- Disclosure comes first and has deadlines. Regulators and investors hear from you before the press does.
- Several clocks can run at once: 36 hours for banks to notify their regulator and four business days for a listed company's SEC filing once an incident is judged material.
- A PR firm speaks to reporters and investors. An online crisis firm works on what people find in search afterward. You may need both.
- Regulator releases and news coverage cannot be removed by any firm. Private data and rule-breaking content can be reported.
- Your lawyer decides what is said and when. Communications follow the legal position, not the other way round.
In this guide
Top pick for financial services crisis management in 2026: Reputation Resolutions
Scored 93 out of 100 on our five-criteria methodology, the highest of any firm we rank for online crisis management. Results-based services for repairing, improving and protecting online reputations on Google and AI, and payment is only required after results are achieved. A+ BBB Accredited, in business since 2013.
What Crisis Communications Means in Financial Services
It is the planned, lawful way a financial firm tells regulators, investors, customers, staff and the public about an incident, in the right order.
For most companies a crisis is about reputation. For a bank, lender or listed company it is also about rules. Some facts must be told to a regulator or to the market by a deadline. Others must not be shared with some people before others.
That makes the order of statements part of the job. Say the right thing to the wrong audience first and you can create a second problem. This guide is about who speaks to whom, and when. It is not legal advice, and your counsel's view overrides anything here.
Disclosure Timing in Plain Terms, from the Regulators' Own Pages
Different rules start different clocks. Which ones apply depends on what you are: a listed company, a bank, a non-bank lender or all three.
| Who and what | The clock | Primary source |
|---|---|---|
| Listed company, a cybersecurity incident judged material | Form 8-K Item 1.05 is due four business days after the company determines the incident is material | SEC press release on the 2023 rules |
| Listed company, annual reports | Describe processes for managing material cyber risk and the material effects of past incidents | SEC press release on the 2023 rules |
| Banking organization, a notification incident | Tell the primary federal regulator as soon as possible and no later than 36 hours after determining the incident occurred | FDIC letter FIL-74-2021 |
| Any firm talking to market professionals or shareholders | Do not tell select people something material before telling the market. Intentional disclosures must be public at the same time | SEC Regulation FD release |
These clocks are separate and can overlap. Materiality is a legal judgment, and the SEC says disclosure can be delayed only where the Attorney General finds immediate disclosure would threaten national security or public safety. State laws add their own notice duties for customers.
Rules change and some have exceptions. Treat this table as a map of where to look, then confirm the current wording on the linked pages with your lawyer.
Ready to Fix What People See When They Search You?
Talk to a specialist at Reputation Resolutions, the top-scored firm on this list. You get a straight answer on what can be removed, what can be pushed down, and what it will take. Every service, from repairing to improving to protecting your reputation, is results-based and agreed in writing.
Who Speaks to Whom: An Audience Matrix
Each audience needs a different message, from a different person, at a different time. Mixing them up is the common mistake.
| Audience | Who speaks | What they need | When |
|---|---|---|---|
| Regulators | Counsel and the compliance lead | Facts required by the rule, accurate and on time | On the deadline that applies, often before anyone else |
| Investors and the market | Counsel, the CFO and investor relations | One public statement, filed or released so everyone sees it together | After the legal decision on materiality |
| Customers | The CEO or a named senior leader | What happened to them, what you are doing, what they can do | As soon as the legal clock and the facts allow |
| Employees | HR and leadership | The same facts, plus who may speak and who may not | Before they read it in the news |
| Reporters | One trained spokesperson | Facts you can confirm, nothing else | After regulators and investors have been told |
| Search and AI answers | An online crisis firm, with your approval | Accurate pages, correct profiles, rule-based reports | Starts during the incident and runs for months |
The last row is the one most financial firms plan for least. It is where an online crisis firm fits, and it is covered in the next section.
Do Listed Companies Need a Crisis PR Firm, or an Online Crisis Firm?
Usually both. A traditional crisis PR firm handles reporters, investors and spokespeople. An online crisis firm works on what people find in search, reviews and AI answers.
These two jobs are often confused. Crisis PR is about the message and the media. Online response is about the footprint: which pages appear when someone searches your name, your brand or your executives. For the full difference, read crisis PR firms versus online crisis response.
Below are traditional crisis and strategic communications firms, listed alphabetically and unranked. We do not score them. Each describes its own work on its own site, so check that it has experience with your regulator and your type of institution.
