# Filing of reports.
**AGENCY:**
National Credit Union Administration (NCUA).
**ACTION:**
Proposed rule.
**SUMMARY:**
The NCUA Board (Board) is publishing this proposed rule to amend the requirements for federally insured credit unions (FICUs) to report catastrophic acts to the agency. By providing more time for FICUs to notify the agency of the occurrence of a catastrophic act and by eliminating the specific list of items to be documented, the Board expects the proposed rule to reduce the compliance burden and allow FICUs to focus their resources on recovery and core functions without compromising safety and soundness.
**DATES:**
Comments must be received on or before February 27, 2026.
**ADDRESSES:**
Comments may be submitted in one of the following ways. (Please send comments by one method only):
• *Federal eRulemaking Portal: https://www.regulations.gov.* The docket number for this proposed rule is NCUA-2025-1437. Follow the “Submit a comment” instructions. If you are reading this document on *federalregister.gov* , you may use the green “SUBMIT A PUBLIC COMMENT” button beneath this rulemaking's title to submit a comment to the *regulations.gov* docket. A plain language summary of the proposed rule is also available on the docket website.
• *Mail:* Address to Melane Conyers-Ausbrooks, Secretary of the Board, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428.
• *Hand Delivery/Courier:* Same as mailing address.
Mailed and hand-delivered comments must be received by the close of the comment period.
*Public inspection:* Please follow the search instructions on *https://www.regulations.gov* to view the public comments. Do not include any personally identifiable information (such as name, address, or other contact information) or confidential business information that you do not want publicly disclosed. All comments are public records; they are publicly displayed exactly as received, and will not be deleted, modified, or redacted. Comments may be submitted anonymously. If you are unable to access public comments on the internet, you may contact the NCUA for alternative access by calling (703) 518-6540 or emailing *[email protected].*
**FOR FURTHER INFORMATION CONTACT:**
Gira Bose, Senior Staff Attorney, at (703) 518-6540 or at 1775 Duke Street, Alexandria, VA 22314.
**SUPPLEMENTARY INFORMATION:**
**I. Introduction**
**A. Background**
Part 748 requires a FICU to notify the appropriate NCUA Regional Director within five business days of any catastrophic act that occurs at its office(s). NCUA regulations define a catastrophic act as “any disaster, natural or otherwise, resulting in physical destruction or damage to the credit union or causing an interruption in vital member services, as defined in § 749.1 of this chapter, projected to last more than two consecutive business days.” <sup>1</sup> The agency adopted this requirement under 12 U.S.C. 1785(e), which requires the agency to promulgate rules establishing minimum safety standards relating to security.
[^1] 12 CFR 748.1(b). *See also* 12 CFR 749, App. B, Catastrophic Act Preparedness Guidelines. The NCUA has long required catastrophic act reporting. In 1970, Congress amended the Federal Credit Union Act (FCU Act) to require that the NCUA promulgate rules establishing minimum standards for the installation, maintenance, and operation of security devices and procedures to discourage robberies, burglaries, and larcenies. The 1970 amendment to the FCU Act also required the agency to adopt time limits for compliance and mandated the submission of periodic reports. *See* 12 U.S.C. 1785(e) (Pub. L. 91-468) (84 Stat. 1002). Thus, since 1971, the NCUA has promulgated regulations requiring the submission of reports within five working days of an occurrence, or attempted occurrence, of a crime or catastrophic act. *See* 36 FR 10940 (June 1, 1971). *See also* 47 FR 17981 (Apr. 27, 1982); 50 FR 53295 (Dec. 31, 1985).
In 2007, NCUA amended the definition of catastrophic act “to address concerns that relatively minor events could be construed to trigger the need to file a report and, also, clarifying the causal link between a disaster and an interruption in vital member services.” [^2] The Board believed these changes to be “consistent with the usual and customary meaning of the word catastrophe.” [^3] The Board stated, “[t]hese changes also reinforce the Board's view that the reporting requirement applies only to a disaster as opposed to a circumstance where physical damage or a business closing occurs but is not disaster-related.” [^4] While natural disasters were the leading concern in the aftermath of hurricanes Katrina and Rita, the use of the phrasing “any disaster, natural or otherwise” in the definition of catastrophic act was meant to illustrate other events, such as a power grid failure or physical attack, for example, could have a similar impact on access to member services and vital records.
[^2] 72 FR 42271 (Aug. 2, 2007).
