Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 63

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 63
---
 and First Republic Bank, which could result in additional expense.

Consumer Protection Laws and Regulations

In connection with its lending and leasing activities, Truist Bank is subject to federal and state laws designed to protect borrowers and promote lending to various sectors of the economy and population. The CFPB examines Truist and Truist Bank for compliance with a broad range of federal consumer financial laws and regulations, including the laws and regulations that relate to deposit products, credit card, mortgage, automobile, student, and other consumer loans, and other consumer financial products and services offered. The federal consumer financial protection laws that are subject to the CFPB’s supervision and enforcement powers include, among others, the Truth in Lending Act, Truth in Savings Act, Home Mortgage Disclosure Act, Fair Credit Reporting Act, Electronic Funds Transfer Act, Real Estate Settlement Procedures Act, Fair Debt Collection Practices Act, and Equal Credit Opportunity Act. The CFPB also has authority to take enforcement actions to prevent and remedy acts and practices relating to consumer financial products and services that it deems to be unfair, deceptive, or abusive, and to impose new disclosure requirements for any consumer financial product or service.

12   Truist Financial Corporation

In October 2024, the CFPB finalized a rule under the Dodd-Frank Act, which requires certain entities, including Truist and Truist Bank, to, among other things, make available to a consumer, upon request, information in its control or possession concerning the consumer financial product or service that the consumer obtained from that entity. The rule also requires data providers holding a consumer account, such as Truist Bank, to establish a developer interface satisfying certain data security specifications and other standards, through which the data provider can receive requests for, and provide, specific types of data covered by the rule in electronic, usable form to authorized third parties, including data aggregators. Data providers are prohibited from charging consumers or third parties fees for processing these consumer data requests. The rule also places certain data security, authorization, and other obligations on third parties accessing covered data from data providers, which could include Truist and Truist Bank when acting in certain capacities. The rule also requires such third parties to limit their collection, use, and retention of the data received from the applicable data provider to only what is reasonably necessary to provide the applicable consumer’s requested product or service, including uses that are reasonably necessary to improve the product or service. The compliance date for a data provider that is a depository institution with over $