diff --git a/CHANGELOG.md b/CHANGELOG.md
index c0d5021e..a64e9b32 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ For more information about each release including git tags and artifacts, see [R
 
 ## [Unreleased]
 
+### Added
+
+- Setting to add media from accepted NCMEC reports to a hash bank ([#1208](https://github.com/roostorg/coop/pull/1208) by [@maarkN](https://github.com/maarkN), closes [#196](https://github.com/roostorg/coop/issues/196))
+
 ## [1.1.0] - 2026-09-29
 
 ### Added
diff --git a/client/src/graphql/generated.ts b/client/src/graphql/generated.ts
index c3ac37ae..3d93045e 100644
--- a/client/src/graphql/generated.ts
+++ b/client/src/graphql/generated.ts
@@ -3153,6 +3153,7 @@ export type GQLNcmecOrgSettings = {
   readonly ncmecAdditionalInfoEndpoint?: Maybe<Scalars['String']['output']>;
   readonly ncmecPreservationEndpoint?: Maybe<Scalars['String']['output']>;
   readonly password: Scalars['String']['output'];
+  readonly reportedMediaHashBankId?: Maybe<Scalars['Int']['output']>;
   readonly termsOfService?: Maybe<Scalars['String']['output']>;
   readonly username: Scalars['String']['output'];
 };
@@ -3173,6 +3174,7 @@ export type GQLNcmecOrgSettingsInput = {
   readonly ncmecAdditionalInfoEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly ncmecPreservationEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly password: Scalars['String']['input'];
+  readonly reportedMediaHashBankId?: InputMaybe<Scalars['Int']['input']>;
   readonly termsOfService?: InputMaybe<Scalars['String']['input']>;
   readonly username: Scalars['String']['input'];
 };
@@ -25065,7 +25067,13 @@ export type GQLNcmecOrgSettingsQuery = {
     readonly contactPersonPhone?: string | null;
     readonly mediaReviewRequirement?: GQLNcmecMediaReviewRequirement | null;
     readonly minMediaToReview?: number | null;
+    readonly reportedMediaHashBankId?: number | null;
   } | null;
+  readonly hashBanks: ReadonlyArray<{
+    readonly __typename: 'HashBank';
+    readonly id: string;
+    readonly name: string;
+  }>;
   readonly myOrg?: {
     readonly __typename: 'Org';
     readonly hasNCMECReportingEnabled: boolean;
@@ -44318,6 +44326,11 @@ export const GQLNcmecOrgSettingsDocument = gql`
       contactPersonPhone
       mediaReviewRequirement
       minMediaToReview
+      reportedMediaHashBankId
+    }
+    hashBanks {
+      id
+      name
     }
     myOrg {
       hasNCMECReportingEnabled
diff --git a/client/src/webpages/settings/NCMECSettings.tsx b/client/src/webpages/settings/NCMECSettings.tsx
index 1fd50124..f4390e5d 100644
--- a/client/src/webpages/settings/NCMECSettings.tsx
+++ b/client/src/webpages/settings/NCMECSettings.tsx
@@ -48,6 +48,11 @@ gql`
       contactPersonPhone
       mediaReviewRequirement
       minMediaToReview
+      reportedMediaHashBankId
+    }
+    hashBanks {
+      id
+      name
     }
     myOrg {
       hasNCMECReportingEnabled
@@ -83,6 +88,7 @@ type NcmecSettings = {
   contactPersonPhone: string;
   mediaReviewRequirement: GQLNcmecMediaReviewRequirement;
   minMediaToReview: string;
+  reportedMediaHashBankId: string;
 };
 
 export default function NCMECSettings() {
@@ -104,6 +110,7 @@ export default function NCMECSettings() {
     contactPersonPhone: '',
     mediaReviewRequirement: GQLNcmecMediaReviewRequirement.All,
     minMediaToReview: '1',
+    reportedMediaHashBankId: '',
   });
 
   const { loading, error, data } = useGQLNcmecOrgSettingsQuery({
@@ -149,6 +156,8 @@ export default function NCMECSettings() {
           data.ncmecOrgSettings.mediaReviewRequirement ??
           GQLNcmecMediaReviewRequirement.All,
         minMediaToReview: String(data.ncmecOrgSettings.minMediaToReview ?? 1),
+        reportedMediaHashBankId:
+          data.ncmecOrgSettings.reportedMediaHashBankId?.toString() ?? '',
       });
     }
   }, [data?.ncmecOrgSettings]);
@@ -237,6 +246,9 @@ export default function NCMECSettings() {
           contactPersonPhone: settings.contactPersonPhone || null,
           mediaReviewRequirement: settings.mediaReviewRequirement,
           minMediaToReview: isMinimumPolicy ? parsedMinMedia : null,
+          reportedMediaHashBankId: settings.reportedMediaHashBankId
+            ? Number(settings.reportedMediaHashBankId)
+            : null,
         },
       },
     });
@@ -573,6 +585,43 @@ export default function NCMECSettings() {
             </Text>
           </div>
 
+          <div className="flex flex-col gap-2">
+            <Label
+              htmlFor="reportedMediaHashBankId"
+              className="text-sm font-medium"
+            >
+              Hash bank for reported media
+            </Label>
+            <Select
+              value={settings.reportedMediaHashBankId || '__none__'}
+              onValueChange={(value) =>
+                setSettings({
+                  ...settings,
+                  reportedMediaHashBankId: value === '__none__' ? '' : value,
+                })
+              }
+            >
+              <SelectTrigger id="reportedMediaHashBankId">
+                <SelectValue placeholder="Don't add reported media to a bank" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="__none__">
+                  Don&apos;t add reported media to a bank
+                </SelectItem>
+                {(data?.hashBanks ?? []).map((bank) => (
+                  <SelectItem key={bank.id} value={bank.id}>
+                    {bank.name}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <Text size="XS" className="text-gray-500">
+              Media from each report accepted by NCMEC is added to this bank so
+              it can be matched if it is uploaded again. Only applies when
+              reports are sent to the NCMEC production endpoint.
+            </Text>
+          </div>
+
           <div className="flex flex-col gap-2">
             <Label
               htmlFor="defaultInternetDetailType"
diff --git a/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql b/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
new file mode 100644
index 00000000..cf3a046d
--- /dev/null
+++ b/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
@@ -0,0 +1,16 @@
+ALTER TABLE ncmec_reporting.ncmec_org_settings
+  ADD COLUMN IF NOT EXISTS reported_media_hash_bank_id integer NULL;
+
+DO $$
+BEGIN
+  ALTER TABLE ncmec_reporting.ncmec_org_settings
+    ADD CONSTRAINT ncmec_org_settings_reported_media_hash_bank_fkey
+    FOREIGN KEY (reported_media_hash_bank_id)
+    REFERENCES public.hash_banks(id)
+    ON DELETE SET NULL;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+COMMENT ON COLUMN ncmec_reporting.ncmec_org_settings.reported_media_hash_bank_id IS
+  'When set, media from accepted production NCMEC reports is added to this hash bank.';
diff --git a/docs/development/local.md b/docs/development/local.md
index e56fbc3c..4fa23405 100644
--- a/docs/development/local.md
+++ b/docs/development/local.md
@@ -164,6 +164,14 @@ npm run runWorkerOrJob ItemProcessingWorker
 
 Without this running, submitted items will be enqueued in Redis but not processed. Other available workers/jobs can be found in `server/iocContainer/services/workersAndJobs.ts`.
 
