I. Policy Objective

The FDIC's objective in setting forth this proposal is to ensure that the risk-based deposit insurance assessment system applicable to large and highly complex banks conforms to recently updated accounting standards. 1 In March 2022, FASB issued Accounting Standards Update No. 2022-02 (ASU 2022-02), “Financial Instruments—Credit Losses (Topic 326): Troubled Debt Restructurings and Vintage Disclosures,” that eliminates the recognition and measurement guidance of TDRs and, instead, introduces new requirements related to financial statement disclosure of certain modifications of receivables made to borrowers experiencing financial difficulty, or “modifications to borrowers experiencing financial difficulty.”  2 Risk-based deposit insurance assessments for large and highly complex banks are determined, in part, using TDRs. Therefore, to incorporate the updated accounting standards, the proposed amendment would include modifications to borrowers experiencing financial difficulty in the description of the underperforming assets ratio, which includes restructured loans, and definitions used in the higher-risk assets ratio, which reference TDRs. Both of these ratios are used to determine risk-based deposit insurance assessments for large and highly complex banks.

The Federal Deposit Insurance Act (FDI Act) requires that the FDIC establish a risk-based deposit insurance assessment system. 3 The FDIC charges all IDIs an assessment for deposit insurance equal to the IDI's deposit insurance assessment base multiplied by its risk-based assessment rate. 4 An IDI's assessment base and assessment rate are determined each quarter using supervisory ratings and information collected from the Consolidated Reports of Condition and Income (Call Report) or the Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks (FFIEC 002), as appropriate. Generally, an IDI's assessment base equals its average consolidated total assets minus its average tangible equity. 5

An IDI's assessment rate is calculated using different methods dependent upon whether the IDI is classified for deposit insurance assessment purposes as a small, large, or highly complex bank. 6 Large and highly complex banks are assessed using a scorecard approach that combines CAMELS ratings and certain forward-looking financial measures to assess the risk that a large or highly complex bank poses to the Deposit Insurance Fund (DIF). 7 The score that each large or highly complex bank receives is used to determine its deposit insurance assessment rate. One scorecard applies to most large banks and another applies to highly complex banks. Both scorecards use quantitative financial measures that are useful for predicting a large or highly complex bank's long-term performance. Two of the measures in the large and highly complex bank scorecards, the credit quality measure and the concentration measure, are determined using restructured loans or TDRs. These measures are described in more detail below.

Both the large bank and the highly complex bank scorecards include a credit quality measure. The credit quality measure is the greater of (1) the criticized and classified items to the sum of Tier 1 capital and reserves score or (2) the underperforming assets to the sum of Tier 1 capital and reserves score. 8 Each risk measure, including the criticized and classified items ratio and the underperforming assets ratio, is converted to a score between 0 and 100 based upon minimum and maximum cutoff values. 9

The underperforming assets ratio is described identically in the large and highly complex bank scorecards as the sum of loans that are 30 days or more past due and still accruing interest, nonaccrual loans, restructured loans (including restructured 1-4 family loans), and other real estate owned (ORE), excluding the maximum amount recoverable from the U.S. Government, its agencies, or Government-sponsored agencies, under guarantee or insurance provisions, divided by a sum of Tier 1 capital and reserves. 10

The specific data used to identify the “restructured loans” referenced in the above description are those items that banks disclose in their Call Report on Schedule RC-C, Part I, Memorandum items 1.a. through 1.g, “Loans restructured in troubled debt restructurings that are in compliance with their modified terms.” The portion of restructured loans that is guaranteed or insured by the U.S. Government are excluded from underperforming assets. This data is collected in Call Report Schedule RC-O, Memorandum item 16, “Portion of loans restructured in troubled debt restructurings that are in compliance with their modified terms and are guaranteed or insured by the U.S. government.”

Both the large and highly complex bank scorecards also include a concentration measure. The concentration measure is the greater of (1) the higher-risk assets to the sum of Tier 1 capital and reserves score or (2) the growth-adjusted portfolio concentrations score. 11 Each risk measure, including the criticized and classified items ratio and the underperforming assets ratio, is converted to a score between 0 and 100 based upon minimum and maximum cutoff values. 12 The higher-risk assets ratio captures the risk associated with concentrated lending in higher-risk areas. Higher-risk assets include construction and development (C&D) loans, higher-risk commercial and industrial (C&I) loans, higher-risk consumer loans, nontraditional mortgage loans, and higher-risk securitizations. 13

Higher-risk C&I loans are defined, in part, based on whether the loan is owed to the bank by a higher-risk C&I borrower, which includes, among other things, a borrower that obtains a refinance of an existing C&I loan, subject to certain conditions. Higher-risk consumer loans are defined as all consumer loans where, as of origination, or, if the loan has been refinanced, as of refinance, the probability of default within two years is greater than 20 percent, excluding those consumer loans that meet the definition of a nontraditional mortgage loan. A refinance for purposes of higher-risk C&I loans and higher-risk consumer loans is defined in the assessment regulations and explicitly does not include modifications to a loan that would otherwise meet the definition of a refinance, but that result in the classification of a loan as a TDR.

On March 31, 2022, FASB issued ASU 2022-02. 14 This update eliminated the recognition and measurement guidance for TDRs for all entities that have adopted ASU 2016-13, “Financial Instruments—Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments” and the Current Expected Credit Losses (CECL) methodology. 15 The rationale was that ASU 2016-13 requires the measurement and recording of lifetime expected credit losses on an asset that is within the scope of ASU 2016-13, and as a result, credit losses from TDRs have been captured in the allowance for credit losses. Therefore, stakeholders observed and asserted that the additional designation of a loan modification as a TDR and the related accounting were unnecessarily complex and provided less meaningful information than under the incurred loss methodology. 16

The update eliminates the recognition of TDRs and, instead, introduces new financial statement disclosure requirements related to certain modifications of receivables made to borrowers experiencing financial difficulty, or “modifications to borrowers experiencing financial difficulty.” Such modifications are limited to those that result in principal forgiveness, interest rate reductions, other-than-insignificant payment delays, or term extensions in the current reporting period. Modifications to borrowers experiencing financial difficulty may be different from those previously captured in TDR disclosures because an entity no longer would have to determine whether the creditor has granted a concession, which is a current requirement to determine whether a modification represents a TDR. The update requires entities to disclose information about (a) the types of modifications provided, disaggregated by modification type, (b) the expected financial effect of those modifications, and (c) the performance of the loans after modification.

For entities that have adopted CECL, ASU 2022-02 is effective for fiscal years beginning after December 15, 2022. 17 FASB also permitted the early adoption of ASU 2022-02 by any entity that has adopted CECL. For regulatory reporting purposes, if an institution chooses to early adopt ASU 2022-02 during 2022, Supplemental Instructions to the Call Report specify that the institution should implement ASU 2022-02 for the same quarter-end report date and report “modifications to borrowers experiencing financial difficulty” in the current TDR Call Report line items. 18 These line items include Schedule RC-C, Part I, Memorandum items 1.a. through 1.g., which are used to identify “restructured loans” for the underperforming asset ratio used in the large and highly complex bank scorecards, described above. As a result, a large or highly complex institution that has early adopted ASU 2022-02 and is reporting modifications to borrowers experiencing financial difficulty in the current TDR Call Report line items will be assigned a deposit insurance assessment rate that relies, in part, on this reporting. The FDIC and other members of the Federal Financial Institutions Examination Council (FFIEC) are planning to revise the Call Report forms and instructions to replace the current TDR terminology with updated language from ASU 2022-02 for the first quarter of 2023.

The FDIC proposes to incorporate into the large and highly complex bank assessment scorecards the updated accounting standard that eliminates the recognition of TDRs and, instead, requires new financial statement disclosures on “modifications to borrowers experiencing financial difficulty.” The FDIC is proposing to expressly define restructured loans in the underperforming assets ratio to include “modifications to borrowers experiencing financial difficulty.” The FDIC is also proposing to amend the definition of a refinance for the purposes of determining whether a loan is a higher-risk C&I loan or a higher-risk consumer loan, both elements of the higher-risk assets ratio. Under the proposal, a refinance would not include modifications to a loan that otherwise would meet the definition of a refinance, but that result in the classification of a loan as a modification to borrowers experiencing financial difficulty. This proposal would not affect the small bank deposit insurance assessment system.

The FDIC proposes to amend the underperforming assets ratio used in the large and highly complex bank pricing scorecards to conform to the updated accounting standards in ASU 2022-02. The amended text explicitly defines restructured loans for large and highly complex banks that have adopted CECL and ASU 2022-02 as modifications to borrowers experiencing financial difficulty. For the remaining large and highly complex banks that have not yet adopted CECL and ASU 2022-02, the FDIC would continue to use TDRs for restructured loans, and the amended text would explicitly define restructured loans for these banks as TDRs.

The FDIC has included restructured loans in the underperforming assets ratio since the introduction of the large and highly complex bank scorecards in 2011. Restructured loans, in the context of the underperforming assets measure, typically present an elevated level of credit risk because they represent loans to borrowers unable to perform according to the original contractual terms. The FDIC believes it is important to capture such elevated credit risk in its measurement of credit quality. The FDIC believes the accounting term introduced by FASB in ASU 2022-02, “modifications to borrowers experiencing financial difficulty,” will provide a similar and meaningful indicator of credit risk.

