Company: FCNCB
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000798941-25-000010
Chunk: 107

Company: FIRST CITIZENS BANCSHARES INC /DE/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1
Chunk 107
---
 agencies have adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the board of directors. These guidelines and related regulatory materials increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Under SEC rules, companies also must provide enhanced disclosures in their Annual Reports on Form 10-K with respect to cybersecurity risk assessment and management, strategy and governance, including disclosures regarding management’s role in overseeing the public company’s cybersecurity risk management and compliance program. Refer to Item 1C. Cybersecurity for additional information.

The U.S. Congress, federal and state regulators, as well as regulators outside the United States, have implemented or are considering implementing data protection laws or regulations, which could create new individual privacy rights and impose increased obligations on companies handling personal information, impacting our data security- and privacy-related internal controls and risk profile. For example, in Europe and in the United Kingdom, both the EU General Data Protection Regulation and the UK General Data Protection Regulation impose extensive obligations on companies that process personal data of individuals in Europe, with the potential for significant fines for non-compliance (up to 4% of total annual worldwide revenue). Some of its requirements include prompt notice of data breaches, in certain circumstances, to affected individuals and supervisory authorities. 

Climate

BancShares is subject to a number of laws relating to climate, among those being the federal banking agencies’ Principles for Climate-Related Financial Risk Management for LFIs (the “CRFR Banking Principles”) and California’s Climate Corporate Data Accountability Act (the “California CCDAA”) and Climate-Related Financial Risk Act (the “California CFRA”). The CRFR Banking Principles provide a high-level framework for the safe and sound management of exposures to climate-related financial risks, including physical and transition risks associated with climate change, and cover governance; policies, procedures, and limits; strategic planning; risk management; data, risk measurement, and reporting; and scenario analysis. The California CCDAA requires annual public disclosure of scope 1, 2, and 3 greenhouse gas emissions, with scope 1 and 2 reporting required in 2026 and scope 3 in 2027, and the California CRFRA requires biennial public disclosure of climate-related financial risks, with the first disclosure required by January 1, 2026. New York is considering a law similar to the California CRFRA.

17

Compensation

Our compensation practices are subject to oversight by the federal banking agencies, Nasdaq,