US Banking Groups Lobby SEC to Scrap Cyberattack Disclosure Rules

The US Securities and Exchange Commission adopted cybersecurity disclosure rules on July 26, 2023, requiring listed companies to file a Form 8-K within four business days of determining that a cyber incident is material. The rules are intended to help investors promptly assess operational and financial risks. The banking industry argues, however, that disclosure while an incident is still being investigated or remediated could expose vulnerabilities to hackers.

On April 10, 2026, five groups, including the American Bankers Association, the Bank Policy Institute and SIFMA, again urged the SEC to repeal Form 8-K Item 1.05 and the corresponding Form 6-K requirement for foreign issuers, renewing a petition filed on May 22, 2025. The ABA, representing a $24.1 trillion banking industry, advocated confidential information-sharing with the government instead. As of June 15, the SEC had not announced that it would repeal the rules.