[^3]*Id.*
[^4]*Id.*
**B. Legal Authority**
The Board is issuing this proposed rule pursuant to its authority under the Federal Credit Union Act (FCU Act). [^5] Under the FCU Act, the NCUA is the chartering and supervisory authority for federal credit unions (FCUs) and the federal supervisory authority for federally insured credit unions (FICUs). The FCU Act grants the NCUA a broad mandate to issue regulations governing both FCUs and FICUs. Section 120 of the FCU Act is a general grant of regulatory authority and authorizes the Board to prescribe regulations for the administration of the FCU Act. [^6] Section 209 of the FCU Act is a plenary grant of regulatory authority to the NCUA to issue regulations necessary or appropriate to carry out its role as share insurer for all FICUs. [^7] The FCU Act also includes an express grant of authority for the Board to subject federally chartered central, or corporate, credit unions to such rules, regulations, and orders as the Board deems appropriate. [^8]
[^5] 12 U.S.C. 1751 *et seq.*
[^6] 12 U.S.C. 1766(a).
[^7] 12 U.S.C. 1789.
[^8] 12 U.S.C. 1766(a).
**II. Proposed Rule**
The Board is proposing to further ease the reporting burden with the following amendments. First, the proposal would amend the regulation to require that credit unions notify “NCUA” rather than the specific “regional director.” This change is intended to modernize the reporting process and provide greater operational flexibility for both FICUs and the agency. By designating “NCUA” as the recipient, the agency can centralize and streamline the intake of these critical reports, ensuring they are routed efficiently to the appropriate personnel for response and monitoring. This change would remove the burden on a credit union, which may be operating under emergency conditions, to identify and direct its report to a specific regional office.
Second, the proposal would extend the timeframe for submitting a catastrophic act report from “5 business days” to “15 calendar days.” The Board believes the current five-day deadline may be impractical for an institution recovering from a significant operational disruption. Extending the deadline to 15 calendar days provides credit union management with a more reasonable amount of time to stabilize operations, assess the full scope of the damage, and provide a more accurate report to the agency. This change acknowledges the significant operational challenges that follow a catastrophic act and would allow a credit union to prioritize recovery efforts over immediate administrative reporting.
Finally, the Board proposes to remove the prescriptive list of items that a credit union should include in its internal record of a catastrophic act and replace it with a requirement that a credit union record the basic facts of the event. The current rule suggests documenting details such as the location, timing, loss amount, and potential operational deficiencies. While maintaining a record containing the basic facts of an event is a prudent business practice, the Board believes that specifying the exact contents of this internal record to the degree currently required is an unnecessary and overly prescriptive regulatory burden. FICUs already maintain records of such events as part of their own business continuity and disaster recovery planning. Removing the list of items in this sentence would reduce administrative overhead and allow FICUs the flexibility to document these incidents in a manner that best suits their operational and recordkeeping policies, while still ensuring a record is created and maintained. This change would also make the regulation clearer by removing a provision that is phrased as a suggestion and not a requirement with the use of the word “should.”
Commenters are invited to provide feedback on these proposed changes to the catastrophic act reporting requirements. Specifically, the Board seeks feedback on whether the proposed amendments appropriately balance the agency's need for timely information with the operational burdens faced by FICUs during a crisis. The Board is also seeking comment on whether credit unions should be permitted to use existing notification tools, such as the form currently used to report cybersecurity incidents under section 748.1(c), to report catastrophic acts. Commenters are also invited to address whether the proposed 15-calendar-day reporting timeframe is appropriate and whether the removal of the recordkeeping elements would provide meaningful burden reduction.
**III. Regulatory Procedures**
**A. Providing Accountability Through Transparency Act of 2023**
The Providing Accountability Through Transparency Act of 2023 (5 U.S.C. 553(b)(4)) (Act) requires that a notice of proposed rulemaking include the internet address of a summary of not more than 100 words in length of a proposed rule, in plain language, that shall be posted on the internet website under section 206(d) of the E-Government Act of 2002 (44 U.S.C. 3501 note) (commonly known as *regulations.gov* ). The Act, under its terms, applies to notices of proposed rulemaking and does not expressly include other types of documents that the Board publishes voluntarily for public comment, such as notices and interim-final rules that request comment despite invoking “good cause” to forgo such notice and public procedure. The Board, however, has elected to address the Act's requirement in these types of documents in the interests of administrative consistency and transparency.
In summary, NCUA is publishing this proposed rule to amend the requirements for FICUs to report catastrophic acts to the agency. By providing more time for FICUs to notify the agency of the occurrence of a catastrophic act and by eliminating the specific list of items to be documented, the Board expects the proposed rule to reduce their compliance burden and allow FICUs to focus their resources on recovery and core functions without compromising safety and soundness.
