Company: WBS-PG
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000801337-25-000004
Chunk: 150

Company: WEBSTER FINANCIAL CORP
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 150
---
. In accordance with these rules, financial institutions and creditors are required to develop and implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft in connection with certain existing accounts or the opening of new accounts. The Company has an Identity Theft Prevention Program in place satisfying its compliance with these requirements.

7

Financial Privacy and Data Security

The Company is subject to federal and certain state laws and regulations containing consumer privacy and data protection provisions addressing the treatment of nonpublic personal information about consumers by financial institutions. Subject to certain exceptions, financial institutions are prohibited from disclosing nonpublic personal information about a consumer to nonaffiliated third parties, unless the institution satisfies various notice and opt-out requirements, and the consumer has not elected to opt out of the disclosure. Regardless as to whether a financial institution shares nonpublic personal information, the institution must provide notice of its privacy policies and practices to its consumers, and must follow redisclosure and reuse limitations on any nonpublic personal information it receives from a nonaffiliated financial institution. 

The federal banking regulatory agencies have adopted guidelines for establishing information security standards and programs to protect such information, with an increased focus on risk management and processes related to information technology, and the use of third parties. The expectation from the federal banking regulatory agencies is that financial institutions have established lines of defense to ensure that their risk management processes address the risks posed by compromised customer credentials, and that the financial institution has sufficient business continuity planning processes to ensure rapid recovery, resumption, and maintenance of operations after a cyber-attack.

Financial institutions are required to notify customers of security breaches that result in unauthorized access to their nonpublic personal information and its primary regulator of certain types of computer security incidents that result in harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits, as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.

Community Reinvestment Act and Fair Lending Laws

The Bank has a responsibility under the CRA to help meet the credit needs of its communities, including low and moderate-income neighborhoods. The CRA does not establish specific lending requirements or programs for financial institutions, nor does it limit an institution’s discretion to develop the types of products or services that it believes are best suited to its particular community. In connection with its examination, the OCC assesses the Bank’s record of compliance with the CRA. In addition, the Equal Credit Opportunity Act and the Fair Housing Act prohibit discrimination in lending practices on the basis