIA in effect?

No. Proposed rule only (published Apr 4, 2024, 89 FR 23644). No final rule as of September 30, 2026, so no reporting clock is in effect. Information only. CISA held further town halls in 2026 (91 FR 6794; 91 FR 30498) and gives no final-rule date.

◆ Sources

Primary sources.

The regulation or regulator page behind each row. Contract, card-brand and insurance rows point to your own agreements.

Data: CSV · JSON. Free to reuse under CC BY 4.0 with attribution to RiskTemplates and a link to this page. Last verified September 30, 2026.