The FDIC proposes to amend the definition of a refinance, in determining whether a loan is a higher-risk C&I loan or a higher-risk consumer loan for deposit insurance assessment purposes, to conform to the updated accounting standards in ASU 2022-02. Specifically, a refinance of a C&I loan would not include a modification or series of modifications to a commercial loan that would otherwise meet the definition of a refinance, but that result in the classification of a loan as a modification to borrowers experiencing financial difficulty, for a large or highly complex bank that has adopted CECL and ASU 2022-02, or that result in the classification of a loan as a TDR, for all remaining large and highly complex banks. For purposes of higher-risk consumer loans, a refinance would not include modifications to a loan that would otherwise meet the definition of a refinance, but that result in the classification of a loan as a modification to borrowers experiencing financial difficulty, for a large or highly complex bank that has adopted CECL and ASU 2022-02, or that result in the classification of a loan as a TDR, for all remaining large and highly complex banks.

Question 1: The FDIC invites comment on its proposal to include modifications to borrowers experiencing financial difficulty in the definition of restructured loans, used in part to determine the underperforming assets ratio, and in the definition of refinance, used in part to determine the higher-risk assets ratio. Does the proposal appropriately meet the objective to incorporate updated accounting standards under ASU 2022-02 into the large and highly complex bank scorecards?

As of December 31, 2021, the FDIC insured 148 banks that were classified as large or highly complex for deposit insurance assessment purposes, and that would be affected by this proposed rule. 19 The FDIC expects most of these institutions will adopt CECL by January 1, 2023, the proposed effective date of the rule.

The primary expected effect of the proposed rule is the change in underperforming assets, and consequent change in assessment rates, that could occur as a result of the difference between the amount of TDRs that most banks are currently reporting and the amount of modifications to borrowers experiencing financial difficulty that banks will report upon adoption of ASU 2022-02. The effect of this proposed rule on assessments paid by large and highly complex banks is difficult to estimate since most banks are not yet reporting modifications to borrowers experiencing financial difficulty, and the FDIC does not know how the amount of reported modifications to borrowers experiencing financial difficulty will compare to the amount of TDRs that affected banks report.

In general, the FDIC expects that the initial amount of modifications made to borrowers experiencing financial difficulty will be lower than previously reported TDRs. This is because under ASU 2022-02, reporting of modifications to borrowers experiencing financial difficulty should be applied prospectively and would therefore apply only to modifications made after a bank adopts the standard. However, in the long term it is possible that the amount of modifications to borrowers experiencing financial difficulty could be higher or lower than the amount of TDRs that banks would have reported prior to adoption of ASU 2022-02. Therefore, under the proposed rule, the underperforming assets ratio could be higher or lower due to the adoption of ASU 2022-02, and the resulting ratio may or may not affect an individual bank's assessment rate, depending on whether it is the binding ratio for the credit quality measure.

The FDIC does not have the information necessary to estimate the expected effects of the proposal to incorporate the new accounting standard into the large and highly complex bank scorecards. However, the following analysis illustrates a range of potential outcomes based on TDRs reported prior to ASU 2022-02, as the amount of modifications to borrowers experiencing financial difficulty could be higher, lower, or similar to previously reported TDRs. The analysis shows the effect on assessments of higher or lower TDRs in calculating the underperforming assets ratio for deposit insurance assessment purposes.

The FDIC calculated some illustrative examples of the effect on assessments if modifications made to borrowers experiencing financial difficulty are lower than certain amounts of previously reported TDRs. For example, if all large and highly complex banks had reported zero TDRs as of December 31, 2021, before FASB issued ASU 2022-02, the impact on the underperforming assets ratio would have reduced total deposit insurance assessment revenue by an annualized amount of approximately $90 million; if modifications were 50 percent lower than TDRs reported as of December 31, 2021, annualized assessments would have decreased by $52 million.

Alternatively, as an extreme and unlikely scenario, if all large and highly complex banks had reported zero TDRs during a period when overall risk in the banking industry was higher, such as December 31, 2011, the resulting underperforming assets ratio would have reduced total deposit insurance assessment revenue by an annualized amount of approximately $957 million. Between 2015 and 2019, if TDRs were zero, the resulting underperforming assets ratio would have reduced total deposit insurance assessment revenue by about $279 million annually, on average.

Over time, however, under ASU 2022-02 large and highly complex banks will begin to report modifications to borrowers experiencing financial difficulties. As noted above, the effect on assessments will depend on how the newly reported modifications compare to the TDRs that would have been reported under the prior accounting standard. For example, if all large and highly complex banks had reported modifications to borrowers experiencing financial difficulty that were 25 percent greater than the TDRs reported as of December 31, 2021, the impact on the underperforming assets ratio would have increased total deposit insurance assessment revenue by an annualized amount of approximately $30 million; if the modifications exceeded TDRs by 50 percent, annualized assessments would have increased by $65 million; and if the modifications exceeded TDRs by 100 percent, annualized assessments would have increased by $137 million.

The analysis presented above serves as an illustrative example of potential effects of the proposed rule. The analysis does not estimate potential future modifications to borrowers experiencing financial difficulty or how those amounts, once reported, will compare to previously reported TDRs for a few reasons. First, banks were granted temporary relief from reporting TDRs that were modified due to the COVID-19 pandemic, so recent reporting of TDRs is likely lower than it may otherwise have been. 20 Second, the amount of modifications or restructurings made by large or highly complex banks vary based on economic conditions and future economic conditions are uncertain. Third, a restructuring of a debt constitutes a TDR if the creditor for economic or legal reasons related to the debtor's financial difficulties grants a concession to the debtor that it would not otherwise consider, while a modification to borrowers experiencing financial difficulty is not evaluated based on whether or not a concession has been granted. Finally, future Call Report revisions and instructions on how modifications to borrowers experiencing financial difficulties should be reported will affect the future reported amount of modifications to borrowers experiencing financial difficulty.

With regard to the higher-risk assets ratio, the effect on assessments paid by large and highly complex banks is likely to be more muted. The assessment regulations define a higher-risk C&I or consumer loan as a loan or refinance that meets certain risk criteria. The proposed rule would exclude modifications to borrowers experiencing financial difficulty from the definition of a refinance for purposes of the higher-risk assets ratio. As a result, if a modification to a C&I or consumer loan results in the classification of the loan as a TDR, under the current regulations, or as a modification to borrowers experiencing financial difficulty, under the proposed rule, a large or highly complex bank would not have to re-evaluate whether the modified loan meets the definition of a higher-risk asset. For example, if a higher-risk C&I loan was subsequently modified as a TDR or modification to borrowers experiencing financial difficulty, it would not be considered a refinance and, therefore, would continue to be considered a higher-risk asset. Conversely, if a C&I loan that does not meet the definition of a higher-risk asset was subsequently modified as a TDR or modification to borrowers experiencing financial difficulty, it would not be considered a refinance and, therefore, would not have to be re-evaluated to determine if it meets the definition of a higher-risk asset. The FDIC assumes that these possible outcomes are offsetting and the change to the rule will have minimal to no effect on deposit insurance assessments for large and highly complex banks.

The proposed rule would pose no additional reporting burden for large and highly complex banks.

Question 2: The FDIC invites comments on the expected effects of the proposal on large and highly complex institutions.

The FDIC considered two reasonable and possible alternatives as described below. On balance, the FDIC believes the current proposal would determine deposit insurance assessment rates for large and highly complex banks in the most appropriate, accurate, and straightforward manner.

One alternative would be to require banks to continue to report TDRs specifically for deposit insurance assessment purposes, even after they have adopted CECL and ASU 2022-02. This alternative would maintain consistency of the data used in the underperforming assets ratio and higher-risk assets ratio with prior reporting periods. However, this alternative would impose additional reporting burden on large and highly complex banks. This alternative would also fail to recognize the potential usefulness of the new data on modifications to borrowers experiencing financial difficulty. Ultimately, the FDIC does not believe any benefits from continued reporting of TDRs expressly for assessment purposes would justify the cost to affected banks.

The FDIC also considered a second alternative: removing restructured loans from the definition of underperforming assets entirely and not incorporating the new data on modifications to borrowers experiencing financial difficulty. Similar to the first alternative, this second alternative would apply uniformly to all large and highly complex banks, regardless of their early adoption status. However, this alternative fails to recognize that data on modifications to borrowers experiencing financial difficulty provide a meaningful indicator of credit risk throughout economic cycles and should be captured in credit quality measures such as the underperforming assets ratio and the higher-risk assets ratio. The FDIC believes that the new modifications data required under ASU 2022-02 can provide valuable information and would not impose additional reporting burden. Incorporating this new data in place of TDRs would be the most reasonable option to ensure that large and highly complex banks are assessed fairly and accurately, all else equal.

Question 3: The FDIC invites comment on the reasonable and possible alternatives described in this proposed rule. Are there other reasonable and possible alternatives that the FDIC should consider?

The FDIC is issuing this proposal with a 30-day comment period. Following the comment period, the FDIC expects to issue a final rule with an effective date of January 1, 2023, and applicable to the first quarterly assessment period of 2023 ( i.e., January 1-April 1, 2023). Most institutions that have implemented CECL, will adopt FASB's ASU 2022-02 in 2023, unless an institution chooses to early adopt in 2022. Institutions (those with a calendar year fiscal year) implementing CECL on January 1, 2023, will also adopt, FASB's ASU 2022-02 at that time. Therefore, by the first quarter of 2023, ASU 2022-02 also will be in effect for most, if not all, large and highly complex banks. The FDIC believes that coordinating the assessment system amendments to conform to the new accounting standards will promote a more efficient transition and will result in affected banks reporting their data in a consistent manner based on the correct accounting concepts.