+Media from accepted NCMEC reports is added to the configured hash bank by
+another worker, which you only need when working on that flow:
+
+```sh
+cd server
+npm run runWorkerOrJob ReportedMediaBankingWorker
+```
+
 To preview emails locally without configuring SES or SendGrid, add the
 following to `server/.env`. The recipient, subject, and rendered content will
 be printed in the server terminal. This transport requires
diff --git a/docs/integrations/ncmec.md b/docs/integrations/ncmec.md
index 20b6b56a..29e160fc 100644
--- a/docs/integrations/ncmec.md
+++ b/docs/integrations/ncmec.md
@@ -45,6 +45,7 @@ Configure NCMEC reporting under **Settings** → **NCMEC Settings**.
 | **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                           |
 | **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                         |
 | **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                            |
+| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Only applies to [production submissions](#test-vs-production-submissions).                                                      |
 | **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                    |
 | **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data. |
 | **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                        |
diff --git a/server/graphql/generated.ts b/server/graphql/generated.ts
index c55ead18..ed0c5832 100644
--- a/server/graphql/generated.ts
+++ b/server/graphql/generated.ts
@@ -3223,6 +3223,7 @@ export type GQLNcmecOrgSettings = {
   readonly ncmecAdditionalInfoEndpoint?: Maybe<Scalars['String']['output']>;
   readonly ncmecPreservationEndpoint?: Maybe<Scalars['String']['output']>;
   readonly password: Scalars['String']['output'];
+  readonly reportedMediaHashBankId?: Maybe<Scalars['Int']['output']>;
   readonly termsOfService?: Maybe<Scalars['String']['output']>;
   readonly username: Scalars['String']['output'];
 };
@@ -3243,6 +3244,7 @@ export type GQLNcmecOrgSettingsInput = {
   readonly ncmecAdditionalInfoEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly ncmecPreservationEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly password: Scalars['String']['input'];
+  readonly reportedMediaHashBankId?: InputMaybe<Scalars['Int']['input']>;
   readonly termsOfService?: InputMaybe<Scalars['String']['input']>;
   readonly username: Scalars['String']['input'];
 };
@@ -11878,6 +11880,11 @@ export type GQLNcmecOrgSettingsResolvers<
     ContextType
   >;
   password?: Resolver<GQLResolversTypes['String'], ParentType, ContextType>;
+  reportedMediaHashBankId?: Resolver<
+    Maybe<GQLResolversTypes['Int']>,
+    ParentType,
+    ContextType
+  >;
   termsOfService?: Resolver<
     Maybe<GQLResolversTypes['String']>,
     ParentType,
diff --git a/server/graphql/modules/ncmec.ts b/server/graphql/modules/ncmec.ts
index d77d3d43..54bab1a5 100644
--- a/server/graphql/modules/ncmec.ts
+++ b/server/graphql/modules/ncmec.ts
@@ -80,6 +80,7 @@ const typeDefs = /* GraphQL */ `
     contactPersonPhone: String
     mediaReviewRequirement: NcmecMediaReviewRequirement
     minMediaToReview: Int
+    reportedMediaHashBankId: Int
   }
 
   input NcmecOrgSettingsInput {
@@ -100,6 +101,7 @@ const typeDefs = /* GraphQL */ `
     contactPersonPhone: String
     mediaReviewRequirement: NcmecMediaReviewRequirement
     minMediaToReview: Int
+    reportedMediaHashBankId: Int
   }
 
   type UpdateNcmecOrgSettingsResponse {
@@ -344,6 +346,19 @@ const Mutation: GQLMutationResolvers = {
     const { mediaReviewRequirement, minMediaToReview } =
       parseMediaReviewPolicy(input);
 
+    const reportedMediaHashBankId = input.reportedMediaHashBankId ?? null;
+
+    if (reportedMediaHashBankId !== null) {
+      const bank = await context.services.HMAHashBankService.getBankById(
+        user.orgId,
+        reportedMediaHashBankId,
+      );
+
+      if (!bank) {
+        throw userInputError('Selected hash bank was not found.');
+      }
+    }
+
     await context.services.NcmecService.updateNcmecOrgSettings({
       orgId: user.orgId,
       username,
@@ -363,6 +378,7 @@ const Mutation: GQLMutationResolvers = {
       contactPersonPhone: input.contactPersonPhone ?? null,
       mediaReviewRequirement,
       minMediaToReview,
+      reportedMediaHashBankId,
     });
 
     return { success: true };
diff --git a/server/graphql/modules/ncmecOrgSettingsValidation.ts b/server/graphql/modules/ncmecOrgSettingsValidation.ts
index 9d5ee4da..53ca21d1 100644
--- a/server/graphql/modules/ncmecOrgSettingsValidation.ts
+++ b/server/graphql/modules/ncmecOrgSettingsValidation.ts
@@ -20,6 +20,7 @@ export type NcmecOrgSettingsInputShape = {
   contactPersonPhone?: string | null;
   mediaReviewRequirement?: string | null;
   minMediaToReview?: number | null;
+  reportedMediaHashBankId?: number | null;
 };
 
 const VALID_NCMEC_MEDIA_REVIEW_REQUIREMENTS = ['ALL', 'MINIMUM'] as const;
diff --git a/server/iocContainer/index.ts b/server/iocContainer/index.ts
index bc2a0adb..e27cfe55 100644
--- a/server/iocContainer/index.ts
+++ b/server/iocContainer/index.ts
@@ -34,6 +34,10 @@ import {
   makeItemSubmissionBulkWrite,
   type ItemSubmissionBulkWrite,
 } from '../queues/itemSubmissionQueue.js';
+import {
+  makeReportedMediaBankingEnqueue,
+  type ReportedMediaBankingEnqueue,
+} from '../queues/reportedMediaBankingQueue.js';
 import makeActionPublisher, {
   type ActionPublisher,
   type ActionTargetItem,
@@ -351,6 +355,8 @@ export interface Dependencies {
 
   itemSubmissionQueueBulkWrite: ItemSubmissionBulkWrite;
   itemSubmissionRetryQueueBulkWrite: ItemSubmissionBulkWrite;
+  /** Enqueues media of accepted NCMEC reports for hash banking. */
+  reportedMediaBankingEnqueue: ReportedMediaBankingEnqueue;
   IORedis: IORedis.Redis | Cluster;
   /**
    * Dedicated ioredis client for the items-async enqueue path. Same Redis
@@ -743,6 +749,11 @@ export default async function getBottle(
   bottle.factory('itemSubmissionRetryQueueBulkWrite', (container) =>
     makeItemSubmissionBulkWrite(container.IORedis, ITEM_SUBMISSION_DLQ_NAME),
   );
+  // Enqueued from the NCMEC submission path, so a Redis outage has to fail
+  // fast instead of buffering and holding up an accepted report.
+  bottle.factory('reportedMediaBankingEnqueue', (container) =>
+    makeReportedMediaBankingEnqueue(container.IORedisEnqueueNoBuffer),
+  );
 
   // Loggers
   register(bottle, 'RuleExecutionLogger', makeRuleExecutionLogger);
@@ -1796,6 +1807,7 @@ export default async function getBottle(
             'Scylla',
             'itemSubmissionQueueBulkWrite',
             'itemSubmissionRetryQueueBulkWrite',
+            'reportedMediaBankingEnqueue',
             'IORedis',
             'IORedisEnqueueNoBuffer',
             // Storage abstractions
diff --git a/server/iocContainer/services/workersAndJobs.ts b/server/iocContainer/services/workersAndJobs.ts
index e172290d..18e36b33 100644
--- a/server/iocContainer/services/workersAndJobs.ts
+++ b/server/iocContainer/services/workersAndJobs.ts
@@ -9,6 +9,7 @@ import {
 } from '../../workers_jobs/index.js';
 import makeItemProcessingWorker from '../../workers_jobs/ItemProcessingWorker.js';
 import makeRefreshMRTDecisionsMaterializedViewJob from '../../workers_jobs/RefreshMRTDecisionsMaterializedViewJob.js';
+import makeReportedMediaBankingWorker from '../../workers_jobs/ReportedMediaBankingWorker.js';
 import makeRetryFailedNcmecDecisionsJob from '../../workers_jobs/RetryFailedNcmecDecisionsJob.js';
 import makeRunUserRulesJob from '../../workers_jobs/RunUserRulesJob.js';
 import { type Dependencies } from '../index.js';
@@ -19,6 +20,7 @@ declare module '../index.js' {
     // NB: worker deps cannot be renamed
     // w/o breaking the deployment that starts them!
     ItemProcessingWorker: Worker;
+    ReportedMediaBankingWorker: Worker;
 
