Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 494

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 494
---
 procedures reasonably designed to require oversight and monitoring of service providers, including by requiring relevant service providers to provide notification to the covered institution as soon as possible, but no later than 72 hours, after becoming aware of a breach in security has occurred resulting in unauthorised access to a customer information system maintained by the service provider. In October 2024, the CFPB released its final rule titled “Required Rulemaking on Personal Financial Data Rights” as required to implement Section 1033 of the Consumer Financial Protection Act of 2010. The final rule requires banks, credit unions and other financial service providers that meet the definition of covered data providers to make covered data regarding covered products and services available in an electronic form to consumers and authorised third parties, subject to a number of requirements. The final rule also sets out criteria a third party must satisfy in order to be an authorised third party and therefore access consumers’ data, including certifying to the relevant consumer it will satisfy certain obligations regarding the collection, use and retention of covered data and obtaining express and informed consumer consent. Compliance with this rule will be phased in over several years, with the first set of requirements taking effect from 1 April 2026, and with Barclays Bank Delaware becoming subject to the rule on 1 April 2027. Cybersecurity and operational resilience Regulators globally continue to focus on cybersecurity risk management, organisational operational resilience and overall soundness across all financial services firms, with customer and market expectations of uninterrupted access to financial services remaining at an all-time high. The regulatory focus has been further heightened by the increasing number of high-profile ransomware and other supply chain attacks seen across the industry in recent years and the growing reliance of financial services on Cloud and other third

| Strategy                               | Shareholderinformation | Climate andsustainability report | Governance |     | Riskreview | Financialreview | Financialstatements |     | Barclays PLC 2024Annual Reporton Form 20-F | 317 |
| Supervision and regulation (continued) |                        |                                  |            |     |            |                 |                     |     |                                            |     |

party service providers. This is evidenced by the continuing introduction of new laws and regulatory frameworks directed at enhancing resilience of both firms and their critical third party providers. The UK operational resilience framework introduced in March 2021 requires firms to be able to remain within impact tolerances set for their important business services, in severe but plausible disruption scenarios such as a cyberattack, by no later than 31 March 2025. In December 2024