Company: SFB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027702
Chunk: 40

Company: STIFEL FINANCIAL CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 40
---
 regulations adopted under U.S. federal law impose obligations on our company and its subsidiaries for protecting the confidentiality, integrity, and availability of personal information, and require notice of data breaches to certain U.S. regulators and to affected individuals. The Fair Credit Reporting Act of 1970, as amended, mandates the development and implementation of a written identity theft prevention program that is designed to detect, prevent, and mitigate identity theft.

The California Privacy Rights Act (“CPRA”) amended the California Consumer Privacy Act of 2020 and became enforceable in 2023. CPRA regulations updated the existing privacy protections for the personal information of California residents, including by requiring companies to provide certain additional disclosures to California consumers, and provides for a number of specific additional data subject rights for California residents.

Similarly, the General Data Protection Regulation (“GDPR”) of E.U. and the U.K. imposes requirements for companies that collect or store personal data of individuals residing in the E.U. and the U.K., respectively. GDPR imposes a strict data protection compliance regime that includes data subject rights actions that must be responded to by organizations. Canadian data privacy laws contain many provisions similar to U.S. financial privacy laws and are currently undergoing legislative reform at a federal and provincial level. Our exposure to these non-U.S. regimes arises primarily through our foreign subsidiaries that do business in these respective jurisdictions. 

In May 2024, the SEC adopted amendments to Regulation S-P, which includes a requirement for broker-dealers, investment companies, RIAs, and transfer agents to adopt written policies and procedures for an incident response program with respect to unauthorized access to or use of customer information. The final amendments require these entities to notify individuals whose sensitive customer information was accessed or used without authorization no later than 30 days after becoming aware that the information has been compromised. These amendments become effective on December 21, 2025, and are not expected to have a significant impact on our business. 

Certain U.S. states have recently enacted privacy and data protection regulation related to the development and deployment of artificial intelligence (“AI”). These laws intersect with existing privacy laws and present challenges for firms using AI-related technologies, particularly in cases where personal information is processed requiring notice disclosure and, in certain cases, consent for use of AI. The E.U. Artificial Intelligence Act, which has tiered compliance dates, poses further challenges for organizations in managing transparency, fairness, and accountability for AI use. Data privacy requirements affect business processes and compel companies to track personal information use and provide greater transparency on data practices to