     // Jobs. Like workers, can't be renamed w/o breaking stuff.
     // The distinction between jobs and workers is that workers run continuously,
@@ -34,6 +36,7 @@ declare module '../index.js' {
 
 const workerAndJobFactories = {
   ItemProcessingWorker: makeItemProcessingWorker,
+  ReportedMediaBankingWorker: makeReportedMediaBankingWorker,
   RunUserRulesJob: makeRunUserRulesJob,
   RefreshMRTDecisionsMaterializedViewJob:
     makeRefreshMRTDecisionsMaterializedViewJob,
diff --git a/server/queues/reportedMediaBankingQueue.ts b/server/queues/reportedMediaBankingQueue.ts
new file mode 100644
index 00000000..86da4bed
--- /dev/null
+++ b/server/queues/reportedMediaBankingQueue.ts
@@ -0,0 +1,87 @@
+import { Queue } from 'bullmq';
+import type IORedis from 'ioredis';
+import { type Cluster } from 'ioredis';
+
+import { jsonStringify } from '../utils/encoding.js';
+import { logErrorJson } from '../utils/logging.js';
+
+export const REPORTED_MEDIA_BANKING_QUEUE_NAME = 'reported-media-banking';
+
+/** One media item of an accepted NCMEC report, to be added to the org's hash
+ * bank. One job per item, so a failure retries only that item. */
+export type ReportedMediaBankingJobData = {
+  orgId: string;
+  hashBankId: number;
+  ncmecReportId: string;
+  itemId: string;
+  itemTypeId: string;
+  url: string;
+};
+
+/** The enqueue call, without the queue lifecycle the container owns. */
+export type ReportedMediaBankingEnqueueFn = (
+  jobs: readonly ReportedMediaBankingJobData[],
+) => Promise<void>;
+
+type RedisConnection = IORedis.Redis | Cluster;
+
+/** Factory for the function that enqueues reported media for banking. */
+function makeReportedMediaBankingEnqueue(redis: RedisConnection) {
+  let queue: Queue<ReportedMediaBankingJobData> | undefined;
+
+  // Built on first use: creating it opens a Redis connection, and most
+  // processes that depend on this service never enqueue anything.
+  function getQueue() {
+    if (queue === undefined) {
+      queue = new Queue<ReportedMediaBankingJobData>(
+        REPORTED_MEDIA_BANKING_QUEUE_NAME,
+        { connection: redis },
+      );
+      // BullMQ re-emits Redis connection errors, and an 'error' event with no
+      // listener takes the process down. Enqueue failures still reject below.
+      queue.on('error', (error) => {
+        // eslint-disable-next-line no-restricted-syntax
+        logErrorJson({
+          error,
+          message: jsonStringify({
+            event: 'reportedMediaBankingQueueError',
+            queue: REPORTED_MEDIA_BANKING_QUEUE_NAME,
+          }),
+        });
+      });
+    }
+    return queue;
+  }
+
+  async function reportedMediaBankingEnqueue(
+    jobs: readonly ReportedMediaBankingJobData[],
+  ) {
+    if (jobs.length === 0) {
+      return;
+    }
+    await getQueue().addBulk(
+      jobs.map((data) => ({
+        name: REPORTED_MEDIA_BANKING_QUEUE_NAME,
+        data,
+        opts: {
+          attempts: 5,
+          backoff: { type: 'exponential', delay: 1000 },
+          removeOnComplete: { count: 0 },
+          removeOnFail: { count: 1000 },
+        },
+      })),
+    );
+  }
+
+  reportedMediaBankingEnqueue.close = async () => {
+    await queue?.close();
+  };
+
+  return reportedMediaBankingEnqueue;
+}
+
+export type ReportedMediaBankingEnqueue = ReturnType<
+  typeof makeReportedMediaBankingEnqueue
+>;
+
+export { makeReportedMediaBankingEnqueue };
diff --git a/server/services/hmaService/index.test.ts b/server/services/hmaService/index.test.ts
index d907fbea..14ca57a6 100644
--- a/server/services/hmaService/index.test.ts
+++ b/server/services/hmaService/index.test.ts
@@ -385,4 +385,210 @@ describe('HmaService', () => {
       expect(result.credentials_schema).toBeNull();
     });
   });
+
+  describe('addContentToBank', () => {
+    it('sends the url as a query param and the metadata in the JSON body', async () => {
+      const fetchHTTP = vi
+        .fn()
+        .mockResolvedValue(ok({ id: 7, signals: { pdq: 'abc' } }));
+      const svc = makeService(fetchHTTP);
+
+      const result = await svc.addContentToBank('COOP_ORG1_BANK', {
+        url: 'https://cdn.example.com/a.jpg?sig=1',
+        metadata: {
+          content_id: 'type1:item1',
+          json: { source: 'ncmec_report' },
+        },
+      });
+
+      expect(result).toEqual({ id: 7, signals: { pdq: 'abc' } });
+      expect(fetchHTTP).toHaveBeenCalledTimes(1);
+      const call = fetchHTTP.mock.calls[0][0];
+      const url = new URL(call.url);
+      expect(url.pathname).toMatch(/\/c\/bank\/COOP_ORG1_BANK\/content$/);
+      expect([...url.searchParams.keys()]).toEqual(['url']);
+      expect(url.searchParams.get('url')).toBe(
+        'https://cdn.example.com/a.jpg?sig=1',
+      );
+      expect(call.method).toBe('post');
+      expect(call.headers).toEqual({ 'Content-Type': 'application/json' });
+      expect(jsonParse(call.body)).toEqual({
+        metadata: {
+          content_id: 'type1:item1',
+          json: { source: 'ncmec_report' },
+        },
+      });
+    });
+
+    it('throws when HMA rejects the content', async () => {
+      const fetchHTTP = vi.fn().mockResolvedValue(fail(400));
+      const svc = makeService(fetchHTTP);
+
+      await expect(
+        svc.addContentToBank('COOP_ORG1_BANK', {
+          url: 'https://cdn.example.com/a.jpg',
+        }),
+      ).rejects.toThrow('Failed to add content to bank: 400');
+    });
+
+    describe('note', () => {
+      const URL_OPTIONS = { url: 'https://cdn.example.com/a.jpg' };
+
+      function makeOkService() {
+        const fetchHTTP = vi
+          .fn()
+          .mockResolvedValue(ok({ id: 7, signals: { pdq: 'abc' } }));
+        return { fetchHTTP, svc: makeService(fetchHTTP) };
+      }
+
+      it('sends the note next to the metadata in the JSON body', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          metadata: { content_id: 'type1:item1' },
+          note: 'Reported to NCMEC',
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          metadata: { content_id: 'type1:item1' },
+          note: 'Reported to NCMEC',
+        });
+      });
+
+      it('sends a JSON body with only the note when there is no metadata', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: 'Reported to NCMEC',
+        });
+
+        const call = fetchHTTP.mock.calls[0][0];
+        expect(call.headers).toEqual({ 'Content-Type': 'application/json' });
+        expect(jsonParse(call.body)).toEqual({ note: 'Reported to NCMEC' });
+      });
+
+      it('sends no body and no JSON content type without metadata or note', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', URL_OPTIONS);
+
+        const call = fetchHTTP.mock.calls[0][0];
+        expect(call.body).toBeUndefined();
+        expect(call.headers).toBeUndefined();
+      });
+
+      it('does not send an empty note, since HMA treats it as no note', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          metadata: { content_id: 'type1:item1' },
+          note: '',
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          metadata: { content_id: 'type1:item1' },
+        });
+      });
+
+      it('does not send a note with only whitespace', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          metadata: { content_id: 'type1:item1' },
+          note: '   ',
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          metadata: { content_id: 'type1:item1' },
+        });
+      });
+
+      it('does not append a note with only whitespace on file uploads', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          file: new Blob(['bytes'], { type: 'image/png' }),
+          contentType: 'photo',
+          note: ' \n\t ',
+        });
+
+        const form = fetchHTTP.mock.calls[0][0].body as FormData;
+        expect(form.has('note')).toBe(false);
+      });
+
+      it('accepts a note with exactly 255 characters', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+        const note = 'a'.repeat(255);
+
+        await svc.addContentToBank('COOP_ORG1_BANK', { ...URL_OPTIONS, note });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({ note });
+      });
+
+      it('cuts a note longer than 255 characters instead of failing the add', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: 'a'.repeat(256),
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          note: 'a'.repeat(255),
+        });
+      });
+
+      it('counts characters like HMA does, so 255 emoji go through whole', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: '🚩'.repeat(255),
+        });
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          note: '🚩'.repeat(255),
+        });
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: '🚩'.repeat(256),
+        });
+        // Cut by code point, so the last emoji is dropped whole rather than
+        // leaving half a surrogate pair behind.
+        expect(jsonParse(fetchHTTP.mock.calls[1][0].body)).toEqual({
+          note: '🚩'.repeat(255),
+        });
+      });
+
+      it('appends the note to the form data on file uploads', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          file: new Blob(['bytes'], { type: 'image/png' }),
+          contentType: 'photo',
+          note: 'Reported to NCMEC',
+        });
+
+        const form = fetchHTTP.mock.calls[0][0].body as FormData;
+        expect(form.get('note')).toBe('Reported to NCMEC');
+      });
+
+      it('does not append an empty note on file uploads', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          file: new Blob(['bytes'], { type: 'image/png' }),
+          contentType: 'photo',
+          note: '',
+        });
+
+        const form = fetchHTTP.mock.calls[0][0].body as FormData;
+        expect(form.has('note')).toBe(false);
+      });
+    });
+  });
 });
diff --git a/server/services/hmaService/index.ts b/server/services/hmaService/index.ts
index be81a152..deed57fb 100644
--- a/server/services/hmaService/index.ts
+++ b/server/services/hmaService/index.ts
@@ -802,9 +802,11 @@ export class HmaService {
         content_uri?: string;
         json?: Record<string, unknown>;
       };
+      note?: string;
     },
   ): Promise<BankContentResponse> {
     const { file, contentType, url, metadata } = options;
+    const note = toHmaNote(options.note);
 