Brunswick Group
Describes itself as a global advisory firm that helps organizations build relationships with their key stakeholders, including under high-pressure, high-stakes conditions (https://www.brunswickgroup.com).
brunswickgroup.comDezenhall Resources
Describes itself as a public affairs and crisis management firm, with a Washington, D.C. address listed (https://www.dezenhall.com).
dezenhall.comFTI Consulting Strategic Communications
FTI's Strategic Communications practice says it advises large organizations through complex moments of opportunity, change and geopolitical risk (https://www.fticonsulting.com/services/strategic-communications).
fticonsulting.com/services/strategic-communicationsJoele Frank, Wilkinson Brimmer Katcher
Describes itself as a strategic communications firm that helps clients in their most critical moments, with offices in New York and San Francisco (https://www.joelefrank.com).
joelefrank.comKekst CNC
Describes itself as a global strategic communications firm that helps protect and enhance client reputations, with Crisis and Issues Management listed as an expertise (https://www.kekstcnc.com).
kekstcnc.comSitrick and Company
Says it focuses on corporate, financial, transactional and crisis communications, with offices in Los Angeles, New York and Washington, D.C. (https://www.sitrick.com).
sitrick.comListed alphabetically, not ranked. Descriptions summarize each firm's own site, accessed November 9, 2026.
For the online half, firms are scored on a sheet we publish. See the best crisis management firms for online crises. If the crisis is about a named executive, the best reputation management companies for executives scores firms on that case.
Banks and listed companies in the city can compare the best reputation management companies in New York.
How a Bank Should Communicate a Data Breach
Secure the systems, tell the people the law says to tell, then tell customers plainly. A simple sequence works for any financial firm.
Contain and preserve
Fix the cause and keep the evidence. Bring in forensic and legal help and do not shut systems down before forensic experts arrive.
Decide who must be told
Regulators, law enforcement, partners whose data you hold, and credit bureaus where Social Security numbers were taken. Counsel confirms the clocks above.
Write for customers in plain words
A good customer letter covers what happened, what information was involved, what you are doing, what people can do and where to get updates.
Offer real help
Where financial data or Social Security numbers were exposed, offer at least a year of free credit monitoring or identity restoration.
Keep one page of updates
Post plain answers to likely questions and say how you will contact people in future, so they can spot fake messages.
Do not give attackers a map
Share what helps people protect themselves. Do not publish details that raise their risk.
Our companion guide, data breach and recall crisis communication, adds the say and repair sequence for breaches outside finance.
Hospitals face a parallel duty, covered in the guide on healthcare crisis communication.
What Can and Cannot Come Down from Search
Regulator releases, court records and accurate news coverage cannot be removed by any firm. Content that breaks a platform's written rules can be reported.
What an online firm can help with
- Reporting private customer data that has been posted
- Reporting impersonation and spam pages that use your name
- Reporting reviews from people who were never customers, where a platform's policy covers it
- Publishing accurate statement and update pages that search can show
- Watching for new damaging pages so you see them early
What nobody can do
- Remove an SEC filing or a regulator's press release
- Remove accurate news coverage of a real incident on request
- Promise a result before reading each page and its platform's rules
- Change what an AI tool says directly, as opposed to improving what it can draw on
Reputation Resolutions offers reputation repair services for companies that need the online half handled. Its pitch: results-based services for repairing, improving and protecting online reputations on Google and AI. Payment is only required after results are achieved. It is A+ BBB Accredited, has been in business since 2013 and serves clients in 40+ countries. Removals typically take 30 to 60 days, and any outcome depends on the content and the platform's rules.
A practice facing the same limits can compare the best reputation management for law firms.
Best Practices for Financial Crisis Communications
These are the habits that separate a controlled response from a messy one.
- Write the plan before the incident, with names, phone numbers and holding statements
- Keep one list of who is told what, and in which order
- Let counsel set the timing for every statement to regulators and investors
- Never tell a reporter or a large client something the market has not heard
- Use plain words with customers and avoid legal phrasing they cannot parse
- Keep one public page where the latest facts live
- Rehearse once a year, including a drill that adds a search and social media check
- After the incident, publish a short account of what was fixed
The general method for the first hour and first week is in our guide to crisis communication best practices. This page adds the financial and legal layer on top.
Anthony Will
Founder and CEO, Reputation Resolutions
Anthony Will founded Reputation Resolutions, the publisher of this site, and has worked in online reputation management since 2013. He reviews the methodology and every scoring change.