On November 9, 2022, the New York Department of Financial Services (DFS) published its proposed second amendment to its cybersecurity regulations (23 NY CRR Part 500). This proposal follows a July 29 pre-proposal and comment period. The amendment is available for a sixty-day comment period – until January 9, 2023 – after which the agency may adopt final regulations or issue a further revised version.
The Consumer Financial Protection Bureau (CFPB) on October 27, 2022 took the long-anticipated first step to issue a regulation implementing Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. This followed a preview by CFPB Director Rohit Chopra at the Money 20/20 conference on October 25 in which he outlined the “CFPB’s new approach to regulation,” which is designed to create “catalysts for more competition.” With respect to Section 1033, Director Chopra said that the CFPB is “exploring safeguards to prevent excessive control or monopolization by one, or even a handful of, firms” and will be working toward avoiding regulations that could be “rigged in favor of some players over others.” Director Chopra’s focus on competition as an essential element of consumer protection has been a hallmark of his directorship.
On April 28, 2022, the White House announced, in partnership with 60 global partners, the launch of the Declaration for the Future of the Internet, also known as the “DFI.”
According to the White House briefing, the Declaration sets forth the shared principles regarding how parties should comport themselves with respect to the Internet, the digital ecosystem, and the digital economy. The Declaration affirms that the signatories are committed to defending the Internet, to governing it by a multi-stakeholder approach, and to promoting an open, free, global, interoperable, reliable, and secure Internet for the world. The State Department’s newly formed Bureau of Cyberspace and Digital Policy put out a nearly identical statement. (more…)
On 6 April 2022, the European Parliament formally approved the Data Governance Act (“DGA”), which establishes a legal framework to promote the availability of data and increase trust in data sharing across sectors in the EU. Some of the key objectives of the new legislation include enabling the re-use of certain categories of protected public sector data and making it easier and safer for citizens and businesses to share their data with relevant stakeholders. (more…)
From February 28-March 3, Sidley and OneTrust DataGuidance hosted their annual Data Protection in Financial Services (DPFS) Week, a series of webinars looking at the impacts of data privacy across the financial sector. Industry speakers covered a range of issues including:
- How the latest privacy and cybersecurity developments in Europe and the U.S. have impacted financial services
- How new and existing privacy and cyber requirements intersect with finance-specific regulation
- What financial organizations can do to keep ahead of the curve in the ever-evolving data privacy and cyber landscape
- How to deal with and manage the key issues for 2022, such as AI, data governance, and international transfers
On November 18, 2021, a group of federal bank regulators announced a final rule requiring banks to notify their primary federal regulator of any “significant computer-security incidents.” Regulators must be notified no later than 36 hours after the bank has determined that the incident triggers the rule’s notification requirement. Further, bank service providers are now required to promptly notify all affected banks whenever a cybersecurity disruption lasts for four or more hours. (more…)
Article I: Digital Asset Overview and Methods to Gain Exposure to Digital Assets
Given the growth of markets for cryptocurrencies and other blockchain-based assets, often referred to as “digital assets,” we see growing interest from traditional investment managers in gaining exposure to this emerging asset class. We have seen development of many new products and service offerings to facilitate institutional investment in digital assets over the past year. With the recent announcement of the first bitcoin-exchange traded fund, this week, we expect continued and expansive growth in this area. This article aims to serve as an introductory guide to digital asset investing for institutional investors by describing at a high level the available service offerings and potential avenues for investment managers to gain exposure to the digital assets space.
On September 30, the U.S. Senate confirmed Commissioner Rohit Chopra of the Federal Trade Commission as the new Director of the Consumer Financial Protection Bureau (CFPB). Director Chopra is expected to usher in a regime of dramatically increased enforcement and creative, expansive regulation. Many financial institutions will have questions and concerns about the CFPB, how it will affect their businesses and operations, and how to productively engage with this exceptionally powerful and opaque regulator. It is now more important than ever to closely follow the work of the CFPB as new leadership seeks to aggressively employ all of the agency’s tools in service of the American consumer. (more…)
Please join us for a program focused on the latest 2021 FinTech and blockchain developments. Sidley lawyers in the banking, white collar, and FinTech groups will discuss the key regulatory and enforcement issues related to enhanced focus by the DOJ, SEC, CFTC, FinCEN, CFPB, OCC, and Federal Reserve on FinTech, blockchain, and cryptocurrencies from both the criminal and civil enforcement perspectives.
On August 11, 2021, the Federal Financial Institutions Examination Council (FFIEC)1 issued guidance establishing risk management principles and practices to support the authentication of users accessing a financial institution’s information systems and customers accessing a financial institution’s digital banking services (the Guidance). The Guidance is not intended to serve as a comprehensive framework but rather provides financial institutions with examples of effective risk management practices without endorsing any specific information security framework or standard.