     if (!url && (!file || !contentType)) {
       throw new Error(
@@ -814,21 +816,22 @@ export class HmaService {
 
     let response;
     if (url) {
-      // URL-based content
-      const params = new URLSearchParams();
-      params.append('url', url);
-      if (metadata) {
-        if (metadata.content_id)
-          params.append('content_id', metadata.content_id);
-        if (metadata.content_uri)
-          params.append('content_uri', metadata.content_uri);
-        if (metadata.json)
-          params.append('metadata', jsonStringify(metadata.json));
+      // HMA reads `metadata` from the JSON body only; query-param metadata is dropped.
+      const params = new URLSearchParams({ url });
+      let body: string | undefined;
+      if (metadata || note) {
+        body = jsonStringify({
+          ...(metadata ? { metadata } : {}),
+          ...(note ? { note } : {}),
+        });
       }
 
       response = await this.fetchHTTP({
         url: `${this.hmaServiceUrl}/c/bank/${bankName}/content?${params.toString()}`,
         method: 'post',
+        ...(body !== undefined
+          ? { body, headers: { 'Content-Type': 'application/json' } }
+          : {}),
         handleResponseBody: 'as-json',
       });
     } else {
@@ -849,6 +852,8 @@ export class HmaService {
           formData.append('metadata', jsonStringify(metadata.json));
       }
 
+      if (note) formData.append('note', note);
+
       response = await this.fetchHTTP({
         url: `${this.hmaServiceUrl}/c/bank/${bankName}/content`,
         method: 'post',
@@ -950,4 +955,13 @@ export class HmaService {
   }
 }
 
+function toHmaNote(note: string | undefined): string | undefined {
+  if (!note?.trim()) {
+    return undefined;
+  }
+  // HMA counts code points (Python len), not UTF-16 units, truncate to 255 to avoid exceeding the limit.
+  const codePoints = [...note];
+  return codePoints.length > 255 ? codePoints.slice(0, 255).join('') : note;
+}
+
 export default inject(['fetchHTTP', 'KyselyPg'], HmaService);
diff --git a/server/services/ncmecService/dbTypes.ts b/server/services/ncmecService/dbTypes.ts
index a26c57f7..0c8d581e 100644
--- a/server/services/ncmecService/dbTypes.ts
+++ b/server/services/ncmecService/dbTypes.ts
@@ -27,6 +27,7 @@ export type NcmecReportingServicePg = {
     contact_person_phone?: string | null;
     media_review_requirement?: 'ALL' | 'MINIMUM';
     min_media_to_review?: number | null;
+    reported_media_hash_bank_id?: number | null;
     created_at: GeneratedAlways<Date>;
     updated_at: GeneratedAlways<Date>;
   } & (
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index c5e388b7..5981e281 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -8,6 +8,7 @@ import { FormData } from 'undici';
 import { js2xml } from 'xml-js';
 
 import { type Dependencies } from '../../iocContainer/index.js';
+import { type ReportedMediaBankingEnqueueFn } from '../../queues/reportedMediaBankingQueue.js';
 import { jsonStringify } from '../../utils/encoding.js';
 import { type JSONSchemaV4 } from '../../utils/json-schema-types.js';
 import { type FixKyselyRowCorrelation } from '../../utils/kysely.js';
@@ -1391,6 +1392,7 @@ export default class NcmecReporting {
     private moderationConfigService: Dependencies['ModerationConfigService'],
     private getItemTypeEventuallyConsistent: Dependencies['getItemTypeEventuallyConsistent'],
     private readonly tracer: Dependencies['Tracer'],
+    private readonly reportedMediaBankingEnqueue: ReportedMediaBankingEnqueueFn,
   ) {}
   async hasNCMECReportingEnabled(orgId: string) {
     const ncmecOrgSettings = await this.pgQuery
@@ -2072,6 +2074,41 @@ export default class NcmecReporting {
               reportId: parseInt(reportId),
             });
           }
+
+          const reportedMediaHashBankId =
+            ncmecConfig?.reported_media_hash_bank_id;
+
+          if (
+            reportedMediaHashBankId != null &&
+            reportParams.media.length > 0 &&
+            isTest === false
+          ) {
+            // Banking runs in its own worker. Enqueueing must never fail an
+            // accepted report, so a Redis outage is logged and dropped here.
+            try {
+              await this.reportedMediaBankingEnqueue(
+                reportParams.media.map((media) => ({
+                  orgId: reportParams.orgId,
+                  hashBankId: reportedMediaHashBankId,
+                  ncmecReportId: reportId,
+                  itemId: media.id,
+                  itemTypeId: media.typeId,
+                  url: media.url,
+                })),
+              );
+            } catch (e) {
+              // eslint-disable-next-line no-restricted-syntax
+              logErrorJson({
+                error: e,
+                message: jsonStringify({
+                  event: 'ncmecReportedMediaBankingEnqueueFailed',
+                  orgId: reportParams.orgId,
+                  ncmecReportId: reportId,
+                  hashBankId: reportedMediaHashBankId,
+                }),
+              });
+            }
+          }
           return 'SUCCESS';
         } catch (e) {
           // We are intentionally using logErrorJson instead of relying on
diff --git a/server/services/ncmecService/ncmecService.ts b/server/services/ncmecService/ncmecService.ts
index 7ccfc074..05c6382d 100644
--- a/server/services/ncmecService/ncmecService.ts
+++ b/server/services/ncmecService/ncmecService.ts
@@ -4,6 +4,7 @@ import { sql, type Kysely } from 'kysely';
 
