Passed
417 Yea7 Nay9 Not voting2/3 required
HR-8278-119
Received in the Senate and Read twice and referred to the Committee on Banking, Housing, and Urban Affairs.
Sponsored by Marlin Stutzman (R-IN)
What it does
This bill would require seven federal financial supervisory agencies — the Federal Reserve, CFPB, FDIC, Treasury (including OCC and FinCEN), FHFA, and NCUA — to assess their existing technology capabilities and procurement practices within 180 days of enactment. The agencies would then jointly submit a report to Congress within 18 months of completing those assessments, and every five years thereafter, covering their hardware and software, workforce technology expertise, data collection processes, and plans for future technology upgrades.
Who benefits
Financial regulators who would receive a structured mandate and political cover to modernize outdated systems. Congress, which would gain visibility into supervisory technology gaps across agencies. Consumers and the broader public, who could benefit indirectly from more effective detection of financial fraud, money laundering, and systemic risk. Fintech and technology vendors who may see increased procurement opportunities as agencies identify and address gaps. Smaller banks and credit unions that could benefit from more standardized, efficient reporting processes if agencies modernize data collection.
Who is hurt
Banks, credit unions, and other supervised financial institutions that may face new or modified data-sharing requirements as agencies upgrade their systems — the bill requires cost estimates for such transitions, signaling that compliance burdens are anticipated. Technology contractors currently serving agencies under existing procurement arrangements, who could face increased competition if procurement rules are streamlined. Taxpayers who would bear the cost of any technology upgrades that follow from the assessments, though the bill itself does not appropriate funds. Agency staff whose roles may shift as technology replaces manual supervisory processes.
Supporters argue
Supporters argue that federal banking regulators rely on outdated technology that leaves the financial system vulnerable to undetected risks, fraud, and cyberattacks — a concern underscored by the rapid adoption of artificial intelligence by the very firms these agencies supervise. They contend that requiring a structured, coordinated self-assessment is a low-cost, high-value first step: Congress cannot direct agencies to modernize effectively without first understanding the scope of the problem, and the five-year reporting cycle ensures ongoing accountability rather than a one-time exercise.
Opponents argue
Opponents argue that the bill is largely a reporting exercise that imposes administrative burdens on already resource-constrained agencies without providing the funding, authority, or mandates needed to actually fix the technology gaps it identifies. They contend that agencies already conduct internal technology assessments on an ongoing basis — a fact the bill's own findings acknowledge — making the additional congressional reporting requirement duplicative and potentially diverting staff time from frontline supervisory work without producing meaningful change.
Constitutional context
No significant constitutional tension exists here. Congress has broad authority under the Necessary and Proper Clause (Art. I, §8, cl. 18) to direct the operations of federal agencies it has created, including requiring self-assessments and reports. This bill does not delegate new rulemaking authority to agencies, so the major questions doctrine (West Virginia v. EPA, 2022) and post-Chevron scrutiny (Loper Bright v. Raimondo, 2024) are not implicated.
Checks and balances
Congress gains improved oversight visibility through mandatory reporting; the executive branch agencies retain operational control over how assessments are conducted and how any resulting upgrades are implemented, with no new enforcement mechanism created by this bill.
Historical precedent
The Economic Growth, Regulatory Relief, and Consumer Protection Act (2018) and various annual appropriations riders have previously directed financial regulators to study and report on specific technology and data practices, though none required this breadth of coordinated cross-agency technology self-assessment.
Passed