The FDIC is requesting comment on all aspects of the notice of proposed rulemaking, in addition to the specific requests for comment above.

The Regulatory Flexibility Act (RFA) generally requires an agency, in connection with a proposed rule, to prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of a proposed rule on small entities. 21 However, a regulatory flexibility analysis is not required if the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. The U.S. Small Business Administration (SBA) has defined “small entities” to include banking organizations with total assets of less than or equal to $750 million. 22 Certain types of rules, such as rules relating to rates, corporate or financial structures, or practices relating to such rates or structures, are expressly excluded from the definition of “rule” for purposes of the RFA. 23 Because the proposed rule relates directly to the rates imposed on IDIs for deposit insurance and to the deposit insurance assessment system that measures risk and determines each bank's assessment rate, the proposed rule is not subject to the RFA. Nonetheless, the FDIC is voluntarily presenting information in this RFA section.

Based on Call Report data as of December 31, 2021, the FDIC insures 4,848 IDIs, of which 3,478 are defined as small entities by the terms of the RFA. 24 The proposed rule, however, would apply only to institutions with $10 billion or greater in total assets which, by definition, do not meet the criteria to be considered small entities for the purposes of the RFA. Since no small entities would be affected by the proposed rule, the FDIC certifies that the proposed rule would not have a significant economic effect on a substantial number of small entities.

Section 302(a) of the Riegle Community Development and Regulatory Improvement Act (RCDRIA) requires that the Federal banking agencies, including the FDIC, in determining the effective date and administrative compliance requirements of new regulations that impose additional reporting, disclosure, or other requirements on IDIs, consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations. 25 In addition, section 302(b) of RCDRIA requires new regulations and amendments to regulations that impose additional reporting, disclosures, or other new requirements on IDIs generally to take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form, with certain exceptions, including for good cause. 26

The proposed rule would not impose additional reporting, disclosure, or other new requirements on insured depository institutions, including small depository institutions, or on the customers of depository institutions. Accordingly, section 302 of RCDRIA does not apply. Nevertheless, the requirements of RCDRIA have been considered in setting the proposed effective date. The FDIC invites comments that will further inform its consideration of RCDRIA.

The Paperwork Reduction Act of 1995 (PRA) states that no agency may conduct or sponsor, nor is the respondent required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. 27 The FDIC's OMB control numbers for its assessment regulations are 3064-0057, 3064-0151, and 3064-0179. The proposed rule does not revise any of these existing assessment information collections pursuant to the PRA and consequently, no submissions in connection with these OMB control numbers will be made to the OMB for review. However, the proposed rule affects the agencies' current information collections for the Call Report (FFIEC 031 and FFIEC 041, but not FFIEC 051). The agencies' OMB control numbers for the Call Reports are: OCC OMB No. 1557-0081; Board OMB No. 7100-0036; and FDIC OMB No. 3064-0052. Proposed changes to the Call Report forms and instructions will be addressed in a separate Federal Register notice.

Section 722 of the Gramm-Leach-Bliley Act  28 requires the Federal banking agencies to use plain language in all proposed and final rulemakings published in the Federal Register after January 1, 2000. The FDIC invites your comments on how to make this proposed rule easier to understand. For example:

• Has the FDIC organized the material to suit your needs? If not, how could the material be better organized?

• Are the requirements in the proposed regulation clearly stated? If not, how could the regulation be stated more clearly?

• Does the proposed regulation contain language or jargon that is unclear? If so, which language requires clarification?

• Would a different format (grouping and order of sections, use of headings, paragraphing) make the regulation easier to understand?

For the reasons stated in the preamble, the Federal Deposit Insurance Corporation proposes to amend 12 CFR part 327 as follows:

The revision and addition read as follows:

The revisions read as follows:

Given the frequency and severity of cyber incidents within the financial services industry, the National Credit Union Administration Board (Board) believes it is important that the National Credit Union Administration (NCUA or agency) be notified of cyber incidents that disrupt a federally insured credit union's (FICU) operations, lead to unauthorized access to sensitive data, or disrupt members' access to accounts or services. In accordance with § 704.1(a) of the NCUA's rules and regulations, this proposed rule also applies to federally chartered corporate credit unions and federally insured, state-chartered corporate credit unions.

Cyberattacks reported to Federal law enforcement have increased in frequency and severity in recent years. 1 The financial services sector is one of the top U.S. critical infrastructure sectors targeted by ransomware. 2 Cyberattacks may use destructive malware or other malicious software to target weaknesses in the computers or networks of financial institutions, typically with malicious intent.

Some cyberattacks have the potential to alter, delete, or otherwise render a credit union's data and systems unusable. Examples include a large-scale distributed denial of service (DDoS) attack that disrupts member account access, a computer hacking incident that disables business operations, or a data breach that exposes sensitive data. Depending on the scope of a cyber incident, a credit union's data and system backups may also be affected which can severely affect the ability of the credit union to recover operations. Cyber incidents can result from destructive malware or malicious software (cyberattacks), as well as non-malicious failure of hardware or software, personnel errors, and other causes.

A FICU experiencing a cyber incident is encouraged to contact relevant law enforcement or security agencies, as appropriate, after the incident occurs. Furthermore, providing information on cyber intrusions or other cyber incidents to the NCUA, the Federal Bureau of Investigation, and the Cybersecurity and Infrastructure Security Agency (CISA)  3 provides the U.S. Government with information that can be used to identify new cyber-related adversarial tactics, techniques, and procedures, as well as information on industry sectors that are being targeted. This leads to greater visibility and an ability for the U.S. Government to issue cybersecurity alerts, advise software and equipment manufacturers of critical vulnerabilities, and prosecute offenders.

The NCUA Board is issuing this notice of proposed rulemaking (proposal or proposed rule) to require a FICU to provide the NCUA with prompt notification of any cyber incident that rises to the level of a reportable cyber incident. The proposed rule would require such notification as soon as possible but no later than 72 hours after a FICU reasonably believes that a reportable cyber incident has occurred. 4

The proposed rule defines cyber incident as an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system or actually or imminently jeopardizes, without lawful authority, an information system. 5

The proposed rule defines a reportable cyber incident as any substantial cyber incident that leads to one or more of the following: A substantial loss of confidentiality, 6 integrity, 7 or availability of a network or member information system  8 that results from the unauthorized access to or exposure of sensitive data, 9 disrupts  10 vital member services, 11 or has a serious impact on the safety and resiliency of operational systems and processes; a disruption of business operations, vital member services, or a member information system resulting from a cyberattack  12 or exploitation of vulnerabilities; and/or a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise  13 of a credit union service organization, cloud service provider, managed service provider, or other third-party data hosting provider or by a supply chain compromise. The definition excludes any event where the cyber incident is performed in good faith by an entity in response to a specific request by the owner or operator of the information system.

The proposed definition of reportable cyber incident is intended to capture the reporting of substantial cyber incidents. What a FICU would consider to be substantial will likely depend on a variety of factors, including the size of the FICU, the type and impact of the loss, and its duration, for example. The agency expects a FICU to exercise reasonable judgment in determining whether it has experienced a substantial cyber incident that would be reportable to the agency. Under this proposal, if a FICU is unsure as to whether a cyber incident is reportable, the Board encourages the FICU to contact the agency.

The first prong of the reportable cyber incident definition would require a FICU to report a cyber incident that leads to a substantial loss of confidentiality, integrity, or availability of a member information system as a result of the exposure of sensitive data, disruption of vital member services, or that has a serious impact on the safety and resiliency of operational systems and processes. For example, if a FICU becomes aware that a substantial level of sensitive data is unlawfully accessed, modified, or destroyed, or if the integrity of a network or member information system is compromised, the cyber incident is reportable. If the credit union becomes aware that a member information system has been unlawfully modified and/or sensitive data has been left exposed to an unauthorized person, process, or device, that cyber incident is also reportable, irrespective of intent.

There are many technological reasons why services may not be available at any given time as, for example, computer servers are offline or systems are being updated. Such events are routine and thus would not be reportable to the NCUA. Only a cyber incident that leads to a substantial loss of confidentiality, integrity, or availability would be reportable to the agency.

The second prong of the reportable cyber incident definition would require reporting to the NCUA in the event of a cyberattack that leads to a disruption of business operations, vital member services, or a member information system. Cyberattacks that cause disruption to a FICU's business operations, vital member services, or a member information system must be reported to the NCUA within 72 hours of a FICU's reasonable belief that it has experienced a cyberattack. For example, a DDoS attack that disrupts member account access would be reportable under this prong. Blocked phishing attempts, failed attempts to gain access to systems, or unsuccessful malware attacks would not be reportable.

The third prong of the reportable cyber incident definition would require a FICU to notify the agency either when a third-party service provider has informed a FICU that the FICU's sensitive data or business operations have been compromised as a result of a cyber incident experienced by the third-party service provider or upon the FICU forming a reasonable belief this has occurred, whichever occurs sooner.