 import { type Dependencies } from '../../iocContainer/index.js';
 import { inject } from '../../iocContainer/utils.js';
+import { type ReportedMediaBankingEnqueueFn } from '../../queues/reportedMediaBankingQueue.js';
 import { type ActionExecutionCorrelationId } from '../analyticsLoggers/ActionExecutionLogger.js';
 import { type RuleExecutionCorrelationId } from '../analyticsLoggers/ruleExecutionLoggingUtils.js';
 import { type ItemSubmissionWithTypeIdentifier } from '../itemProcessingService/makeItemSubmissionWithTypeIdentifier.js';
@@ -39,6 +40,7 @@ export class NcmecService {
     readonly tracer: Dependencies['Tracer'],
     readonly itemInvestigationService: Dependencies['ItemInvestigationService'],
     readonly getItemTypeEventuallyConsistent: Dependencies['getItemTypeEventuallyConsistent'],
+    readonly reportedMediaBankingEnqueue: ReportedMediaBankingEnqueueFn,
   ) {
     this.ncmecReporting = new NcmecReporting(
       pgQuery,
@@ -48,6 +50,7 @@ export class NcmecService {
       moderationConfigService,
       getItemTypeEventuallyConsistent,
       tracer,
+      reportedMediaBankingEnqueue,
     );
     this.ncmecEnqueueToMrt = new NcmecEnqueueToMrt(
       partialItemsService,
@@ -239,6 +242,7 @@ export class NcmecService {
         'contact_person_phone as contactPersonPhone',
         'media_review_requirement as mediaReviewRequirement',
         'min_media_to_review as minMediaToReview',
+        'reported_media_hash_bank_id as reportedMediaHashBankId',
       ])
       .where('org_id', '=', orgId)
       .executeTakeFirst();
@@ -265,6 +269,7 @@ export class NcmecService {
     contactPersonPhone: string | null;
     mediaReviewRequirement: 'ALL' | 'MINIMUM';
     minMediaToReview: number | null;
+    reportedMediaHashBankId: number | null;
   }) {
     await this.pgQuery
       .insertInto('ncmec_reporting.ncmec_org_settings')
@@ -289,6 +294,7 @@ export class NcmecService {
         contact_person_phone: params.contactPersonPhone ?? null,
         media_review_requirement: params.mediaReviewRequirement,
         min_media_to_review: params.minMediaToReview ?? null,
+        reported_media_hash_bank_id: params.reportedMediaHashBankId,
         actions_to_run_upon_report_creation: null,
         policies_applied_to_actions_run_on_report_creation: null,
       })
@@ -314,6 +320,7 @@ export class NcmecService {
           contact_person_phone: params.contactPersonPhone ?? null,
           media_review_requirement: params.mediaReviewRequirement,
           min_media_to_review: params.minMediaToReview ?? null,
+          reported_media_hash_bank_id: params.reportedMediaHashBankId,
         }),
       )
       .execute();
@@ -332,6 +339,7 @@ export default inject(
     'Tracer',
     'ItemInvestigationService',
     'getItemTypeEventuallyConsistent',
+    'reportedMediaBankingEnqueue',
   ],
   NcmecService,
 );
diff --git a/server/test/integ/ncmec-org-settings.integ.test.ts b/server/test/integ/ncmec-org-settings.integ.test.ts
new file mode 100644
index 00000000..e42e7daf
--- /dev/null
+++ b/server/test/integ/ncmec-org-settings.integ.test.ts
@@ -0,0 +1,130 @@
+/**
+ * Integration test: the reported-media hash bank setting is scoped to the
+ * caller's org.
+ *
+ * Goes through the real GraphQL API so the org check is exercised against
+ * Postgres instead of a mocked HMAHashBankService.
+ *
+ * Run with: docker compose run --rm test
+ * Requires: `npm run up && npm run db:update`
+ */
+import { uid } from 'uid';
+
+import { HashBankService } from '../../services/hmaService/index.js';
+import { jsonStringify } from '../../utils/encoding.js';
+import createOrg from '../fixtureHelpers/createOrg.js';
+import createUser from '../fixtureHelpers/createUser.js';
+import {
+  makeIntegrationServer,
+  type IntegrationServer,
+} from './setupIntegrationServer.js';
+
+const ADMIN_PASSWORD = 'integ-admin-password-1';
+
+describe('updateNcmecOrgSettings reported media hash bank (integration)', () => {
+  const orgId = uid();
+  const otherOrgId = uid();
+  let harness: IntegrationServer | undefined;
+  let ownBankId: number;
+  let otherOrgBankId: number;
+  let orgCleanup: (() => Promise<unknown>) | undefined;
+  let otherOrgCleanup: (() => Promise<unknown>) | undefined;
+  let adminCleanup: (() => Promise<unknown>) | undefined;
+
+  beforeAll(async () => {
+    harness = await makeIntegrationServer();
+
+    const orgDeps = {
+      KyselyPg: harness.deps.KyselyPg,
+      ModerationConfigService: harness.deps.ModerationConfigService,
+      ApiKeyService: harness.deps.ApiKeyService,
+    };
+    orgCleanup = (await createOrg(orgDeps, orgId)).cleanup;
+    otherOrgCleanup = (await createOrg(orgDeps, otherOrgId)).cleanup;
+
+    const adminFixture = await createUser(harness.deps.KyselyPg, orgId, {
+      password: ADMIN_PASSWORD,
+      loginMethods: ['password'],
+      approvedByAdmin: true,
+    });
+    adminCleanup = adminFixture.cleanup;
+
+    const hashBanks = new HashBankService(harness.deps.KyselyPg);
+    ownBankId = (
+      await hashBanks.create({
+        name: 'Reported CSAM',
+        hma_name: `COOP_TEST_${uid()}`,
+        enabled_ratio: 1,
+        org_id: orgId,
+      })
+    ).id;
+    otherOrgBankId = (
+      await hashBanks.create({
+        name: 'Someone else reported CSAM',
+        hma_name: `COOP_TEST_${uid()}`,
+        enabled_ratio: 1,
+        org_id: otherOrgId,
+      })
+    ).id;
+
+    const loginRes = await harness.request.post('/api/v1/graphql').send({
+      query: `mutation {
+        login(input: { email: ${jsonStringify(adminFixture.user.email)}, password: ${jsonStringify(ADMIN_PASSWORD)} }) {
+          __typename
+        }
+      }`,
+    });
+    expect(loginRes.body?.data?.login?.__typename).toBe('LoginSuccessResponse');
+  }, 60_000);
+
+  afterAll(async () => {
+    try {
+      await adminCleanup?.();
+      await orgCleanup?.();
+      await otherOrgCleanup?.();
+    } finally {
+      await harness?.shutdown();
+    }
+  }, 30_000);
+
+  const saveBank = async (bankId: number) => {
+    if (!harness) throw new Error('harness was not initialized');
+    return harness.request.post('/api/v1/graphql').send({
+      query: `mutation {
+        updateNcmecOrgSettings(input: {
+          username: "espuser"
+          password: "esppass"
+          contactEmail: "reporter@example.com"
+          reportedMediaHashBankId: ${bankId}
+        }) {
+          success
+        }
+      }`,
+    });
+  };
+
+  const readBankId = async () => {
+    if (!harness) throw new Error('harness was not initialized');
+    const res = await harness.request.post('/api/v1/graphql').send({
+      query: `query { ncmecOrgSettings { reportedMediaHashBankId } }`,
+    });
+    return res.body?.data?.ncmecOrgSettings?.reportedMediaHashBankId ?? null;
+  };
+
+  test('refuses a bank that belongs to another org and saves nothing', async () => {
+    const res = await saveBank(otherOrgBankId);
+
+    expect(res.body?.errors?.[0]?.message).toBe(
+      'Selected hash bank was not found.',
+    );
+    expect(await readBankId()).toBeNull();
+  });
+
+  test('saves a bank that belongs to the org', async () => {
+    const res = await saveBank(ownBankId);
+
+    expect(res.body?.errors).toBeUndefined();
+    expect(res.body?.data?.updateNcmecOrgSettings?.success).toBe(true);
+    expect(await readBankId()).toBe(ownBankId);
+  });
+});
diff --git a/server/test/integ/ncmec-report-submission.integ.test.ts b/server/test/integ/ncmec-report-submission.integ.test.ts
index 02bbc358..01a61ea2 100644
--- a/server/test/integ/ncmec-report-submission.integ.test.ts
+++ b/server/test/integ/ncmec-report-submission.integ.test.ts
@@ -100,6 +100,7 @@ describe('NCMEC report and submission (integration)', () => {
       contactPersonPhone: null,
       mediaReviewRequirement: 'ALL',
       minMediaToReview: null,
+      reportedMediaHashBankId: null,
     });
   }, 60_000);
 
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index b979fcf8..95480c46 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -1,5 +1,8 @@
 import { uid } from 'uid';
+import { vi } from 'vitest';
 
+import { type ReportedMediaBankingEnqueueFn } from '../../queues/reportedMediaBankingQueue.js';
+import { HashBankService } from '../../services/hmaService/index.js';
 import {
   NCMECFileAnnotation,
   NCMECIncidentType,
@@ -7,18 +10,79 @@ import {
   NcmecReporting,
   type NCMECReportParams,
 } from '../../services/ncmecService/index.js';
+import {
+  type CoopRequestQuery,
+  type FetchHTTP,
+  type HandleResponseBody,
+} from '../../services/networkingService/index.js';
 import createOrg from '../fixtureHelpers/createOrg.js';
 import { makeStubFetchHTTP } from '../fixtureHelpers/makeStubFetchHTTP.js';
 import { makeTransactionalTestWithFixture } from '../harness/transactionalTest.js';
+import { type MockedServer } from '../setupMockedServer.js';
 
 const MEDIA_URL = 'https://cdn.example/sample.jpg';
+const SECOND_MEDIA_URL = 'https://cdn.example/clip.mp4';
 const PRESERVATION_URL = 'https://preserve.example/req';
 
