Banks fight to scrap an SEC cyberattack rule

Banks are leading a coordinated push to scrap a Securities and Exchange Commission rule on cyber incident disclosure. The major groups behind the effort include the American Bankers Association, Bank Policy Institute, Independent Community Bankers of America, Institute of International Bankers, and SIFMA, joined by seven other coalitions. They oppose the 2023 rule that requires public companies to disclose a cybersecurity incident within four business days after it is deemed material. In parallel, they urge Congress to renew the Cybersecurity Information Sharing Act of 2015 to encourage confidential sharing of threat information with the government. The campaign underscores a policy tension between transparency for investors and controlled information flows for security. The initiative began with a March 2025 letter to Congress.

Supporters argue that public disclosures can expose companies to exploitative risk, while critics say timely reporting strengthens investor awareness and market resilience. SEC Chair Paul Atkins is reviewing the rule, and a former dissenter now sits in the majority, signaling potential changes. A Bank Policy Institute blog notes that artificial intelligence could turn a public breach disclosure into an immediate threat, reinforcing the case for confidential sharing. The debate centers on whether information should flow primarily through sharing with regulators or disclosure to investors, and whether one approach can substitute for the other or if both remain complementary.