OCC 2026 report to Congress: how it supervises bank cybersecurity and secures itself

In two minutes

• The report is the OCC's annual statutory report to Congress under the Consolidated Appropriations Act, 2021, and it covers policies, implementation, threats and the OCC's own security (p. 3).
• The OCC runs an IT assessment, including cybersecurity risk management and controls, in every supervisory cycle for every bank (p. 13).
• Banks must notify their primary federal regulator within 36 hours of determining a notification incident has occurred. Bank service providers must tell affected banks when a disruption lasts four or more hours (p. 7).
• The OCC says threat actors exploit known software vulnerabilities, weak authentication, phishing and compromised credentials, and that ransomware targets banks and their third parties (p. 14).
• Supervisory concerns named include end-of-life systems, patch management, and system and data architecture, plus third-party and supply chain risk (p. 14).
• The threats the OCC is most focused on are ransomware, DDoS, account takeover, supply chain, geopolitical threats, post-quantum cryptography, digital assets and AI (pp. 19-21).
• The OCC says AI lowers the barrier to entry for attackers and speeds up and scales attacks, including automated reconnaissance and rapid vulnerability exploitation (p. 21).
• On its own security, the OCC reports Level 4 maturity in the Treasury OIG's fiscal year 2025 FISMA audit (p. 18).

Key numbers

• 1,010: institutions in the federal banking system as of September 30, 2025 (961 banks and 49 federal branches and agencies) (p. 2).
• $16.7 trillion: assets held by banks in the federal banking system, 67 percent of all U.S. bank assets (p. 2).
• approximately 2,071: OCC bank examiners as of September 30, 2025 (p. 9).
• 12 to 18 months: length of the full-scope examination cycle for each bank (pp. 10-11).
• 36 hours: maximum time for a banking organization to notify its regulator after determining a notification incident occurred (p. 5).
• four or more hours: service provider disruption that triggers notice to affected customer banks (p. 5).
• $50 billion to $700 billion: proposed change to the asset threshold for the heightened standards guidelines (proposed December 30, 2025) (p. 4, footnote 7).
• Level 4: maturity level the OCC reports in the OIG's fiscal year 2025 FISMA audit (p. 18).

What to do with it

• Check your incident response plan against the 36-hour regulator notice and the four-hour service provider notice described on p. 5.
• Review multifactor authentication, system hardening and patch management, which the report names as key mitigations (p. 14).
• Review end-of-life systems and technology architecture plans against the supervisory concerns the report lists (p. 14).
• Assess third-party and supply chain risk using the interagency guidance and community bank guide the report cites (pp. 14-15, Appendix A).
• Map your cybersecurity assessment to the OCC's Cybersecurity Supervision Work Program, which cross-references the NIST CSF and the FFIEC IT Examination Handbook (p. 12).
• Join and monitor FS-ISAC and CISA alerts, which the OCC encourages banks to do (p. 19).

Read the full document if

• you work at an OCC-supervised bank and want to know what examiners assess each cycle.
• you need a list of interagency cybersecurity guidance from 2014 onward (Appendix A).
• you want the OCC's own list of current threats, including AI and post-quantum cryptography.

What it relies on

The report is a statutory report to Congress written by the OCC, describing its own policies, programs and views. It gives few measurements. Its figures cover bank counts, assets, examiner numbers and OIG audit results. Threat statements rest on OCC Semiannual Risk Perspective reports and OCC monitoring, and the report does not give underlying incident data. It cites federal rules, interagency guidance and FFIEC publications. The OCC is a regulator and does not sell security products.

Our read

Useful as a plain statement of what the OCC expects and examines on cybersecurity, and of which threats it names. It describes agency activity and is not a threat data report. Appendix A is a handy reference list of guidance and dates.