#aai? ,,congress  #b;d ,session  ,h4 ,r4
 #hbgh  ,,an ,,act  ,to require c]ta9   
sup]visory ag5cies to assess _!         
te*nological capabilities1 & = o!r      
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,fo/]+ ! ,use ( ,te*nology 
to ,uphold ,regulatory ,effectiv5ess 9  
,sup]vision ,act4  #b4 ,f9d+s ,congress 
f9ds ! foll[+3  7#a7 ,bank+ regulators  
cont9ue to exam9e & monitor depository  
in/itutions )\t suffici5t access to     
real-"t in=mation4  7#b7 ,risk surr\nd+ 
te*nology procurem5t may pres5t *all5ges
 = updat+ sup]visory te*nology4  7#c7   
,to ensure t prud5tial sup]vision is    
effective & su/a9able 9 ! digital age1  
ag5cies mu/ lev]age new te*nologies to  
all[ = ! f9ancial monitor+ necess>y to  
pres]ve a safe & s\nd bank+ sy/em4  7#d7
 ,new te*nological tools are also       
necess>y 9 ord] = ag5cies to effectively
 fulfill m&ates o!r ?an prud5tial       
sup]vision1 includ+ _! m&ates to assure 
consum] protection & monitor ,bank      
,secrecy ,act compliance4  7#e7         

,ag5cies' reliance on outdat$ te*nology 
c create vuln]abilities = ! f9ancial    
sy/em1 ?r\gh-- 7,a7 difficulties 9      
collect+1 compil+1 & analyz+ relevant   
in=mation ab\t risks & noncompliance at 
sup]vis$ firms2  7,b7 reliance on       
in=mation t is inaccurate1 incomplete1  
or n timely2  7,c7 reliance on limit$ & 
outdat$ tools = data analysis2  7,d7    
difficulties 9 us+ data to id5tify risk 
tr5ds2  7,e7 difficulties 9 produc+     
accurate & timely reports2  7,f7        
inadequacy ( cyb]security safegu>ds2 &  
7,g7 failure to detect illegal          
activities4  7#f7 ,! rapid expansion (  
f9ancial firms' use ( artificial        
intellig5ce may g5]ate opportunities to 
improve ! f9ancial sy/em :ile also      
introduc+ a range ( risks1 mak+ x       
ess5tial t ag5cies be equipp$ ) !       
te*nology1 exp]tise1 & skills ne$$ to   
analyze ^! opportunities & pot5tial     
risks4  7#g7 ,:ile ag5cies assess _!    
sup]visory capabilities on an ongo+     
basis1 x is imp]ative t !re be a unifi$ 

goal ( enhanc+ sup]visory te*nologies t 
ensure effective & su/a9able ov]sight4  
#c4 ,te*nological capabilities &        
procurem5t practices assessm5t  7a7 ,9  
g5]al  7#a7 ,te*nological capabilities  
assessm5t ,ea* cov]$ ag5cy %all1 n lat] 
?an #ahj days aft] ! date ( ! enactm5t (
 ?is section1 assess h[ exi/+           
te*nologies us$ by ! cov]$ ag5cy pose   
*all5ges to ! cov]$ ag5cy 9 conduct+    
adequate1 real-"t sup]visory assessm5ts 
( entities ov] :i* ! cov]$ ag5cy has    
sup]visory au?ority4 ,su* te*nologies   
include1 z applicable-- 7,a7 core       
in=mation te*nology infra/ructure2  7,b7
 te*nologies us$ to sup]vise entities2  
7,c7 te*nologies = monitor+ g5]al m>ket 
risks us+ report$ data & ext]nal data2 &
  7,d7 te*nologies = data collection1   
/orage1 process+1 & security4  7#b7     
,procurem5t practices assessm5t ,ea*    
cov]$ ag5cy %all1 n lat] ?an #ahj days  
aft] ! date ( ! enactm5t ( ?is section--
  7,a7 assess ! procurem5t rules &      
protocols adh]$ to by su* cov]$ ag5cy :5

 su* cov]$ ag5cy acquires or develops   
new te*nological sy/ems2 &  7,b7 id5tify
 any opportunities to fur!r /reaml9e    
procurem5t rules & protocols1 includ+ an
 assessm5t ( ! impact su* rules or      
protocols h on ! ability ( ! cov]$ ag5cy
 to te/ new te*nological sy/ems1 t are  
)9 ! cov]$ ag5cy's au?ority to /reaml9e4
  7b7 ,report ,n lat] ?an #ah mon?s aft]
 ! completion ( ! assessm5ts requir$ "u 
subsection 7a71 & = e #e ye>s !reaft]1 !
 cov]$ ag5cies %all coord9ate & jo9tly  
submit to ! ,committee on ,f9ancial     
,s]vices ( ! ,h\se ( ,repres5tatives & !
 ,committee on ,bank+1 ,h\s+1 & ,urban  
,affairs ( ! ,s5ate1 9 a mann] t does n 
pose a risk to ! integrity or security (
 any te*nologies1 sy/ems1 or            
capabilities ( cov]$ ag5cies1 regulat$  
entities1 or m>ket p>ticipants1 a report
 t includes1 z applicable1 ! foll[+ )   
respect to ea* cov]$ ag5cy3 7#a7 ,a     
g5]al ov]view ( h>dw>e & s(tw>e us$ =   
in=mation ga!r+ & advanc$ analytics dur+
 sup]vision activities1 includ+         

