Company: SFBC
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001541119-25-000009
Chunk: 50

Company: Sound Financial Bancorp, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1
Chunk 50
---
 requires a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after, the banking organization determines that a “computer-security incident” rising to the level of a “notification incident” has occurred.  Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector.  Service providers are required under the rule to notify affected banking organization customers as soon as possible when the 

30

provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization’s customers for four or more hours. Compliance with the rule was required starting May 1, 2022.  Non-compliance with federal or similar state privacy and cybersecurity laws and regulations could lead to substantial regulatory fines and penalties, damages from private causes of action and/or reputational harm.

In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. The rules require registrants to disclose on Form 8-K any cybersecurity incident they determine to be material and to describe the material aspects of the incident's nature, scope, and timing, as well as the material impact or reasonably likely material impact on the registrant. For information regarding the Company’s cybersecurity risk management, strategy, and governance,  see “Item 1C.” in this Form 10-K.

Anti-Money Laundering and Customer Identification.  The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA Patriot Act) was signed into law on October 26, 2001.  The USA PATRIOT Act and the Bank Secrecy Act requires financial institutions to develop programs to prevent themselves from being used for money laundering and terrorist activities. If such activities are detected, financial institutions are obligated to file suspicious activity reports with the U.S. Treasury’s Office of Financial Crimes Enforcement Network. These rules require financial institutions to establish procedures for identifying and verifying the identity of customers seeking to open new financial accounts, and, effective in 2018, the beneficial owners of accounts. Bank regulators are directed to consider a holding company’s effectiveness in combating money laundering when ruling on Bank Holding Company Act and Bank Merger Act applications.

Standards for Safety and Soundness. Each federal