,i #aahth ,,congress #b;d ,session ,h4 ,r4 #gife ,,in ,,the ,,house ,,of ,,representatives ,april #aa1 #bjbd,ms4 ,pettersen 7for herself and ,mr4 ,mc,henry7 introduced the following bill2 which was referred to the ,committee on ,financial ,services ,a ,,bill ,to include requirements relating to ransomware attack deterrence for a covered ,u4,s4 financial institution in the ,consolidated ,appropriations ,act1 #bjba1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,ransomware and ,financial ,stability ,act of #bjbd4 #b4 ,ransomware attack deterrence 7a7 ,in general ,section #ajh of title ,i of division ,q of the ,consolidated ,appropriations ,act1 #bjba 7,public ,law #aaf-bfj2 #ace ,stat4 #bagc2 #ab ,u4,s4,c4 #ahaa note7 is amended-- 7#a7 in the subsection heading1 by striking report2 7#b7 by redesignating subsections 7d7 and 7e7 as subsections 7e7 and 7f71 respectively2 7#c7 by inserting the following after subsection 7c73 7d7 ,ransomware attack deterrence 7#a7 ,requirements 7,a7 ,in general ,a covered ,u4,s4 financial institution subject to a ransomware attack may not make a ransomware payment in response to such ransomware attack-- 7i7 before submitting the notification described in paragraph 7#b72 and 7ii7 in an amount greater than #ajj1jjj1 unless the payment is subject to a ransomware payment authorization4 7,b7 ,rule of construction ,nothing in this subsection shall be construed to permit a ransomware payment that is otherwise prohibited by law4 7#b7 ,notification described 7,a7 ,in general ,the notification described in this paragraph shall be submitted by a covered ,u4,s4 financial institution to the ,director of the ,financial ,crimes ,enforcement ,network and shall include-- 7i7 a determination by such institution that such institution is subject to a ransomware attack2 and 7ii7 a description of the ransomware attack and any associated ransomware payment demanded4 7,b7 ,contents ,to ensure efficient notification and resolution of a ransomware attack1 the ,secretary of the ,treasury-- 7i7 shall1 in consultation with interested persons1 issue guidance specifying information required to be included in the notification described in this paragraph2 and 7ii7 may not require1 to be included in such notification1 information that is unavailable to a covered ,u4,s4 financial institution1 based on good-faith efforts of such institution to provide information4 7#c7 ,waiver ,the ,president may waive the requirements of paragraph 7#b7 with respect to a covered ,u4,s4 financial institution if the ,president determines that the waiver is in the national interest of the ,united ,states and notifies such institution and the appropriate members of ,congress of such waiver4 7#d7 ,safe harbor with respect to ransomware payment authorizations and good-faith determinations 7,a7 ,in general ,with respect to a ransomware payment made under paragraph 7#b77;,b7 or a waiver issued under paragraph 7#c7-- 7i7 a ,u4,s4 financial institution shall not be liable under subchapter ,,ii of chapter #ec of title #ca1 ,united ,states ,code1 or chapter #b of title ,i of ,public ,law #ia-ejh 7#ab ,u4,s4,c4 #aiea et seq47 for making a ransomware payment consistent with the parameters and timing of a ransomware payment authorization2 and 7ii7 no ,federal or ,state department or agency may take any adverse supervisory action with respect to the ,u4,s4 financial institution solely for making a ransomware payment consistent with the parameters and timing of the authorization4 7,b7 ,good-faith efforts to assess ransomware attacks ,a covered ,u4,s4 financial institution may not be held liable for deficiencies in describing a ransomware attack in a notification described under paragraph 7#b7 if such institution engaged in good-faith efforts to determine the nature of the ransomware attack4 7,c7 ,rule of construction ,nothing in this paragraph may be construed-- 7i7 to prevent a ,federal or ,state department or agency from verifying the validity of a ransomware payment authorization with the law enforcement agency submitting that authorization2 7ii7 to relieve a ,u4,s4 financial institution from complying with any other provision of law1 including the reporting of suspicious transactions under section #ecah7;g7 of title #ca1 ,united ,states ,code2 or 7iii7 to extend the safe harbor described in this paragraph to any actions taken by the ,u4,s4 financial institution-- 7,i7 before the date of issuance of ransomware payment authorization2 or 7,,ii7 after any termination date stated in the ransomware payment authorization4 7,d7 ,ransomware payment authorization termination date ,any ransomware payment authorization submitted under this subsection shall include a termination date after which that authorization shall no longer apply4 7,e7 ,records ,any ,federal law enforcement agency that submits to a ,u4,s4 financial institution a ransomware payment authorization shall1 not later than #b business days after the date on which the authorization is submitted to the ,u4,s4 financial institution-- 7i7 submit to the ,director of the ,financial ,crimes ,enforcement ,network a copy of