Company: TCBI
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001077428-25-000036
Chunk: 103

Company: TEXAS CAPITAL BANCSHARES INC/TX
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1
Chunk 103
---
 aware of a “computer-security incident” that rises to the level of a “notification incident.”

In February 2018, the SEC published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal banking law and regulations.

In July 2023, the SEC issued a final rule to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934. Specifically, the final rule requires current reporting about material cybersecurity incidents, periodic disclosures about a registrant’s policies and procedures to identify and manage cybersecurity risk, management’s role in implementing cybersecurity policies and procedures, and the board of directors’ cybersecurity expertise, if any, and its oversight of cybersecurity risk. See Item 1C. Cybersecurity for a discussion of the Company’s cybersecurity risk management, strategy and governance.

Privacy and data security areas are expected to receive increased attention at the federal level. An increasing number of state laws and regulations have been enacted in recent years to implement privacy and cybersecurity standards and regulations, including data breach notification and data privacy requirements. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs that meet specified requirements. In addition, other jurisdictions in which customers do business, such as the European Union, have adopted similar requirements. This trend of activity is expected to continue to expand, requiring continual monitoring of developments in the states and nations in which the Company’s customers are located and ongoing investments in its information systems and compliance capabilities. 

Community Reinvestment Act.    The Community Reinvestment Act of 1977 (the “CRA”) requires depository institutions to assist in meeting the credit needs of their market areas consistent with safe and sound banking practice. Under the CRA, each depository institution is required to help meet the credit needs of its market areas by, among other things, providing credit, making investments and providing community development services to low- and moderate-income individuals and communities. Depository institutions are periodically examined for compliance with the CRA and are assigned one of four ratings. The Bank is subject to examination by the FDIC. In order for a financial holding company to commence new activity permitted by the BHCA, each insured depository institution subsidiary of the financial holding company must have received a rating of at least “satisfactory” in its most recent examination under the CRA. The Bank's strategic focus on serving