---
kind: "section"
citation: "12 C.F.R. § 225.301"
title: "12"
number: "225.301"
heading: "Definitions."
url: "https://uscodex.org/cfr/12/225.301"
---

# §225.301. Definitions.

- (a) Except as modified in this subpart, or unless the context otherwise requires, the terms used in this subpart have the same meanings as set forth in [12 U.S.C. 1813](/usc/12/1813.md).
- (b) **For purposes of this subpart, the following definitions apply.**
  - (1) Banking organization means a U.S. bank holding company; U.S. savings and loan holding company; state member bank; the U.S. operations of foreign banking organizations; and an Edge or agreement corporation; provided, however, that no designated financial market utility shall be considered a banking organization.
  - (2) Bank service provider means a bank service company or other person that performs covered services; provided, however, that no designated financial market utility shall be considered a bank service provider.
  - (3) Business line means a product or service offered by a banking organization to serve its customers or support other business needs.
  - (4) **Computer-security incident—** is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.
  - (5) **Covered services—** are services performed, by a person, that are subject to the Bank Service Company Act ([12 U.S.C. 1861-1867](/usc/12/1861-1867.md)).
  - (6) **Designated financial market utility—** has the same meaning as set forth at [12 U.S.C. 5462(4)](/usc/12/5462.md?p=4).
  - (7) **Notification incident—** is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's—
    - (i) Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business;
    - (ii) Business line(s), including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or
    - (iii) Operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.
  - (8) **Person—** has the same meaning as set forth at [12 U.S.C. 1817(j)(8)(A)](/usc/12/1817.md?p=j-8-A).

## Notes

### Source

Source: 86 FR 66442, Nov. 23, 2021, unless otherwise noted.

### Authority

Authority: 12 U.S.C. 1817(j)(13), 1818, 1828(o), 1831i, 1831p-1, 1843(c)(8), 1844(b), 1972(1), 3106, 3108, 3310, 3331-3351, 3354, 3906, 3907, and 3909; 15 U.S.C. 1681s, 1681w, 6801 and 6805.

### Source

Source: Reg. Y, 49 FR 818, Jan. 5, 1984, unless otherwise noted.