Company: WTFCN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001015328-25-000093
Chunk: 25

Company: WINTRUST FINANCIAL CORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 25
---
 Client Information

Data privacy and cybersecurity laws and regulations concerning the collection, storage, handling, use, disclosure, transfer, protection and other processing of client information (including personal information) affect many aspects of the Company’s business, and are continuing to evolve. Data privacy and cybersecurity are currently areas of considerable legislative and regulatory attention, with new or modified laws, regulations, rules and standards frequently being adopted and potentially 

15

subject to divergent interpretation or application in a manner that may create inconsistent or conflicting requirements for businesses. 

We are, or may in the future become, subject to a variety of complex federal, state and local laws, regulations, rules and standards regarding data privacy and cybersecurity, including the privacy and information safeguarding provisions of the Gramm-Leach-Bliley Act (“GLB Act”), the Fair Credit Reporting Act (“FCRA”) and the amendments adopted by the Fair and Accurate Credit Transactions Act of 2003, as well as various state laws and regulations. The GLB Act requires a financial institution to, among other things, disclose its privacy policy to certain customers and, in some circumstances, enables certain customers to opt-out of certain sharing of the customers’ nonpublic personal information with nonaffiliated third parties. The GLB Act also requires financial institutions to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer information. In accordance with these requirements, we and each of our banks and operating subsidiaries provide a written privacy notice to each affected customer when the customer relationship begins and, to the extent required, on an annual basis. As described in the privacy notice, we endeavor to protect the security of information (including personal information) about our customers, educate our employees about the importance of protecting customer privacy, and allow affected customers to opt-out of certain types of information sharing. We and our subsidiaries also require business partners with which we share information (including personal information) to have adequate security safeguards and to follow the requirements of the GLB Act. The GLB Act, as interpreted by the federal banking regulators, and state laws and regulations require us to take certain actions, including providing notice under certain circumstances to affected customers, in the event that sensitive or personal customer information is compromised. We and/or each of the banks and operating subsidiaries may need to amend our privacy policies and adapt our internal procedures in the event that these legal requirements, or the regulators’ interpretation of them, change, or if new requirements are added. Additionally, the federal banking regulators, as well as the SEC