,,ii  #aag? ,,congress  #b;d ,session   
,s4 #dihe  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,septemb] #bh1         
#bjbb,mrs4 ,blackburn 7= h]self & ,ms4  
,lummis7 introduc$ ! foll[+ bill2 :i* 0 
read twice & ref]r$ to ! ,committee on  
,bank+1 ,h\s+1 & ,urban ,affairs  ,a    
,,bill  ,to am5d ! ,cyb]security        
,in=mation ,%>+ ,act ( #bjae to include 
volunt>y in=mation %>+ ( cyb] ?reat     
indicators among cryptocurr5cy          
companies1 & = o!r purposes4  #a4 ,%ort 
title ,?is ,act may be cit$ z !         
,cryptocurr5cy ,cyb]security ,in=mation 
,%>+ ,act4  #b4 ,%>+ ( cyb] ?reat       
indicators by cov]$ companies  7a7 ,9   
g5]al ,! ,cyb]security ,in=mation ,%>+  
,act ( #bjae 7#f ,u4,s4,c4 #aeja et     
seq47 is am5d$-- 7#a7 9 section         
#ajb7ae77;,a7 7#f ,u4,s4,c4             
#aeja7ae77;,a77 by ins]t+ cov]$ company 
7z def9$ 9 section #aaj71 aft]          
coop]ative12  7#b7 by r$esignat+        
sections #aaj & #aaa 7#f ,u4,s4,c4      
#aeji1 #aeaj7 z sections #aaa & #aab1   

respectively2 &  7#c7 by ins]t+ aft]    
section #aji 7#f ,u4,s4,c4 #aejh7 !     
foll[+3  #aaj4 ,%>+ ( cyb] ?reat        
indicators by cov]$ companies  7a7      
,def9itions ,9 ?is section3 7#a7 ,cov]$ 
company  7,a7 ,9 g5]al ,subject to      
subp>agraph 7,b71 ! t]m cov]$ company   
means an entity-- 7i7 t is-- 7,i7 engag$
 9 ! bus9ess ( validat+ di/ribut$ l$g]  
te*nology transactions2  7,,ii7 engag$ 9
 ! bus9ess ( develop+ digital assets or 
! correspond+ protocols = use ( digital 
assets by o!r p]sons2  7,,iii7 an       
association ( entities t manage digital 
assets or di/ribut$ l$g] te*nologies2 or
  7,,iv7 a comm]cial g5]al liability    
insurance provid] or prop]ty insurance  
provid] (f]+ products design$ to        
mitigate losses f a v>iety ( cyb]       
incid5ts1 includ+-- 7aa7 data brea*es2  
7bb7 ransomw>e attacks2  7cc7 bus9ess   
int]ruption2 &  7dd7 network damage2 &  
7ii7 t %>es or receives in=mation "u ?is
 section4  7,b7 ,money s]vices bus9esses
 & f9ancial in/itutions ,= purposes (   

p>agraphs 7#a71 7#b71 & 7#c7 (          
subsection 7b71 ! t]m cov]$ company     
includes an entity t is a money s]vices 
bus9ess1 or t o!rwise is a f9ancial     
in/itution1 z def9$ 9 section #ecab (   
title #ca1 ,unit$ ,/ates ,code1 =       
purposes ( digital asset activity engag$
 9 by ! entity4  7#b7 ,digital asset ,! 
t]m digital asset means a natively      
electronic asset t-- 7,a7 conf]s        
economic1 propriet>y1 or access rights  
or p[]s2 &  7,b7 is record$ us+         
cryptographically secur$ di/ribut$ l$g] 
te*nology1 or any simil> analogue4  7#c7
 ,di/ribut$ l$g] te*nology ,! t]m       
di/ribut$ l$g] te*nology means te*nology
 t enables ! op]ation & use ( a l$g] t--
 7,a7 is %>$ across a set ( di/ribut$   
nodes t p>ticipate 9 a network & /ore a 
complete or p>tial replica ( ! l$g]2    
7,b7 is syn*roniz$ betwe5 ! nodes2  7,c7
 has data app5d$ to ! l$g] by foll[+ !  
specifi$ cons5sus me*anism ( ! l$g]2    
7,d7 may be accessible to anyone or     
re/rict$ to a subset ( p>ticipants2 &   

