Proposed Rule2025-23856
Catastrophic Act Reporting
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
December 29, 2025
Issuing agencies
National Credit Union Administration
Abstract
The NCUA Board (Board) is publishing this proposed rule to amend the requirements for federally insured credit unions (FICUs) to report catastrophic acts to the agency. By providing more time for FICUs to notify the agency of the occurrence of a catastrophic act and by eliminating the specific list of items to be documented, the Board expects the proposed rule to reduce the compliance burden and allow FICUs to focus their resources on recovery and core functions without compromising safety and soundness.
Full Text
<html>
<head>
<title>Federal Register, Volume 90 Issue 245 (Monday, December 29, 2025)</title>
</head>
<body><pre>
[Federal Register Volume 90, Number 245 (Monday, December 29, 2025)]
[Proposed Rules]
[Pages 60591-60594]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2025-23856]
-----------------------------------------------------------------------
NATIONAL CREDIT UNION ADMINISTRATION
12 CFR Part 748
RIN 3133-AF77
Catastrophic Act Reporting
AGENCY: National Credit Union Administration (NCUA).
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The NCUA Board (Board) is publishing this proposed rule to
amend the requirements for federally insured credit unions (FICUs) to
report catastrophic acts to the agency. By providing more time for
FICUs to notify the agency of the occurrence of a catastrophic act and
by eliminating the specific list of items to be documented, the Board
expects the proposed rule to reduce the compliance burden and allow
FICUs to focus their resources on recovery and core functions without
compromising safety and soundness.
DATES: Comments must be received on or before February 27, 2026.
ADDRESSES: Comments may be submitted in one of the following ways.
(Please send comments by one method only):
<bullet> Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
The docket number for this proposed rule is NCUA-2025-1437. Follow the
``Submit a comment'' instructions. If you are reading this document on
<a href="http://federalregister.gov">federalregister.gov</a>, you may use the green ``SUBMIT A PUBLIC COMMENT''
button beneath this rulemaking's title to submit a comment to the
<a href="http://regulations.gov">regulations.gov</a> docket. A plain language summary of the proposed rule
is also available on the docket website.
<bullet> Mail: Address to Melane Conyers-Ausbrooks, Secretary of
the Board, National Credit Union Administration, 1775 Duke Street,
Alexandria, Virginia 22314-3428.
<bullet> Hand Delivery/Courier: Same as mailing address.
Mailed and hand-delivered comments must be received by the close of
the comment period.
Public inspection: Please follow the search instructions on <a href="https://www.regulations.gov">https://www.regulations.gov</a> to view the public comments. Do not include any
personally identifiable information (such as name, address, or other
contact information) or confidential business information that you do
not want publicly disclosed. All comments are public records; they are
publicly displayed exactly as received, and will not be deleted,
modified, or redacted. Comments may be submitted anonymously. If you
are unable to access public comments on the internet, you may contact
the NCUA for alternative access by calling (703) 518-6540 or emailing
<a href="/cdn-cgi/l/email-protection#0c434b4f416d65604c626f796d226b637a"><span class="__cf_email__" data-cfemail="622d25212f030b0e220c0117034c050d14">[email protected]</span></a>.
FOR FURTHER INFORMATION CONTACT: Gira Bose, Senior Staff Attorney, at
(703) 518-6540 or at 1775 Duke Street, Alexandria, VA 22314.
SUPPLEMENTARY INFORMATION:
I. Introduction
A. Background
Part 748 requires a FICU to notify the appropriate NCUA Regional
Director within five business days of any catastrophic act that occurs
at its office(s). NCUA regulations define a catastrophic act as ``any
disaster, natural or otherwise, resulting in physical destruction or
damage to the credit union or causing an interruption in vital member
services, as defined in Sec. 749.1 of this chapter, projected to last
more than two consecutive business days.'' \1\
[[Page 60592]]
The agency adopted this requirement under 12 U.S.C. 1785(e), which
requires the agency to promulgate rules establishing minimum safety
standards relating to security.
---------------------------------------------------------------------------
\1\ 12 CFR 748.1(b). See also 12 CFR 749, App. B, Catastrophic
Act Preparedness Guidelines. The NCUA has long required catastrophic
act reporting. In 1970, Congress amended the Federal Credit Union
Act (FCU Act) to require that the NCUA promulgate rules establishing
minimum standards for the installation, maintenance, and operation
of security devices and procedures to discourage robberies,
burglaries, and larcenies. The 1970 amendment to the FCU Act also
required the agency to adopt time limits for compliance and mandated
the submission of periodic reports. See 12 U.S.C. 1785(e) (Pub. L.
