Joint Trades Letter to the Treasury on Data Security

Dear Secretary Bessent,

In recent years, nation-state cyber adversaries have increasingly targeted and successfully compromised federal agencies, including the financial regulators. As the new administration evaluates its approach to cybersecurity and data protection, and assesses legacy challenges, we would like to highlight some perceived preparedness gaps and work in partnership with the U.S. government to protect our financial markets and ensure the health of the nation's economy.

We are deeply concerned about the cybersecurity risk management practices at federal regulatory agencies, and the need for critical reforms to ensure the supervisory process does not introduce unnecessary risk to firms through regulators' own security weaknesses. The recently disclosed cybersecurity incidents at the Office of the Comptroller of the Currency (OCC) and the Department of Treasury in December 2024 show that government agencies are increasingly the target of persistent and sophisticated nation state attacks that could disrupt financial markets and our economy. It is imperative that federal regulators recognize that they are equally a target of malicious actors and implement the same or substantially similar cybersecurity and incident response practices that they expect financial institutions to maintain.

To address similar challenges across all financial regulatory agencies, we encourage the Administration to implement the following recommendations:

1. ensure agencies are held to the same or substantively similar security and data protection standards expected of financial institutions to include transparency and accountability for upholding these standards;
2. enable firms to retain and house their own sensitive data needed for regulatory engagement;
3. improve regulatory agencies' incident response processes to include notification and communication with regulated institutions; and
4. consolidate and streamline examinations conducted by the financial regulatory agencies to reduce the amount of data being shared.

Download the joint trades letter to read the full text.