Federal law requires every insured bank to maintain a written, tested, board-approved disaster recovery plan that keeps critical systems running, protects customer data, and restores operations within defined time and data-loss targets when something goes wrong. The requirements for bank disaster recovery planning are set primarily by the Federal Financial Institutions Examination Council (FFIEC), enforced by the OCC, Federal Reserve, and FDIC, and backed by civil money penalties that can reach $1,000,000 per day for the most serious violations.1Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution A bank that cannot show examiners a viable, exercised plan has a problem long before any disaster hits.
Who Sets the Rules
The baseline for every federally regulated bank comes from the FFIEC’s IT Examination Handbooks, which cover information security, business continuity, and operational resilience. Examiners use these booklets as the measuring stick during supervisory reviews.2Federal Financial Institutions Examination Council. FFIEC Information Technology Examination Handbook – Information Security The FFIEC’s Business Continuity Planning Booklet also assigns direct responsibility to the board of directors and senior management for maintaining a plan that stays current with the institution’s business processes, technology, and threat environment.3Federal Financial Institutions Examination Council (FFIEC). Business Continuity Planning Booklet
Larger institutions face an additional layer. The interagency paper on Sound Practices to Strengthen Operational Resilience, jointly issued by the OCC, Federal Reserve, and FDIC, applies to domestic firms with $250 billion or more in average total consolidated assets, and to firms with at least $100 billion that also have significant cross-jurisdictional activity or wholesale funding.4Office of the Comptroller of the Currency. Sound Practices to Strengthen Operational Resilience It consolidates existing guidance into one reference point for building resilience programs at the largest banks.
What the Plan Must Contain
A compliant plan starts by identifying which business functions must stay active to prevent immediate financial harm, then ranks every system against that standard. A core processing platform is not the same priority as an internal HR portal, and recovery targets are assigned accordingly.
Backup Sites
Banks maintain secondary data centers, and the type of site drives how fast recovery can happen. A hot site runs a mirrored copy of production at all times and allows near-instant cutover. A cold site provides space, power, and cooling but needs hardware installed and configured before it is useful. Hot sites recover in minutes and cost more to maintain; cold sites are cheaper and take days to bring online. Most large banks use hot sites for their most critical systems and cold sites for secondary functions.
Data Replication
How data gets to the backup site determines how much is lost in a disruption. Synchronous replication writes every transaction to both locations at once, so the backup is always current, but it needs high-bandwidth, low-latency links and is typically reserved for the most critical databases. Asynchronous replication sends data in batches with a slight delay, meaning a few minutes of activity may be lost. Most banks mix the two by matching the method to the sensitivity of each system.
Personnel and Documentation
The plan must name specific individuals authorized to initiate recovery, with clear succession if primary contacts are unreachable. Those people need the credentials and technical access to reach off-site backups, reconfigure network routing, and contact vendors. A recovery that stalls because nobody can log in is a recovery that fails.
Every step belongs in a comprehensive recovery manual covering hardware startup sequences, password retrieval, and vendor contacts. The manual needs to exist in both digital and physical formats at multiple secure locations. A single copy on a server in the flooded building is worthless.
Cyber-Specific Requirements
Ransomware changed the planning problem because it targets backups directly. An attacker who encrypts both the primary data and the backup copies has total leverage. The FFIEC addressed this in its joint statement on destructive malware by requiring institutions to protect offline backups from destructive code and to account for scenarios where mirrored backup sites are hit simultaneously or where corrupted data replicates to backups before anyone notices.5Federal Financial Institutions Examination Council. Joint Statement Destructive Malware
Recommended defenses include air-gapped backups that are physically and electromagnetically isolated from any network, logical network segmentation, and physical separation of critical systems.5Federal Financial Institutions Examination Council. Joint Statement Destructive Malware The point is to keep at least one copy of the data beyond any digital pathway an attacker can use. Some banks also make these backups immutable, so the data cannot be altered or deleted after it is written, even by someone with administrative credentials.
Sheltered Harbor is a voluntary industry program that goes further by setting standards for an encrypted, fully isolated data vault kept separate from every other backup the institution holds. Participating banks develop and test playbooks for restoring essential services after standard recovery options have been exhausted. Certification requires an annual independent audit and a data recovery test.
Vendor and Third-Party Obligations
Most banks depend on outside providers for core processing, cloud hosting, and other critical services, and regulators hold the bank responsible for disruptions regardless of who caused them. That means vendor contracts have to do more than promise uptime.
