Banking and Finance Law Daily Wrap Up, OVERSIGHT AND INVESTIGATION—OIG flags Fed offboarding failures mid-audit, (Sep 29, 2026)

By Colleen M. Svelnis, J.D.

The OIG acted before finishing its audit because it said the risks required immediate attention. Fed management concurred with all nine recommendations and said remediation was underway.

The Federal Reserve Board's Office of Inspector General (OIG) issued an early management alert on September 24, 2026, finding Fed-wide offboarding-control breakdowns after a 2024 sensitive-information removal incident remained unresolved for more than a year and the information was not fully retrieved. The OIG acted before finishing its audit because it said the risks required immediate attention. Fed management concurred with all nine recommendations, said remediation was underway, and assigned its technology division a larger role in monitoring, escalation, resolution, and access restrictions. The OIG plans to resume audit fieldwork and account for implemented corrective actions in its final report.

The incident involved an employee in the Division of International Finance who retired in July 2024. During the preceding 90 days, the employee triggered 279 data loss prevention (DLP) alerts; the system identified 111 as potentially involving Federal Open Market Committee (FOMC) classified information and 40 as potentially involving restricted Federal Reserve material. Of the total, 227 arose in June, including 192 three days before restricted-country travel; 141 of those 192 were potentially FOMC classified or restricted Fed material.

The Office of Investigations nevertheless found insufficient grounds to pursue employee misconduct because available records did not clearly establish what was removed and many alerts were confirmed as false positives. That determination did not resolve the control concerns: after two follow-up contacts, the former employee stopped responding, no further attempt was made, and responsible groups did not determine the incident's status after updates ceased.

Control and escalation failures. OIG found that group-level procedures did not supply enterprise standards for escalation or interdivision coordination. The Fed lacked procedures to confirm incidents, set reasonable resolution periods, coordinate assessments, or define escalation thresholds, and its incident plans lacked criteria for reporting to the Core Response Group. OIG warned that without stronger oversight, escalation, and incident response, those weaknesses were likely to persist and raise the risk of a major information-security breach.

Offboarding controls also failed to account sufficiently for the employee's history, procedural violations, and removal activity around travel and retirement, the OIG found. The employee's personal identity verification (PIV) card remained active for six days after separation, although logical access ended after one day; officials could not determine whether the card was used. The OIG also found inconsistent escalation of the possible FOMC incident and unclear policies on how deeply to review suspected removals or who could disconnect devices during a threat.

The watchdog further identified no Fed-wide lookback requirement, no standard independent check of transferred file contents or predeparture DLP-log review, and a handling standard that did not bar all unencrypted removable storage. A 2019 OIG recommendation for a Fed-wide offboarding DLP-log review remained open. The OIG attributed the unresolved incident to collective failures among the employee's division, the FOMC Secretariat, records-management staff, and information-security operations, which did not escalate the matter to officials able to resolve it.

Recommendations. Fed management concurred with all nine recommendations. Its plans include defining roles and strengthening escalation protocols by the first quarter of 2027; enhancing monitoring and escalation through a new DLP system by the third quarter; updating removal policy, procedures, and training by the second quarter; and revising escalation, resolution, and access-restriction processes by the third quarter. Monetary Affairs also plans to seek FOMC program updates by the fourth quarter of 2027, subject to FOMC approval.

Recommendations 7 through 9 call for closing the 2019 DLP-log review recommendation, creating a standard approved process for departing personnel to transfer information, and eliminating legacy unencrypted storage while barring new unencrypted devices. The Fed plans by the third quarter of 2027 to implement enhanced DLP logging and monitoring, standardize transfer controls, and extend restrictions to all unencrypted storage devices.

RegulatoryActivity: DirectorsOfficersEmployers FederalReserveSystem FOMC OversightInvestigations