Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 32

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1
Chunk 32
---
 banking organizations to notify their primary regulator as soon as possible and within 36 hours of determining that a "notification incident" has occurred. A notification incident is a "computer-security incident" that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires specific and immediate notifications by bank service providers that become aware of similar incidents. 

Financial institutions regulated by the NYSDFS, including M&T Bank, are also subject to NYSDFS regulations on cybersecurity matters, including, among other things, requirements to (i) establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems, (ii) implement and maintain a written cybersecurity policy setting forth policies and procedures for the protection of their information systems and nonpublic information and (iii) designate a CISO. 

In November 2023, the NYSDFS adopted amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack vectors; (ii) enhanced requirements for privileged accounts; (iii) enhanced notification obligations; (iv) expansion of cyber governance practices; and (v) additional cybersecurity requirements for larger companies. Most of the amendments became effective in 2024, and all of the amendments will be effective by the end of 2025.

In July 2023, the SEC adopted new rules that require registrants, such as M&T, to (i) report material cybersecurity incidents on Form 8-K and (ii) disclose in its Annual Report on Form 10-K cybersecurity policies and procedures and governance practices, including at the board and management levels. This disclosure is included herein in Part I, Item 1C, "Cybersecurity."

Many states and regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations, including implementing or modifying their data breach notification and data privacy requirements. One example of such state legislation is the California Consumer Privacy Act, which became effective in January 2020 and applies to for-profit businesses that conduct business in California and meet certain revenue or data collection thresholds. Amendments expanding the scope of and requirements under the California Consumer Privacy Act generally became effective in January 2023. 

16

Consumer Protection Laws and the CFPB Supervision

In connection with