Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 48

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 48
---
 the Company is able to raise capital and does so by issuing common stock or convertible securities, the ownership interest of its existing stockholders could be diluted, and the market price of its common stock could decline.

The Company is subject to complex and evolving laws, regulations, rules, standards and contractual obligations related to privacy, data protection and data security, which may increase the Company’s costs of doing business and liability exposure. The Company is subject to a variety of complex and continuously evolving and developing laws, regulations, rules, standards and contractual obligations regarding privacy, data protection and data security, including those related to the collection, storage, handling, use, disclosure, transfer, security and other processing of personal information. Compliance with such laws, regulations, rules, standards and contractual obligations may require the Company to incur significant compliance costs and/or require the Company to change its policies, procedures or operations, and failure to comply with such laws, regulations, rules, standards or contractual obligations could expose the Company to liability, including enforcement actions, fines, penalties and sanctions for non-compliance, governmental investigations and/or reputational damage, and of which could have a material adverse effect on the Company’s business, financial condition and results of operations.

22

At the federal level, the Company is subject to the GLBA, which requires financial institutions to, among other things, periodically disclose their privacy policies and practices relating to sharing personal information and, in some cases, enables retail customers to opt out of the sharing of certain non-public personal information with unaffiliated third parties, among other laws and regulations. The Company is also subject to the rules and regulations promulgated under the authority of the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to privacy and cybersecurity. Federal banking agencies also regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. Moreover, the U.S. Congress is currently considering various proposals for more comprehensive privacy, data protection and data security legislation, to which the Company may be subject if passed.

State regulators have also been increasingly active in implementing privacy and cybersecurity laws, regulations, rules and standards. Several states, including states where the Company currently conducts, or may in the future conduct, business, such as California, Nebraska, Virginia and Colorado, have implemented, or are considering implementing, comprehensive data privacy and cybersecurity laws and regulations, including regulations requiring certain financial institutions to implement cybersecurity programs. For example, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to individuals whose personal