the authorization2 and 7ii7 alert the ,director as to whether the ,u4,s4 financial institution has implemented the request4 7,f7 ,guidance ,the ,secretary of the ,treasury1 in coordination with the ,attorney ,general1 shall issue guidance on the required elements of a ransomware payment authorization4 7#e7 ,confidentiality of information 7,a7 ,in general ,except as provided in paragraph 7#b71 any information or document provided by a ,u4,s4 financial institution to a ,federal law enforcement agency pursuant to this subsection-- 7i7 shall be exempt from disclosure under section #eeb of title #e1 ,united ,states ,code2 and 7ii7 may not be made publicly available4 7,b7 ,exceptions ,paragraph 7#a7 shall not prohibit the disclosure of the following3 7i7 ,information relevant to any administrative or judicial action or proceeding4 7ii7 ,information requested by the appropriate members of ,congress or otherwise required to be submitted to ,congress4 7iii7 ,information required for ,federal law enforcement or intelligence purposes 7as determined by the ,attorney ,general71 in consultation with the ,director of the ,financial ,crimes ,enforcement ,network to be disclosed to a domestic governmental entity or to a governmental entity of a ,united ,states ally or partner1 only to the extent necessary for such purposes1 and subject to appropriate confidentiality and classification requirements4 7iv7 ,anonymized information required for the production of aggregate data or statistical analyses4 7v7 ,information that the ,u4,s4 financial institution has consented to be disclosed to third parties4 7#f7 ,definitions ,in this subsection3 7,a7 ,covered ,u4,s4 financial institution ,the term covered ,u4,s4 financial institution means-- 7i7 any financial market utility that the ,financial ,stability ,oversight ,council has designated as systemically important under section #hjd of the ,dodd-,frank ,wall ,street ,reform and ,consumer ,protection ,act2 7ii7 any exchange registered under section #f of the ,securities ,exchange ,act of #aicd that facilitates trading in any national market system security1 as defined in section #bdb4fjj of title #ag1 ,code of ,federal ,regulations 7or any successor regulation71 and which exchange during at least four of the preceding six calendar months had-- 7,i7 with respect to all national market system securities that are not options1 #aj percent or more of the average daily dollar volume reported by applicable transaction reporting plans2 or 7,,ii7 with respect to all listed options1 #ae percent or more of the average daily dollar volume reported by applicable national market system plans for reporting transactions in listed options2 and 7iii7 any technology service provider in the ,significant ,service ,provider ,program of the ,financial ,institutions ,examination ,council that provides core processing services that is determined by the ,council to be a significant technology service provider4 7,b7 ,malicious software ,the term malicious software means software that1 when deployed1 results in the loss of access to data or the loss of functionality of an information and communications system or network of a ,u4,s4 financial institution4 7,c7 ,ransomware attack ,the term ransomware attack means the deployment of malicious software for the purpose of demanding payment in exchange for restoring critical access to1 or the critical functionality of1 an information and communications system or network4 7,d7 ,ransomware payment ,the term ransomware payment means a payment made by a ,u4,s4 financial institution 7including a payment made through use of digital currency7 to1 at the request of1 or for the benefit of a person responsible for a ransomware attack in exchange for restoration of the access or functionality of an information and communications system or network of the institution4 7,e7 ,ransomware payment authorization ,the term ransomware payment authorization means1 with respect to a ransomware payment made by a ,u4,s4 financial institution1 a written notice from a ,federal law enforcement agency to authorize such ransomware payment4 2 7#d7 in subsection 7f71 as so redesignated1 by striking after the date of enactment of this ,act and inserting after the date of enactment of the ,ransomware and ,financial ,stability ,act of #bjbd2 and 7#e7 by adding at the end the following new subsection3 7g7 ,short title ,this section may be cited as the ,cybersecurity and ,financial ,system ,resilience ,act4 4 7b7 ,applicability ,the amendments made by this ,act shall apply to a covered ,u4,s4 financial institution 7as defined in subsection 7d7 of the ,cybersecurity and ,financial ,system ,resilience ,act 7,public ,law #aaf-bfj2 #ace ,stat4 #bagc2 #ab ,u4,s4,c4 #ahaa note71 as added by this ,act7 beginning on the earlier of the date that is-- 7#a7 #cj days after publication in the ,federal ,register of rules implementing this ,act2 or 7#b7 #a year after the date of the enactment of this ,act4 7c7 ,sunset ,this ,act and the amendments made by this ,act shall be repealed #aj years after the applicability date described in subsection 7b74