91-468) (84 Stat. 1002). Thus, since 1971, the NCUA has promulgated
regulations requiring the submission of reports within five working
days of an occurrence, or attempted occurrence, of a crime or
catastrophic act. See 36 FR 10940 (June 1, 1971). See also 47 FR
17981 (Apr. 27, 1982); 50 FR 53295 (Dec. 31, 1985).
---------------------------------------------------------------------------
In 2007, NCUA amended the definition of catastrophic act ``to
address concerns that relatively minor events could be construed to
trigger the need to file a report and, also, clarifying the causal link
between a disaster and an interruption in vital member services.'' \2\
The Board believed these changes to be ``consistent with the usual and
customary meaning of the word catastrophe.'' \3\ The Board stated,
``[t]hese changes also reinforce the Board's view that the reporting
requirement applies only to a disaster as opposed to a circumstance
where physical damage or a business closing occurs but is not disaster-
related.'' \4\ While natural disasters were the leading concern in the
aftermath of hurricanes Katrina and Rita, the use of the phrasing ``any
disaster, natural or otherwise'' in the definition of catastrophic act
was meant to illustrate other events, such as a power grid failure or
physical attack, for example, could have a similar impact on access to
member services and vital records.
---------------------------------------------------------------------------
\2\ 72 FR 42271 (Aug. 2, 2007).
\3\ Id.
\4\ Id.
---------------------------------------------------------------------------
B. Legal Authority
The Board is issuing this proposed rule pursuant to its authority
under the Federal Credit Union Act (FCU Act).\5\ Under the FCU Act, the
NCUA is the chartering and supervisory authority for federal credit
unions (FCUs) and the federal supervisory authority for federally
insured credit unions (FICUs). The FCU Act grants the NCUA a broad
mandate to issue regulations governing both FCUs and FICUs. Section 120
of the FCU Act is a general grant of regulatory authority and
authorizes the Board to prescribe regulations for the administration of
the FCU Act.\6\ Section 209 of the FCU Act is a plenary grant of
regulatory authority to the NCUA to issue regulations necessary or
appropriate to carry out its role as share insurer for all FICUs.\7\
The FCU Act also includes an express grant of authority for the Board
to subject federally chartered central, or corporate, credit unions to
such rules, regulations, and orders as the Board deems appropriate.\8\
---------------------------------------------------------------------------
\5\ 12 U.S.C. 1751 et seq.
\6\ 12 U.S.C. 1766(a).
\7\ 12 U.S.C. 1789.
\8\ 12 U.S.C. 1766(a).
---------------------------------------------------------------------------
II. Proposed Rule
The Board is proposing to further ease the reporting burden with
the following amendments. First, the proposal would amend the
regulation to require that credit unions notify ``NCUA'' rather than
the specific ``regional director.'' This change is intended to
modernize the reporting process and provide greater operational
flexibility for both FICUs and the agency. By designating ``NCUA'' as
the recipient, the agency can centralize and streamline the intake of
these critical reports, ensuring they are routed efficiently to the
appropriate personnel for response and monitoring. This change would
remove the burden on a credit union, which may be operating under
emergency conditions, to identify and direct its report to a specific
regional office.
Second, the proposal would extend the timeframe for submitting a
catastrophic act report from ``5 business days'' to ``15 calendar
days.'' The Board believes the current five-day deadline may be
impractical for an institution recovering from a significant
operational disruption. Extending the deadline to 15 calendar days
provides credit union management with a more reasonable amount of time
to stabilize operations, assess the full scope of the damage, and
provide a more accurate report to the agency. This change acknowledges
the significant operational challenges that follow a catastrophic act
and would allow a credit union to prioritize recovery efforts over
immediate administrative reporting.