Credit unions are increasingly using third parties to provide technological services, including information security and mobile and online banking. These third-party systems and servers also store a vast amount of FICU member data. A compromise of a third party's systems can be the result of an intentional cyberattack or an unintentional disclosure or loss of information. Considering the high degree of reliance by FICUs upon third parties, it is imperative that the NCUA be informed of any type of compromise to a third party's systems that places the credit union system at risk. Systemic risk from third-party vendors and credit union service organizations (CUSO) is a significant concern given that credit unions rely on many of the same third-party vendors.

As of March 30, 2022, the top five credit union core processing system third-party vendors provided service to credit unions holding approximately 87 percent of total credit union system assets. Likewise, at the end of 2021, the top five CUSOs provided service to credit unions that hold approximately 95 percent of total credit union system assets. Significant problems or a failure with a critical vendor or CUSO has the potential to result in disruption, including losses, to many credit unions and, in turn, pose risk to the National Credit Union Share Insurance Fund (NCUSIF) and national economic security given the amount and type of data held and processed, as well as the number of Americans who use credit unions for financial services. Thus, when a FICU is alerted to a cyber incident caused by a third party which impacts the FICU's sensitive data or business operations, the FICU must report the incident to the NCUA as soon as possible but no later than 72 hours after it was notified by the third party or within 72 hours of the FICU forming a reasonable belief that a reportable cyber incident has occurred, whichever is sooner.

Finally, a FICU would not be required to report an incident performed in good faith by an entity in response to a request by the owner or operator of the information system. An example of an incident excluded from reporting would be the contracting of a third party to conduct a penetration test. 14

In addition to the preceding examples, the following is a non-exhaustive list of incidents that would be considered reportable cyber incidents under the proposed rule:

1. A computer hacking incident that disables a FICU's operations.

2. A ransom malware attack that encrypts a core banking system or backup data.

3. Third-party notification to a FICU that they have experienced a breach of a FICU employee's personally identifiable information (PII).

4. A detected, unauthorized intrusion into a network information system.

5. Discovery or identification of zero-day malware  15 in a network or information system.

6. Internal breach or data theft by an insider.

7. A systems compromise resulting from card skimming.

8. Sensitive data exfiltrated outside of the FICU or a contracted third party in an unauthorized manner, such as through a flash drive or online storage account.

The Board expects that FICUs would consider whether other cyber incidents they experience, beyond those listed above, constitute reportable cyber incidents for purposes of notifying the NCUA. Under this proposal, if a FICU is unsure as to whether a cyber incident is reportable, the Board encourages the FICU to contact the agency.

A cyber incident reporting requirement will help promote early awareness of emerging threats to FICUs and the broader financial system. This early awareness will help the NCUA react to these threats before they become systemic. This reporting requirement is intended to serve as an early alert to the agency and is not intended to include a lengthy assessment of the incident. The agency will require only certain basic information, to the extent it is known to the FICU at the time of reporting, such as:

• A basic description of the reportable cyber incident, including what functions were, or are reasonably believed to have been, affected.

• The estimated date range during which the reportable cyber incident took place.

• Where applicable, a description of the exploited vulnerabilities and the techniques used to perpetrate the reportable cyber incident.

• Any identifying or contact information of the actor(s) reasonably believed to be responsible.

• The impact to the FICU's operations.

The NCUA anticipates that further follow-up communications between the FICU and the agency will occur through the supervisory process, as necessary. As such, the proposed rule does not include any prescribed reporting forms or templates, which should minimize reporting burden.

The Board does not expect that a FICU would typically be able to come to a reasonable belief that a reportable cyber incident has occurred immediately upon becoming aware of a cyber incident. Rather, the Board anticipates that a FICU would take some time to form a reasonable belief that it has experienced a reportable cyber incident. The Board recognizes that a FICU may not be able to form a reasonable belief that a reportable cyber incident has occurred outside of normal business hours. Only once the FICU has formed a reasonable belief that it has experienced a reportable cyber incident would the requirement to report within 72 hours be triggered.

The Board recognizes that a FICU may be working expeditiously to resolve the reportable cyber incident at the time it would be expected to notify the agency. Thus, the Board believes 72 hours is a reasonable amount of time to notify the agency upon the occurrence of a reportable cyber incident, particularly because the notice would not need to include a lengthy assessment of the incident. The Board also recognizes that these situations can be fluid and that additional information or changes to previously reported information may become available after the initial report. The Board expects only that FICUs share general information about what is known at the time.

While the Board is proposing a 72-hour time frame, depending on the feedback received during the comment period and the agency's analysis of the need for more prompt reporting, the final rule may provide a shorter time frame, such as 36 hours as the Federal banking agencies require. 16 Moreover, the notice could be provided to a designated point of contact at the agency via email or telephone or other similar method that the agency may prescribe through guidance. This notification, and any information provided by a FICU related to the incident, would be subject to the NCUA's confidentiality rules. 17

Knowing about and responding to cyber incidents affecting FICUs is important to the NCUA's mission for a variety of reasons, including the following:

• The receipt of cyber incident information may give the NCUA earlier awareness of emerging threats to individual FICUs and, potentially, to the broader financial system.

• An incident may so severely impact a FICU that it can no longer support its members, and the incident could impact the safety and soundness of the FICU, leading to its failure. In these cases, the sooner the NCUA knows of the event, the better it can assess the extent of the threat and take appropriate action.

• An incident may substantially harm or inconvenience a FICU's members and undermine a FICU's consumer protection obligations. In these cases, the sooner the NCUA knows of the event, the sooner it can take appropriate action, including helping the FICU protect its members.

• Based on the NCUA's broad supervisory experience, it may be able to provide information and guidance to FICUs that may not have previously faced a particular type of cyber incident.

• The NCUA would be better able to conduct analyses across the credit union system to improve guidance, adjust supervisory programs, and provide information to the industry to help FICUs protect themselves.

• Receiving notice would enable the NCUA to facilitate requests from FICUs for assistance through the U.S. Treasury Office of Cybersecurity and Critical Infrastructure Protection. 18

In March of this year, Congress enacted the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (Cyber Incident Reporting Act or Act). That Act requires CISA to publish a final rule by September 2025 that will require covered entities, as will be defined in that rule, to report certain cyber incidents to CISA not later than 72 hours after their occurrence. 19 The Board believes that it would be imprudent in light of the increasing frequency and severity of cyber incidents to postpone a notification requirement until after CISA promulgates a final rule.

The Board is proposing to make two technical conforming amendments to appendix B to part 748 to reflect the changes proposed in this rule. The first amends the appendix's reference to the heading to part 748. The second amends a footnote reference to the filing requirements for Suspicious Activity Reports (SARs).

The Board believes this proposed rule is necessary because, as discussed below, current reporting requirements, while related to cyber incidents in some instances, are neither designed nor intended to provide timely information to the NCUA about such incidents.

The Board considered whether the information that would be provided under the proposed rule could be obtained through existing reporting standards. Currently, FICUs may be required to report certain instances of disruptive cyber-events and cyber-crimes by filing SARs. 20 In addition, FICUs should notify the appropriate NCUA Regional Director “as soon as possible” when they become aware “of an incident involving unauthorized access to or use of sensitive member information.”  21 FICUs are also required to notify the NCUA within five business days of any catastrophic act that occurs at their office(s). 22

These reporting provisions can provide the NCUA with valuable insight into cyber-related events and information-security compromises; however, they do not provide the agency with sufficiently timely information about every substantial cyber incident that would be captured by the proposed rule.

Under the reporting requirements of the Bank Secrecy Act (BSA) and its implementing regulations, FICUs are required to file SARs when they detect a known or suspected criminal violation of Federal law or a suspicious transaction related to a money-laundering activity. 23 SARs, however, serve a different purpose from this proposed cyber notification requirement and do not require reporting of every incident captured by the proposed definition of a reportable cyber incident. Moreover, the 30-calendar-day reporting requirement under the BSA framework (with an additional 30 calendar days provided in certain circumstances) does not provide the agency with sufficiently timely notice of reported incidents.

Under the reporting guidelines set forth in appendix B of part 748, the NCUA's Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice (Unauthorized Access Guidance), a FICU's procedures should include notifying the appropriate NCUA Regional Director or, in the case of state-chartered credit unions the appropriate state supervisory authority, as soon as possible when the credit union becomes aware of an incident involving unauthorized access to or use of sensitive member information. 24 While this may provide the agency with notice of some cyber incidents, this standard is too narrow in scope to address all relevant cyber incidents of which the NCUA needs to be notified. In particular, the Gramm-Leach-Bliley Act (GLBA) notification standard, on which the Unauthorized Access Guidance is based, does not include the reporting of incidents that disrupt operations or compromise sensitive credit union data but do not compromise sensitive member information.

At the same time, this proposed rule's definition of `sensitive data' contains some overlap with the definition of `member information' used in the Unauthorized Access Guidance. Thus, there may be instances where unauthorized access to or use of sensitive member information could trigger FICU reporting to the NCUA pursuant to the Unauthorized Access Guidance as well as reporting to the NCUA under this proposed rule. In such instances, the agency expects FICUs to use the reporting framework outlined in this proposed rule. Despite this potential for overlap in some instances, the agency continues to find the Unauthorized Access Guidance to be applicable and appropriate for complying with GLBA and part 748.

