Company: NEWTP
Filing Date: 2025-08-15
Form Type: 424B2
Source: 0001587987-25-000152
Chunk: 90

Company: NewtekOne, Inc.
Filing Date: 2025-08-15
Form: 424B2
Chunk 90
---
 of operations and other functions, which may present various risks. Our regulators will expect us to maintain an effective program for managing risk arising from third-party relationships, which should be commensurate with the level of risk and complexity of our business and our third-party relationships. If not managed effectively, the use of third-party service providers may expose us to risks that could result in regulatory action, financial loss, litigation and reputational harm.

#### Privacy, Information Technology and Cybersecurity
We are subject to various laws related to the privacy of consumer information. For example, we and our subsidiaries are required under federal law periodically to disclose to their retail clients our policies and practices with respect to the sharing of nonpublic client information with their affiliates and others, and the confidentiality and security of that information. In some cases, Newtek Bank must obtain a consumer’s consent before sharing information with an unaffiliated third party, and Newtek Bank must allow a consumer to opt out of Newtek Bank’s sharing of information with its affiliates for marketing and certain other purposes. We are also subject to laws and regulatory requirements related to information technology and cybersecurity. For example, the Federal Financial Institutions Examination Council, which is a council comprised of the primary federal banking regulators, has issued guidance and supervisory expectations for banking organizations with respect to information technology and cybersecurity. Our regulators will regularly examine us for compliance with applicable laws, and adherence to industry best practices, with respect to these topics. For example, they will evaluate our security of user and customer credentials, business continuity planning, and the ability to identify and thwart cyber-attacks.

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. For example, the California Privacy Rights Act of 2020 became fully operative on January 1, 2023. We expect this trend of state-level activity in those areas to continue, and are continually monitoring developments in the states in which our clients are located.

<div align='center'>14</div>

Limitations on Transactions with Affiliates and Loans to Insiders

Banks are subject to restrictions on their ability to conduct transactions with affiliates and other related parties under federal banking laws. For example, federal banking laws impose quantitative limits, qualitative requirements, and collateral standards on certain extensions of credit and other transactions by an insured depository institution