Finally, the Board proposes to remove the prescriptive list of
items that a credit union should include in its internal record of a
catastrophic act and replace it with a requirement that a credit union
record the basic facts of the event. The current rule suggests
documenting details such as the location, timing, loss amount, and
potential operational deficiencies. While maintaining a record
containing the basic facts of an event is a prudent business practice,
the Board believes that specifying the exact contents of this internal
record to the degree currently required is an unnecessary and overly
prescriptive regulatory burden. FICUs already maintain records of such
events as part of their own business continuity and disaster recovery
planning. Removing the list of items in this sentence would reduce
administrative overhead and allow FICUs the flexibility to document
these incidents in a manner that best suits their operational and
recordkeeping policies, while still ensuring a record is created and
maintained. This change would also make the regulation clearer by
removing a provision that is phrased as a suggestion and not a
requirement with the use of the word ``should.''
Commenters are invited to provide feedback on these proposed
changes to the catastrophic act reporting requirements. Specifically,
the Board seeks feedback on whether the proposed amendments
appropriately balance the agency's need for timely information with the
operational burdens faced by FICUs during a crisis. The Board is also
seeking comment on whether credit unions should be permitted to use
existing notification tools, such as the form currently used to report
cybersecurity incidents under section 748.1(c), to report catastrophic
acts. Commenters are also invited to address whether the proposed 15-
calendar-day reporting timeframe is appropriate and whether the removal
of the recordkeeping elements would provide meaningful burden
reduction.
III. Regulatory Procedures
A. Providing Accountability Through Transparency Act of 2023
The Providing Accountability Through Transparency Act of 2023 (5
U.S.C. 553(b)(4)) (Act) requires that a notice of proposed rulemaking
include the internet address of a summary of not more than 100 words in
length of a proposed rule, in plain language, that shall be posted on
the internet website under section 206(d) of the E-Government Act of
2002 (44 U.S.C. 3501 note) (commonly known as <a href="http://regulations.gov">regulations.gov</a>). The
Act, under its terms, applies to notices of proposed rulemaking and
does not expressly include other types of documents that the Board
publishes voluntarily for public comment, such as notices and interim-
final rules that request comment despite invoking ``good cause'' to
forgo such notice and public procedure. The Board, however, has elected
to address the Act's requirement in these types of documents in the
interests of administrative consistency and transparency.
In summary, NCUA is publishing this proposed rule to amend the
[[Page 60593]]
requirements for FICUs to report catastrophic acts to the agency. By
providing more time for FICUs to notify the agency of the occurrence of
a catastrophic act and by eliminating the specific list of items to be
documented, the Board expects the proposed rule to reduce their
compliance burden and allow FICUs to focus their resources on recovery
and core functions without compromising safety and soundness.
The proposal and the required summary can be found at <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
B. Executive Orders 12866, 13563, and 14192
Pursuant to Executive Order 12866 (``Regulatory Planning and
Review''), as amended by Executive Order 14215, a determination must be
made whether a regulatory action is significant and therefore subject
to review by the Office of Management and Budget (OMB) in accordance
with the requirements of the Executive Order.\9\ Executive Order 13563
(``Improving Regulation and Regulatory Review'') supplements and
reaffirms the principles, structures, and definitions governing
contemporary regulatory review established in Executive Order
12866.\10\ This proposed rule was drafted and reviewed in accordance
with Executive Order 12866 and Executive Order 13563. OMB has
determined that this proposed rule is not a ``significant regulatory
action'' as defined in section 3(f)(1) of Executive Order 12866.
Further, this proposed rule is consistent with Executive Order 13563.
The proposed rule will reduce the burden of catastrophic act reporting
by increasing the time FICUs have to report to the agency and giving
them the flexibility to determine what to incorporate into their record
of an incident.
---------------------------------------------------------------------------
\9\ 58 FR 51735 (Oct. 4, 1993).
\10\ 76 FR 3821 (Jan.21, 2011).
---------------------------------------------------------------------------
Executive Order 14192 (``Unleashing Prosperity Through
Deregulation'') requires that any new incremental costs associated with
new regulations shall, to the extent permitted by law, be offset by the
elimination of existing costs associated with at least 10 prior
regulations.\11\ This proposed rule is expected to be a deregulatory
action for purposes of Executive Order 14192.
