PART 304—FORMS, INSTRUCTIONS, AND REPORTS Authority: 5 U.S.C. 552; 12 U.S.C. 1463, 1464, 1811, 1813, 1817, 1819, 1831, and 1861-1867. Link to an amendment published at 91 FR 38268, June 25, 2026. Source: 84 FR 29052, June 21, 2019, unless otherwise noted. Subpart A—In General § 304.1 Purpose. This subpart informs the public where it may obtain forms and instructions for reports, applications, and other submittals used by the Federal Deposit Insurance Corporation (FDIC), and describes certain forms that are not described elsewhere in FDIC regulations in this chapter. [86 FR 66443, Nov. 23, 2021] § 304.2 Where to obtain forms and instructions. Forms and instructions used in connection with applications, reports, and other submittals used by the FDIC can be obtained by contacting the FDIC Public Information Center (550 17th Street NW, Washington, DC 20429; telephone: (877) 275-3342 or (703) 562-2200), except as noted in § 304.3. In addition, many forms and instructions can be obtained from FDIC regional offices. A list of FDIC regional offices can be obtained from the FDIC Public Information Center, or found at the FDIC's website at http://www.fdic.gov, § 304.3 Reports. (a) Consolidated Reports of Condition and Income, Forms FFIEC 031, 041, and 051. http://www.ffiec.gov/. (b) Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign Banks, Form FFIEC 002. http://www.ffiec.gov/. (c) Summary of Deposits, Form FDIC 8020/05. (d) Notification of Performance of Bank Services, Form FDIC 6120/06. (Approved by the Office of Management and Budget under control numbers 3064-0052, 7100-0032, 3064-0061, and 3064-0029) §§ 304.4-304.10 [Reserved] Subpart B—Implementation of Reduced Reporting Requirement Authority: 12 U.S.C. 1464(v), 1817(a), and 1819 Tenth. § 304.11 Authority, purpose, and scope. (a) Authority. (b) Purpose. (c) Scope. (d) Preservation of authority. § 304.12 Definitions. (a) Covered depository institution (1) Has less than $5 billion in total consolidated assets as reported in its report of condition for the second calendar quarter of the preceding year; (2) Has no foreign offices, as defined in this section; (3) Is not required to or has not elected to use 12 CFR part 324, subpart E, to calculate its risk-based capital requirements; (4) Is not a large institution or highly complex institution, as such terms are defined in 12 CFR 327.8, or treated as a large institution, as requested under 12 CFR 327.16(f); and (5) Is not a state-licensed insured branch of a foreign bank, as such terms are defined in section 3(s) of the Federal Deposit Insurance Act, 12 U.S.C. 1813(s). (6) In determining whether an insured depository institution meets the asset threshold in paragraph (1) of the definition of “covered depository institution” in paragraph (a)(1) of this section, for purposes of a report required to be submitted for calendar year 2021, an insured depository institution may refer to the lesser of its total consolidated assets as reported in its report of condition as of December 31, 2019, and its total consolidated assets as reported in its report of condition for the second calendar quarter of 2020. (b) Foreign country (c) Foreign office (1) A branch or consolidated subsidiary in a foreign country, unless the branch is located on a U.S. military facility; (2) An international banking facility as such term is defined in 12 CFR 204.8; (3) A majority-owned Edge Act or Agreement subsidiary including both its U.S. and its foreign offices; and (4) For an institution chartered or headquartered in any U.S. state or the District of Columbia, a branch or consolidated subsidiary located in a U.S. territory or possession. (d) Report of condition (e) Total consolidated assets [84 FR 29052, June 21, 2019, as amended at 85 FR 77363, Dec. 2, 2020] § 304.13 Reduced reporting. A covered depository institution may file the FFIEC 051 version of the report of condition, or any successor thereto, which shall provide for reduced reporting for the reports of condition for the first and third calendar quarters for a year. § 304.14 Reservation of authority. Notwithstanding § 304.13, the Corporation, in consultation with the applicable state chartering authority, may require an otherwise eligible covered depository institution to file the FFIEC 041 version of the report of condition, or any successor thereto, based on an institution-specific determination. In making this determination, the Corporation may consider criteria including, but not limited to, whether the institution is significantly engaged in one or more complex, specialized, or other higher-risk activities, such as those for which limited information is reported in the FFIEC 051 version of the report of condition compared to the FFIEC 041 version of the report of condition. Nothing in this part shall be construed to limit the Corporation's authority to obtain information from insured depository institutions. §§ 304.15-304.20 [Reserved] Subpart C—Computer-Security Incident Notification Source: 86 FR 66443, Nov. 23, 2021, unless otherwise noted. § 304.21 Authority, purpose, and scope. (a) Authority. (b) Purpose. (c) Scope. § 304.22 Definitions. (a) Except as modified in this subpart, or unless the context otherwise requires, the terms used in this subpart have the same meanings as set forth in 12 U.S.C. 1813. (b) For purposes of this subpart, the following definitions apply. (1) Banking organization (2) Bank service provider (3) Business line (4) Computer-security incident (5) Covered services (6) Designated financial market utility (7) Notification incident (i) Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business; (ii) Business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or (iii) Operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States. (8) Person § 304.23 Notification. A banking organization must notify the appropriate FDIC supervisory office, or an FDIC-designated point of contact, about a notification incident through email, telephone, or other similar methods that the FDIC may prescribe. The FDIC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. § 304.24 Bank service provider notification. (a) A bank service provider is required to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to such banking organization for four or more hours. (1) A bank-designated point of contact is an email address, phone number, or any other contact(s), previously provided to the bank service provider by the banking organization customer. (2) If the banking organization customer has not previously provided a bank-designated point of contact, such notification shall be made to the Chief Executive Officer and Chief Information Officer of the banking organization customer, or two individuals of comparable responsibilities, through any reasonable means. (b) The notification requirement in paragraph (a) of this section does not apply to any scheduled maintenance, testing, or software update previously communicated to a banking organization customer. §§ 304.25-304.29 [Reserved] Subpart D—XXX Link to an amendment published at 91 FR 38268, June 25, 2026.