System
name. FRB—Electronic Applications
Security classification. Unclassified.
System location.
Board of Governors of the Federal
Reserve System
20th Street and Constitution
Avenue NW
Washington, DC 20551
Some
data will be hosted by third-party vendors, in government clouds managed
by BOX in Nevada and California, Appian in Ohio, and OneSpan in Virginia
and Ohio.
System manager(s).
Vaishali Sack, Designated Agency
Applications Official
Division of Supervision and Regulation
Board of Governors of the Federal
Reserve System
20th Street and Constitution
Avenue NW
Washington, DC 20551
202-452-5221
vaishali.d.sack@frb.gov
Authority for maintenance of
the system. Sections 9, 19, 23A, 23B, 24A, 25, and 25A of the
Federal Reserve Act (12 U.S.C. 321-338a, 461-506, 371c, 371c-1, 371(d),
601-605, and 611-631); the Change in Bank Control Act (12 U.S.C. 1817(j));
sections 8, 18(c), 19, 32, and 44 of the Federal Deposit Insurance
Act (12 U.S.C. 1818, 1828(c), 1829, 1831i, and 1831(u)); the Bank
Holding Company Act of 1956 (12 U.S.C. 1841 et seq.); section
5 of the Bank Service Company Act (12 U.S.C. 1865); the International
Banking Act of 1978, as amended (12 U.S.C. 3101 et seq.) and
the Foreign Bank Supervision Enhancement Act (12 U.S.C. 3101 note);
the Depository Institution Management Interlocks Act (12 U.S.C. 3201 et seq.); the Home Owners’ Loan Act (12 U.S.C. 1465-1468); sections
163(b) and 167 of the Dodd-Frank Wall Street Reform and Consumer Protection
Act (12 U.S.C. 5363(b) and 5367); the Board’s Regulation H (12 CFR
part 208); Regulation K (12 CFR part 211); Regulation L (12 CFR part
212); Regulation W (12 CFR part 223); Regulation Y (12 CFR part 225);
Regulation LL (12 CFR part 238); Regulation MM (12 CFR part 239);
Regulation YY (12 CFR part 252); and Executive Order 9397.
Purpose(s) of the system. These records are collected and maintained to assist the Board and
the Federal Reserve Banks (collectively, FRS) in evaluating whether
individuals, financial institutions, and other business organizations
meet the applicable statutory and regulatory factors that are required
to be considered in a particular filing.
Categories of individuals covered by the system. Persons who are parties to regulatory filings submitted to the FRS,
and public commenters to such submissions.
Categories of records in the system. In
connection with their role in filings, individuals provide information,
which may include, but is not limited to the following: name (including
former names and/or nicknames); contact information such as telephone
number, email address, etc.; address (home, business, and/or mailing);
citizenship information, including place and date of birth; and/or
citizenship status; government-issued identification, such as driver’s
license number, Social Security number, passport number and/or alien
registration number, and/or taxpayer identification number; occupation
and employment history; financial and credit information (including
credit history); education and professional credentials; information
about compliance with applicable laws and regulations, criminal history,
and involvement with court proceedings; and related organizations.
In addition, submissions from members of the public may contain unsolicited
personally identifiable information (PII) (such as bank account information
or Social Security numbers) even though such PII is not required for
the individual to provide comments or feedback.
Record source categories. The information
is submitted by individual filers, certain employees, officers, directors,
or shareholders of financial institutions or other business organizations,
representatives of individual or institutional filers, federal and
state banking regulators, state insurance regulators, and members
of the public. FRS staff may also provide information to obtain access
to the system. FRS staff may also independently obtain information
regarding filers from publicly available sources.
Routine uses of records maintained in the
system, including categories of users and purposes of such uses. General routine uses A, B, C, D, G, I, and J apply to this system.
These general routine uses are located at
https://www.federalreserve.gov/files/SORN-page-general-routine-uses-of-board-systems-of-records.pdf and are published in the
Federal Register at 83 Fed. Reg.