+type Deps = MockedServer['deps'];
+
+function makeReporting(
+  deps: Deps,
+  reportId: string,
+  onRequest?: (url: string) => Promise<void>,
+  reportedMediaBankingEnqueue: ReportedMediaBankingEnqueueFn = vi.fn(),
+) {
+  const stub = makeStubFetchHTTP(reportId, 'f1', {
+    preservationUrl: PRESERVATION_URL,
+  });
+  const fetchHTTP: FetchHTTP = async <T extends HandleResponseBody>(
+    query: CoopRequestQuery<T>,
+  ) => {
+    await onRequest?.(query.url);
+    return stub.fetchHTTP(query);
+  };
+  const ncmecReporting = new NcmecReporting(
+    deps.KyselyPg,
+    deps.KyselyPgReadReplica,
+    fetchHTTP,
+    deps.SigningKeyPairService,
+    deps.ModerationConfigService,
+    deps.getItemTypeEventuallyConsistent,
+    deps.Tracer,
+    reportedMediaBankingEnqueue,
+  );
+  return { stub, ncmecReporting, reportedMediaBankingEnqueue };
+}
+
+function reportWithTwoMedia(
+  orgId: string,
+  userItemTypeId: string,
+): NCMECReportParams & { jobId: string } {
+  return {
+    orgId,
+    reviewerId: 'reviewer-1',
+    reportedUser: { id: uid(), typeId: userItemTypeId },
+    media: [MEDIA_URL, SECOND_MEDIA_URL].map((url, i) => ({
+      id: `media-${i + 1}`,
+      typeId: userItemTypeId,
+      url,
+      createdAt: '2026-06-30T12:00:00.000Z',
+      industryClassification: NCMECIndustryClassification.A1,
+      fileAnnotations: [],
+    })),
+    threads: [],
+    incidentType:
+      NCMECIncidentType[
+        'Child Pornography (possession, manufacture, and distribution)'
+      ],
+    jobId: `job-${uid()}`,
+  };
+}
+
 describe('NCMEC submitReport (integration)', () => {
   const testWithFixture = makeTransactionalTestWithFixture(async ({ deps }) => {
     const orgId = uid();
     const reportId = uid();
-    const fileId = 'f1';
 
     const orgFixture = await createOrg(
       {
@@ -29,6 +93,13 @@ describe('NCMEC submitReport (integration)', () => {
       orgId,
     );
 
+    const hashBank = await new HashBankService(deps.KyselyPg).create({
+      name: 'Reported CSAM',
+      hma_name: `COOP_TEST_${uid()}`,
+      enabled_ratio: 1,
+      org_id: orgId,
+    });
+
     await deps.NcmecService.updateNcmecOrgSettings({
       orgId,
       username: 'espuser',
@@ -48,19 +119,12 @@ describe('NCMEC submitReport (integration)', () => {
       contactPersonPhone: null,
       mediaReviewRequirement: 'ALL',
       minMediaToReview: null,
+      reportedMediaHashBankId: hashBank.id,
     });
 
-    const stub = makeStubFetchHTTP(reportId, fileId, {
-      preservationUrl: PRESERVATION_URL,
-    });
-    const ncmecReporting = new NcmecReporting(
-      deps.KyselyPg,
-      deps.KyselyPgReadReplica,
-      stub.fetchHTTP,
-      deps.SigningKeyPairService,
-      deps.ModerationConfigService,
-      deps.getItemTypeEventuallyConsistent,
-      deps.Tracer,
+    const { stub, ncmecReporting, reportedMediaBankingEnqueue } = makeReporting(
+      deps,
+      reportId,
     );
 