categories ( te*nology pur*as$ f v5dors 
& develop$ by ! cov]$ ag5cy or          
contractors ( ! cov]$ ag5cy4  7#b7 ,a   
description ( ! procurem5t practices &  
protocols ( ! cov]$ ag5cy1 includ+ a    
description (-- 7,a7 :e!r su* processes 
are volunt>ily adh]$ to or m&at$2 &     
7,b7 any opportunities to fur!r /reaml9e
 procurem5t rules & protocols1 includ+  
an assessm5t ( ! impact su* rules or    
protocols h on ! ability ( ! cov]$ ag5cy
 to te/ new te*nological sy/ems4  7#c7  
,a g5]al ov]view ( ! portion ( ! work=ce
 ( ! cov]$ ag5cy t is engag$ mat]ially 9
 te*nology developm5t )9 ! cov]$ ag5cy1 
includ+--  7,a7 an ov]view ( ! ability (
 ! cov]$ ag5cy to recruit & reta9       
appropriate te*nology exp]ts2 &  7,b7 a 
description ( ! degree to :i* ! cov]$   
ag5cy relies on contractors to design1  
develop1 or deploy te*nology & p]=m     
te*nology-relat$ tasks1 & a description 
( relat$ risk managem5t practices =     
contractors & ?ird-p>ty te*nologies4    
7#d7 ,a g5]al description ( ! processes 

us$ by ! cov]$ ag5cy to obta9 in=mation 
f entities sup]vis$ by ! cov]$ ag5cy &  
any imp$im5ts !reto1 includ+ regulatory 
ob/acles4  7#e7 ,g5]al in=mation ab\t   
m>ket & te*nology tr5ds & risks 9 !     
und]ly+ regulat$ m>kets includ+1        
specific to ! cov]$ ag5cy's             
jurisdiction--  7,a7 m>ket developm5ts  
influ5c$ by ! adoption ( new            
te*nologies2  7,b7 ! use ( new          
te*nologies by sup]vis$ entities =      
compliance & risk managem5t purposes2   
7,c7 ! impact ( new te*nologies on !    
collection & analysis ( data submitt$ to
 ! cov]$ ag5cies by sup]vis$ entities z 
requir$ by regulation1 includ+ on data  
quality1 int]op]ability1 & /&>dization2 
&  7,d7 pot5tial risks1 includ+ risks ( 
illicit activity1 relat$ to new         
te*nologies4  7#f7 ,a g5]al description 
( ! ways 9 :i* ! cov]$ ag5cy %>es       
in=mation or sy/em access ) o!r cov]$   
ag5cies & any imp$im5ts !reto1 includ+  
regulatory ob/acles4  7#g7 ,an e/imate (
 ! co/s = sup]vis$ entities to modify   

sy/ems to %>e data ) cov]$ ag5cies1 z   
appropriate4  7#h7 ,a g5]al description 
( any plans ( ! cov]$ ag5cy to implem5t 
future upgrades to ! te*nology x uses to
 sup]vise entities1 includ+-- 7,a7 !    
anticipat$ timel9e = any plann$         
upgrades2  7,b7 ! co/s ( any plann$     
upgrades2  7,c7 any imp$im5ts to procur+
 relevant te*nologies2  7,d7 plans =    
hir+ & tra9+ individuals 9 connection ) 
te*nological upgrades2  7,e7 any aspects
 ( any plann$ upgrades t %\ld be        
address$ on an int]ag5cy basis2  7,f7   
any anticipat$ *all5ges & opportunities 
associat$ ) entities sup]vis$ by ! cov]$
 ag5cy adapt+ to ! cov]$ ag5cy's report+
 process1 includ+-- 7i7 e/imates (      
transition co/s2 &  7ii7 e/imates ( any 
pot5tial co/ r$uctions2 &  7,g7 z       
applicable1 ! cov]$ ag5cy's relation%ips
 ) o!r cov]$ ag5cies 9 _! capacity z    
delegat$ exam9]s4  7c7 ,cov]$ ag5cy     
def9$ ,9 ?is section1 ! t]m cov]$ ag5cy 
means ! ,bo>d ( ,gov]nors ( ! ,f$]al    
,res]ve ,sy/em1 ! ,bureau ( ,consum]    

,f9ancial ,protection1 ! ,f$]al ,deposit
 ,insurance ,corporation1 ! ,dep>tm5t ( 
! ,treasury1 includ+ ! ,(fice ( !       
,comptroll] ( ! ,curr5cy & ! ,f9ancial  
,crimes ,en=cem5t ,network1 ! ,f$]al    
,h\s+ ,f9ance ,ag5cy1 & ! ,national     
,cr$it ,union ,adm9i/ration4  ,pass$ !  
,h\se ( ,repres5tatives ,septemb] #ae1  
#bjbf4;,cl]k4