Company: NEWTP
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001587987-25-000050
Chunk: 96

Company: NewtekOne, Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1
Chunk 96
---
 the use of third-party service providers may expose us to risks that could result in regulatory action, financial loss, litigation and reputational harm. On June 6, 2023, the FDIC, the Federal Reserve and the OCC issued final guidance providing sound principles that support a risk-based approach to third-party risk management.

Privacy, Information Technology and Cybersecurity

We are subject to various laws related to the privacy of consumer information. For example, we and our subsidiaries are required under federal law periodically to disclose to their retail clients our policies and practices with respect to the sharing of nonpublic client information with their affiliates and others, and the confidentiality and security of that information. In some cases, Newtek Bank must obtain a consumer’s consent before sharing information with an unaffiliated third party, and Newtek Bank must allow a consumer to opt out of Newtek Bank’s sharing of information with its affiliates for marketing and certain other purposes. We are also subject to laws and regulatory requirements related to information technology and cybersecurity. For example, the Federal Financial Institutions Examination Council's (“ FFIEC”), which is a council comprised of the primary federal banking regulators, has issued guidance and supervisory expectations for banking organizations with respect to information technology and cybersecurity. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy and governance. Our regulators will regularly examine us for compliance with applicable laws, and adherence to industry best practices, with respect to these topics. For example, they will evaluate our security of user and customer credentials, business continuity planning, and the ability to identify and thwart cyber-attacks.

20

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. For example, the California Privacy Rights Act of 2020 became fully operative on January 1, 2023. We expect this trend of state-level activity in those areas to continue, and are continually monitoring developments in the states in which our clients are located.

Limitations on Transactions with Affiliates and Loans to Insiders

Banks are subject to restrictions on their ability to