     return {
@@ -68,6 +132,8 @@ describe('NCMEC submitReport (integration)', () => {
       reportId,
       stub,
       ncmecReporting,
+      reportedMediaBankingEnqueue,
+      hashBank,
       userItemTypeId: orgFixture.defaultUserItemType.id,
     };
   });
@@ -152,4 +218,141 @@ describe('NCMEC submitReport (integration)', () => {
     },
     60_000,
   );
+  testWithFixture(
+    'enqueues one banking job per reported media item once a production report is accepted',
+    async ({
+      ncmecReporting,
+      reportedMediaBankingEnqueue,
+      orgId,
+      reportId,
+      hashBank,
+      userItemTypeId,
+    }) => {
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        false,
+      );
+
+      expect(result).toBe('SUCCESS');
+      const job = (itemId: string, url: string) => ({
+        orgId,
+        hashBankId: hashBank.id,
+        ncmecReportId: reportId,
+        itemId,
+        itemTypeId: userItemTypeId,
+        url,
+      });
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledTimes(1);
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledWith([
+        job('media-1', MEDIA_URL),
+        job('media-2', SECOND_MEDIA_URL),
+      ]);
+    },
+    60_000,
+  );
+
+  testWithFixture(
+    'uses the bank read before submitting, even if the setting is cleared during submission',
+    async ({ deps, orgId, reportId, hashBank, userItemTypeId }) => {
+      const { ncmecReporting, reportedMediaBankingEnqueue } = makeReporting(
+        deps,
+        reportId,
+        async (url) => {
+          if (url.endsWith('/ispws/submit')) {
+            await deps.KyselyPg.updateTable(
+              'ncmec_reporting.ncmec_org_settings',
+            )
+              .set({ reported_media_hash_bank_id: null })
+              .where('org_id', '=', orgId)
+              .execute();
+          }
+        },
+      );
+
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        false,
+      );
+
+      expect(result).toBe('SUCCESS');
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({ hashBankId: hashBank.id }),
+        ]),
+      );
+    },
+    60_000,
+  );
+
+  testWithFixture(
+    'enqueues nothing when the org has no bank selected',
+    async ({
+      deps,
+      ncmecReporting,
+      reportedMediaBankingEnqueue,
+      orgId,
+      userItemTypeId,
+    }) => {
+      await deps.KyselyPg.updateTable('ncmec_reporting.ncmec_org_settings')
+        .set({ reported_media_hash_bank_id: null })
+        .where('org_id', '=', orgId)
+        .execute();
+
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        false,
+      );
+
+      expect(result).toBe('SUCCESS');
+      expect(reportedMediaBankingEnqueue).not.toHaveBeenCalled();
+    },
+    60_000,
+  );
+
+  testWithFixture(
+    'enqueues nothing for a test submission',
+    async ({
+      ncmecReporting,
+      reportedMediaBankingEnqueue,
+      orgId,
+      userItemTypeId,
+    }) => {
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        true,
+      );
+
+      expect(result).toBe('SUCCESS');
+      expect(reportedMediaBankingEnqueue).not.toHaveBeenCalled();
+    },
+    60_000,
+  );
+
+  testWithFixture(
+    'keeps the report successful when the banking jobs cannot be enqueued',
+    async ({ deps, orgId, reportId, userItemTypeId }) => {
+      const { stub, ncmecReporting, reportedMediaBankingEnqueue } =
+        makeReporting(
+          deps,
+          reportId,
+          undefined,
+          vi.fn().mockRejectedValue(new Error('Redis is down')),
+        );
+      const params = reportWithTwoMedia(orgId, userItemTypeId);
+
+      const result = await ncmecReporting.submitReport(params, false);
+
+      expect(result).toBe('SUCCESS');
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledTimes(1);
+      expect(stub.calls.some((c) => c.url === PRESERVATION_URL)).toBe(true);
+      const errorRow = await deps.KyselyPg.selectFrom(
+        'ncmec_reporting.ncmec_reports_errors',
+      )
+        .selectAll()
+        .where('job_id', '=', params.jobId)
+        .executeTakeFirst();
+      expect(errorRow).toBeUndefined();
+    },
+    60_000,
+  );
 });
diff --git a/server/test/integ/reported-media-banking.integ.test.ts b/server/test/integ/reported-media-banking.integ.test.ts
new file mode 100644
index 00000000..b96659fa
--- /dev/null
+++ b/server/test/integ/reported-media-banking.integ.test.ts
@@ -0,0 +1,154 @@
+/**
+ * Integration test: the banking round trip.
+ *
+ * `reportedMediaBankingEnqueue` -> Redis -> `ReportedMediaBankingWorker` ->
+ * `HmaService`, with only the HTTP layer stubbed. The unit tests mock
+ * `hmaService` entirely, so a regression in the queue name, the job payload
+ * shape or the BullMQ wiring would not show up anywhere else.
+ *
+ * Run with: docker compose run --rm test npm run test:integ
+ * Requires: `npm run up && npm run db:update`
+ */
+import { uid } from 'uid';
+import { Headers } from 'undici';
+
+import { HashBankService } from '../../services/hmaService/index.js';
+import {
+  type CoopRequestQuery,
+  type CoopResponse,
+  type FetchHTTP,
+  type HandleResponseBody,
+} from '../../services/networkingService/index.js';
+import { jsonStringify } from '../../utils/encoding.js';
+import createOrg from '../fixtureHelpers/createOrg.js';
+import {
+  makeIntegrationServer,
+  type IntegrationServer,
+} from './setupIntegrationServer.js';
+import { waitFor } from './wait.js';
+
+const MEDIA_URL = 'https://cdn.example/banked.jpg';
+
+type RecordedCall = { url: string; method: string; body: unknown };
+
+/** Stubs the two HMA calls the worker makes: the bank lookup in `getBankById`
+ * and the content add. Anything else is a bug in the test, so it throws. */
+function makeHmaStub() {
+  const calls: RecordedCall[] = [];
+  const ok = <T extends HandleResponseBody>(body: unknown): CoopResponse<T> =>
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- the stub returns a canned body through a slot typed by the caller's T.
+    ({
+      status: 200,
+      ok: true,
+      headers: new Headers(),
+      body,
+    }) as CoopResponse<T>;
+
+  const fetchHTTP: FetchHTTP = async <T extends HandleResponseBody>(
+    query: CoopRequestQuery<T>,
+  ): Promise<CoopResponse<T>> => {
+    const { url, method, body } = query;
+    // eslint-disable-next-line functional/immutable-data -- request recorder mutates by design
+    calls.push({ url, method, body });
+
+    if (method === 'post' && url.includes('/content?')) {
+      return ok<T>({ id: 1, signals: {} });
+    }
+    // getBankById verifies the bank still exists in HMA before returning it.
+    if (method === 'get' && url.includes('/c/bank/')) {
+      return ok<T>(undefined);
+    }
+    throw new Error(`stub fetchHTTP: unexpected request ${method} ${url}`);
+  };
+
+  return { fetchHTTP, calls };
+}
+
+describe('reported media banking round trip (integration)', () => {
+  const orgId = uid();
+  const ncmecReportId = uid();
+  const itemId = `media-${uid()}`;
+  const itemTypeId = `type-${uid()}`;
+  let harness: IntegrationServer | undefined;
+  let hma: ReturnType<typeof makeHmaStub>;
+  let hmaName: string;
+  let hashBankId: number;
+  let orgCleanup: (() => Promise<unknown>) | undefined;
+
+  beforeAll(async () => {
+    hma = makeHmaStub();
+    harness = await makeIntegrationServer({
+      mockedDeps: { fetchHTTP: hma.fetchHTTP },
+      workers: ['ItemProcessingWorker', 'ReportedMediaBankingWorker'],
+    });
+
+    orgCleanup = (
+      await createOrg(
+        {
+          KyselyPg: harness.deps.KyselyPg,
+          ModerationConfigService: harness.deps.ModerationConfigService,
+          ApiKeyService: harness.deps.ApiKeyService,
+        },
+        orgId,
+      )
+    ).cleanup;
+
+    hmaName = `COOP_TEST_${uid()}`;
+    hashBankId = (
+      await new HashBankService(harness.deps.KyselyPg).create({
+        name: 'Reported CSAM',
+        hma_name: hmaName,
+        enabled_ratio: 1,
+        org_id: orgId,
+      })
+    ).id;
+  }, 60_000);
+
+  afterAll(async () => {
+    try {
+      await orgCleanup?.();
+    } finally {
+      await harness?.shutdown();
+    }
+  }, 30_000);
+
+  test('an enqueued job reaches HMA with the media url and metadata', async () => {
+    if (!harness) throw new Error('harness was not initialized');
+
+    await harness.deps.reportedMediaBankingEnqueue([
+      {
+        orgId,
+        hashBankId,
+        ncmecReportId,
+        itemId,
+        itemTypeId,
+        url: MEDIA_URL,
+      },
+    ]);
+
+    const addCall = await waitFor(
+      `an HMA add-content call for bank ${hmaName}`,
+      async () =>
+        hma.calls.find(
+          (c) => c.method === 'post' && c.url.includes(`/c/bank/${hmaName}/`),
+        ) ?? null,
+      { timeoutMs: 20_000 },
+    );
+
+    expect(addCall.url).toContain(`url=${encodeURIComponent(MEDIA_URL)}`);
+    expect(addCall.body).toBe(
+      jsonStringify({
+        metadata: {
+          content_id: `${itemTypeId}:${itemId}`,
+          json: {
+            source: 'ncmec_report',
+            orgId,
+            ncmecReportId,
+            itemId,
+            itemTypeId,
+          },
+        },
+      }),
+    );
+  }, 60_000);
+});
diff --git a/server/test/integ/setupIntegrationServer.ts b/server/test/integ/setupIntegrationServer.ts
index fb80361d..7e770abb 100644
--- a/server/test/integ/setupIntegrationServer.ts
+++ b/server/test/integ/setupIntegrationServer.ts
@@ -18,9 +18,16 @@ export type IntegrationServer = {
   shutdown: () => Promise<void>;
 };
 
+/** Workers the harness knows how to run inline. */
+export type HarnessWorkerName =
+  'ItemProcessingWorker' | 'ReportedMediaBankingWorker';
+
 export type MakeIntegrationServerOptions = {
   /** A hash of mocked dependencies to replace in the bottle  */
   mockedDeps?: Partial<Dependencies>;
+  /** Workers to run inline. Defaults to the item-processing worker alone, so a
+   * test that doesn't need banking doesn't pay for a second Redis consumer. */
+  workers?: readonly HarnessWorkerName[];
 };
 
 export async function makeIntegrationServer(
@@ -37,13 +44,16 @@ export async function makeIntegrationServer(
   const { app, shutdown: shutdownServer } = await makeServer(deps);
   const request = superTest.agent(app);
 
+  const workerNames = opts.workers ?? ['ItemProcessingWorker'];
+
   const workerAbort = new AbortController();
-  // Run the worker in the background — its run() promise only settles on error
-  // or shutdown, so we don't await it here.
-  const workerRun = deps.ItemProcessingWorker.run(workerAbort.signal);
-  workerRun.catch((err) => {
-    console.error('ItemProcessingWorker exited with error', err);
-  });
+  // Run the workers in the background — run() only settles on error or
+  // shutdown, so we don't await them here.
+  for (const name of workerNames) {
+    deps[name].run(workerAbort.signal).catch((err) => {
+      console.error(`${name} exited with error`, err);
+    });
+  }
 
   return {
     deps,
@@ -64,32 +74,42 @@ export async function makeIntegrationServer(
         }
       };
 
+      // BullMQ's Worker.close() already closes the shared ioredis connection,
+      // so every later step that touches Redis — another worker's close(), or
+      // closeSharedResourcesForShutdown — throws "Connection is closed" on a
+      // connection that is already gone. That specific error is benign here,
+      // since teardown is exactly what we are doing, so we swallow it.
+      const ignoreClosedConnection = (err: unknown) => {
+        if (err instanceof Error && err.message === 'Connection is closed.') {
+          return;
+        }
+        throw err;
+      };
+
+      // One at a time, since they share a Redis connection.
+      const workerErrors: unknown[] = [];
+      for (const name of workerNames) {
+        const err = await runStep(async () => {
+          await deps[name].shutdown().catch(ignoreClosedConnection);
+        });
+        if (err !== null) {
+          // eslint-disable-next-line functional/immutable-data -- local accumulator
+          workerErrors.push(err);
+        }
+      }
+
       // Awaited left-to-right inside the array literal, so steps still run
-      // sequentially — closeSharedResourcesForShutdown depends on the worker
-      // having closed its Redis connection first.
+      // sequentially — closeSharedResourcesForShutdown depends on the workers
+      // having closed their Redis connections first.
       const teardownErrors = [
-        await runStep(async () => {
-          await deps.ItemProcessingWorker.shutdown();
-        }),
+        ...workerErrors,
         await runStep(async () => {
           await shutdownServer();
         }),
         await runStep(async () => {
-          // BullMQ's Worker.close() already closes the shared ioredis
-          // connection, which makes closeSharedResourcesForShutdown throw
-          // "Connection is closed" when it tries to quit() redis a second
-          // time. That specific error is benign — every shared resource is
-          // already torn down — so we swallow it here rather than leak the
-          // failure into afterAll.
-          await deps.closeSharedResourcesForShutdown().catch((err) => {
-            if (
-              err instanceof Error &&
-              err.message === 'Connection is closed.'
-            ) {
-              return;
-            }
-            throw err;
-          });
+          await deps
+            .closeSharedResourcesForShutdown()
+            .catch(ignoreClosedConnection);
         }),
       ].filter((e): e is unknown => e !== null);
 