43,872, 43,873–74 (August 28, 2018). These records may also be used
to disclose certain information to other financial institution regulatory
agencies pursuant to explicit information-sharing agreements.
Policies and
practices for storage of records. Paper records are stored in
locked file cabinets with access limited to staff with a need to know
until the paper records have been scanned and stored electronically.
Electronic records will be stored at the Board and by third-party
vendors in FedRAMP approved government cloud storage solutions.
Policies and practices
for retrieval of records. Records can be searched for and retrieved
by authorized staff only, by every data field on a record, and by
the contents of each record. Access to records is limited to those
persons whose official duties require it.
Policies and practices for retention and disposal
of records. Records are retained for 60 days within the system
and then transferred to the Board’s electronic recordkeeping system.
Records are retained in the Board’s electronic recordkeeping system
for 15 years, then destroyed when no longer needed for reference.
Administrative, technical,
and physical safeguards. The system has the ability to track
individual user actions within the system. The audit and accountability
controls are based on NIST and Board standards, which are based on
applicable laws and regulations. The controls assist in detecting
security violations and performance or other issues in the system.
Access to the system is restricted to authorized users within the
FRS who require access for official business purposes. Users are classified
into different roles and common access and usage rights are established
for each role. User roles are used to delineate between the different
types of access requirements such that users are restricted to information
that is required in the performance of their duties. Periodic assessments
and reviews are conducted to determine whether users still require
access, have the appropriate role, and whether there have been any
unauthorized changes. Records are encrypted at rest and in transmission.
Record access procedures. The Privacy Act allows individuals the right to access records maintained
about them in a Board system of records. Your request for access must:
(1) contain a statement that the request is made pursuant to the Privacy
Act of 1974; (2) provide either the name of the Board system of records
expected to contain the record requested or a concise description
of the system of records; (3) provide the information necessary to
verify your identity; and (4) provide any other information that may
assist in the rapid identification of the record you seek.
The Board handles all Privacy Act
requests as both a Privacy Act request and as a Freedom of Information
Act request. The Board does not charge fees to a requestor seeking
to access or amend his/her Privacy Act records.
You may submit your Privacy Act request to
the Secretary of the Board, Board of Governors of the Federal Reserve
System, 20th Street and Constitution Avenue NW, Washington, DC 20551.
You may also submit your Privacy Act request electronically
by filling out the required information at:
https://foia.federalreserve.gov/.
Contesting record
procedures. The Privacy Act allows individuals to seek amendment
of information that is erroneous, irrelevant, untimely, or incomplete
and is maintained in a system of records that pertains to them. To
request an amendment to your record, you should clearly mark the request
as a “Privacy Act Amendment Request.” You have the burden of proof
for demonstrating the appropriateness of the requested amendment and
you must provide relevant and convincing evidence in support of your
request.
Your request for amendment must: (1) provide the name
of the specific Board system of records containing the record you
seek to amend; (2) identify the specific portion of the record you
seek to amend; (3) describe the nature of and reasons for each requested
amendment; (4) explain why you believe the record is not accurate,
relevant, timely, or complete; and (5) unless you have already done
so in a related Privacy Act request for access or amendment, provide
the necessary information to verify your identity.
Notification procedures. Same as “Access
procedures” above. You may also follow this procedure in order to
request an accounting of previous disclosures of records pertaining
to you as provided for by 5 U.S.C. 552a(c).
Exemptions promulgated for the system. Certain
portions of this system of records may be exempt from 5 U.S.C. 552a(c)(3),
(d), (e)(1), (e)(4)(G), (H), and (I), and (f) of the Privacy Act pursuant
to 5 U.S.C. 552a(k)(2).
History. This SORN was previously published in the Federal
Register at 73 Fed. Reg. 54,595 (September 22, 2008). The SORN
was also amended to incorporate two new routine uses required by OMB
at 83 Fed. Reg. 43,872 (August 28, 2018).