Finally, the NCUA regulations require a FICU to notify the appropriate NCUA Regional Director within five business days of any catastrophic act that occurs at its office(s). The NCUA regulations define a catastrophic act as “any disaster, natural or otherwise, resulting in physical destruction or damage to the credit union or causing an interruption in vital member services, as defined in § 749.1 of this chapter, projected to last more than two consecutive business days.”  25 In 2007, the NCUA amended the definition of catastrophic act “to address concerns that relatively minor events could be construed to trigger the need to file a report and, also, clarifying the causal link between a disaster and an interruption in vital member services.”  26 The Board believed these changes to be “consistent with the usual and customary meaning of the word catastrophe.”  27 Furthermore, “[t]hese changes also reinforce the Board's view that the reporting requirement applies only to a disaster as opposed to a circumstance where physical damage or a business closing occurs but is not disaster-related.”  28

While natural disasters were the leading concern in the aftermath of hurricanes Katrina and Rita, the use of the phrasing “any disaster, natural or otherwise” in the definition of catastrophic act was meant to illustrate other events, such as a power grid failure or physical attack, for example, could have a similar impact on access to member services and vital records. While some cyber-events may fall within the § 748.1(b) definition of catastrophic act, the Board believes they are sufficiently distinguishable and distinct to warrant separate consideration. The Board further believes that the longstanding requirement that FICUs be given five business days to report catastrophic acts, as defined in § 748.1(b), is still appropriate.

The Board issues this proposed rule pursuant to its authority under the Federal Credit Union Act (FCUA). Section 209 of the FCUA is a plenary grant of regulatory authority to the Board to issue rules and regulations necessary or appropriate to carry out its role as share insurer for all FICUs. 29 Section 206 of the FCUA requires the agency to impose corrective measures whenever, in the opinion of the Board, any FICU is engaged in or has engaged in unsafe or unsound practices in conducting its business. 30 Accordingly, the FCUA grants the Board broad rulemaking authority to ensure that the credit union industry and the NCUSIF remain safe and sound.

The Board may amend the final rule based on comments received in response to this proposed rule. The Board seeks comment on all parts of the proposed rule, including the following:

1. The concepts used in the definition of reportable cyber incident are as defined currently in the NCUA regulations or as defined by the National Institute of Standards and Technology. Are these appropriate concepts and definitions to use? If not, please explain your reasoning and how the proposed definition of reportable cyber incident should be modified.

2. The proposed definition of reportable cyber incident would require a FICU to notify the NCUA in the event of a substantial cyber incident or cyberattack. What, if any, challenges would a FICU experience in concluding that it has experienced a cyberattack after determining it has experienced a reportable cyber incident? Would including a definition of substantial help a FICU in determining if it experienced a reportable cyber incident? If so, how would you define substantial?

3. The proposed definition of reportable cyber incident would require FICUs to notify the NCUA in the event of a third-party compromise that impacts the FICU's data or operations. In your experience, how do third parties with which FICUs contract currently provide notice when such incidents occur?

4. The Federal banking agencies recently promulgated a rule that requires banking organizations to report certain computer-security incidents to their regulators within 36 hours. 31 After the Federal banking agencies' rule was finalized, Congress enacted the Cyber Incident Reporting Act, which contains a 72-hour reporting window. Should the NCUA adopt a 72-hour reporting window, as proposed, or 36 hours as the Federal banking agencies adopted, or is a different time frame warranted? If a different time frame, please explain what that would be and why?

5. How should FICUs notify the NCUA when faced with a reportable cyber incident? Are email and telephone the best methods as suggested in the proposal? Should the NCUA adopt a single method of cyber incident reporting? Should the NCUA adopt a single point of contact in its Central Office or should FICUs report to their respective NCUA regional offices?

6. The Cyber Incident Reporting Act requires CISA to establish separate reporting requirements for ransomware attacks. The Act defines a ransomware attack as an incident that includes the use or threat of use of unauthorized or malicious code on an information system, or the use or threat of use of another digital mechanism, such as a denial-of-service attack, to interrupt or disrupt the operations of an information system or compromise the confidentiality, availability, or integrity of electronic data stored on, processed by, or transiting an information system, to extort a demand for a ransom payment. The reporting window for these types of incidents is 24 hours. Should the NCUA incorporate a similar reporting requirement of 24 hours specifically for ransomware attacks?

7. In addition to those referenced in the proposed rule, are there any other existing regulatory provisions that should be amended or clarified as a result of the proposed cyber-incident reporting requirement? For example, should § 748.1(b) on catastrophic act reporting be amended to include a requirement to report unplanned systemic outages of technological assets and critical networks, computer assets, systems, data, devices, or applications used to deliver vital electronic services to credit union members, not related to cyber incidents, that last more than two consecutive business days? For example, should the definition of vital member services be updated to reflect changes in how vital services are delivered to members to include reliance on the use of electronic banking systems and/or mobile banking applications to access and conduct transactions on their share, deposit, or loan accounts?

8. Is further clarification needed about any potential overlap between this proposed rule's reporting requirement in the event of unauthorized access to or exposure of sensitive data and the reporting of unauthorized access to member information conducted under the Unauthorized Access Guidance? If so, please provide specific concerns or issues that need to be addressed.

9. The NCUA invites comments on specific examples of incidents that should or should not constitute reportable cyber incidents. In addition to the examples listed in the proposal are there others the agency should consider?

The Regulatory Flexibility Act (RFA) generally requires that, in connection with a notice of proposed rulemaking, an agency prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of a proposed rule on small entities. A regulatory flexibility analysis is not required, however, if the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities (defined for purposes of the RFA to include FICUs with assets less than $100 million)  32 and publishes its certification and a short explanatory statement in the Federal Register together with the rule. The proposed rule would require FICUs to notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe. While this notice requirement is more than currently required under the agency's regulations, the proposed rule is not expected to create a significant cost burden for FICUs. The proposed rule requires a FICU only to provide the agency with notice in the event of a reportable cyber incident. The initial notice only includes limited details of what is known at the time and is not a full assessment or analysis of the incident. Accordingly, the NCUA certifies that the proposed rule will not have a significant economic impact on a substantial number of small credit unions.

The Paperwork Reduction Act of 1995 (PRA) applies to rulemakings in which an agency creates a new or amends existing information collection requirements. 33 For the purpose of the PRA, an information collection requirement may take the form of a reporting, recordkeeping, or a third-party disclosure requirement. The proposed rule does contain information collection requirements that require approval by the Office of Management and Budget (OMB) under the PRA. 34 The proposed rule would require FICUs to notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe.

The information collection requirements associated with 12 CFR part 748 are cleared under OMB control number 3133-0033 and provide for catastrophic act reporting and GLBA incident reporting guidance under appendix B to part 748. The proposed rule adds a cyber incident reporting under § 748.1(c) where FICUs would be required to report these incidents, as defined. The burden associated with the reporting requirements identified under appendix B will be removed because most reporting will now fall under the new cyber incident requirement. The NCUA estimates a one-hour annual reporting burden on each FICU, for a total of 4,903 hours.

Adjustment will also be made to the information collection requirements under part 748 to reflect a reduction in the current number of FICUs and to provide for a more accurate response rate per respondent.

OMB Number: 3133-0033.

Title: Security Program, 12 CFR part 748.

Type of Review: Revision of a currently approved collection.

Abstract: In accordance with Title V of GLBA, as implemented by 12 CFR part 748, FICUs are required to implement an information security program designed to protect member information. This information collection requires that such programs be designed to respond to incidents of unauthorized access or use, in order to prevent substantial harm or serious inconvenience to members. Part 748 sets forth the minimum requirements of a security program. It also addresses member notification, filing with the Financial Crimes Enforcement Network, and monitoring BSA compliance.

Affected Public: Private Sector: Not-for-profit institutions.

Estimated No. of Respondents: 4,903.

Estimated No. of Responses per Respondent: 19.

Estimated Total Annual Responses: 93,307.

Estimated Burden Hours per Response: 2.58.

Estimated Total Annual Burden Hours: 240,397.

The NCUA invites comments on: (a) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (b) the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (c) ways to enhance the quality, utility and clarity of the information to be collected; and (d) ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology; and (e) estimates of capital or start-up costs and cost of operation, maintenance, and purchase of services to provide information.

All comments are a matter of public record. Interested persons are invited to submit written comments to (1) www.reginfo.gov/public/do/PRAMain. Find this particular information collection by selecting the Agency under “Currently under Review,” and (2) Dawn Wolfgang, National Credit Union Administration, 1775 Duke Street, Suite 6032, Alexandria, Virginia 22314; Fax No. 703-519-8579; or email at PRAComments@ncua.gov. Given the limited in-house staff because of the COVID-19 pandemic, email comments are preferred.

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. In adherence to fundamental federalism principles, the NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the Executive order. This rulemaking will not have a substantial direct effect on the states, on the connection between the National Government and the states, or on the distribution of power and responsibilities among the various levels of government. The NCUA has determined that this proposal does not constitute a policy that has federalism implications for purposes of the Executive order.

The NCUA has determined that this final rule will not affect family well-being within the meaning of Section 654 of the Treasury and General Government Appropriations Act, 1999. 35

For the reasons stated in the preamble, the NCUA Board proposes to amend 12 CFR part 748 as follows:

The addition reads as follows:

The revisions read as follows:

The FAA invites you to send any written relevant data, views, or arguments about this proposal. Send your comments to an address listed under ADDRESSES . Include “Docket No. FAA-2022-0891; Project Identifier AD-2022-00585-A,E,R” at the beginning of your comments. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. The FAA will consider all comments received by the closing date and may amend this proposal because of those comments.

