Federal Reserve Operating Circular 5: Security, Liability, and Deadlines

Federal Reserve Operating Circular 5 is the cross-cutting agreement every institution accepts when it connects to a Reserve Bank for any financial service, setting the rules for electronic access, information security, incident reporting, and the Reserve Bank’s liability when something goes wrong. As of January 5, 2026, the Federal Reserve retitled the document from “Electronic Access” to “General Financial Service Provisions” to reflect how broadly it now reaches.¹ If your institution touches a Reserve Bank system for any reason, OC 5 is the baseline you operate under.

What OC 5 Governs

The Federal Reserve publishes a numbered series of operating circulars, each covering a specific service. OC 1 handles master accounts, OC 3 covers check collection and returns, OC 4 governs ACH, and OC 6 applies to Fedwire funds transfers. OC 5 sits underneath all of them. Its terms apply to every institution using any Reserve Bank financial service, defined to include FedACH Services, Federal Reserve Check Services, Fedwire Funds Service, Fedwire Securities Service, FedNow Service, FedCash Services, National Settlement Service, and any ancillary service the Reserve Banks offer.¹

A boundary worth flagging: OC 5 does not govern the mechanics of electronic check collection, image cash letters, or FedForward and FedReturn processing. Those live in Operating Circular 3, which applies to all cash items accepted for forward collection and all returned checks accepted for return.² When you send a check image to the Fed, OC 3 governs the presentment warranties and technical standards for the transaction. OC 5 governs the electronic connection you used to transmit it and the security protecting that connection.

Beyond the core framework, OC 5 houses specialized services in its appendices: the E-Payments Routing Directory, the API Service, the Exception Resolution Service, and the Payee Name Verification Service. Each carries its own terms and its own liability cap.

Electronic Connections and FedLine

Institutions reach Reserve Bank services through FedLine Solutions, the family of secure platforms the Fed provides for payments and information applications.³ OC 5 lets the Reserve Bank specify which type of connection an institution must use based on its transaction volume and the services it needs. One option, FedLine Advantage, provides access to the Fedwire Funds Service, Fedwire Securities Service, National Settlement Service, FedACH file processing, and the FedNow Service, with customization based on subscriber count, volume, access speed, and operational structure.⁴ The institution is responsible for making sure its own equipment and software meet the Reserve Bank’s requirements and stay in working order.¹

Information Security Requirements

The security obligations are where OC 5 has its sharpest operational bite. Every institution must maintain an information security program covering technical, operational, managerial, and procedural controls. The circular treats this as a condition of access, not a recommendation.¹

Use every access control feature the Reserve Bank specifies, and restrict logical and physical access to authorized staff only.
Install and properly configure commercially reasonable anti-malware software, patch operating systems and applications in a timely way, and regularly scan the environment for vulnerabilities.
Locate VPN or WAN devices used with an electronic connection on the institution’s premises or at a service provider’s premises, unless they sit in a secure facility specifically designed for servers that meets the Reserve Bank’s conditions.
Treat all security-related information as confidential, protect it with at least the same care given to the institution’s own most sensitive information, and limit disclosure to those with a need to know.

Annual Self-Assessment and Attestation

Appendix A requires every institution to self-assess its compliance with the security requirements at least once a year. The institution can calibrate the scope to its own risk analysis, but the Reserve Banks can require the assessment be done or reviewed by an independent third party, an internal audit function, or an internal compliance function.¹

On top of that, the Reserve Banks may ask for a formal attestation no more than once every 12 months. The attestation requires the institution to acknowledge its responsibility for the security requirements, confirm the self-assessment was completed, state that remediation plans exist for any noncompliance, and acknowledge the duty to notify the Fed immediately of any suspected or confirmed security breach. If the Reserve Banks suspect a connection may be compromised, they can demand additional assessments and attestations outside the normal cycle.¹

Incident Notification

When something goes wrong, OC 5 demands immediate action. If an institution suspects, detects, or becomes aware of any cyber event, fraud, malware detection, compromise, or other security incident relating to or potentially impacting an electronic connection or access control feature, it must immediately call the Federal Reserve Support Center at 833-FRS-SVCS (833-377-7827) and follow up in writing by email. The trigger is deliberately broad, covering events that impact or may impact software or hardware used to interface with an electronic connection, that caused or may have caused an unauthorized transaction, or that resulted or may have resulted in unauthorized access to confidential information.¹

The “may impact” phrasing matters. Institutions do not get to wait for confirmation. A reasonable suspicion triggers the call.

Service Providers Do Not Shift the Risk

Many institutions use third-party vendors to manage their Fed connections. OC 5 is explicit that outsourcing the work does not outsource the responsibility. The institution remains accountable for its service provider’s compliance with every security requirement in the circular.¹

Service providers must establish controls that properly segregate each institution’s data from other institutions’ data, and the institution itself is responsible for verifying that segregation. Signing a vendor contract and walking away is not an option. Ongoing oversight is baked into the rule.

What the Fed Will Pay If Something Goes Wrong

OC 5 sharply limits Reserve Bank liability. For the core electronic connection services, liability is capped at the fees the institution paid for the relevant electronic connection during the one-month period immediately before the transaction or event that caused the loss. The Reserve Bank is liable only for failures to exercise ordinary care or act in good faith, and even then will not pay special, incidental, or consequential damages, whether or not foreseeable.¹

The appendices apply their own caps for the specialized services. API Service liability under Appendix C is capped at the greater of $100 or the aggregate fees paid for API access during the six months before the event. Exception Resolution Service liability under Appendix D is limited to the greater of the fees for the underlying financial service or the fees for the Exception Resolution Service itself, paid during the month of the event. Payee Name Verification Service liability under Appendix E is limited to the fees paid for that service during the month of the event. All of these caps exclude lost profits, third-party claims, and consequential or incidental damages.¹

Any loss above one month’s fees sits with the institution.

One-Year Deadline to Sue

OC 5 is governed by federal law and, where federal law does not control, by the law of the state where the institution’s Administrative Reserve Bank has its head office. Any legal action against a Reserve Bank under the circular must be filed within one calendar year of the transaction or event giving rise to the claim, and must be brought in the federal district court for the district where the Administrative Reserve Bank’s head office is located. Participation in Reserve Bank services counts as consent to that court’s exclusive jurisdiction. For disputes under the API Service appendix, the governing state law is Illinois and the exclusive venue is the U.S. District Court for the Northern District of Illinois.¹

One year is shorter than many institutions expect. A processing error discovered 13 months after it happened is already time-barred, no matter when it came to light. If your controls rely on annual audits to surface problems, that calendar needs to be tight.

1
Federal Reserve Services. Operating Circular No. 5 – General Financial Service Provisions
2
Federal Reserve Financial Services. Operating Circulars
3
Federal Reserve Financial Services. FedLine Solutions
4
Federal Reserve Financial Services. FedLine Advantage