Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 27

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 27
---
 and regulations issued by the Federal Trade Commission, which regulates unfair or deceptive acts or practices, including with respect to data privacy and cybersecurity. Additionally, like other lenders, the Bank uses credit bureau data in its underwriting activities. Use of such data is regulated under the Fair Credit Reporting Act, which also regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on the Company and its subsidiaries. The United States Congress also is considering, and may pass, additional data privacy and cybersecurity legislation, to which the Company may become subject if passed.

The enactment of the Cyber Incident Reporting for Critical Infrastructure Act (the “CIRCIA”) in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the Cybersecurity and Infrastructure Agency (the “CISA”) within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators.

The Bank is also subject to federal regulations that, among other things, require a banking organization to notify its primary federal banking agencies as soon as possible and within 36 hours after identifying a “computer-security incident” that has materially disrupted or degraded, or the banking organization believes in good faith is 

12

reasonably likely to materially disrupt or degrade, its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the financial stability of the United States financial sector. Additionally, the federal banking agencies, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions. 

Data privacy and cybersecurity are also areas of increasing state legislative focus. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), among other things, broadly defines personal