Effective agreements for critical services define recovery time objectives and recovery point objectives for each major system, with a default restoration time for anything not specifically listed. They include remedies that go beyond standard service-level credits, because a billing discount does not help when customers cannot reach their accounts. Stronger contracts reserve the right to terminate, step in and operate the service directly, or bring in an alternate provider at the vendor’s expense when outages exceed defined thresholds. Force majeure clauses should not excuse the provider from meeting restoration timelines, since a hurricane is exactly the scenario the recovery plan exists for. Contracts should also require that disaster recovery capabilities are operational before the service goes live, with milestones for staff training and process implementation built into the transition.
Testing the Plan
A plan that has never been exercised is a plan that does not work. Banks validate recovery capabilities through escalating levels of testing.
Tabletop exercises bring departmental leaders together to walk through the manual against a scenario such as a ransomware attack or a regional power outage. The point is not to test technology but to expose gaps in communication, decision authority, and sequencing. Who calls whom? What happens if the primary decision-maker is unreachable?
Component tests go a level deeper by isolating individual systems, such as the core banking platform or the payment gateway, and verifying that each can run independently in the recovery environment. That prevents the situation where a full-scale test fails and nobody can tell which piece broke.
Full-scale simulations are the most rigorous test. The bank deliberately shuts down primary systems and runs operations from the backup site. Two metrics govern the result. The Recovery Time Objective (RTO) measures how long it takes to get systems back online. The Recovery Point Objective (RPO) measures how much data was lost during the transition. If the RTO target is four hours and the failover takes six, the plan needs work. If the RPO target is zero data loss and five minutes of transactions vanished, the replication method needs upgrading. After the backup site is running, auditors perform data integrity checks to confirm balances match and pending transactions are accounted for. Every failure or delay goes into a post-test report that feeds back into the manual.
Incident Notification Deadlines
When a computer-security incident disrupts a bank’s ability to serve customers, deliver core products, or threatens lines of business whose failure would cause material revenue loss, the bank must notify its primary federal regulator within 36 hours of determining that the incident qualifies.6Federal Register. Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers Notification can be made by email, phone, or other methods the agency prescribes.
Bank service providers carry a separate duty. They must notify each affected banking customer as soon as possible after determining that an incident has caused or is reasonably likely to cause a material service disruption lasting four or more hours.7Federal Reserve. Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers The 36-hour clock sits on the bank; the 4-hour trigger sits on the vendor.
Board and Senior Management Responsibility
Disaster recovery is not purely a technology problem, and regulators do not treat it as one. The FFIEC assigns direct responsibility to the board of directors and senior management for maintaining updated and viable business continuity plans.3Federal Financial Institutions Examination Council (FFIEC). Business Continuity Planning Booklet The board cannot delegate the plan to IT and move on. Directors are expected to review the plan, understand the institution’s exposure, and ensure the plan evolves with the business and the threat environment. Examiners ask pointed questions about board involvement, and an institution where the board has never reviewed the plan or approved test results is going to have a difficult supervisory conversation.
What Happens If a Bank Falls Short
Federal law structures banking penalties in three tiers under the Federal Deposit Insurance Act, based on the severity and intent behind the violation:
- Tier 1 covers any violation of law, regulation, a final agency order, or a written agreement with a regulator, and carries a penalty of up to $5,000 per day the violation continues.
- Tier 2 applies when the violation is part of a pattern of misconduct, causes more than a minimal loss, or results in a financial benefit to the violator. The daily cap rises to $25,000.
- Tier 3 applies when someone knowingly commits a violation and recklessly causes a substantial loss to the institution or a substantial gain for themselves. Penalties can reach $1,000,000 per day for individuals. For the institution itself, the cap is the lesser of $1,000,000 per day or one percent of total assets.1Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution
These are the base statutory amounts. Federal agencies normally adjust them annually for inflation under the Federal Civil Penalties Inflation Adjustment Act, though for 2026, agencies were directed to continue using the 2025 penalty levels because of data availability issues. Beyond fines, regulators can issue cease-and-desist orders that force an institution to halt specific practices or hire outside consultants to rebuild its recovery program.
One narrow point worth knowing in the disaster context: temporarily closing a branch during an emergency does not trigger the 90-day advance notice that normally applies to permanent branch closings under the Federal Deposit Insurance Act. If the bank later decides not to reopen, however, the permanent closure rules apply and affected customers must be notified, even though prior notice would not have been possible.8Federal Reserve. Consumer Compliance Handbook – Branch Closings The initial closure is temporary; the decision not to reopen converts it, and the notification duty kicks in at that point.