The proposal and the required summary can be found at *https://www.regulations.gov.*
**B. Executive Orders 12866, 13563, and 14192**
Pursuant to Executive Order 12866 (“Regulatory Planning and Review”), as amended by Executive Order 14215, a determination must be made whether a regulatory action is significant and therefore subject to review by the Office of Management and Budget (OMB) in accordance with the requirements of the Executive Order. [^9] Executive Order 13563 (“Improving Regulation and Regulatory Review”) supplements and reaffirms the principles, structures, and definitions governing contemporary regulatory review established in Executive Order 12866. [^10] This proposed rule was drafted and reviewed in accordance with Executive Order 12866 and Executive Order 13563. OMB has determined that this proposed rule is not a “significant regulatory action” as defined in section 3(f)(1) of Executive Order 12866. Further, this proposed rule is consistent with Executive Order 13563. The proposed rule will reduce the burden of catastrophic act reporting by increasing the time FICUs have to report to the agency and giving them the flexibility to determine what to incorporate into their record of an incident.
[^9] 58 FR 51735 (Oct. 4, 1993).
[^10] 76 FR 3821 (Jan.21, 2011).
Executive Order 14192 (“Unleashing Prosperity Through Deregulation”) requires that any new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least 10 prior regulations. [^11] This proposed rule is expected to be a deregulatory action for purposes of Executive Order 14192.
[^11] 90 FR 9065 (Feb. 6, 2025),
**C. Regulatory Flexibility Act**
The Regulatory Flexibility Act [^12] generally requires an agency to conduct a regulatory flexibility analysis of any rule subject to notice and comment rulemaking requirements, unless the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. If the agency makes such a certification, it shall publish the certification at the time of publication of either the proposed rule or the final rule, along with a statement providing the factual basis for such certification. [^13] For purposes of this analysis, the NCUA considers small credit unions to be those having under $100 million in assets. [^14] The Board fully considered the potential economic impacts of the regulatory amendments on small credit unions.
[^12] 5 U.S.C. 601 *et seq.*
[^13] 5 U.S.C. 605(b).
[^14] 80 FR 57512 (Sept. 24, 2015).
The proposed rule reduces and simplifies aspects of part 748 related to catastrophic act reporting. Even if the magnitude of the change is significant, the NCUA certifies that the proposed rule will not have a significant economic impact on a substantial number of small entities.
Accordingly, the NCUA certifies the proposed rule would not have a significant economic impact on a substantial number of small credit unions.
**D. Paperwork Reduction Act**
The Paperwork Reduction Act of 1995 (PRA) generally provides that an agency may not conduct or sponsor, and not withstanding any other provision of law, a person is not required to respond to, a collection of information, unless it displays a currently valid Office of Management and Budget (OMB) control number. The PRA applies to rulemakings in which an agency creates a new or amends existing information collection requirements. For purposes of the PRA, an information-collection requirement may take the form of a reporting, recordkeeping, or a third-party disclosure requirement. The NCUA has determined that the changes described in this notice do not create a new information collection or revise an existing information collection as defined by the PRA.
**E. Executive Order 13132 on Federalism**
Executive Order 13132 encourages certain agencies to consider the impact of their actions on state and local interests. The NCUA, an agency as defined in 44 U.S.C. 3502(5), complies with the executive order to adhere to fundamental federalism principles. This proposed rule is intended to reduce the burden on FICUs by simplifying catastrophic act reporting. The rulemaking would therefore not have direct effect on the states, the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government.
**F. Assessment of Federal Regulations and Policies on Families**
The NCUA has determined that this proposed rule would not affect family well-being within the meaning of section 654 of the Treasury and General Government Appropriations Act, 1999. [^15] The proposed rule relates to FICU operations in the aftermath of a catastrophic act, and any effect on family well-being is expected to be indirect.
[^15] Public Law 105-277, 112 Stat. 2681 (1998).
**List of Subjects in 12 CFR Part 748**
Credit unions; reporting and recordkeeping requirements; computer technology; internet; security measures; privacy; personally identifiable information; confidential business information; crime; currency.
By the National Credit Union Administration Board, this 19th day of December, 2025.
Melane Conyers-Ausbrooks,
Secretary of the Board.
For the reasons stated in the preamble, the NCUA Board proposes to amend 12 CFR part 748, as follows:
**PART 748—SECURITY PROGRAM, SUSPICIOUS TRANSACTIONS, CATASTROPHIC ACTS, CYBER INCIDENTS, AND BANK SECRECY ACT COMPLIANCE**
1. The authority citation for part 748 continues to read as follows:
**Authority:**
12 U.S.C. 1766(a), 1786(b)(1), 1786(q), 1789(a)(11); 15 U.S.C. 6801-6809; 31 U.S.C. 5311 and 5318.
2. Revise § 748.1(b) to read as follows:
§ 748.1
(b) *Catastrophic act report.* Each federally insured credit union will notify NCUA within 15 calendar days of any catastrophic act that occurs at its office(s). A catastrophic act is any disaster, natural or otherwise, resulting in physical destruction or damage to the credit union or causing an interruption in vital member services, as defined in § 749.1 of this chapter, projected to last more than two consecutive business days. Within a reasonable time after a catastrophic act occurs, the credit union shall ensure that a record of the incident is prepared that contains the basic facts of the event.