In the wake of the Air India Flight 182 bombing in 1985 that killed 329 people, full PPBM was required in 1989 by the International Civil Aviation Organization (ICAO) for all international flights. The FAA required a positive match of bags to boarding passengers in airports which were classified as extraordinary security risks airports. Frankfurt and London were two prominent airports categorized by the FAA as falling into that category.

I believe the applicable US law is 14 CFR part 108. The law essentially say air carriers must develop security programs the meat the security requirements and have their program approved by the FAA.