Bank Protection Act requirements in plain words, for every regulator

The Bank Protection Act requirements are, in plain words, these: every bank's board must designate a security officer; the officer must develop and run a written security program for the main office and every branch; the program must set opening and closing procedures, keep cash and valuables safe, help identify offenders, train staff, and provide for selecting, testing, operating and maintaining security devices; every office must have at least a vault or safe, lighting around a vault visible from outside, tamper-resistant locks and an alarm that notifies the police; and the officer must report to the board at least once a year. The Act itself is two sentences long; the requirements live in four agency rules, three under the Act for banks and savings associations, and a separate NCUA rule for credit unions that differs in ways that matter. The rules are hard to apply because they are written for a whole institution while the evidence sits in each branch. Botminds' Branch Self-Assessment checks the branch's part of the program in every periodic branch review, from the security system before the branch opens and on the manager's walk, and rolls it up for the annual report.

What is the Bank Protection Act?

The Bank Protection Act of 1968 is a short federal statute that ordered the bank regulators to write minimum security standards for the institutions they supervise. Its operative section reads, in full: "Within six months from July 7, 1968, each Federal supervisory agency shall promulgate rules establishing minimum standards with which each bank or savings association must comply with respect to the installation, maintenance, and operation of security devices and procedures, reasonable in cost, to discourage robberies, burglaries, and larcenies and to assist in the identification and apprehension of persons who commit such acts" (12 U.S.C. 1882(a)).

Three phrases in that sentence explain the rules that followed. "Minimum standards" is why the rules list a floor of devices and leave the rest to judgement. "Reasonable in cost" is why the rules ask the security officer to weigh the cost of devices against the risk at each office. And "discourage" and "assist in the identification and apprehension" are the program's two purposes, prevention and evidence, which is why cameras, bait money and records of each crime appear alongside locks and alarms. A violation of the agencies' rules carries a civil penalty that the statute caps at "$100 for each day of the violation" (12 U.S.C. 1884).

The Act once required more paperwork than it does now. A 1989 amendment struck out the requirement that the rules "require the submission of periodic reports with respect to the installation, maintenance, and operation of security devices and procedures". Since then the reporting runs inside the institution, from the security officer to the board, and examiners test it on site.

Does the Bank Protection Act apply to credit unions?

Not directly. The Act applies through the "Federal supervisory agency", which the statute defines as "the appropriate Federal banking agency" under 12 U.S.C. 1813(q) (12 U.S.C. 1881): the OCC, the Federal Reserve and the FDIC. Federally insured credit unions are covered instead by the NCUA's Part 748, which the NCUA issues under the Federal Credit Union Act and other statutes. Part 748 shares the Act's purpose but not its structure.

The credit union rule requires each federally insured credit union to "develop a written security program within 90 days of the effective date of insurance", designed to "Protect each credit union office from robberies, burglaries, larcenies, and embezzlement", to keep member records secure and confidential, to respond to unauthorized access to member information, to assist in identifying offenders, and to prevent the destruction of vital records (12 CFR 748.0). It adds embezzlement, which the bank rules do not name, and it folds information security into the same program. What it does not have is a designated security officer, a list of minimum devices or an annual report to the board. Its dated duty is a certification: "The president or managing official of each federally insured credit union must certify compliance with the requirements of this part in its Credit Union Profile annually through NCUA's online information management system" (12 CFR 748.1(a)).

What does the Bank Protection Act require of a bank?

For a bank or savings association it requires a security officer, a written program, minimum devices, training and an annual report, set out in nearly identical words by each agency. The board carries the responsibility: each rule says it is the board's job to comply and to ensure a written security program for the main office and branches is developed and implemented. The board designates the security officer, who develops the program subject to the board's approval and administers it. Who the security officer is, and how the role works in practice, is the subject of the bank security officer.

The program has four required elements in every bank rule. It must establish procedures for opening and closing and for safekeeping currency, negotiable securities and similar valuables at all times. It must establish procedures to help identify people who commit crimes against the institution and to preserve evidence, which may include cameras, prerecorded serial-numbered bills or chemical and electronic devices, and keeping a record of each robbery, burglary or larceny. It must provide for initial and periodic staff training. And it must provide for selecting, testing, operating and maintaining appropriate security devices.

What security devices are required in a bank?

Four devices are required at every banking office under the Fed, FDIC and OCC rules, and anything else is the security officer's call. The four are a means of protecting cash and other liquid assets, such as a vault, safe or other secure space; a lighting system for the area around the vault during the hours of darkness, if the vault is visible from outside; tamper-resistant locks on exterior doors and exterior windows that may be opened; and an alarm system or other device for promptly notifying the nearest responsible law enforcement officers of an attempted or perpetrated robbery or burglary (the OCC's wording adds larceny).

The fifth line is where the rules ask for judgement. Each bank must also have such other devices as the security officer determines to be appropriate, weighing the local crime rate, the cash exposed, the distance to the police, the cost, the other measures in place and the building itself. Testing is the element most likely to slip, because a device that is installed looks like a device that works. The FBI's own figures on alarms and cameras during robberies make the case for testing on a schedule, and they are set out in FBI bank robbery statistics.

