Company: CFG-PE
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000759944-25-000013
Chunk: 453

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1
Chunk 453
---
 primary banking regulator within 36 hours of computer-security incidents that have materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade its:

•ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base;

•business lines, including associated operations, services, functions, and support, that upon failure would result in a material loss of revenue, profit, or franchise value; or

•operations, including associated services, functions, and support, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

In addition, the SEC requires registrants to disclose material cybersecurity incidents on Form 8-K, which must describe the material aspects of the nature, scope and timing of the incident, as well as the impact of the incident on the registrant. In Form 10-K filings, registrants are required to describe their processes for assessing, identifying and managing material risks from cybersecurity threats and whether such risks have materially affected the registrant. Registrants must also describe Board oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from such threats. See Item 1C “Cybersecurity” for more information.

State regulators have also been active in implementing privacy and cybersecurity standards and regulations. Several states have adopted laws and regulations requiring certain financial institutions to implement cybersecurity programs and provide details with respect to these programs. In addition, many states have implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity to continue and are continually monitoring developments in the states in which we operate.

Climate-Related Laws and Regulations

On March 6, 2024, the SEC adopted a final rule to require registrants to disclose certain climate-related information in their registration statements and annual reports. On April 4, 2024, the SEC issued an order staying its final rule pending completion of the judicial review of certain petitions challenging the rule. Several states in which we operate have also enacted or proposed statutes or regulations addressing climate-related issues. For example, California has enacted laws that impose climate-related disclosure requirements on certain companies doing business in California, while some states have enacted, or proposed to enact, divergent or sometimes conflicting statutes, including those that prohibit financial institutions from denying or canceling products or services on the basis of social credit scores and certain other factors. We will continue to monitor developments on these laws and regulations.

Citizens Financial Group, Inc. | 18

Community