Warren Urges Banking Regulators to Restore Broader Cyber Oversight

Sen. Elizabeth Warren, the Senate Banking Committee’s top Democrat, has urged the Federal Reserve, Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC) to rescind recent changes to supervisory policy and rules. In letters sent Friday, she argued that the changes limit when bank examiners can issue supervisory warnings or pursue certain enforcement actions over unsafe or unsound practices, including cybersecurity vulnerabilities. The issue is a regulatory and market signal rather than a solicitation: the report identifies no contract, funding, buyer, or acquisition timeline.

Warren’s concerns center on distinct standards adopted by the agencies. The Fed’s Updated Statement of Supervisory Operating Principles, published last month, says supervisory staff can issue enforcement actions for unsafe or unsound practices only when they believe those practices “create an abnormal probability of abnormal harm to the financial condition of the banking organization.” In her letter to Fed Vice Chair for Supervision Michelle Bowman, Warren said cybersecurity assessments use “a variety of probability estimates.” She argued that rapid advances in artificial intelligence are also accelerating cyberthreats, making it difficult to quantify whether a risk is “abnormal.”

Warren separately challenged a final rule from the FDIC and OCC, Unsafe or Unsound Practices, Matters Requiring Attention. The 73-page rule sets what she described as a “narrow” definition of unsafe or unsound practices. According to her letter to FDIC Chairman Travis Hill and OCC chief Jonathan Gould, examiners can act on a cybersecurity vulnerability only when it is “likely” unsafe or unsound, rather than when a cyber incident is “possible” or “plausible” and could “materially harm the financial condition of an institution.” The distinction matters for financial institutions and the contractors that help them assess, prioritize, and remediate cyber risks, although the source does not establish that any new compliance obligation has been imposed.

For GovCon firms, the practical implication is to monitor how the agencies respond and how supervisory expectations evolve, rather than treating Warren’s request as a funded near-term opportunity. Banks may continue to need cybersecurity assessments, remediation, control design, and internal-control support, particularly as AI-enabled threats complicate risk evaluation. But the article names no procurement vehicle, budget, specific bank buyer, or acquisition schedule. Companies serving financial institutions should therefore distinguish potential market demand from an actual contract opportunity and validate requirements directly with customers. The Federal Reserve confirmed receipt of Warren’s letter but did not comment further; the FDIC and OCC had not responded to requests for comment by publication.

• Warren asked the Federal Reserve, FDIC, and OCC to reverse supervisory policy changes affecting bank examinations and enforcement.
• The Fed’s updated principles tie enforcement to practices believed to create an “abnormal probability of abnormal harm” to a banking organization’s financial condition.
• Warren said cybersecurity risk may not be easily quantifiable, citing varied probability estimates and fast-moving AI-enabled threats.
• The FDIC and OCC final rule is titled Unsafe or Unsound Practices, Matters Requiring Attention and runs 73 pages.
• Warren said the rule limits action on vulnerabilities to cases where they are “likely” unsafe or unsound, rather than “possible” or “plausible.”
• Her letters cited AI-enabled cyberattacks, including the Hugging Face breach via OpenAI agents, as examples of emerging threats.
• Warren warned that delayed remediation could increase attack frequency and severity, expose sensitive financial data, and threaten financial-system stability.
• Banks and their service providers should track regulatory responses and supervisory expectations when scoping cyber assessments and remediation; the report establishes no new mandatory requirement.
• No specific buyer, solicitation, contract vehicle, budget, or acquisition timeline is identified, so this is not a confirmed procurement opportunity.