BPI Targets Regulator File Transfers as Cyber Trap

Regulator data transfers are supposed to make bank oversight safer, but BPI data sharing safeguards argue the handoff itself can become a cybersecurity weakness.

The Bank Policy Institute wants banks and regulators to cut back on direct electronic transfers of sensitive financial and supervisory data, according to PYMNTS. Its risk-based practices framework, released Thursday, July 23, does not tell banks to stop cooperating with supervisors. It tells regulators to stop treating file uploads, encrypted emails and regulator-controlled portals as the default answer.

BPI data sharing safeguards put bank exam files inside the cyber perimeter

The core tension is simple. Regulators need access to confidential bank information. But every copied file creates another place attackers can try to reach.

BPI’s framework pushes a different model: regulators can review sensitive information while the financial institution keeps control of the underlying data. The options include firm-hosted applications, screen sharing, on-site reviews, and, for the most sensitive material, oral briefings or summaries instead of full file transfers.

That is the real shift. BPI is not arguing against supervision. It is arguing against unnecessary duplication.

The recommendation follows cybersecurity incidents discovered at the Office of the Comptroller of the Currency in February 2025 and the Treasury Department in December 2024. A June 9 letter from SIFMA, BPI, ABA and MFA said the OCC incident involved hackers likely having access to about 148,000 emails beginning in roughly May 2023, with the OCC learning of unusual activity only in February 2025 after Microsoft notified the agency.

“[G]overnment agencies are increasingly the target of persistent and sophisticated nation-state attacks that could disrupt financial markets and our economy,” the groups wrote to Treasury Secretary Scott Bessent.

XOOMAR analysis: BPI’s argument lands because it reframes supervisory data as operational risk. Once highly sensitive bank data leaves the bank’s environment, the bank loses practical control over access, copying, retention and destruction.

More bank data in more repositories means more breach points

BPI’s framework names the categories that worry it most. They include strategic plans, capital plans, material nonpublic information, M&A data, financial statements, investment strategies and revenue analyses. It groups these as sensitive “Strategy, Planning & Financial Data.”

That list matters because these are not generic compliance forms. Some of the material could affect markets or competition if disclosed before the right time. BPI gives special treatment to pre-deal M&A information, recommending oral discussions, restricted regulator audiences and summaries until a transaction becomes public.

The same logic can apply beyond financial plans when supervisory requests reach especially sensitive customer, operational or technology-related material. The practical point is not that every category must be handled the same way. It is that banks and regulators should match the method of access to the sensitivity of the information, using redaction, aggregation, excerpts, summaries or controlled review where those alternatives satisfy the supervisory need.

For particularly sensitive technology information, BPI recommends reducing direct transfers, using oral briefings or summaries where appropriate, and minimizing unnecessary exposure rather than defaulting to full file submissions.

That position fits a broader cyber lesson visible across sectors: control over where data sits often matters as much as perimeter defense. XOOMAR readers following OpenAI Models Breached Hugging Face During Cyber Test and Estée Lauder Data Breach Hid for 10 Months in Oracle will recognize the recurring question. Who had access, where was the data stored, and how quickly could the owner see what happened?

Direct file transfers solve examiner access but weaken bank control

The traditional process is convenient. A regulator requests material. The institution sends files through a portal, encrypted email or another electronic channel. Everyone can point to a submission record.

BPI’s critique is that convenience hides a governance problem. After transfer, the bank has less visibility into who opens the file, whether it is copied or redistributed, how long it remains stored and how it is destroyed.

The framework’s preferred answer is not one tool. It is a hierarchy of exposure reduction.

BPI also recommends limiting requests and submissions to information material to regulators’ responsibilities for safety and soundness, investor protection, market integrity or risk management.

That word, material, does heavy lifting. It gives banks a framework to challenge overbroad requests without refusing legitimate oversight. It also gives regulators a way to narrow collection before data starts moving.

The new model favors controlled access over bigger file drops

BPI’s framework builds on a joint statement this month from the Federal Reserve, FDIC and OCC establishing a coordinated approach for highly sensitive information during bank examinations. Under that approach, supervised institutions identify requested information they consider highly sensitive, while regulators consider alternatives that minimize collection and storage.

That is a meaningful concession to the bank side of the debate. The agencies still inspect. But the process starts to recognize that collecting everything can create its own risk.

XOOMAR analysis: the likely operational burden now shifts to classification. Banks will need sharper internal processes for deciding which examiner requests involve highly sensitive material, which alternatives fit the request and when direct transfer remains justified.

That means more scrutiny of:

• Transfer logs: who sent what, when and through which system.
• Retention schedules: how long regulators and firms keep shared material.
• Access approvals: which examiners can see which files.
• Exception processes: when a full file transfer is unavoidable.
• Security terms: storage location, authorized users, further sharing and disposal.

Regtech and secure collaboration vendors could benefit if banks demand better firm-hosted review tools, granular access controls, audit trails and restricted-download environments. That’s an inference, not a claim from BPI. But the framework clearly points away from bulk transfers and toward controlled viewing.

For cyber teams, the warning is sharper. Less data movement reduces exposure only if the replacement channels are well governed. A poorly managed viewing portal can become its own problem.

Banks and regulators now have to prove access does not mean possession

The hard part is practical. Regulators may resist processes that slow document review during examinations. Banks may struggle to classify materials consistently across business lines, legal teams and cyber teams. Legal review adds another fault line, because institutions still need a repeatable process for handling protected or sensitive materials without turning classification into a blanket objection to legitimate oversight.

Still, the direction is clear. BPI data sharing safeguards are pushing bank supervision toward supervised access, not bigger file drops.

The next test is whether banks and regulators can turn this into repeatable exam practice. Evidence that would support BPI’s thesis includes more written agreements on storage and retention, wider use of firm-hosted applications, narrower requests for highly sensitive data and fewer complete-file submissions for cybersecurity and pre-deal M&A materials.

Evidence against it would be just as visible: regulators continuing to default to portals and encrypted email, banks treating exceptions as routine, or another breach showing sensitive supervisory data copied into systems where the originating institution had little visibility.

The financial sector can’t treat regulator data transfers as clerical work anymore. BPI’s framework says the transfer itself is now part of cyber resilience.

Impact Analysis

• Sensitive supervisory data can become a cybersecurity risk when copied across regulator systems.
• BPI’s proposal could change how banks and regulators handle confidential exam materials.
• Recent incidents at the OCC and Treasury have raised concerns about government systems as targets for sophisticated attacks.