Company: MBINL
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001558370-25-001941
Chunk: 11

Company: Merchants Bancorp
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 11
---
Item 1C. Cybersecurity.

Privacy and Cybersecurity

Merchants Bank is subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of their customers. These laws require banks to periodically disclose their privacy policies and practices relating to sharing such information and permitting customers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. They also impact a bank’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition, banks are required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information. 

Risk Management and StrategyTo combat the ever-present cyber risks, the Company maintains a comprehensive ISP, which includes continuous risk assessments, an Incident Response Plan, and a multilayered control environment meant to protect, detect, respond to, and limit unauthorized or harmful actions across our information environment. The control environment is based off industry leading recommendations, including the Center for Internet Security (CIS) Critical Security Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our Information Security Officer (ISO) is primarily responsible for coordinating the various aspects of the ISP with cross-functional support teams across various teams within the Company. Standards over information security are Board-approved and various types of control testing is conducted throughout the year, by internal and external parties. Recommendations are implemented and reported to various committees. These security and privacy policies and procedures, aimed at protecting personal and confidential