Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 73

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 73
---
 of a cyber attack, or media reports of perceived security vulnerabilities at the Company or at third-party service providers could result in significant legal and financial exposure, regulatory intervention, remediation costs, damage to reputation or loss of confidence in the security of systems, products and services that could adversely affect the Company’s business. Like other U.S. financial services providers, the Company continues to be targeted with evolving and adaptive cyber threats from sophisticated third parties. Although the Company is not aware of any material losses relating to cybersecurity incidents, there can be no assurance that unauthorized access or cybersecurity incidents will not become known or occur or that the Company will not suffer such losses in the future. 

38

The Company is subject to laws and regulations relating to the privacy of the information of customers, clients, employees or others, and any failure to comply with these laws and regulations could expose the Company to liability and/or reputational damage.

The Company is also subject to laws and regulations relating to the privacy of the information of customers, clients, employees or others, and any failure to comply with these laws and regulations could expose the Company to liability and/or reputational damage. New privacy and data protection initiatives will impose additional operational burdens on the Company, may limit the Company’s ability to pursue desirable business initiatives and increase the risks associated with any future use of customer data. Significant examples include the General Data Protection Act, the UK General Data Protection Act, known as The Data Protection Act of 2018, and the California Consumer Privacy Act. Compliance with these and other laws and regulations may require changes to policies, procedures and technology for information security and segregation of data, which could, among other things, make the Company more vulnerable to operational failures, and to monetary penalties, litigation or regulatory enforcement actions for breach of such laws and regulations.

As privacy-related laws and regulations are implemented, they may also limit how companies like M&T can use personal data and impose obligations on companies in their management of such data. The time and resources needed for the Company to comply with such laws and regulations, as well as its potential liability for non-compliance and reporting obligations in the case of data breaches, may significantly increase. The impacts will be greater to the extent requirements vary across jurisdictions.

M&T relies on other companies to provide key components of the Company’s business infrastructure.

Third parties provide key components of the Company’s business infrastructure such as banking services, processing, and Internet connections and network access. Any disruption in such services provided by these third parties or any failure of these third parties to handle current or higher