,i  #aag? ,,congress  #a/ ,session  ,h4 
,r4 #eicf  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,novemb] #i1 #bjba,mr4
 ,mc,henry introduc$ ! foll[+ bill2 :i* 
0 ref]r$ to ! ,committee on ,f9ancial   
,s]vices  ,a ,,bill  ,to include        
requirem5ts relat+ to ransomw>e attack  
det]r5ce = a cov]$ ,u4,s4 f9ancial      
in/itution 9 ! ,consolidat$             
,appropriations ,act1 #bjba1 & = o!r    
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,ransomw>e & ,f9ancial     
,/ability ,act ( #bjba4  #b4 ,ransomw>e 
attack det]r5ce  7a7 ,9 g5]al ,section  
#ajh ( title ,i ( division ,q ( !       
,consolidat$ ,appropriations ,act1 #bjba
 7,public ,law #aaf-bfj2 #ace ,/at4     
#bagc2 #ab ,u4,s4,c4 #ahaa note7 is     
am5d$-- 7#a7 9 ! subsection head+1 by   
/rik+ report2  7#b7 by r$esignat+       
subsections 7d7 & 7e7 z subsections 7e7 
& 7f71 respectively2  7#c7 by ins]t+ !  
foll[+ aft] subsection 7c73  7d7        
,ransomw>e attack det]r5ce  7#a7        
,requirem5ts  7,a7 ,9 g5]al ,a cov]$    

,u4,s4 f9ancial in/itution subject to a 
ransomw>e attack may n make a ransomw>e 
paym5t 9 response to su* ransomw>e      
attack-- 7i7 be=e submitt+ !            
notification describ$ 9 p>agraph 7#b72 &
  7ii7 9 an am\nt great] ?an #ajj1jjj1  
unless ! paym5t is subject to a         
ransomw>e paym5t au?orization4  7,b7    
,rule ( con/ruction ,no?+ 9 ?is         
subsection %all be con/ru$ to p]mit a   
ransomw>e paym5t t is o!rwise prohibit$ 
by law4  7#b7 ,notification describ$    
7,a7 ,9 g5]al ,! notification describ$ 9
 ?is p>agraph %all be submitt$ by a     
cov]$ ,u4,s4 f9ancial in/itution to !   
,director ( ! ,f9ancial ,crimes         
,en=cem5t ,network & %all include-- 7i7 
a det]m9ation by su* in/itution t su*   
in/itution is subject to a ransomw>e    
attack2 &  7ii7 a description ( !       
ransomw>e attack & any associat$        
ransomw>e paym5t dem&$4  7,b7 ,cont5ts  
,to ensure effici5t notification &      
resolution ( a ransomw>e attack1 !      
,secret>y ( ! ,treasury-- 7i7 %all1 9   

consultation ) int]e/$ p]sons1 issue    
guidance specify+ in=mation requir$ to  
be includ$ 9 ! notification describ$ 9  
?is p>agraph2 &  7ii7 may n require1 to 
be includ$ 9 su* notification1 in=mation
 t is unavailable to a cov]$ ,u4,s4     
f9ancial in/itution1 bas$ on good-fai?  
ef=ts ( su* in/itution to provide       
in=mation4  7#c7 ,waiv] ,! ,presid5t may
 waive ! requirem5ts ( p>agraph 7#b7 )  
respect to a cov]$ ,u4,s4 f9ancial      
in/itution if ! ,presid5t det]m9es t !  
waiv] is 9 ! national int]e/ ( ! ,unit$ 
,/ates & notifies su* in/itution & !    
appropriate memb]s ( ,congress ( su*    
waiv]4  7#d7 ,safe h>bor ) respect to   
ransomw>e paym5t au?orizations &        
good-fai? det]m9ations  7,a7 ,9 g5]al ,)
 respect to a ransomw>e paym5t made "u  
p>agraph 7#b77;,b7 or a waiv] issu$ "u  
p>agraph 7#c7-- 7i7 a ,u4,s4 f9ancial   
in/itution %all n be liable "u sub*apt] 
,,ii ( *apt] #ec ( title #ca1 ,unit$    
,/ates ,code1 or *apt] #b ( title ,i (  
,public ,law #ia-ejh 7#ab ,u4,s4,c4     

