Company: ASB
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000007789-25-000013
Chunk: 149

Company: ASSOCIATED BANC-CORP
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1
Chunk 149
---
 have a business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.  

Additionally, recent and ongoing developments may impact our data security- and privacy-related internal controls and risk profile. On October 22, 2024, the CFPB adopted a final rule regarding personal financial data rights that is designed to promote “open banking.”  The final rule requires, among other things, that data providers, including any financial institution, make available to consumers and certain authorized third parties upon request certain covered transaction, account and payment 

12

information. IDIs with at least $10 billion but less than $250 billion in total assets, including Associated Bank, are required to comply with the final rule by April 1, 2027. On the same day the final rule was released, certain industry participants filed a complaint against the CFPB challenging the final rule. This legal challenge may delay or halt the final rule’s implementation.

Artificial Intelligence

CFPB and other federal regulatory guidance reiterates that creditors are not excused from the adverse action notice requirements under ECOA simply because they rely on complex algorithmic underwriting models. States have also started to regulate the use of AI technologies. Of note, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making. California also enacted new laws that further regulate use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI, and other states have also passed AI-focused legislation. In addition, the New York State Department of Financial Services issued an industry letter on combating cybersecurity risks associated with AI.

Additionally, on January 23, 2025, President Trump issued an Executive Order aimed at reducing barriers to AI innovation in the U.S. economy. The Order requires relevant persons and bodies within the federal government to develop an AI action plan to carry out this objective, and revokes an AI-related Executive Order issued in 2023 by President Biden, as well as all corresponding policies, regulations, orders, directives and other actions taken in response to such Order.

Bank Secrecy Act / Anti-Money Laundering

The BSA, which is intended to require financial institutions to develop policies, procedures, and practices to prevent and deter money laundering, mandates that every national bank have a written, board-approved program that is reasonably designed to assure