7,e7 may require p>ticipants to h       
au?orization to p]=m c]ta9 actions or   
require no au?orization4  7b7 ,volunt>y 
in=mation %>+ among cov]$ companies     
7#a7 ,9 g5]al ,subject to p>agraphs     
7#b71 7#c71 & 7#d71 a cov]$ company may1
 "u ! protection ( ! safe h>bor f       
liability describ$ 9 subsection 7d71    
transmit1 receive1 or o!rwise %>e       
in=mation ) any o!r cov]$ company reg>d+
 individuals1 entities1 organizations1 &
 c\ntries = purposes ( id5tify+ &1 z    
appropriate1 report+ activities t !     
cov]$ company suspects may involve      
possible cyb] ?reat indicators4  7#b7   
,in=mation %>+ betwe5 cov]$ companies   
7,a7 ,notice requirem5t  7i7 ,9 g5]al ,a
 cov]$ company t int5ds to %>e in=mation
 z describ$ 9 p>agraph 7#a7 %all submit 
a notice ( int5t to ! ,f9ancial ,crimes 
,en=cem5t ,network & ! ,cyb]security &  
,infra/ructure ,security ,ag5cy1 :i*    
%all conta91 at a m9imum1 a li/ ( ea*   
o!r company ! cov]$ company int5ds to   
%>e in=mation )4  7ii7 ,effective p]iod 

,ea* notice provid$ "u clause 7i7 %all  
be effective = ! #a-ye> p]iod beg9n+ on 
! date ( ! notice4  7iii7 ,additional   
notices ,^u expiration ( ! #a-ye> p]iod 
describ$ 9 subclause 7ii71 a cov]$      
company %all submit an additional notice
 ( int5t at ! beg9n+ ( ea* ye> dur+ :i* 
! cov]$ company int5ds to %>e in=mation 
z describ$ 9 p>agraph 7#a74  7iv7 ,li/ (
 cov]$ companies t h submitt$ notice ,! 
,f9ancial ,crimes ,en=cem5t ,network    
%all p]iodically make available a li/ ( 
cov]$ companies t h submitt$ a notice "u
 ?is subp>agraph4  7,b7 ,v]ification    
requirem5t ,prior to %>+ in=mation z    
describ$ 9 p>agraph 7#a71 a cov]$       
company %all take reasonable /eps to    
v]ify t ! company ) :i* ! cov]$ company 
int5ds to %>e in=mation is li/$ 9 a     
notice requir$ "u subp>agraph 7,a74     
7#c7 ,protection & use ( in=mation by   
cov]$ companies  7,a7 ,purpose          
,in=mation receiv$ by a cov]$ company "u
 ?is section may n be us$ = any purpose 
o!r ?an-- 7i7 id5tify+ &1 z appropriate1

 report+ on cyb] ?reat indicators2 or   
7ii7 assi/+ ! cov]$ company 9 comply+ ) 
any requirem5t ( ?is title4  7,b7       
,proc$ures = protection ( in=mation ,ea*
 cov]$ company t engages 9 ! %>+ (      
in=mation "u ?is section %all ma9ta9    
adequate proc$ures to protect ! security
 & confid5tiality ( ! in=mation 9       
accordance ) ! policies & guidel9es     
e/abli%$ "u subsection 7c74  7#d7       
,report+ requirem5ts = cov]$ companies  
7,a7 ,cyb]security ?reat in=mation ,a   
cov]$ company t id5tifies cyb]security  
?reat in=mation requir+ imm$iate        
att5tion1 su* z suspect$ t]rori/        
activity1 %all1 z soon z practicable b n
 lat] ?an #cf h\rs aft] id5tify+ !      
in=mation-- 7i7 notify an appropriate   
law en=cem5t au?ority & ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy       
,incid5t ,report+ ,sy/em2 &  7ii7 comply
 ) any o!r ,f$]al requirem5ts = report+ 
suspici\s activity4  7,b7 ,suspici\s    
activity  7i7 ,volunt>y report+ to f$]al
 ag5cies ,a cov]$ company may volunt>ily

 report suspici\s activity to !         
,f9ancial ,crimes ,en=cem5t ,network & !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy "u ?is section4  7ii7  
,rule ( con/ruction ,no?+ 9 ?is         
subp>agraph %all be con/ru$ to-- 7,i7   
modify ! requirem5ts = report+ suspici\s
 activity if a cov]$ company is subject 
to su* regulations2 or  7,,ii7 create   
new suspici\s activity report+          
requirem5ts = a cov]$ company t is n    
curr5tly subject to su* a regulation4   
7,c7 ,exemption f disclosure ,in=mation 
%>$ "u ?is p>agraph %all be exempt f    
disclosure "u any provision ( ,/ate1    
,tribal1 or local fre$om ( in=mation    
law1 op5 gov]nm5t law1 op5 meet+s law1  
op5 records law1 sun%9e law1 or simil>  
law requir+ disclosure ( in=mation or   
records1 9 accordance ) section         
#ajd7;d77#d77;,b74  7c7 ,in=mation %>+  
betwe5 cov]$ companies & ! ,f$]al       
,gov]nm5t  7#a7 ,policies & proc$ures   
7,a7 ,9 g5]al ,n lat] ?an #ahj days aft]
 ! date ( enactm5t ( ! ,cryptocurr5cy   