#aiea et seq47 = mak+ a ransomw>e paym5t
 consi/5t ) ! p>amet]s & tim+ ( a       
ransomw>e paym5t au?orization2 &  7ii7  
no ,f$]al or ,/ate dep>tm5t or ag5cy may
 take any adv]se sup]visory action )    
respect to ! ,u4,s4 f9ancial in/itution 
solely = mak+ a ransomw>e paym5t        
consi/5t ) ! p>amet]s & tim+ ( !        
au?orization4  7,b7 ,good-fai? ef=ts to 
assess ransomw>e attacks ,a cov]$ ,u4,s4
 f9ancial in/itution may n be held      
liable = defici5cies 9 describ+ a       
ransomw>e attack 9 a notification       
describ$ "u p>agraph 7#b7 if su*        
in/itution engag$ 9 good-fai? ef=ts to  
det]m9e ! nature ( ! ransomw>e attack4  
7,c7 ,rule ( con/ruction ,no?+ 9 ?is    
p>agraph may be con/ru$-- 7i7 to prev5t 
a ,f$]al or ,/ate dep>tm5t or ag5cy f   
v]ify+ ! validity ( a ransomw>e paym5t  
au?orization ) ! law en=cem5t ag5cy     
submitt+ t au?orization2  7ii7 to       
relieve a ,u4,s4 f9ancial in/itution f  
comply+ ) any o!r provision ( law1      
includ+ ! report+ ( suspici\s           

transactions "u section #ecah7;g7 (     
title #ca1 ,unit$ ,/ates ,code2 or      
7iii7 to ext5d ! safe h>bor describ$ 9  
?is p>agraph to any actions tak5 by !   
,u4,s4 f9ancial in/itution-- 7,i7 be=e !
 date ( issuance ( ransomw>e paym5t     
au?orization2 or  7,,ii7 aft] any       
t]m9ation date /at$ 9 ! ransomw>e paym5t
 au?orization  7,d7 ,ransomw>e paym5t   
au?orization t]m9ation date ,any        
ransomw>e paym5t au?orization submitt$  
"u ?is subsection %all include a        
t]m9ation date aft] :i* t au?orization  
%all no long] apply4  7,e7 ,records ,any
 ,f$]al law en=cem5t ag5cy t submits to 
a ,u4,s4 f9ancial in/itution a ransomw>e
 paym5t au?orization %all1 n lat] ?an #b
 bus9ess days aft] ! date on :i* !      
au?orization is submitt$ to ! ,u4,s4    
f9ancial in/itution-- 7i7 submit to !   
,director ( ! ,f9ancial ,crimes         
,en=cem5t ,network a copy ( !           
au?orization2 &  7ii7 al]t ! ,director z
 to :e!r ! ,u4,s4 f9ancial in/itution   
has implem5t$ ! reque/4  7,f7 ,guidance 

,! ,secret>y ( ! ,treasury1 9           
coord9ation ) ! ,attorney ,g5]al1 %all  
issue guidance on ! requir$ elem5ts ( a 
ransomw>e paym5t au?orization4  7#e7    
,confid5tiality ( in=mation  7,a7 ,9    
g5]al ,except z provid$ 9 p>agraph 7#b71
 any in=mation or docum5t provid$ by a  
,u4,s4 f9ancial in/itution to a ,f$]al  
law en=cem5t ag5cy pursuant to ?is      
subsection-- 7i7 %all be exempt f       
disclosure "u section #eeb ( title #e1  
,unit$ ,/ates ,code2 &  7ii7 may n be   
made publicly available4  7,b7          
,exceptions ,p>agraph 7#a7 %all n       
prohibit ! disclosure ( ! foll[+3 7i7   
,in=mation relevant to any adm9i/rative 
or judicial action or proce$+4  7ii7    
,in=mation reque/$ by ! appropriate     
memb]s ( ,congress or o!rwise requir$ to
 be submitt$ to ,congress4  7iii7       
,in=mation requir$ = ,f$]al law en=cem5t
 or intellig5ce purposes 7z det]m9$ by !
 ,attorney ,g5]al71 9 consultation ) !  
,director ( ! ,f9ancial ,crimes         
,en=cem5t ,network to be disclos$ to a  

