Meet the FCA CRM rule with a cyber programme examiners can verify

The FCA cyber risk management rule is a US federal regulation, codified in 12 CFR Part 609, issued by the Farm Credit Administration. It requires each Farm Credit System institution to keep a comprehensive, written cyber risk management programme, approved by its board each year, that protects customer and employee information against cyber threats and unauthorised access. It is unrelated to the UK Financial Conduct Authority.

All Farm Credit System institutions must comply, including Farm Credit banks, agricultural credit associations and the Federal Agricultural Mortgage Corporation (Farmer Mac) for the business planning requirement. The programme must be scaled to the size, risk profile and complexity of each institution. Vendors serving these institutions are not directly regulated, but they face due diligence, contract terms and risk assessments under the rule's vendor management requirements.

The rule took effect on 1 January 2025. The Farm Credit Administration published the final rule in the Federal Register on 11 December 2023 at 88 FR 85825, replacing earlier Part 609 rules that focused on electronic commerce. The longer lead time gave institutions a period to build or update their programmes, incident response plans and board reporting before FCA began examining against the new requirements.

An institution must notify the Farm Credit Administration as soon as possible and no later than 36 hours after it determines that an incident has occurred. The incident response plan must also cover notifying the institution's board, containing the incident while preserving evidence, resuming business activities, and notifying affected customers, employees and known website visitors when warranted under state and federal law.

At a minimum, the programme must include an annual risk assessment, identification and risk-based remediation of system and software vulnerabilities, an incident response plan reviewed at least annually, a training plan for employees, vendors, contractors and the board, vendor management policies, and regular testing of key controls by independent parties. Institutions must also address privacy and report to the board at least quarterly.

Non-compliance is identified through FCA's examination process and can lead to examination findings and supervisory action. FCA has enforcement powers under the Farm Credit Act of 1971 that apply to violations of its regulations. The rule itself does not set specific fines, so the consequences depend on the severity of the weaknesses and how the institution responds to examiner findings.

The rule requires a programme consistent with industry standards but does not mandate a specific framework. Many institutions build their programme on the NIST Cybersecurity Framework or ISO 27001, and use SOC 2 reports to monitor vendors. Controls you already run for those frameworks, such as risk assessment, incident response and vendor management, overlap strongly with the FCA requirements.

Yes, on request. The FCA cyber risk management rule is mapped in OneClickComply's control library as a draft framework and is available on request rather than live for self-service adoption today. Once enabled, it uses the same automated evidence collection, risk register, vendor risk management and continuous monitoring as other frameworks, with expert guidance from OneClickComply's in-house audit team.