Cybersecurity Policy Report, Federal Reserve highlights cybersecurity priorities for banking sector, payment systems, (Sep 8, 2026)

By Patricia K. Ruiz, J.D.

The report to Congress outlines supervisory oversight, resilience initiatives, and emerging risks tied to artificial intelligence, cybercrime, and quantum computing.

The Board of Governors of the Federal Reserve System said cybersecurity remains a top priority for the Federal Reserve System and Board-supervised institutions, describing supervisory programs, internal security measures, and coordination efforts intended to strengthen resilience throughout the financial sector. The agency's latest report to Congress outlines examination programs, incident-response efforts, information-sharing initiatives, and governance practices affecting financial institutions, service providers, payment systems, and financial market utilities. The report also identifies artificial intelligence, cyber-criminal activity, third-party dependencies, geopolitical tensions, and quantum-computing developments as significant risks to financial system resilience.

Supervisory oversight. According to the report, the Federal Reserve's supervision program includes issuing cybersecurity-related regulations, guidance, tools, and resources; examining cybersecurity and information-technology practices at supervised institutions; monitoring cybersecurity risk-management programs; and collecting cybersecurity incident data. The Board said its supervisory policies are intended to reduce risks to the financial system through effective cybersecurity practices and are supported by interagency information-security standards requiring banking organizations to implement safeguards protecting customer information.

The Board highlighted supervisory operating principles updated in 2026 that emphasize identifying significant risks early, tailoring supervision to the size and complexity of banking organizations, and prioritizing material financial risk. The report states that cybersecurity remains a top supervisory priority because cyber incidents can contribute significantly to material financial risk.

For the eight U.S. global systemically important banks, the Federal Reserve conducts joint cybersecurity examinations with the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation. The agency also conducts common-scope cybersecurity examinations across banking organizations with assets of $100 billion or more and uses continuous monitoring processes focused on cybersecurity, information-technology, and operational risks.

Internal cybersecurity programs. The report states that the Board's information-security program follows requirements established under the Federal Information Security Modernization Act and related National Institute of Standards and Technology standards. The Board said it continues implementing zero-trust security principles requiring continuous credential verification and is expanding supply-chain risk-management efforts intended to secure information and services involving third parties.

The Board oversees the cybersecurity risk-management posture of the Reserve Banks, which maintain a risk-based information-security program informed by NIST standards and industry best practices. Institutions accessing Reserve Bank services, including the Fedwire Funds Service, Fedwire Securities Service, FedACH, FedNow Service, and National Settlement Service, are subject to information-security requirements set forth in Operating Circular No. 5.

Examinations, findings, and incident response. The report describes the Federal Reserve's examination and monitoring activities involving cybersecurity governance, controls, and risk management at supervised institutions and certain third-party service providers. Supervisors may issue findings when cybersecurity deficiencies affect safety and soundness, violate regulations, or threaten financial stability. The Board said institutions are expected to address those findings promptly and may face supervisory or enforcement actions if deficiencies are not corrected.

The Board outlined supervisory incident-response processes designed to respond to cybersecurity incidents affecting supervised institutions and service providers. Under the Computer-Security Incident Notification Rule, banking organizations must notify their primary federal regulator of significant computer-security incidents as soon as possible and no later than 36 hours after determining that a notification incident has occurred. The Board said those notifications help regulators identify and respond to emerging threats.

Reserve Bank resilience efforts. According to the report, the Reserve Banks strengthened their cybersecurity posture through initiatives including development of artificial-intelligence deployment protocols, improvements to identity-and-access-management capabilities, and modernization of encryption technologies intended to address future quantum-computing risks. The Reserve Banks continued efforts to strengthen the security and operational resilience of Federal Reserve payment applications through testing designed to simulate cybersecurity scenarios and evaluate potential service disruptions.

Coordination and information sharing. The Board said it remains engaged in domestic and international forums focused on cybersecurity resilience. The report describes coordination through organizations including the Financial Stability Oversight Council, the Financial and Banking Information Infrastructure Committee, the Federal Financial Institutions Examination Council, and the Financial Services Information Sharing and Analysis Center. Activities include cybersecurity exercises, information sharing, incident-response planning, and development of guidance and resources for supervised institutions.

The Board reported participation in international efforts involving the Financial Stability Board, the Basel Committee on Banking Supervision, the Committee on Payments and Market Infrastructures, the International Association of Insurance Supervisors, and the Group of Seven Cyber Expert Group. Those efforts have included work on operational resilience, third-party risk management, cyber-incident reporting, artificial-intelligence risks, and post-quantum cryptography planning.

Inspector general reviews. The report discusses a February 2026 Office of Inspector General review concerning safeguards for confidential supervisory information in OASIS. The review identified one finding and made four recommendations addressing user-access controls, portfolio-specific access approaches, guidance for sensitive file folders, and access-review procedures. The Board said it submitted a management response and is implementing a plan to address the recommendations.

The report also notes that the OIG's 2025 assessment of the Board's information-security program rated the program at level 3 maturity, which was deemed "not effective" under the applicable FISMA framework. According to the report, the identified weaknesses were primarily governance-related rather than technical in nature. The Board said it has begun implementing a new information-security operating model and continues efforts to improve governance and restore an effective rating.

Artificial intelligence risks. The Board identified frontier artificial-intelligence models as presenting both opportunities and cybersecurity risks. According to the report, researchers have reported that advanced AI models can identify previously undiscovered vulnerabilities, create methods to exploit them, and link vulnerabilities into exploit chains capable of operating at machine speed. The Board said these developments raise concerns that malicious actors could gain access to vulnerability information or offensive AI capabilities before vulnerabilities are fully addressed across the financial sector.

Geopolitical threats. The report states that geopolitical tensions can increase the likelihood of cyberattacks targeting critical infrastructure and financial services because of the interconnected nature of global financial markets and international digital networks. The Board said destructive malware and other techniques designed to destroy or corrupt critical data have been observed and continue to evolve in sophistication and capability.

Cyber-criminal activity. The Board identified cyber-criminal activity as a continuing major threat to the U.S. financial sector, particularly for smaller community and regional banking organizations. The report highlights ransomware-as-a-service operations, phishing campaigns, malware-as-a-service and phishing-as-a-service offerings, exploitation of software vulnerabilities, and distributed-denial-of-service attacks as significant concerns for financial institutions.

Third-party dependencies. According to the report, financial institutions' reliance on third-party service providers creates significant cybersecurity risks because attacks affecting vendors, technology partners, cloud-service providers, or other external providers can have broad operational consequences. The Board also noted risks associated with cloud computing and improperly configured application programming interfaces that may increase exposure to data breaches involving sensitive customer information.

Quantum-computing risks. The report identifies quantum computing as a significant emerging risk because future quantum capabilities could render some widely used encryption standards obsolete. The Board pointed to ongoing work involving post-quantum cryptography and efforts by federal agencies and international organizations to encourage institutions to prepare for migration to quantum-resistant encryption technologies.

RegulatoryActivity: BankingOperations CrimesOffenses CyberPrivacyFeed DataSecurity FederalReserveSystem FinancialStability FinTech GCNNews OversightInvestigations DataPrivacy