Except for Confidential Business Information (CBI) as described in the following paragraph, and other information as described in 14 CFR 11.35, the FAA will post all comments received, without change, to www.regulations.gov, including any personal information you provide. The agency will also post a report summarizing each substantive verbal contact received about this NPRM.

CBI is commercial or financial information that is both customarily and actually treated as private by its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552), CBI is exempt from public disclosure. If your comments responsive to this NPRM contain commercial or financial information that is customarily treated as private, that you actually treat as private, and that is relevant or responsive to this NPRM, it is important that you clearly designate the submitted comments as CBI. Please mark each page of your submission containing CBI as “PROPIN.” The FAA will treat such marked submissions as confidential under the FOIA, and they will not be placed in the public docket of this NPRM. Submissions containing CBI should be sent Thomas Teplik, Aviation Safety Engineer, Wichita ACO Branch, FAA, 1801 S. Airport Road, Wichita, KS 67209. Any commentary that the FAA receives which is not specifically designated as CBI will be placed in the public docket for this rulemaking.

Since the mid-1970s, failures of v-band couplings that attach the exhaust tailpipe to the turbocharger exhaust outlet have resulted in a significant number of incidents and accidents (fatal and non-fatal) on both airplanes and helicopters. Since 1974, National Transportation Safety Board (NTSB) accident and incident investigations have led to the issuance of 7 NTSB Safety Recommendations concerning exhaust systems and/or exhaust v-band couplings; 20 FAA ADs to address the unsafe condition with exhaust systems and/or exhaust v-band couplings; and 10 FAA Special Airworthiness Information Bulletins (SAIBs). Industry has also taken action to raise awareness of the concerns associated with v-band coupling failures.

You may examine these NTSB Safety Recommendations in the AD docket at www.regulations.gov by searching for and locating Docket No. FAA-2022-0891.

I. Background

The Commission promulgated the Amplifier Rule in 1974 to address sellers' failure to provide essential pre-purchase information. 1 Specifically, manufacturers of home entertainment amplifiers described their products' performance through power output claims ( e.g., “25 Watts.”). However, because manufacturers tested amplifiers under a variety of conditions and used incompatible procedures, consumers could not effectively use the wattage claims to compare the power characteristics of different brands or determine how individual amplifiers would perform. The Commission noted “[s]ince the mid-50's the [audio] industry” had failed “to agree upon a single industry standard which is meaningful to the consumer.”  2 Accordingly, the Rule standardized the measurement and disclosure of some, but not all, performance characteristics of power amplification equipment to permit consumers to “assure that all performance characteristics are based upon conditions of normal use by the consumer, i.e., conditions which are encountered in the home.”  3

Under the Rule, sellers making certain power claims ( i.e., for power output, power band or power frequency response, or distortion characteristics) must disclose power output measured under specified test conditions; for example, amplifiers must be tested at an ambient air temperature of at least 77 °F (25 °C). 4 The Rule, however, does not specify values for three test conditions that strongly affect power output measurements: load impedance, 5 rated power band or power frequency response, 6 and Total Harmonic Distortion (THD). 7 Instead, it requires sellers to disclose these conditions when making certain power claims in product brochures and manufacturer specification sheets. 8 The original Rule required these disclosures wherever sellers made these claims;  9 however, in 2000, the Commission eliminated disclosure requirements in “media advertising.”  10

Additionally, the Rule requires manufacturers to fully drive all “associated” channels to the rated per channel power when measuring the power output of sound amplification equipment designed to amplify two or more channels simultaneously. 11 When the Commission established the Rule, stereo amplifiers were the only equipment subject to this requirement, and, importantly, normal consumer use drove both “associated” channels equally. This requirement prevented manufacturers from deceiving consumers by driving only one channel in testing, and thus inflating power output. 12

The introduction of “home theater” equipment with five or more channels improved consumer amplification choices but raised questions regarding which of these new channels were “associated” under the Rule. 13 Consequently, in 2000 the Commission issued a supplemental notice of proposed rulemaking (“SNPR”) soliciting evidence on which channels multichannel amplifiers fully drive during normal usage. 14 The Commission also sought comment on its proposal to amend the definition of “associated channels” to reflect real-world use. The Commission received only one comment in response. The Consumer Electronics Association (“CEA”) noted there was no industry consensus regarding measuring power output of multichannel amplifiers.

On January 15, 2002, at CEA's request, the Commission deferred action to allow industry to form a consensus on procedures for testing multichannel amplifiers. 15 Although CEA subsequently issued a standard, designated EIA/CEA-490-A, “Test Methods of Measurement for Audio Amplifiers,” the Commission did not find widespread adoption of this standard. With no industry standard in place and only CEA's comment on the record, the Commission decided not to amend the Rule. 72 FR 13052 (March 20, 2007).

On February 27, 2008, the Commission published notification in the Federal Register seeking comment on the Amplifier Rule as part of its periodic review of the Rule to determine its effectiveness and impact. 16 Sony Electronics Inc. (“Sony”) urged the Commission not to amend the Rule to define all channels of a multichannel home theater system as “associated.” Sony explained “the additional channels in today's 5.1 and 7.1 home theater systems are designed to carry vastly different sounds at vastly different levels.” Thus, Sony asserted driving all channels simultaneously during testing would not represent actual use and would drive up consumer prices. 17 On January 26, 2010, based on the record at that time, the Commission again retained the Rule in its current form, finding a continuing need for the Rule and that it imposed minimal costs on industry. Although the Commission did not amend the test procedures for multichannel amplifiers, it provided guidance confirming it would be a violation of the Rule to make power output claims for multichannel amplifiers utilized in home entertainment products unless those representations are substantiated by measurements made with, at a minimum, the left front and right front channels driven to full rated power. 18

Pursuant to its ongoing regulatory review schedule, on December 18, 2020, the Commission published an advance notice of proposed rulemaking (ANPR) seeking comment on the Amplifier Rule. 85 FR 82391 (Dec. 18, 2020). The ANPR sought comments regarding possible Rule improvements, its continuing need, costs and benefits, and whether, and how, technological or economic changes have affected the Rule.

The Commission received 530 unique comments in response to its ANPR. 19 The commenters primarily consisted of amplifier and speaker manufacturers, amplifier sellers and purchasers, and engineers or journalists in the audio field.

All but one commenter supported retaining the Rule. 20 Commenters explained the Amplifier Rule enables consumers to make informed, “apples-to-apples” comparisons, and creates incentives for manufacturers to produce superior amplifiers. 21 Commenters further asserted if the Commission were to rescind the Rule, the audio amplifier marketplace would return to the “Wild West” conditions that initially led to its promulgation. 22 Additionally, commenters noted the Rule imposes insignificant or no costs on industry. 23 Commenters noted changes in the audio marketplace have increased the need for the Rule. For example, Garry Grube (187) stated the shift from purchases in stores, where consumers could listen to amplifiers, to online purchases increases consumers' reliance on power output measurements. David R. (424) stated larger modern living spaces require more powerful amplifiers, increasing the importance of reliable power output ratings. Based on this near universal support, the Commission concludes there is a continuing need for the Rule.

Although commenters overwhelmingly supported the Amplifier Rule, some recommended amendments. Specifically, commenters asked the Commission to specify values for load impedance, power band, and THD during testing; and to define the associated channels in multichannel amplifiers used for home theaters.

Numerous commenters urged the Commission to require uniform power band, load impedance, and THD limits for measuring amplifier power output. Specifically, one hundred and seventy three commenters proposed standardizing testing with at least one of the following specifications: a load impedance of 8 ohms, a power band of 20 Hz to 20 kHz, and a THD limit of less than 0.1%. 24 These commenters generally asserted that uniform test conditions would address consumer confusion resulting from advertising of unrealistic power outputs. 25 For example, commenter David Rich (548) noted “online product literature is showing values up to twice the power” compared to tests conducted under conditions that reflect normal consumer usage.

Consistent with these comments, FTC staff found this problem was ubiquitous in the marketplace. Specifically, staff found dozens of examples of the same equipment advertised with significantly different power output ( e.g., some sellers advertised a particular model with 45 watts output per channel, while others advertised the same model with 100 watts per channel  26 ). Using specification sheets on manufacturers' websites, staff confirmed these widely divergent output claims result from different testing parameters.

Based on the comments and staff's review, the Commission finds consumers are unlikely to understand the complex power output disclosures marketers are making under the current Rule. 27 Specifically, FTC staff's review of advertisements shows, in some cases, amplifiers are advertised with widely differing power outputs due to testing conditions. For example, FTC staff reviewed advertisements for two amplifiers and found that—when tested under identical conditions  28 —Amplifier A (75 watts) had a higher power output than Amplifier B (45 watts). 29 However, staff's review found advertisements in which Amplifier B was advertised as outputting 100 watts because it was tested under more favorable conditions. 30 These types of confusing disclosures are likely to deceive many consumers who, when comparing two amplifiers, are likely to reasonably conclude that an amplifier advertised as outputting “75 watts” is less powerful than an amplifier advertised as outputting “100 watts.”

In the past, the Commission has attempted to rectify this problem by requiring sellers to disclose load impedance, rated power band or power frequency response, and Total Harmonic Distortion (THD). The Rule first required these disclosures in all “media advertising” and later just in brochures and specification sheets. However, returning to this stricter disclosure regime is unlikely to adequately address the problem in the modern marketplace. Specifically, given the technical nature of the disclosed terms, and the complex calculations needed to convert the disclosure into apples-to-apples comparisons of power output claims, these disclosures are unlikely to prevent most consumers from being deceived. The problem is amplified because consumers shop online more frequently, providing fewer opportunities to listen to equipment before purchasing it.

