Bank Information Technology Issuances

These issuances provide information to national banks and federal savings associations (collectively, banks) about bank information technology activities and situations that could affect the safe and sound management of banks.

Bulletins

Date	ID	Title
05/05/2025	OCC 2025-8	Bank Activities: Request for Information on Community Bank Digitalization
03/19/2025	OCC 2025-3	Digitalization: Resources for Community Banks
09/13/2024	OCC 2024-27	Bank-Fintech Arrangements: Agencies Extend Comment Period on Request for Information on Arrangements Involving Banking Products and Services Distributed to Consumers and Businesses
09/05/2024	OCC 2024-26	FFIEC Information Technology Examination Handbook: New Development, Acquisition, and Maintenance Booklet
08/29/2024	OCC 2024-25	Cybersecurity: FFIEC Cybersecurity Assessment Tool Sunset Statement
07/25/2024	OCC 2024-21	Bank-Fintech Arrangements: Request for Information on Arrangements Involving Banking Products and Services Distributed to Consumers and Businesses
07/25/2024	OCC 2024-20	Third-Party Arrangements: Joint Statement on Banks' Arrangements With Third Parties to Deliver Bank Deposit Products and Services
05/03/2024	OCC 2024-11	Third-Party Relationships: A Guide for Community Banks
06/26/2023	OCC 2023-22	Cybersecurity: Cybersecurity Supervision Work Program
06/06/2023	OCC 2023-17	Third-Party Relationships: Interagency Guidance on Risk Management
10/06/2022	OCC 2022-22	Cybersecurity: 2022 Cybersecurity Resource Guide for Financial Institutions
03/29/2022	OCC 2022-8	Information Technology: OCC Points of Contact for Banks’ Computer-Security Incident Notifications
11/23/2021	OCC 2021-56	Crypto-Assets: Joint Statement on Crypto-Asset Policy Sprint Initiative and Next Steps
11/23/2021	OCC 2021-55	Computer-Security Incident Notification: Final Rule
09/10/2021	OCC 2021-42	Third-Party Relationships: Agencies Extend Comment Period on Proposed Interagency Guidance
08/27/2021	OCC 2021-40	Third-Party Relationships: Conducting Due Diligence on Financial Technology Companies: A Guide for Community Banks
08/11/2021	OCC 2021-36	Information Security: FFIEC Statement on Authentication and Access to Financial Institution Services and Systems
06/30/2021	OCC 2021-30	FFIEC Information Technology Examination Handbook: New Architecture, Infrastructure, and Operations Booklet
03/31/2021	OCC 2021-17	Artificial Intelligence: Request for Information on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning
01/14/2021	OCC 2021-3	Computer-Security Incident Notification: Notice of Proposed Rulemaking
10/30/2020	OCC 2020-94	Operational Risk: Sound Practices to Strengthen Operational Resilience
06/04/2020	OCC 2020-59	National Bank and Federal Savings Association Digital Activities: Advance Notice of Proposed Rulemaking
04/30/2020	OCC 2020-46	Cybersecurity: Joint Statement on Security in a Cloud Computing Environment
03/25/2020	OCC 2020-23	Pandemic Planning: Essential Critical Infrastructure Workers in the Financial Services Sector
03/19/2020	OCC 2020-19	Pandemic Planning: Joint Statement on Community Reinvestment Act Consideration for Activities in Response to COVID-19
03/19/2020	OCC 2020-17	Pandemic Planning: Joint Questions and Answers Regarding Statement About the Use of Capital and Liquidity Buffers
03/06/2020	OCC 2020-13	Pandemic Planning: Updated FFIEC Guidance
01/16/2020	OCC 2020-5	Cybersecurity: Joint Statement on Heightened Cybersecurity Risk
11/14/2019	OCC 2019-57	FFIEC Information Technology Examination Handbook: Revised Business Continuity Management Booklet
07/24/2019	OCC 2019-37	Operational Risk: Fraud Risk Management Principles
11/05/2018	OCC 2018-40	Cybersecurity: Cyber-Related Sanctions
04/11/2018	OCC 2018-8	Cyber Insurance: FFIEC Joint Statement on Cyber Insurance and Its Potential Role in Risk Management Programs
10/20/2017	OCC 2017-43	New, Modified, or Expanded Bank Products and Services: Risk Management Principles
01/24/2017	OCC 2017-7	Third-Party Relationships: Supplemental Examination Procedures
10/17/2016	OCC 2016-34	Cybersecurity: Frequently Asked Questions on the FFIEC Cybersecurity Assessment Tool
09/09/2016	OCC 2016-27	FFIEC Information Technology Examination Handbook: Revised Information Security Booklet
06/07/2016	OCC 2016-18	Cybersecurity of Interbank Messaging and Wholesale Payment Networks: FFIEC Statement
04/29/2016	OCC 2016-14	FFIEC Information Technology Examination Handbook: Mobile Financial Services, New Appendix to the Retail Payment Systems Booklet
03/21/2016	OCC 2016-10	Prepaid Cards: Interagency Guidance to Issuing Banks on Applying Customer Identification Program Requirements for Holders of Prepaid Cards
11/10/2015	OCC 2015-44	FFIEC Information Technology Examination Handbook: Revised Management Booklet
11/03/2015	OCC 2015-40	Cybersecurity: Joint Statement on Cyber Attacks Involving Extortion
