Ask HN: rules for storing banking info?

There are a lot of rumors about rules that companies must abide by security-wise to store banking information - say, checking account and routing numbers. It's very difficult to dig up anything factual on the matter, though.

It seems to me that it must work one of three ways:

1.) The government provides a set of security standards which must be met to legally store banking information.

2.) Banks provide security standards which must be met to retain their business.

3.) There are no specific standards, but you are liable to be sued for any breech in security.

I know how important it is to have near impenetrable security when storing important information. I'm looking specifically to demystify the legal end of things. Have I hit the target with one of these three theories?