Therefore, to eliminate widespread claims regarding power output that are likely to confuse or deceive consumers, the Commission proposes amending the Amplifier Rule to simplify power output measurements by standardizing test parameters. Specifically, the Commission proposes requiring the following standard testing parameters: load impedance of 8 ohms, a power band of 20 Hz to 20 kHz, and a THD limit of less than 0.1%. Staff's review found amplifiers are generally designed to drive a nominal load impedance of 8 ohms; 20 Hz to 20 kHz covers the normal range of human hearing;  31 and 0.1% THD does not audibly distort a signal. Several commenters suggested these parameters, and many manufacturers' specification sheets already disclose power outputs tested at 8 ohms, 20 Hz to 20 kHz, and at THD limits of or slightly below 0.1%, e.g., at 0.08%.

Numerous commenters recommended amending the Rule to clarify which channels are associated for testing multichannel home theater amplifiers. Several commenters recommended defining all channels of a multichannel amplifier as associated, i.e., testing with all channels fully driven. 32 However, they failed to explain how fully driving all channels related to normal usage. 33 As noted above, in 2010, the Commission considered and rejected a similar amendment because home theater systems are designed to carry different sounds at different levels on different channels. Therefore, driving all channels simultaneously during testing would not represent normal use, potentially incentivizing manufacturers to overbuild systems and raise prices without any consumer benefit. 34

Other commenters recommended driving the three front channels to full rated power and all other channels to one-eighth rated power. 35 Again, however, these comments did not provide evidence that these parameters approximated normal use.

Accordingly, the Commission seeks evidence regarding:

(1) Which channels multichannel amplifiers fully drive simultaneously during normal usage?

(2) Which channels multichannel amplifiers partially drive during normal usage, and how hard such amplifiers drive these channels?

(3) What test procedures would best measure multichannel amplifier power output during normal usage?  36

The Commission seeks comments on all aspects of the proposed requirements, including the likely effectiveness of the proposed amendments in helping the Commission combat unfair or deceptive practices in the marketing of amplifiers utilized in home entertainment equipment. The Commission also seeks comment on various alternatives to the proposed regulation, to further address disclosures. It also seeks comment on other approaches, such as the publication of additional consumer and business education. The Commission seeks any suggestions or alternative methods for improving current requirements. Commenters should provide any available evidence and data that supports their position, such as empirical data, consumer perception studies, and consumer complaints.

You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before September 26, 2022. Include “Amplifier Rule Review, Project No. P974222” on your comment. Your comment, including your name and your state, will be placed on the public record of this proceeding, including, to the extent practicable, on the https://www.regulations.gov website.

Because of the public health emergency in response to the COVID-19 outbreak and the agency's heightened security screening, postal mail addressed to the Commission will be subject to delay. We strongly encourage you to submit your comments online through the https://www.regulations.gov website. To ensure that the Commission considers your online comment, please follow the instructions on the web-based form.

If you file your comment on paper, write “Amplifier Rule Review, Project No. P974222” on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex A), Washington, DC 20580.

Because your comment will be placed on the publicly accessible website, https://www.regulations.gov, you are solely responsible for making sure that your comment does not include any sensitive or confidential information. In particular, your comment should not include any sensitive personal information such as your or anyone's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any “[t]rade secret or any commercial or financial information which . . . is privileged or confidential”—as provided in section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)—including in particular competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.

Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled “Confidential,” and must comply with FTC Rule 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted publicly at www.regulations.gov —as legally required by FTC Rule 4.9(b)—we cannot redact or remove your comment, unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule 4.9(c), and the General Counsel grants that request.

Visit the FTC website to read this request for comment and the news release describing it. The FTC Act and other laws the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments it receives on or before September 26, 2022. For information on the Commission's privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

The Commission finds that using expedited procedures in this rulemaking will serve the public interest. Expedited procedures will support the Commission's goals of clarifying and updating existing regulations without undue expenditure of resources, while ensuring that the public has an opportunity to submit data, views, and arguments on whether the Commission should amend the Amplifier Rule. Pursuant to 16 CFR 1.20, the Commission will use the following procedures: (1) publishing this notice of proposed rulemaking; (2) soliciting written comments on the Commission's proposals to amend the Rule; (3) holding an informal hearing, if requested by interested parties; and (4) announcing final Commission action in a document published in the Federal Register .

The Commission, in its discretion, has not chosen to schedule an informal hearing and has not made any initial designations of disputed issues of material fact necessary to be resolved at an informal hearing. Interested persons who wish to make an oral submission at an informal hearing must file a comment in response to this notification and submit a statement identifying their interests in the proceeding and describing any proposals regarding the designation of disputed issues of material fact to be resolved at the informal hearing, on or before September 26, 2022. 16 CFR 1.11. Such requests, and any other motions or petitions in connection with this proceeding, must be filed with the Secretary of the Commission.

Under Section 22 of the FTC Act, 15 U.S.C. 57b-3, the Commission must issue a preliminary regulatory analysis for a proceeding to amend a rule if the Commission: (1) estimates the amendment will have an annual effect on the national economy of $100 million or more; (2) estimates the amendment will cause a substantial change in the cost or price of certain categories of goods or services; or (3) otherwise determines the amendment will have a significant effect upon covered entities or upon consumers. The Commission has preliminarily determined the proposed amendments to the Amplifier Rule will not have such effects on the national economy, on the cost of sound amplification equipment, or on covered businesses or consumers. In developing these proposals, the Commission has sought to minimize prescriptive requirements and provide flexibility to sellers in meeting the Rule's objectives. The Commission, however, requests comment on the economic effects of the proposed amendments.

The Regulatory Flexibility Act (“RFA”), 5 U.S.C. 601-612, requires that the Commission conduct an analysis of the anticipated economic impact of the proposed amendment on small entities. The purpose of a regulatory flexibility analysis is to ensure that an agency considers potential impacts on small entities and examines regulatory alternatives that could achieve the regulatory purpose while minimizing burdens on small entities. The RFA requires the Commission provide an Initial Regulatory Flexibility Analysis (“IRFA”) with a proposed rule and a Final Regulatory Flexibility Analysis (“FRFA”) with a final rule, if any, unless the Commission certifies that the rule will not have a significant economic impact on a substantial number of small entities.

The Commission believes the proposed amendment would not have a significant economic impact upon small entities, although it may affect a substantial number of small businesses. Specifically, the proposed change in the disclosure requirements should not significantly increase the costs of small entities that manufacture or import power amplification equipment for use in the home. Therefore, based on available information, the Commission certifies that amending the Rule as proposed will not have a significant economic impact on a substantial number of small businesses. Although the Commission certifies under the RFA the proposed amendment would not, if promulgated, have a significant impact on a substantial number of small entities, the Commission has determined, nonetheless, it is appropriate to publish an IRFA to inquire into the impact of the proposed amendment on small entities. Therefore, the Commission has prepared the following analysis:

The Commission proposes amending the Rule to standardize testing parameters to assist consumers in understanding power output disclosures for amplifiers and to eliminate claims regarding power output that are likely to deceive consumers.

The Commission promulgated the Rule pursuant to section 18 of the FTC Act, 15 U.S.C. 57a. The proposed amendment would standardize testing parameters for amplifiers to prevent deceptive claims regarding power output and assist consumers in understanding power output disclosures.

The Rule covers manufacturers and importers of power amplification equipment for use in the home. Under the Small Business Size Standards issued by the Small Business Administration, audio and video equipment manufacturers qualify as small businesses if they have 750 or fewer employees. 37 The Commission's staff estimates a substantial number of the entities covered by the Rule likely qualify as small businesses.

The Commission is proposing amendments designed to simplify the Rule and provide clearer amplifier power output measurements for consumers to use to compare products. While the amendments modify the Rule's testing requirements, FTC staff do not anticipate these changes will result in higher costs for covered entities because manufacturers already test power output for their amplifiers, in many cases testing amplifiers under the conditions specified by the proposed amendments.

The Commission has not identified any other Federal statutes, rules, or policies that would duplicate, overlap, or conflict with the proposed amendment.

The Commission has not proposed any specific small entity exemption or other significant alternatives because the proposed amendment would not impose any new requirements or compliance costs.

The current Rule contains various provisions that constitute information collection requirements as defined by 5 CFR 1320.3(c), the definitional provision within the Office of Management and Budget (“OMB”) regulations implementing the Paperwork Reduction Act (“PRA”). OMB has approved the Rule's existing information collection requirements through April 30, 2024 (OMB Control No. 3084-0105). As described above, the Commission is proposing amendments to simplify power output measurements by standardizing test parameters. The amendments do not change the frequency of the testing or disclosure requirements specified under the Rule. Accordingly, FTC staff do not anticipate this change will result in additional burden hours or higher costs for manufacturers who already test power output for their amplifiers, in many cases testing amplifiers under the conditions specified by the proposed amendments. Therefore, the amendments do not require further OMB clearance.

