Company: CFG-PE
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000759944-25-000013
Chunk: 1062

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1
Chunk 1062
---
 to the fee every other year based on a survey of debit card issuers. We will continue to monitor the proposed changes to these rules.

The Dodd-Frank Act permits states to adopt stricter consumer protection laws and standards than those adopted at the federal level, and in certain circumstances allows state attorneys general to enforce compliance with both the state and federal laws and regulations on banks like us.

Protection of Customer Personal Information and Cybersecurity

The privacy provisions of GLBA generally prohibit financial institutions, including us, from disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes unless customers have the opportunity to opt out of the disclosure. The Fair Credit Reporting Act restricts information sharing among affiliates for marketing purposes. Both the Fair Credit Reporting Act and Regulation V, which are issued by the FRB, govern the use and provision of information to consumer reporting agencies.

In October 2024, the CFPB adopted a rule regarding personal financial data rights that applies to financial institutions that offer consumer deposit accounts, such as CBNA. Covered financial institutions are required to provide consumers electronic access to 24 months of transaction data and certain account information and are prohibited from imposing any fees or charges for maintaining or providing access to such data. The rule also imposes data accuracy, retention and other obligations. For banks with total assets between $10 billion and $250 billion, compliance with the rule is required by April 1, 2027.

Citizens Financial Group, Inc. | 17

The federal banking regulators regularly issue guidance regarding cybersecurity intended to enhance cyber risk management standards among financial institutions. Financial institutions are expected to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers when accessing internet-based services of the financial institution. Further, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware or other compromise of customer data and/or systems. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack or compromise. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. For further discussion of risks related to cybersecurity, see Item 1A “Risk Factors.”

A financial institution is also required to notify its