Company: BPOPM
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001193125-25-043848
Chunk: 66

Company: POPULAR, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 5
Chunk 66
---
federal
regulators
of
proposed
merger, 
acquisition, restructuring, or other expansionary activity. 
Protection of Customer Personal Information and
Cybersecurity 
The privacy
provisions of
the Gramm-Leach-Bliley Act
of 1999
generally prohibit financial
institutions, including
us, from 
disclosing nonpublic personal financial information of consumer customers to third
parties for certain purposes (primarily marketing) 
unless
customers
have
the
opportunity
to
opt
out
of
the
disclosure.
The
Fair
Credit
Reporting
Act
restricts
information
sharing 
among affiliates for marketing purposes and governs
the use and provision of information to consumer
reporting agencies. 
The federal banking regulators have also issued guidance and rules regarding cybersecurity that are intended to enhance 
cyber risk management standards among financial institutions. A financial institution is expected to establish lines
of defense and to 
maintain risk management processes that are designed to address the risk posed by compromised customer credentials. A financial 
institution’s
management
is
expected
to
maintain
sufficient
business
continuity
planning
processes
for
the
rapid
recovery, 
resumption and maintenance of
the institution’s operations
after a cyber-attack involving
destructive malware. A financial
institution 
is
also
expected
to
develop
appropriate
processes
to
enable
recovery
of
data
and
business
operations
and
address
rebuilding 
network capabilities and restoring data if the institution or its critical service
providers fall victim to this type of cyber-attack. If we
fail 
to observe the
regulatory guidance, we could
be subject to various
regulatory sanctions, including financial
penalties. In November 
2021, the U.S.
federal bank regulatory agencies
issued a final
rule requiring banking organizations,
including Popular,
PNA, BPPR 
and PB, to notify
their primary federal banking regulator
within 36 hours of determining
that a “notification incident” has
occurred. A 
notification incident
is a
“computer-security incident” that
has materially
disrupted or degraded,
or is
reasonably likely to
materially 
disrupt or
degrade, the
banking organization’s
ability to
deliver services
to a
material portion
of its
customer