Pursuant to FTC Rule 1.18(c)(1), the Commission has determined that communications with respect to the merits of this proceeding from any outside party to any Commissioner or Commissioner's advisor shall be subject to the following treatment. Written communications and summaries or transcripts of oral communications shall be placed on the rulemaking record if the communication is received before the end of the comment period. They shall be placed on the public record if the communication is received later. Unless the outside party making an oral communication is a member of Congress, such communications are permitted only if advance notice is published in the Weekly Calendar and Notice of “Sunshine” Meetings. 38

For the reasons stated above, the Commission proposes to amend part 432 of title 16 of the Code of Federal Regulations as follows:

The Commission is proposing for public comment amendments to 17 CFR 240.14a-8 (“Rule 14a-8”) under the Securities Exchange Act of 1934 [15 U.S.C. 78a et seq. ] (“Exchange Act”).

Exchange Act Rule 14a-8 requires companies that are subject to the federal proxy rules  1 to include shareholder proposals in their proxy statements to shareholders, subject to certain procedural and substantive requirements. 2 The rule is intended to facilitate shareholders' right under state law to present their own proposals at a company's meeting of shareholders and the ability of all shareholders to consider and vote on such proposals. 3

Under Rule 14a-8, a company must include a shareholder's proposal in the company's proxy materials unless the proposal fails to satisfy any of several specified substantive requirements or the proposal or shareholder-proponent does not satisfy certain eligibility or procedural requirements. Companies and shareholder-proponents do not always agree on the application of these requirements. If a company intends to exclude a shareholder proposal from its proxy materials, it is required under Rule 14a-8(j)(1) to “file its reasons” for doing so with the Commission. 4 These notifications are generally submitted in the form of no-action requests, with companies seeking the staff's concurrence that they may exclude a shareholder proposal under one or more of the procedural or substantive bases under Rule 14a-8. For many years the staffs of the Division of Corporation Finance and the Division of Investment Management, as applicable, have engaged through the no-action letter process in the informal practice of expressing whether they would recommend enforcement action to the Commission if a company excludes a proposal from its proxy materials. 5 The staff offers its views in this manner to assist companies and shareholder-proponents in complying with the federal proxy rules. 6

The shareholder proposal process has become a cornerstone of engagement between shareholders and company management. 7 Shareholder proposals provide an important mechanism for investors to express their views, provide feedback to companies, exercise oversight of management, and raise important issues for the consideration of their fellow shareholders in the company's proxy statement. Moreover, investor support for shareholder proposal campaigns over the years has helped to shape many current corporate practices and policies, such as annual director elections, majority vote standards for director elections, and proxy access rights for shareholders. 8

On January 14, 2022, DEA published a Notice of Proposed Rulemaking (NPRM) in the Federal Register (87 FR 2376) to place five tryptamine hallucinogens—specifically, 4-hydroxy- N,N -diisopropyltryptamine (4-OH-DiPT), 5-methoxy- alpha -methyltryptamine (5-MeO-AMT), 5-methoxy- N -methyl- N -isopropyltryptamine (5-MeO-MiPT), 5-methoxy- N,N -diethyltryptamine (5-MeO-DET), and N,N -diisopropyltryptamine (DiPT)—in schedule I of the Controlled Substances Act (CSA) (21 U.S.C. 801, et seq. ). The proposed placement of these substances in schedule I was based on the scientific and medical evaluations and recommendations that the HHS provided to DEA.

In response to the NPRM, DEA received numerous comments and four requests for a hearing on the proposed rule, as provided in 21 U.S.C. 811(a). DEA scheduled a hearing on the proposed rule and published a notice to that effect in the Federal Register on July 6, 2022 (87 FR 40167). The public hearing was scheduled to commence on August 22, 2022.

Upon further consideration, DEA has determined that it is appropriate to submit a new request to HHS for an updated scientific and medical evaluation and scheduling recommendation for these substances in accordance with 21 U.S.C. 811(b) and 21 CFR 1308.43(d).

Accordingly, DEA's proposed rule published in the Federal Register on January 14, 2022 (87 FR 2376), and the notice of hearing on the proposed rule published in the Federal Register on July 6, 2022 (87 FR 40167), are withdrawn. The public hearing scheduled to commence on August 22, 2022 is canceled, and all proceedings related thereto are hereby terminated. DEA may issue a new proposed rule in the future regarding the five tryptamine hallucinogens if warranted.

This document of the Drug Enforcement Administration was signed on July 22, 2022, by Administrator Anne Milgram. That document with the original signature and date is maintained by DEA. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DEA Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of DEA. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .

Background

Section 329 of the 2021 National Defense Authorization Act (NDAA 2021) (Pub. L. 116-283, Jan. 3, 2020) requires the Service to issue regulations of general applicability establishing objectives, measurable performance standards, and criteria for use for species conservation banking programs, consistent with the ESA. The NDAA 2021 states that, to the maximum extent practicable, the regulatory standards and criteria shall maximize available credits and opportunities for mitigation, provide flexibility for characteristics of various species, and apply equivalent standards and criteria to all mitigation banks. The NDAA 2021 also requires us to publish an advance notice of proposed rulemaking (ANPR) within 1 year of enactment of the NDAA 2021.

The Service has a long history collaborating with both private and public entities in the establishment and oversight of mitigation and conservation banks, and other compensatory mitigation projects. In 2003, we issued the Guidance for the Establishment, Use, and Operation of Conservation Banks (68 FR 24753, May 8, 2003), which was intended to help Service personnel evaluate conservation bank proposals. One of the stated goals of the ESA is to “provide a means whereby the ecosystems upon which endangered species and threatened species depend may be conserved.” Conservation banks contribute to the recovery of listed species and help reduce threats such as habitat fragmentation and lack of habitat connectivity by consolidating and managing priority habitat areas in a reserve network. So far, 173 Service-approved conservation banks have protected approximately 260,000 acres of habitat for 57 species listed under the ESA.

As the conservation banking program continues to grow, it is important to ensure consistency, transparency, and predictability for project proponents and mitigation providers. The development and application of equivalent standards and criteria for conservation banks and all habitat-based compensatory mitigation mechanisms is in the interest of industry, mitigation providers, and species conservation. This proposed rule will focus on conservation banking programs for ESA-listed, proposed, and candidate species, including maximizing available credits.

Conservation banks typically adhere to basic standards for providing real estate protection, ecological management, and funding. The Service intends to apply equivalent standards to all habitat-based compensatory mitigation mechanisms (including conservation banks, in-lieu fee programs, and permittee-responsible mitigation) for covered species.

Species conservation banks sometimes overlap with wetland mitigation banks established under the joint regulation Compensatory Mitigation for Losses of Aquatic Resources (33 CFR parts 325 and 332, and 40 CFR part 230) (73 FR 19594, April 10, 2008; hereafter the “2008 Rule”) administered by the U.S. Army Corps of Engineers and the U.S. Environmental Protection Agency, so the Service intends this proposed rule to maintain compatibility with the 2008 Rule. The 2008 Rule applies equivalent standards to each covered mitigation mechanism (in-lieu fee programs, permittee-responsible mitigation, and mitigation banks) to help ensure compensatory mitigation results in successful, durable, and sustainable resource functions regardless of mechanism.

The proposed rule will not modify any of the Service's existing authorities for either recommending or requiring mitigation. Instead, it will address regulatory standards and criteria for compensatory mitigation mechanisms, consistent with the ESA and its implementing regulations.

The Service will analyze the proposed regulation in accordance with the criteria of the National Environmental Policy Act (NEPA), the Department of the Interior regulations on Implementation of the National Environmental Policy Act (43 CFR 46.10-46.450), and the Department of the Interior Manual (516 DM Chapters 1-15).

The Service requests your comments regarding the content of the proposed regulation, including appropriate objectives, measurable performance standards (including metrics for ecological benefit and additionality) for habitat and species, and criteria for use of credits offered by bank operators to satisfy a mitigation requirement consistent with the ESA. We also request your comments regarding how to ensure the regulatory standards and criteria maximize the accrual of functions measured as available credits and opportunities for mitigation to the maximum extent practicable, provide flexibility for characteristics of various species, and apply equivalent standards and criteria such as real estate protections, ecological management, and funding to all species conservation banks. We also request comment on how best to account for risk and uncertainty when conservation banks are used to achieve a given conservation objective.

The Service is particularly interested in comments on the following:

(1) What level of detail should be in the proposed rule to ensure equivalent standards are consistently applied to all forms of compensatory mitigation, including equivalence in covering the costs of mitigation whether they are on public or private lands?

(2) What level of detail should be in the proposed rule regarding durability and additionality standards to both achieve equivalent standards across mitigation mechanisms and provide species conservation?

(3) How should the proposed rule incorporate monitoring, financial assurances, and publicly accessible mitigation data tracking systems to ensure a compensatory mitigation mechanism is meeting its performance standards?

(4) What are the hurdles to species bank establishment that are within the Service's authority to address through regulation?

(5) How should the proposed rule align with 2008 Rule provisions to maintain compatibility between mitigation banks and species banks where appropriate?

(6) How should the Service address potential bank projects on Federal and Tribal lands or on other lands with unique ownership considerations and/or some degree of existing protection?

We seek information from knowledgeable members of the public, including mitigation providers, small businesses, Tribes, developers, and others. All submissions received must include the Service docket number for this document. Before including your address, phone number, email address, or other personal identifying information in your comment, you should be aware that your entire comment—including your personal information—may be made publicly available. While you can ask us in your comment to withhold your personal identifying information from public review, we cannot guarantee that we will be able to do so.