Company: CFG-PE
Filing Date: 2025-11-03
Form Type: 10-Q
Source: 0000759944-25-000153
Chunk: 221

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-11-03
Form: 10-Q
Item: Part I, Item 2
Chunk 221
---
 FRB and OCC regularly evaluate our liquidity as part of the overall supervisory process. In addition, we are subject to existing and evolving regulatory liquidity requirements, some of which are subject to further rulemaking, guidance, and interpretation by the applicable federal regulators. For further discussion, see the “Liquidity Requirements” section under “Regulation and Supervision” in our 2024 Form 10-K.

Off-Balance Sheet Arrangements

We engage in a variety of activities that are not reflected in our Consolidated Balance Sheets that are generally referred to as “off-balance sheet arrangements.” For more information on these types of activities, see Note 11.

Operational Risk

Operational risk is the risk of loss due to human error, third-party performance failures, or inadequate or failed internal systems and controls and includes certain risks such as fraud, legal, and natural disasters. To mitigate these risks, we maintain a comprehensive system of internal controls designed to identify, assess, and monitor potential threats to our operations. Our risk management framework includes regular audits, employee training, cybersecurity measures, and business continuity planning. We continuously evaluate and enhance these controls to adapt to evolving risks and regulatory requirements, ensuring the integrity, reliability, and efficiency of our operations.

Cybersecurity

The Company’s Cybersecurity Program (“CSP”) drives an end-to-end, continuous process that protects our customers, colleagues, assets, premises, systems, and information (electronic and non-electronic), and is designed to ensure compliance with current and emerging federal and state laws and regulations. The CSP is designed to ensure the effective implementation of the Corporate Security and Resilience Operating Model across all business lines of the Company and is under the supervision of the Chief Security Officer. 

The CSP is designed to assess and mitigate threats and risks to the Company. New and emerging threats are assessed through an intelligence lifecycle, which includes threat modeling. In addition, risk assessment processes drive risk identification and measurement related to security. Once risks are identified and measured, the Company’s Enterprise Risk Management Governance Framework is leveraged to track and mitigate them. Control testing is utilized to demonstrate that risks are managed effectively, identify gaps in expected control operation, and develop appropriate remediation plans, in order to manage risk to the Company within tolerable limits.

Citizens Financial Group, Inc. | 28

The Company regularly reviews the nature of its business activities and modifies the CSP as appropriate. Many of the elements of the CSP are related to cyber defense and are in place to reduce our risk to a wide