diff --git a/server/workers_jobs/ReportedMediaBankingWorker.test.ts b/server/workers_jobs/ReportedMediaBankingWorker.test.ts
new file mode 100644
index 00000000..f15ab459
--- /dev/null
+++ b/server/workers_jobs/ReportedMediaBankingWorker.test.ts
@@ -0,0 +1,98 @@
+import { UnrecoverableError } from 'bullmq';
+import { vi } from 'vitest';
+
+import { type ReportedMediaBankingJobData } from '../queues/reportedMediaBankingQueue.js';
+import type { HashBank } from '../services/hmaService/index.js';
+import {
+  bankReportedMedia,
+  type ReportedMediaBankingDeps,
+} from './ReportedMediaBankingWorker.js';
+
+const BANK: HashBank = {
+  id: 42,
+  name: 'Reported CSAM',
+  hma_name: 'COOP_ORG1_REPORTED_CSAM',
+  description: null,
+  enabled_ratio: 1,
+  org_id: 'org1',
+  created_at: new Date(),
+  updated_at: new Date(),
+};
+
+const JOB: ReportedMediaBankingJobData = {
+  orgId: 'org1',
+  hashBankId: BANK.id,
+  ncmecReportId: '123',
+  itemId: 'img-1',
+  itemTypeId: 'type-a',
+  url: 'https://cdn.example.com/1.jpg',
+};
+
+function makeDeps(
+  overrides: Partial<ReportedMediaBankingDeps['hmaService']> = {},
+) {
+  const deps = {
+    hmaService: {
+      getBankById: vi.fn().mockResolvedValue(BANK),
+      addContentToBank: vi
+        .fn()
+        .mockResolvedValue({ id: 1, signals: { pdq: 'abc' } }),
+      ...overrides,
+    },
+  };
+  return deps as typeof deps & ReportedMediaBankingDeps;
+}
+
+describe('bankReportedMedia', () => {
+  it('adds the media to the org bank with metadata pointing back to the report', async () => {
+    const deps = makeDeps();
+
+    await bankReportedMedia(deps, JOB);
+
+    expect(deps.hmaService.getBankById).toHaveBeenCalledWith('org1', BANK.id);
+    expect(deps.hmaService.addContentToBank).toHaveBeenCalledWith(
+      BANK.hma_name,
+      {
+        url: JOB.url,
+        metadata: {
+          content_id: 'type-a:img-1',
+          json: {
+            source: 'ncmec_report',
+            orgId: 'org1',
+            ncmecReportId: '123',
+            itemId: 'img-1',
+            itemTypeId: 'type-a',
+          },
+        },
+      },
+    );
+  });
+
+  it('stops retrying when the bank is gone', async () => {
+    const deps = makeDeps({ getBankById: vi.fn().mockResolvedValue(null) });
+
+    await expect(bankReportedMedia(deps, JOB)).rejects.toBeInstanceOf(
+      UnrecoverableError,
+    );
+    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
+  });
+
+  it('lets a failed HMA call through, so the queue retries the job', async () => {
+    const deps = makeDeps({
+      addContentToBank: vi
+        .fn()
+        .mockRejectedValue(new Error('Failed to add content to bank: 500')),
+    });
+
+    const error = await bankReportedMedia(deps, JOB).then(
+      () => null,
+      (e: unknown) => e,
+    );
+
+    // An UnrecoverableError carries the same message but stops the retry, so
+    // the type is what this test is about.
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(UnrecoverableError);
+    expect((error as Error).message).toBe('Failed to add content to bank: 500');
+  });
+});
diff --git a/server/workers_jobs/ReportedMediaBankingWorker.ts b/server/workers_jobs/ReportedMediaBankingWorker.ts
new file mode 100644
index 00000000..ec003cfe
--- /dev/null
+++ b/server/workers_jobs/ReportedMediaBankingWorker.ts
@@ -0,0 +1,108 @@
+import {
+  Worker as BullWorker,
+  UnrecoverableError,
+  type Job as BullJob,
+} from 'bullmq';
+import type IORedis from 'ioredis';
+import { type Cluster } from 'ioredis';
+
+import { inject } from '../iocContainer/utils.js';
+import {
+  REPORTED_MEDIA_BANKING_QUEUE_NAME,
+  type ReportedMediaBankingJobData,
+} from '../queues/reportedMediaBankingQueue.js';
+import { type HmaService } from '../services/hmaService/index.js';
+import { jsonStringify } from '../utils/encoding.js';
+import { logErrorJson } from '../utils/logging.js';
+import { type Worker } from './index.js';
+
+export interface ReportedMediaBankingDeps {
+  hmaService: Pick<HmaService, 'getBankById' | 'addContentToBank'>;
+}
+
+/** Adds one media item of an accepted NCMEC report to the org's hash bank.
+ * Throwing hands the retry to BullMQ; `UnrecoverableError` stops retrying a
+ * job that cannot succeed, such as a bank that no longer exists. */
+export async function bankReportedMedia(
+  deps: ReportedMediaBankingDeps,
+  data: ReportedMediaBankingJobData,
+): Promise<void> {
+  const { orgId, hashBankId, ncmecReportId, itemId, itemTypeId, url } = data;
+  const bank = await deps.hmaService.getBankById(orgId, hashBankId);
+
+  if (bank == null) {
+    throw new UnrecoverableError(
+      `Hash bank ${hashBankId} no longer exists for org ${orgId}`,
+    );
+  }
+
+  await deps.hmaService.addContentToBank(bank.hma_name, {
+    url,
+    metadata: {
+      content_id: `${itemTypeId}:${itemId}`,
+      json: {
+        source: 'ncmec_report',
+        orgId,
+        ncmecReportId,
+        itemId,
+        itemTypeId,
+      },
+    },
+  });
+}
+
+export default inject(
+  ['IORedis', 'Tracer', 'HMAHashBankService'],
+  (redis: IORedis.Redis | Cluster, tracer, hmaService) => {
+    let worker: BullWorker<ReportedMediaBankingJobData> | undefined;
+
+    return {
+      type: 'Worker' as const,
+      async run(_signal) {
+        const bankingWorker = new BullWorker<ReportedMediaBankingJobData>(
+          REPORTED_MEDIA_BANKING_QUEUE_NAME,
+          async (job: BullJob<ReportedMediaBankingJobData>) => {
+            const processJob = tracer.traced(
+              {
+                operation: 'processJob',
+                resource: 'reportedMediaBankingWorker',
+              },
+              async () => bankReportedMedia({ hmaService }, job.data),
+            );
+
+            await processJob();
+          },
+          {
+            connection: redis,
+            concurrency: 5,
+            removeOnComplete: { count: 0 },
+            removeOnFail: { count: 1000 },
+          },
+        );
+        worker = bankingWorker;
+
+        // An 'error' event with no listener takes the process down, which
+        // would stop banking until the worker is restarted.
+        bankingWorker.on('error', (error) => {
+          // eslint-disable-next-line no-restricted-syntax
+          logErrorJson({
+            error,
+            message: jsonStringify({
+              event: 'reportedMediaBankingWorkerError',
+              queue: REPORTED_MEDIA_BANKING_QUEUE_NAME,
+            }),
+          });
+        });
+
+        await bankingWorker.waitUntilReady();
+
+        await new Promise<void>((resolve) => {
+          bankingWorker.on('closed', () => resolve());
+        });
+      },
+      async shutdown() {
+        await worker?.close();
+      },
+    } satisfies Worker;
+  },
+);