Recommendation: In the event that Congress again requires an agency to provide affected individuals with identity theft insurance in response to a breach of sensitive personal data, Congress should consider permitting the agency to determine the appropriate level of that insurance.

Agency: Congress
Status: Open

Comments: As of July 2020, Congress had not enacted legislation for which our Matter for Congressional Consideration would be applicable.

Recommendation: The Director of the Office of Management and Budget should, to the extent feasible, conduct an analysis of the effectiveness of the various identity theft services relative to alternatives, and revise OMB's guidance to federal agencies in light of this analysis.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As we reported in GAO-19-230, we contacted OMB several times between May 2018 and early March 2019 to update the status of this recommendation, and again in July 2020, but as of July 2020, OMB had not responded with an update.

Recommendation: The Director of the Office of Management and Budget should explore options to address the risk of duplication in federal agencies' provision of identity theft services in response to data breaches, and take action if viable options are identified.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: No executive action identified. As of July 2020, OMB had not responded to GAO's request for an update.

Recommendation: To help state credit union supervisors and privately insured credit unions better interpret Regulation I and inform consumers when an institution is not federally insured, CFPB should issue guidance to clarify whether drive-through windows require disclosures.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB agreed with this recommendation. As of January 2020, CFPB said it had explored options for addressing the recommendation and determined it would require notice-and-comment rulemaking. CFPB said that because the agency had other, higher regulatory priorities, it did not currently have plans to implement the recommendation.

Recommendation: To help state credit union supervisors and privately insured credit unions better interpret Regulation I and inform consumers when an institution is not federally insured, CFPB should issue guidance to describe what constitutes clear and conspicuous disclosure, including minimum signage dimensions and font size for disclosures.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB agreed with this recommendation. As of January 2020, CFPB said it had explored options that would most effectively and efficiently provide guidance regarding Regulation I and said that notice-and-comment rulemaking would be necessary to address GAO's recommendation with regard to "clear and conspicuous" disclosures. CFPB said that because the agency had other, higher regulatory priorities, it did not currently have plans to implement the recommendation.

Recommendation: To help state credit union supervisors and privately insured credit unions better interpret Regulation I and inform consumers when an institution is not federally insured, CFPB should issue guidance to explain and provide examples of which communications are advertising.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB agreed with this recommendation. As of January 2020, CFPB said it had explored options that would most effectively and efficiently provide guidance regarding Regulation I and said that notice-and-comment rulemaking would be necessary to address GAO's recommendation. CFPB said that because the agency had other, higher regulatory priorities, it did not currently have plans to implement the recommendation.

Recommendation: To help ensure that the government is not exposed to more liability risk than intended, the Secretary of Transportation should ensure that the FAA Administrator prioritizes the development of a plan to address the identified weakness in the cost-of-casualty amount, including setting time frames for action, and update the amount based on current information.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation agreed with the recommendation. In March 2018, the Federal Aviation Administration (FAA) stated that the agency planned to conduct a rulemaking to address any updates to the cost-of-casualty amount. As part of the rulemaking, FAA planned to engage with the commercial space and insurance industries to obtain views on an appropriate cost-of-casualty amount and implications of any changes. However, in February 2019, FAA stated that it has been unable to conduct the planned rulemaking due to a competing priority that will continue through 2020. FAA has requested input from the industry on prioritizing needed rule revisions and will develop a plan for updating the cost-of-casualty amount based on the industry's prioritization recommendations. We will continue to monitor FAA's actions in response to this recommendation.

Recommendation: To better ensure spaceport operators' understanding of FAA's financial responsibility regulations for commercial space launches, the Secretary of Transportation should ensure that the FAA Administrator provides additional communication to clarify FAA's interpretation of the financial responsibility regulations for commercial space launches. The forms of communication could include, among other things, issuing additional guidance or using other forums to clarify when a spaceport operator is a third party to a launch and when it is not.

Agency: Department of Transportation
Status: Open

Comments: In May 2018, FAA officials said that they were working towards implementing the recommendation, but did not have documented efforts at this time and do not have an estimated completion date.

Recommendation: To help ensure that FSOC is comprehensively identifying and considering companies, the Secretary of the Treasury in consultation with FSOC members, should establish procedures to evaluate companies in Stage 2 and Stage 3 under both statutory determination standards when an evaluation in either stage concludes that a company does not meet one of the standards, or document--on a company-specific or more general basis--why the second determination standard is not relevant for determination evaluations.

Agency: Department of the Treasury: Financial Stability Oversight Council
Status: Open

Comments: In December 2019, FSOC adopted final interpretive guidance that revises its approach to evaluating and determining whether to designate nonbank financial companies. The final revised guidance prioritizes an activities-based approach to identifying and addressing potential risks to financial stability and states that FSOC will pursue company-specific determinations only if the activities-based approach is not sufficient. The guidance further states that if FSOC does consider a company-specific determination, its evaluation will focus primarily on the first determination standard. The guidance does not indicate the establishment of procedures to evaluate companies under both determination standards for the purpose of comprehensively identifying and considering companies or to document why the other standard is not relevant. We will continue to monitor FSOC's implementation of the guidance and any additional actions that may be responsive to our recommendation.

Recommendation: To help ensure that FSOC is comprehensively identifying and considering companies, the Secretary of the Treasury in consultation with FSOC members, should develop a process to collect information necessary for Stage 1 analysis, as appropriate, from certain nonbank financial companies for which public or regulatory information is otherwise unavailable. For example, FSOC could have companies for which such information is unavailable and that meet certain characteristics (such as quantitative thresholds similar to those used in Stage 1) report necessary information to the Office of Financial Research.

Agency: Department of the Treasury: Financial Stability Oversight Council
Status: Open

Comments: In December 2019, FSOC adopted final interpretive guidance that revises its approach to evaluating and determining whether to designate nonbank financial companies. The final revised guidance introduces a new stage 1 of the designation process in which FSOC would notify a nonbank financial company under review and consider available public and regulatory information. While the guidance states that a company under review in stage 1 may submit information it deems relevant to the evaluation, FSOC would not require the company to submit information during stage 1. We will continue to monitor FSOC's implementation of the revised guidance and any additional actions that may be responsive to our recommendation.

Recommendation: To promote forward-looking construction and rebuilding efforts while FEMA phases out most subsidies, the Secretary of the Department of Homeland Security should direct FEMA to consider amending NFIP minimum standards for floodplain management to incorporate, as appropriate, forward-looking standards, similar to the minimum standard adopted by the Hurricane Sandy Rebuilding Task Force.

Agency: Department of Homeland Security
Status: Open

Comments: In August 2019, a FEMA official stated that FEMA intends to implement the recommendation in full eventually, but it is unlikely that it will happen as a cohesive effort in 2020, given other ongoing flood insurance reforms. As of August 2020, the status of this recommendation remains unchanged.