Skip to content
LexBuild

12 CFR § 225.301 - Definitions.

---
identifier: "/us/cfr/t12/s225.301"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "12 CFR § 225.301 - Definitions."
title_number: 12
title_name: "Banks and Banking"
section_number: "225.301"
section_name: "Definitions."
chapter_name: "FEDERAL RESERVE SYSTEM"
subchapter_number: "A"
subchapter_name: "BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM"
part_number: "225"
part_name: "BANK HOLDING COMPANIES AND CHANGE IN BANK CONTROL (REGULATION Y)"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "12 U.S.C. 1817(j)(13), 1818, 1828(o), 1831i, 1831p-1, 1843(c)(8), 1844(b), 1972(1), 3106, 3108, 3310, 3331-3351, 3354, 3906, 3907, and 3909; 15 U.S.C. 1681s, 1681w, 6801 and 6805."
regulatory_source: "Reg. Y, 49 FR 818, Jan. 5, 1984, unless otherwise noted."
cfr_part: "225"
---

# 225.301 Definitions.

(a) Except as modified in this subpart, or unless the context otherwise requires, the terms used in this subpart have the same meanings as set forth in 12 U.S.C. 1813.

(b) For purposes of this subpart, the following definitions apply.

(1) *Banking organization* means a U.S. bank holding company; U.S. savings and loan holding company; state member bank; the U.S. operations of foreign banking organizations; and an Edge or agreement corporation; provided, however, that no designated financial market utility shall be considered a banking organization.

(2) *Bank service provider* means a bank service company or other person that performs covered services; provided, however, that no designated financial market utility shall be considered a bank service provider.

(3) *Business line* means a product or service offered by a banking organization to serve its customers or support other business needs.

(4) *Computer-security incident* is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.

(5) *Covered services* are services performed, by a person, that are subject to the Bank Service Company Act (12 U.S.C. 1861-1867).

(6) *Designated financial market utility* has the same meaning as set forth at 12 U.S.C. 5462(4).

(7) *Notification incident* is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's—

(i) Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business;

(ii) Business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or

(iii) Operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

(8) *Person* has the same meaning as set forth at 12 U.S.C. 1817(j)(8)(A).