06/30/2015	OCC 2015-31	Cybersecurity: FFIEC Cybersecurity Assessment Tool
03/30/2015	OCC 2015-20	Cybersecurity: Destructive Malware Joint Statement
03/30/2015	OCC 2015-19	Cybersecurity: Cyber Attacks Compromising Credentials Joint Statement
02/06/2015	OCC 2015-9	FFIEC Information Technology Examination Handbook: Strengthening the Resilience of Outsourced Technology Services, New Appendix for Business Continuity Planning Booklet
11/03/2014	OCC 2014-53	Cybersecurity: Cybersecurity Assessment General Observations and Statement
09/26/2014	OCC 2014-48	Bourne-Again Shell (Bash) "Shellshock" Vulnerability: FFIEC Alert
08/20/2014	OCC 2014-41	Merchant Processing: Revised Comptroller's Handbook Booklet
04/25/2014	OCC 2014-17	Information Security Vulnerability in OpenSSL: Joint Statement
04/03/2014	OCC 2014-14	Distributed Denial-of-Service Cyber Attacks, Risk Mitigation, and Additional Resources: Joint Statement
04/02/2014	OCC 2014-13	Cyber Attacks on Financial Institutions' ATM and Card Authorization Systems: Joint Statement
10/07/2013	OCC 2013-22	Windows XP Operating System: Joint Statement
10/31/2012	OCC 2012-34	Supervision of Technology Service Providers: FFIEC IT Examination Handbook Booklet Revision and Administrative Guidelines for Interagency Supervisory Programs
06/28/2011	OCC 2011-27	Prepaid Access Programs
03/29/2011	OCC 2011-11	Collective Investment Funds: Risk Management Elements: Collective Investment Funds and Outsourced Arrangements
05/20/2010	OCC 2010-17	Unlawful Internet Gambling Enforcement Act of 2006: Examination Procedures
01/14/2009	OCC 2009-4	Remote Deposit Capture: Interagency Guidance
05/08/2008	OCC 2008-16	Information Security: Application Security
04/24/2008	OCC 2008-12	Payment Processors: Risk Management Guidance
09/01/2006	OCC 2006-39	Automated Clearing House Activities: Risk Management Guidance
08/15/2006	OCC 2006-35	Authentication in an Internet Banking Environment: Frequently Asked Questions
07/27/2006	OCC 2006-31	FFIEC Information Security Booklet: Information Security Guidance
06/15/2006	OCC 2006-26	Disaster Planning: Hurricane Katrina - Lessons Learned
03/15/2006	OCC 2006-12	Influenza Pandemic: Interagency Advisory
12/14/2005	OCC 2005-44	Small Entity Compliance Guide: Information Security
07/01/2005	OCC 2005-24	Threats from Fraudulent Bank Websites: Risk Mitigation and Response Guidance for Website Spoofing Incidents
04/14/2005	OCC 2005-13	Response Programs for Unauthorized Access to Customer Information and Customer Notice: Final Guidance: Interagency Guidance
10/27/2004	OCC 2004-47	FFIEC Guidance: Risk Management for the Use of Free and Open Source Software
09/08/2004	OCC 2004-42	FFIEC Customer Brochure: Protecting Customers’ Personal Financial Information
09/02/2004	OCC 2004-40	FFIEC Information Technology Examination Handbook: FFIEC IT Booklets on IT Operations and Wholesale Payment Systems
07/15/2004	OCC 2004-32	FFIEC Information Technology Examination Handbook: FFIEC IT Booklets on Outsourcing Technology Services and Management
10/02/2003	OCC 2003-41	FFIEC Information Technology Examination Handbook: E-Banking, Audit, and FedLine Booklets
04/23/2003	OCC 2003-15	Weblinking: Interagency Guidance on Weblinking Activity
04/08/2003	OCC 2003-14	Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System: Business continuity sound practices developed by the FRB, SEC, and OCC to ensure the continued functioning of critical financial services
03/27/2003	OCC 2003-13	Telecommunications Service Priority (TSP) Program: Policy on Sponsorship of TSP for Private Sector Entities
07/23/2002	OCC 2002-33	Government Emergency Telecommunications Service (GETS): FBIIC Policy on Sponsorship of GETS Cards for Private Sector Entities
05/15/2002	OCC 2002-16	Bank Use of Foreign-Based Third-Party Service Providers: Risk Management Guidance
07/18/2001	OCC 2001-35	Examination Procedures to Evaluate Compliance with the Guidelines to Safeguard Customer Information: Examination Procedures
02/28/2001	OCC 2001-12	Bank-Provided Account Aggregation Services: Guidance to Banks
05/15/2000	OCC 2000-14	Infrastructure Threats -- Intrusion Risks: Message to Bankers and Examiners
05/04/1999	OCC 1999-20	Certification Authority Systems: Guidance for Bankers and Examiners
07/30/1998	OCC 1998-31	Guidance on Electronic Financial Services and Consumer: FFIEC Guidance
05/12/1998	OCC 1998-22	Branch Names: Interagency Statement
02/04/1998	OCC 1998-3	Technology Risk Management: Guidance for Bankers and Examiners

FFIEC Statements

FFIEC Issues Statement on Safeguarding the Cybersecurity of Interbank Messaging and Payment Networks - June 7, 2016
The Federal Financial Institutions Examination Council (FFIEC), on behalf of its members, is issuing this statement, in light of recent cyber attacks, to remind financial institutions of the need to actively manage the risks associated with interbank messaging and wholesale payment networks.