Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 159

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 159
---
 for us.

For more information regarding the Bank Secrecy Act, Patriot Act, anti-money laundering requirements and OFAC-administered sanctions, refer to Item 1: Business - “Regulatory Matters.”

Cybersecurity and data privacy are areas of heightened legislative and regulatory focus.

As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. For example, the federal bank regulatory agencies (namely, the Federal Reserve, FDIC and OCC) have proposed regulations that would enhance cyber risk management standards, which would apply to a wide range of large financial institutions and their third-party service providers, including us and the Bank, and would focus on cyber risk governance and management, management of internal and external dependencies, incident response, cyber resilience, and situational awareness. Although the FDIC and OCC each withdrew this proposal, the Federal Reserve has not withdrawn its propose and may still propose such a rule. For more information regarding applicable cybersecurity and data privacy legislation and regulations, refer to Item 1: Business - “Regulatory Matters.”

We share, use, collect, disclose and otherwise process personal information of our customers and counterparties, including, but not limited to, personal financial information. The sharing, use, collection, disclosure, and other processing of these types of information are governed by increasingly stringent and evolving legislation and regulations, the intent of which is to protect the privacy of personal information, including personal financial information. We may become subject to new legislation or regulations concerning cybersecurity and data privacy. We could be adversely affected if new legislation or regulations are adopted or if existing legislation or regulations are modified such that we are required to change our business practices, policies, or systems or otherwise incur significant additional costs and expenses in order to comply. 

Further, we make public statements about our sharing, use, collection, disclosure, and other processing of personal information through our privacy policies, information provided on our website, and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. Our public statements and documentation that provide promises and assurances about cybersecurity and data privacy can subject us to potential government or legal action if they are found to be deceptive, unfair, or misrepresent our actual practices.

40     Huntington Bancshares Incorporated

Table of Contents

If cybersecurity or data privacy legislation or regulations are implemented, interpreted, or applied in a manner inconsistent with our