Company: STBA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000719220-25-000013
Chunk: 38

Company: S&T BANCORP INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 38
---
 their affiliates from engaging in proprietary trading and investing in and sponsoring certain unregistered investment companies generally covering hedge funds and private equity funds, subject to certain exemptions. Banking entities had until July 21, 2017 to conform their activities to the requirements of the rule. Since S&T generally does not engage in the activities prohibited by the Volcker Rule, the effectiveness of the rule has not had a material effect on S&T Bank or its affiliates.

In addition, the Dodd-Frank Act provides that the amount of any interchange fee charged for electronic debit transactions by debit card issuers having assets over $10 billion must be reasonable and proportional to the actual cost of a transaction to the issuer. The FRB has adopted a rule which limits the maximum permissible interchange fees that such issuers can receive for an electronic debit transaction. This rule, Regulation II, was effective October 1, 2011, and then amended on October 3, 2022 to require debit card issuers to provide at least two unaffiliated payment card networks to process card-not-present debit card transactions. Regulation II does not apply to a bank that, together with its affiliates, has less than $10 billion in assets, which includes S&T.

Cybersecurity

We are subject to a variety of regulatory expectations and requirements regarding cybersecurity and data privacy. Federal regulators have issued statements regarding cybersecurity addressing the controls that financial institutions should design and business continuity planning and recovery processes that should be in place. Additionally, the FDIC, OCC and FRB issued a final rule that became effective in May 2022, requiring banking organizations that experience a computer-security incident to notify certain entities and its federal regulator of the computer-security incident as soon as possible and no later than 36 hours after the bank determines a computer-security incident has occurred. This rule also requires banking organizations to notify 

10

Table of ContentsS&T BANCORP, INC. AND SUBSIDIARIES

their customers of a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours. Moreover, in March 2022, the Cyber Incident Reporting for Critical Infrastructure Act, or CIRCIA, was enacted and once final rules are adopted, will require certain covered entities to report a covered cyber incident to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency, or CISA, within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours