Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 66

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 66
---
 other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or stock price, or pose a threat to the financial stability of the U.S.

In addition, once implementing regulations are finalized, the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) will require, among other things, covered entities to report significant cyber incidents, including ransomware attacks, to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours from the time the covered entity reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). The CISA proposed a rule under the CIRCIA in April 2024 that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to include banking organizations like Truist.

Truist’s nonbank subsidiaries are also subject to rules and regulations issued by the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to data privacy, data protection, and cybersecurity. Moreover, the U.S. Congress has recently considered, and is expected to continue to consider various proposals for, more comprehensive data privacy, data protection, and cybersecurity legislation.

Like other lenders, Truist Bank uses credit bureau data in its underwriting activities. The Fair Credit Reporting Act regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on Truist Bank.

States are also increasingly proposing or enacting legislation that relates to data privacy, data protection, and cybersecurity such as the California Consumer Privacy Act as amended by the California Privacy Rights Act. Truist may be subject to similar laws in other states where Truist does business or in states where Truist may collect personal information of residents. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to individuals whose personal information has been disclosed as a result of a data breach.

Moreover, the New York Department of Financial Services Cybersecurity Regulation is driving significant cybersecurity compliance activities for Truist. This regulation includes phased compliance periods as well as attestation of compliance by certain Truist entities.

Truist has undertaken significant efforts to comply with these laws and regulations and continues to assess their requirements and applicability to Truist. These laws and regulations, as