Guidance: Response Programs for Unauthorized Access to Member Information and Member Notice

Key Points

• 1Credit unions must create and follow a plan for responding when member data is hacked or accessed without permission
• 2Members must be notified promptly when their personal information is compromised, so they can monitor their accounts and protect themselves from fraud
• 3The regulation sets specific timelines and methods for how credit unions should communicate with affected members about the breach
• 4Credit unions must document their response procedures and be prepared to explain them to regulators
• 5The public comment period ends February 10, 2026, giving people time to provide feedback before the final rule is adopted

Key Dates