---------------------------------------------------------------------------
\11\ 90 FR 9065 (Feb. 6, 2025),
---------------------------------------------------------------------------
C. Regulatory Flexibility Act
The Regulatory Flexibility Act \12\ generally requires an agency to
conduct a regulatory flexibility analysis of any rule subject to notice
and comment rulemaking requirements, unless the agency certifies that
the rule will not have a significant economic impact on a substantial
number of small entities. If the agency makes such a certification, it
shall publish the certification at the time of publication of either
the proposed rule or the final rule, along with a statement providing
the factual basis for such certification.\13\ For purposes of this
analysis, the NCUA considers small credit unions to be those having
under $100 million in assets.\14\ The Board fully considered the
potential economic impacts of the regulatory amendments on small credit
unions.
---------------------------------------------------------------------------
\12\ 5 U.S.C. 601 et seq.
\13\ 5 U.S.C. 605(b).
\14\ 80 FR 57512 (Sept. 24, 2015).
---------------------------------------------------------------------------
The proposed rule reduces and simplifies aspects of part 748
related to catastrophic act reporting. Even if the magnitude of the
change is significant, the NCUA certifies that the proposed rule will
not have a significant economic impact on a substantial number of small
entities.
Accordingly, the NCUA certifies the proposed rule would not have a
significant economic impact on a substantial number of small credit
unions.
D. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 (PRA) generally provides that
an agency may not conduct or sponsor, and not withstanding any other
provision of law, a person is not required to respond to, a collection
of information, unless it displays a currently valid Office of
Management and Budget (OMB) control number. The PRA applies to
rulemakings in which an agency creates a new or amends existing
information collection requirements. For purposes of the PRA, an
information-collection requirement may take the form of a reporting,
recordkeeping, or a third-party disclosure requirement. The NCUA has
determined that the changes described in this notice do not create a
new information collection or revise an existing information collection
as defined by the PRA.
E. Executive Order 13132 on Federalism
Executive Order 13132 encourages certain agencies to consider the
impact of their actions on state and local interests. The NCUA, an
agency as defined in 44 U.S.C. 3502(5), complies with the executive
order to adhere to fundamental federalism principles. This proposed
rule is intended to reduce the burden on FICUs by simplifying
catastrophic act reporting. The rulemaking would therefore not have
direct effect on the states, the relationship between the national
government and the states, or on the distribution of power and
responsibilities among the various levels of government.
F. Assessment of Federal Regulations and Policies on Families
The NCUA has determined that this proposed rule would not affect
family well-being within the meaning of section 654 of the Treasury and
General Government Appropriations Act, 1999.\15\ The proposed rule
relates to FICU operations in the aftermath of a catastrophic act, and
any effect on family well-being is expected to be indirect.
---------------------------------------------------------------------------
\15\ Public Law 105-277, 112 Stat. 2681 (1998).
---------------------------------------------------------------------------
List of Subjects in 12 CFR Part 748
Credit unions; reporting and recordkeeping requirements; computer
technology; internet; security measures; privacy; personally
identifiable information; confidential business information; crime;
currency.
By the National Credit Union Administration Board, this 19th day
of December, 2025.
Melane Conyers-Ausbrooks,
Secretary of the Board.
For the reasons stated in the preamble, the NCUA Board proposes to
amend 12 CFR part 748, as follows:
PART 748--SECURITY PROGRAM, SUSPICIOUS TRANSACTIONS, CATASTROPHIC
ACTS, CYBER INCIDENTS, AND BANK SECRECY ACT COMPLIANCE
0
1. The authority citation for part 748 continues to read as follows:
Authority: 12 U.S.C. 1766(a), 1786(b)(1), 1786(q), 1789(a)(11);
15 U.S.C. 6801-6809; 31 U.S.C. 5311 and 5318.
0
2. Revise Sec. 748.1(b) to read as follows:
Sec. 748.1 Filing of reports.
* * * * *
(b) Catastrophic act report. Each federally insured credit union
will notify NCUA within 15 calendar days of any catastrophic act that
occurs at its office(s). A catastrophic act is any disaster, natural or
otherwise, resulting in physical destruction or damage to the credit
union or causing an interruption in vital member services, as defined
in Sec. 749.1 of this chapter, projected to last more than two
consecutive business days. Within a reasonable time after a
catastrophic act occurs, the credit union shall ensure that a record of
the incident
[[Page 60594]]
is prepared that contains the basic facts of the event.
* * * * *
[FR Doc. 2025-23856 Filed 12-23-25; 8:45 am]
BILLING CODE 7535-01-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on December 29, 2025.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.