,cyb]security ,in=mation ,%>+ ,act1 !   
,director ( ! ,f9ancial ,crimes         
,en=cem5t ,network & ! ,director ( !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all1 9 consultation ) !        
,national ,cyb] ,director & ! heads ( ! 
appropriate ,f$]al entities1 jo9tly     
develop & make publicly available       
policies & proc$ures relat+ to ! receipt
 by ! ,f$]al ,gov]nm5t ( cyb] ?reat     
indicators %>$ by cov]$ companies4  7,b7
 ,consid]ations ,9 develop+ ! policies &
 proc$ures requir$ "u subp>agraph 7,a71 
! ,director ( ! ,f9ancial ,crimes       
,en=cem5t ,network & ! ,director ( !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all take into acc\nt !         
requirem5ts describ$ 9 subsections      
7a77#c7 & 7b77#c7 ( section #aje4  7,c7 
,compliance ) simil> proc$ures ,9 ! case
 ( a cov]$ company t is requir$ to      
comply ) section #eja ( !               
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhja7 & ! ,paym5t ,c>d ,indu/ry ,data 
,security ,/&>d1 & applicable           

regulations issu$ !reund]1 ! cov]$      
company %all be consid]$ to be act+ 9   
compliance ) ! requirem5ts develop$ "u  
?is subsection if ! cov]$ company       
applies ! proc$ures requir$ "u su*      
section #eja to in=mation %>$ "u ?is    
section4  7#b7 ,guidel9es  7,a7 ,9 g5]al
 ,n lat] ?an #fj days aft] ! date (     
enactm5t ( ! ,cryptocurr5cy             
,cyb]security ,in=mation ,%>+ ,act1 !   
,director ( ! ,f9ancial ,crimes         
,en=cem5t ,network & ! ,director ( !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all jo9tly develop & make      
publicly available guidance-- 7i7 to    
assi/ cov]$ companies & promote %>+ (   
cyb] ?reat indicators ) ,f$]al entities 
"u ?is section2 &  7ii7 relat+ to       
adequate proc$ures to protect ! security
 & confid5tiality ( in=mation %>$ "u ?is
 section1 z requir$ "u subsection       
7b77#c77;,b74  7,b7 ,cont5ts ,!         
guidel9es requir$ "u subp>agraph 7,a7   
%all include guidance relat+ to !       
foll[+3 7i7 ,id5tification ( types (    

in=mation t w\ld qualify z a cyb] ?reat 
indicator "u ?is title & t w\ld be      
unlikely to include in=mation t-- 7,i7  
is n directly relat$ to a cyb]security  
?reat2 &  7,,ii7 is p]sonal in=mation ( 
a specific individual or in=mation t    
id5tifies a specific individual4  7ii7  
,id5tification ( types ( in=mation      
protect$ "u o!rwise applicable privacy  
laws t are unlikely to be directly      
relat$ to a cyb]security ?reat4  7iii7  
,su* o!r matt]s z ! ,director ( !       
,f9ancial ,crimes ,en=cem5t ,network & !
 ,director ( ! ,cyb]security &          
,infra/ructure ,security ,ag5cy consid] 
appropriate = entities %>+ cyb] ?reat   
indicators ) ,f$]al entities "u ?is     
title4  7#c7 ,compliance ) ! ,pap]work  
,r$uction ,act ,9 e/abli%+ requirem5ts  
"u ?is subsection1 ! ,secret>y %all     
ensure t ! requirem5ts comply ) *apt]   
#ce ( title #dd1 ,unit$ ,/ates ,code    
7commonly kn[n z ! 8,pap]work ,r$uction 
,act074  7d7 ,safe h>bor f c]ta9        
liability ,! liability protections 9    

section #ajf %all n apply to a cov]$    
company to ! ext5t ! company fails to   
comply ) p>agraphs 7#b71 7#c71 & 7#d7 ( 
subsection 7b74  7e7 ,exemption f       
disclosure ,9 accordance ) p>agraphs    
7#c7 & 7#h7 ( section #ejb7;e7 ( !      
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhjb71 if a cov]$ company volunt>ily  
%>es in=mation pursuant to ?is section1 
! cov]$ company %all n be requir$ to    
provide any affect$ consum] ! notice    
requir$ "u section #ejc ( !             
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fhjc74  4  7b7 ,con=m+ am5dm5t ,!     
table ( cont5ts 9 section #a7;b7 (      
division ,n ( ! ,consolidat$            
,appropriations ,act1 #bjaf 7,public    
,law #aad-aac2 #abi ,/at4 #bice7 is     
am5d$ by /rik+ ! items relat+ to        
sections #aaj & #aaa & ins]t+ ! foll[+3 
,sec4 #aaj4 ,%>+ ( cyb] ?reat indicators
 by cov]$ companies4,sec4 #aaa4         
,exception to limitation on au?ority (  
,secret>y ( ,def5se to dissem9ate c]ta9 
in=mation4,sec4 #aab4 ,effective p]iod4 

4