Incident Notification Deadlines: A Reference for Financial Firms

When a security incident occurs, the clock starts immediately — and the deadline depends on your regulator, the nature of the event, and who needs to be notified. A bank, a credit union, a CPA firm, and a wealth management firm can be hit by the same attack on the same afternoon and owe four different notifications on four different schedules. This page summarizes the federal notification requirements that apply to each, as of October 2026. It is a reference guide, not legal advice. Your legal counsel and compliance team should confirm the requirements that apply to your firm's specific situation.

Section 1

The Word That Starts Your Clock

None of these deadlines measure how long you have to fix the problem. They measure how long you have to report it — starting from a specific state of mind that is often only identifiable in hindsight. The rules do not all use the same starting point, and the differences matter.

Two of these starting points deserve special attention. For banks, the clock runs from determination — which means an investigation that stays quiet can push the deadline earlier than expected. For credit unions, a vendor's notice starts your clock: if a third party tells you your data or operations were compromised, the 72-hour window begins when you receive that notice.

Section 2

Notification Deadlines by Regulator

Section 3

The Rules That Reach Your Vendors

The most commonly missed obligations are the ones that apply to your service providers — because they flow through to you.

• A bank service provider must notify your designated contact as soon as possible after determining it has experienced a computer-security incident that has materially disrupted, or is reasonably likely to materially disrupt, covered services for four or more hours. If you have not designated a contact, the rule defaults to your CEO and CIO.
• For credit unions, a third party's notice of compromise starts your own 72-hour clock.
• Under SEC Regulation S-P, covered firms must ensure their service providers notify them within 72 hours of a breach — an obligation that belongs in vendor contracts, not in good intentions.

In the first year of NCUA's reporting rule, nearly seven in ten cyber incident reports filed by credit unions involved a third-party vendor. Your own controls can be excellent, and your exposure is still only as good as your weakest critical vendor.

Section 4

Regulator Notice Is Not Customer Notice

The 36- and 72-hour deadlines cover your regulator. Customer notification runs on a separate track: under the interagency response-program guidance, banks should notify affected customers as soon as possible once misuse of their information has occurred or is reasonably possible. Under Regulation S-P, covered firms have their own 30-day individual-notice obligation. Your incident response plan needs both tracks — with a named owner for each.

Section 5

What This Means in Practice

Notification deadlines do not start when the incident is resolved. They start when the firm becomes aware of it — or in some cases, when it reasonably should have. That distinction matters for how incidents are monitored and escalated.

• Detection determines the clock. A 24/7 monitoring capability that identifies incidents promptly gives your firm more time to investigate, assess scope, and coordinate before deadlines run.
• The first call is not the regulator. Your internal escalation process — who is notified, who makes the determination, who coordinates legal, compliance, and insurance — needs to be defined before an incident occurs, with a named backup for each role.
• Vendor obligations flow both ways. Put notification terms in your vendor agreements and designate the contacts your providers must call.
• Different rules apply to different firms. A firm subject to more than one regulator may have multiple obligations running simultaneously.

Section 6

A Short Preparedness Checklist

Five things to confirm before an incident, not during one:

1. 1Your reporting clock is in writing — which rule applies to you, and the exact trigger word that starts it.
2. 2Someone owns the notification decision, by name, with a backup.
3. 3Regulator notice and customer notice are documented as two separate tracks.
4. 4Your critical vendors have a designated contact to notify, and the contract terms that require it.
5. 5Your monitoring and escalation path is tested — a tabletop exercise simulating your first 36 or 72 hours is the cheapest deadline insurance available.

Section 7

How VanderNet Supports Incident Response

VanderNet's role in an incident focuses on the technology side: detecting activity in the managed environment, assessing scope, containing where possible, providing documentation, and coordinating with your designated contacts.

The regulatory notification decisions — whether a threshold has been met, who to notify, and when — belong to your legal counsel, compliance team, and leadership. VanderNet provides the technical facts and timeline your team needs to make those decisions.

For a full explanation of the incident response sequence, see the FAQ on our Wealth Management page or Accounting & CPA page.

Know the Clock Before the Incident Starts.

VanderNet helps define the detection, escalation, and documentation process before something goes wrong. Start with a 15-minute conversation.