Banking Industry Calls for Rollback of Biden-Era Cybersecurity Disclosure Rule
Washington D.C. – A powerful coalition of banking industry groups is urging the Securities and Exchange Commission (SEC) to rescind a controversial cybersecurity breach notification rule implemented during the biden management. The groups argue the rule creates needless legal risks and fails to provide investors with genuinely useful details, potentially even increasing market volatility.
Key Takeaways:
The Rule: The SEC rule, adopted in July 2023, requires public companies to disclose “material” cybersecurity breaches within just four business days of determining materiality.
Industry Concerns: Banks argue this short timeframe forces premature disclosure before investigations are complete, exposing companies to legal liabilities based on potentially incomplete or inaccurate information.
New SEC Leadership: the push for rescission comes as newly appointed SEC Chairman paul Atkins, known for his preference for less burdensome regulation, settles into his role. Bipartisan Opposition: Republican lawmakers have already voiced concerns, urging the SEC to withdraw the rule as part of a broader effort to reduce regulatory burdens on businesses.
Why the Pushback Now?
The coalition – comprised of the Securities Industry and Financial Markets Association (SIFMA), the American Bankers Association, the Bank Policy Institute, the Institute of International Bankers, and Self-reliant Community Bankers of America – filed a petition last month outlining their concerns. They contend the rule’s rapid disclosure requirement doesn’t enhance investor protection, but instead creates a “signal dilution” where the constant stream of disclosures, even preliminary ones, obscures genuinely critical information.
“Mandating the public disclosure of a cybersecurity incident before it is indeed fully investigated or remediated creates significant and potentially costly legal exposure for registrants,” the groups wrote in their petition. “This is particularly true when disclosure is based on preliminary information…that may unintentionally be incomplete or inaccurate,and therefore may inadvertently misinform investors and fuel market volatility.”
Patrick Warren,VP of Regulatory Technology at BITS (the technology policy division of the Bank Policy Institute),emphasized the potential damage to the financial system. “We hope that the SEC will take action to rescind this rule’s premature disclosure requirements, which undermine the resiliency of the U.S. financial system.”
What to Expect Under Chairman Atkins?
Experts predict Atkins will be receptive to arguments against overly burdensome regulations. A recent analysis by law firm Proskauer Rose suggests he will prioritize regulations that “appropriately balance effectiveness and costs.” Though, Atkins has also indicated support for sensible regulation, suggesting a complete overhaul isn’t guaranteed.
The SEC declined to comment on the petition.
This challenge to the cybersecurity rule is part of a larger trend of Republican scrutiny of financial regulations enacted under the Biden administration. In March, House Financial Services Committee Republicans sent a letter to then-Acting Chairman Mark Uyeda, urging the agency to withdraw the rule, arguing it makes U.S. capital markets less attractive to companies.
The Rule’s Implementation & Clarification Attempts
The original rule, passed along party lines in a 3-2 vote, requires companies to determine the materiality of a breach “without unreasonable delay” and file a Form 8-K within four business days if deemed material.
The SEC attempted to address some concerns in May 2024, with then-Director of the Division of Corporation Finance, Erik Gerding, clarifying that the rule wasn’t intended to encompass immaterial incidents.Though, the industry coalition argues this clarification doesn’t go far enough to address the fundamental issues with the rule’s
