Federal Reserve's 2026 Report to Congress Details Cybersecurity Supervision and Emerging Risks

Key Takeaways

• The Federal Reserve's annual Cybersecurity and Financial System Resilience Report outlines its supervisory framework, internal security programs, and emerging threats including AI, quantum computing, and third-party risk.
• Compliance teams at Board-supervised institutions should note the continued emphasis on tailored, risk-based examinations, updated supervisory operating principles, and heightened scrutiny of third-party service providers and incident notification timelines.

Deep Dive

This report, mandated under the Consolidated Appropriations Act, 2021, provides Congress with an annual update on the Federal Reserve's cybersecurity oversight activities. For compliance teams, the report serves as a reaffirmation that cybersecurity remains a top supervisory priority, with the Board applying differentiated expectations based on institution size and complexity. Community banks (under USD $10 Billion in assets) and regional banks (USD $10 Billion to USD $100 Billion) continue to be evaluated primarily through the Uniform Rating System for Information Technology (URSIT) and the InTREx program, while large institutions (USD $100 Billion or more) and the eight U.S. global systemically important banks (G-SIBs) face common-scope and joint examinations with the OCC and FDIC.

A key development is the April 2026 "Updated Statement of Supervisory Operating Principles," which supersedes the October 2025 version and directs examiners to rely more heavily on primary state or federal regulators' work, tailor supervision by institution risk profile, and prioritize material financial risks—explicitly recognizing cyber incidents as a potential driver of such risk. Compliance teams should review how this updated posture may affect the frequency, scope, and intensity of upcoming IT and cybersecurity examinations, particularly for institutions that are not G-SIBs or LFBOs.

The report also reinforces existing obligations under the Computer-Security Incident Notification Rule, requiring banking organizations to notify their primary federal regulator within 36 hours of determining a notification incident has occurred, and requiring bank service providers to promptly notify affected banking organization customers. Firms should ensure incident response playbooks, escalation protocols, and third-party contractual notification clauses remain aligned with this timeline. Additionally, the Board's continued use of the Bank Service Company Act authority to jointly supervise critical technology service providers (via URSIT ratings and confidential examination reports) underscores the need for robust third-party risk management programs and active monitoring of service provider examination outcomes.

Looking forward, the report flags emerging risks—artificial intelligence, geopolitical tensions, cyber-criminal activity, third-party/vendor risk, and quantum computing—as areas likely to shape future supervisory expectations and guidance. Compliance and risk teams should proactively assess their organization's exposure to these themes, particularly AI governance and quantum-readiness of cryptographic systems, and monitor for forthcoming Federal Reserve guidance, rulemakings, or updated examination handbooks addressing these areas. No new binding requirements were introduced in this report itself, but it signals the direction of regulatory focus and should inform internal risk assessments, board reporting, and examination readiness.

Source: Board of Governors of the Federal Reserve System