Banking and Finance Law Daily Wrap Up, BANKING OPERATIONS—ABA, BPI back FAA drone restrictions for critical financial sites, (Jul 8, 2026)

By Charles A. Menke, J.D.

The groups said members operate thousands of facilities and warned unauthorized drones can aid surveillance, disruption, ransomware planning, fraud, and extortion.

The American Bankers Association (ABA) and the Bank Policy Institute (BPI) have written to the Federal Aviation Administration’s (FAA) expressing support for proposed restrictions on drone operations over certain critical infrastructure sites and urged the agency to finalize the rule with two banking-sector safeguards. In a June 30 comment letter, the groups asked the FAA to protect sensitive applicant information and to clarify that the proposal would not prevent a financial institution from using drones for its own lawful physical security purposes at an eligible financial services facility.

The proposed restrictions are on unmanned aircraft near fixed-site facilities. As described by the groups, the proposal would require applicants to show a site-specific need grounded in aviation safety, protecting people and property on the ground, national security, or homeland security. The groups said the framework is petition-based, with facility-specific justification, defined boundaries, FAA review, and limited exceptions for certain operations within a designated unmanned aircraft flight restriction. They said that structure would give compliant operators clear notice and help security teams and law enforcement distinguish authorized drone activity from activity that is suspicious or unlawful.

For banks, the requested restrictions are framed as an operational-resilience measure rather than a broad industry carveout. BPI and ABA said their members operate thousands of facilities that support financial-sector continuity, resilience, and security, and that unauthorized drones near those sites can support surveillance, hostile reconnaissance, operational disruption, emergency-response interference, and threats to people and core business functions. They also warned that drone activity can aid threat-actor reconnaissance for cyber intrusions, fraud, extortion, and ransomware attacks.

The groups endorsed a targeted eligibility approach. “Not every office or branch warrants a flight restriction,” they said, but certain financial services facilities perform functions whose disruption could impair payment flows, liquidity management, cash operations, data security, crisis response, or other core business functions. They said focusing on fixed-site critical infrastructure, rather than an entire industry, gives the FAA an administrable standard and gives applicants a clear burden to meet.

The first practical fix concerns applicant data. Because the proposal would require sensitive facility-risk information, BPI and ABA urged the FAA to implement robust data-security measures to avoid improper disclosure directly damaging to applicants. The groups also asked the FAA to let applicants rely on both site-specific activity and evidence of actual or potential risks at similarly situated critical infrastructure facilities when justifying a restriction for a financial institution-related site.

The second fix concerns banks’ own security drones. The groups asked the FAA to make clear that the framework deters unauthorized operations and does not disable lawful security operations conducted by or for a protected facility, including drones used for perimeter inspection, incident assessment, emergency-response support, or other security-related functions. They said clarification would reduce the risk that institutions forgo useful and lawful protective measures because of regulatory uncertainty.

Companies: American Bankers Association; Bank Policy Institute

RegulatoryActivity: BankingOperations CrimesOffenses FinancialStability FinTech Privacy