What training does the Bank Protection Act require?

The rules require the program to provide for "initial and periodic training of officers and employees in their responsibilities under the security program and in proper employee conduct during and after a burglary, robbery, or larceny" (12 CFR 208.61(c)(1)(iii)); the FDIC's wording is nearly identical, and the OCC's covers employees and conduct "during and after a robbery". The rules set no topics, hours or frequency beyond "initial and periodic". In practice training covers the institution's own opening and closing, cash-handling and dual-control procedures, what to do during a robbery, how to preserve evidence afterwards, and how to use alarms, duress codes and bait money.

Training is one of the items examiners test directly. The Federal Reserve's cash examination procedures tell examiners to test compliance with the rule by, among other steps, "reviewing documentation showing training sessions held since the preceding examination" (CBEM 2310.3). A branch review that checks who has been trained and who has not, including new staff, gives the security officer that documentation branch by branch.

How often must a bank report on its security program?

At least once a year, to the board. Under the Federal Reserve and FDIC rules, the security officer reports "at least annually" to the board on the implementation, administration and effectiveness of the program; under the OCC rules, on its effectiveness, with the substance of the report reflected in the board minutes. There is no annual filing with the regulator. A credit union's annual duty is the president's certification in the Credit Union Profile; Appendix A to Part 748, which sets guidelines for the information security side of the program, adds that each credit union "should report to its board or an appropriate committee of the board at least annually" on that program.

What is 12 CFR 208.61, and how does it differ from 12 CFR 326 and 21?

12 CFR 208.61 is the Federal Reserve's version of the Bank Protection Act rule, part of Regulation H for state member banks. 12 CFR 326, subpart A, is the FDIC's version for the institutions it supervises, rewritten in 2018, and 12 CFR 21, subpart A, is the OCC's for national banks, with 12 CFR 168 for federal savings associations. The texts differ in small ways worth knowing when a holding company has banks under different regulators. The OCC gives the board 30 days from opening to designate the officer and asks for the program "immediately"; the Fed and FDIC allow up to 180 days. The OCC's alarm must cover larceny as well as robbery and burglary, and its list of factors for other devices adds the time the police ordinarily take to arrive. The OCC asks for the report's substance in the minutes.

What is 12 CFR 748?

12 CFR 748 is the NCUA's rule for the security program, suspicious activity reports, catastrophic acts, cyber incidents and Bank Secrecy Act compliance at federally insured credit unions. Section 748.0 sets the written security program; 748.1 sets the reports: the annual certification, the five-business-day catastrophic act report, the 72-hour cyber incident notice and the suspicious activity report rules, including a SAR for insider abuse "regardless of the amount involved". The cyber notice is the newest piece, added in 2023: NCUA "must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident".

How examiners test the security program, and how Branch Self-Assessment answers

Examiners test the program by sampling its evidence, not by reading the policy. The Federal Reserve's cash procedures are a good model of what a branch review should be able to show.

In Branch Self-Assessment the branch's part of the program is its own section of each review. For the fictional sample credit union in the solution, Norrell Federal Credit Union, that section has 16 items for each branch: 11 checked by the Security agent from the security system before the branch opens (monthly and hold-up alarm tests, cameras recording, footage kept 90 days, recorder clock, alarm user codes against current staff, after-hours entries, vault-door alarms, duress code, ATM and drive-up cameras, the monitoring center's contact list), four on the walk and one from training records. The security officer owns and signs the section, and each branch's section feeds the annual report and the certification draft. The solution is at Branch Self-Assessment.

One branch's part of the security program in Branch Self-Assessment, checked from the security system and signed by the security officer

Questions people ask

What is the penalty for violating the Bank Protection Act?

The statute sets a civil penalty for a bank or savings association that violates a rule issued under it, capped at $100 for each day of the violation (12 U.S.C. 1884). In practice a weak security program is more likely to appear as an examination finding than as a penalty.

Does the Bank Protection Act require cameras?

No. Cameras are listed as one of the procedures a program may use to identify offenders and preserve evidence, alongside prerecorded bills and chemical or electronic devices. The required minimum is a vault or safe, vault lighting, tamper-resistant locks and an alarm; cameras fall under the devices the security officer decides are appropriate.

Do ATMs fall under the Bank Protection Act rules?

The rules apply to banking offices, and the program's procedures and devices cover the office's cash wherever it sits. Examiners' cash procedures also ask about ATMs directly, including whether every ATM has an alarm and whether a communication break with the processor triggers it.

Who signs the annual security report?

At a bank, the security officer gives the report to the board; the rules do not require a signature, but the OCC requires its substance in the board minutes. At a credit union, the president or managing official certifies compliance with Part 748 each year in the Credit Union Profile.

Is the information security program part of the Bank Protection Act?

Not for banks: their information security programs come from separate interagency guidelines. For credit unions, Part 748 combines both, so the same written program protects offices from robbery and embezzlement and secures member records.