Company: SFBC
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001541119-25-000009
Chunk: 49

Company: Sound Financial Bancorp, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1
Chunk 49
---
 to a merger or the establishment of a branch. An unsatisfactory rating may be the basis for the denial of such an application. The CRA also requires that all institutions make public disclosures of their CRA ratings. Sound Community Bank received a “satisfactory” rating in its most recent CRA evaluation. 

On October 24, 2023, the federal banking agencies, including the FDIC, issued a final rule designed to strengthen and modernize regulations implementing the CRA. The changes are designed to encourage banks to expand access to credit, investment and banking services in low- and moderate-income communities, adapt to changes in the banking industry including mobile and internet banking, provide greater clarity and consistency in the application of the CRA regulations and tailor CRA evaluations and data collection to bank size and type. The applicability date for the majority of the changes is January 1, 2026, with additional requirements becoming applicable on January 1, 2027.

Under the laws of the state of Washington, Sound Community Bank has a similar obligation to meet the credit needs of the communities it serves, and is subject to examination by the WDFI for this purpose, including assignment of a rating. An unsatisfactory rating may be the basis for denial of certain applications by the WDFI. Sound Community Bank received a “satisfactory” rating from the WDFI in its most recent WDFI CRA evaluation.

Privacy Standards and Cybersecurity.  The Gramm-Leach-Bliley Financial Services Modernization Act of 1999 modernized the financial services industry by establishing a comprehensive framework to permit affiliations among commercial banks, insurance companies, securities firms and other financial service providers.  Federal banking agencies, including the FDIC, have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors.  These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. These regulations require Sound Community Bank to disclose its privacy policy, including informing consumers of its information sharing practices and informing consumers of their rights to opt out of certain practices. In addition, Washington and other federal and state cybersecurity and data privacy laws and regulations may expose Sound Community Bank to risk and result in certain risk management costs. 

On November 18, 2021, the federal banking agencies announced the adoption of a final rule providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents.  Specifically, the rule