dome/ic gov]nm5tal entity or to a       
gov]nm5tal entity ( a ,unit$ ,/ates ally
 or p>tn]1 only to ! ext5t necess>y =   
su* purposes1 & subject to appropriate  
confid5tiality & classification         
requirem5ts4  7iv7 ,anonymiz$ in=mation 
requir$ = ! production ( aggregate data 
or /ati/ical analyses4  7v7 ,in=mation t
 ! ,u4,s4 f9ancial in/itution has       
cons5t$ to be disclos$ to ?ird p>ties4  
7#f7 ,def9itions ,9 ?is subsection3 7,a7
 ,cov]$ ,u4,s4 f9ancial in/itution ,!   
t]m cov]$ ,u4,s4 f9ancial in/itution    
means-- 7i7 any f9ancial m>ket utility t
 ! ,f9ancial ,/ability ,ov]sight ,c\ncil
 has designat$ z sy/emically important  
"u section #hjd ( ! ,dodd-,frank ,wall  
,/reet ,re=m & ,consum] ,protection     
,act2  7ii7 any ex*ange regi/]$ "u      
section #f ( ! ,securities ,ex*ange ,act
 ( #aicd t facilitates trad+ 9 any      
national m>ket sy/em security1 z def9$ 9
 section #bdb4fjj ( title #ag1 ,code (  
,f$]al ,regulations 7or any successor   
regulation71 & :i* ex*ange dur+ at lea/ 

f\r ( ! prec$+ six cal5d> mon?s _h--    
7,i7 ) respect to all national m>ket    
sy/em securities t are n options1 #aj   
p]c5t or m ( ! av]age daily doll> volume
 report$ by applicable transaction      
report+ plans2 or  7,,ii7 ) respect to  
all li/$ options1 #ae p]c5t or m ( !    
av]age daily doll> volume report$ by    
applicable national m>ket sy/em plans = 
report+ transactions 9 li/$ options2 &  
7iii7 any te*nology s]vice provid] 9 !  
,significant ,s]vice ,provid] ,program (
 ! ,f9ancial ,in/itutions ,exam9ation   
,c\ncil t provides core process+ s]vices
 t is det]m9$ by ! ,c\ncil to be a      
significant te*nology s]vice provid]4   
7,b7 ,malici\s s(tw>e ,! t]m malici\s   
s(tw>e means s(tw>e t1 :5 deploy$1      
results 9 ! loss ( access to data or !  
loss ( functionality ( an in=mation &   
communications sy/em or network ( a     
,u4,s4 f9ancial in/itution4  7,c7       
,ransomw>e attack ,! t]m ransomw>e      
attack means ! deploym5t ( malici\s     
s(tw>e = ! purpose ( dem&+ paym5t 9     

ex*ange = re/or+ critical access to1 or 
! critical functionality (1 an in=mation
 & communications sy/em or network4     
7,d7 ,ransomw>e paym5t ,! t]m ransomw>e 
paym5t means a paym5t made by a ,u4,s4  
f9ancial in/itution 7includ+ a paym5t   
made ?r\gh use ( digital curr5cy7 to1 at
 ! reque/ (1 or = ! b5efit ( a p]son    
responsible = a ransomw>e attack 9      
ex*ange = re/oration ( ! access or      
functionality ( an in=mation &          
communications sy/em or network ( !     
in/itution4  7,e7 ,ransomw>e paym5t     
au?orization ,! t]m ransomw>e paym5t    
au?orization means1 ) respect to a      
ransomw>e paym5t made by a ,u4,s4       
f9ancial in/itution1 a writt5 notice f a
 ,f$]al law en=cem5t ag5cy to au?orize  
su* ransomw>e paym5t4  2  7#d7 9        
subsection 7f71 z s r$esignat$1 by /rik+
 aft] ! date ( enactm5t ( ?is ,act &    
ins]t+ aft] ! date ( enactm5t ( !       
,ransomw>e & ,f9ancial ,/ability ,act ( 
#bjba2 &  7#e7 by add+ at ! end ! foll[+
 new subsection3  7g7 ,%ort title ,?is  

section may be cit$ z ! ,cyb]security & 
,f9ancial ,sy/em ,resili5ce ,act4  4    
7b7 ,applicability  7#a7 ,9 g5]al ,!    
am5dm5ts made by ?is ,act %all apply to 
a cov]$ ,u4,s4 f9ancial in/itution 7z   
def9$ 9 subsection 7d7 ( ! ,cyb]security
 & ,f9ancial ,sy/em ,resili5ce ,act     
7,public ,law #aaf-bfj2 #ace ,/at4      
#bagc2 #ab ,u4,s4,c4 #ahaa note71 z add$
 by ?is ,act7 beg9n+ on ! e>li] ( ! date
 t is-- 7,a7 #cj days aft] publication 9
 ! ,f$]al ,regi/] ( rules implem5t+ ?is 
,act2 or  7,b7 #a ye> aft] ! date ( !   
enactm5t ( ?is ,act4  7c7 ,sunset ,?is  
,act & ! am5dm5ts made by ?is ,act %all 
be repeal$ #aj ye>s aft] ! applicability
 date describ$ 9 subsection 7b74