Company: BANC-PF
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001628280-25-009438
Chunk: 236

Company: BANC OF CALIFORNIA, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 236
---
 to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification and data privacy requirements. For example, the California Consumer Privacy Act became effective on January 1, 2020, and key provisions of an additional law strengthening the protection, the California Privacy Rights Act of 2020, became effective on January 1, 2023. We expect this trend of state-level activity and consumer expectations in those areas to continue to heighten, and we are continually monitoring for developments in the states in which our clients are located. Our regulators regularly examine us for compliance with applicable laws, and adherence to industry best practices, with respect to these topics. For example, they will evaluate our security of user and customer credentials, business continuity planning, and the ability to identify and thwart cyber-attacks.

On November 18, 2021, the federal banking agencies announced the adoption of a final rule providing for new notification requirements for banking organizations and their service providers for significant cybersecurity incidents. Specifically, the new rule requires a banking organization to notify its primary federal regulator as soon as possible, and no later than 36 hours after, the banking organization determines that a “computer-security incident” rising to the level of a “notification incident” has occurred. Notification is required for incidents that have materially affected or are reasonably likely to materially affect the viability of a banking organization’s operations, its ability to deliver banking products and services, or the stability of the financial sector. Service providers are required under the rule to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect the banking organization’s customers for four or more hours. Compliance with the new rule was required by May 1, 2022. The Company believes it and the Bank are currently in compliance with these requirements.

Other Regulations

The Bank is a member of the FHLB, which makes loans or advances to members. All advances are required to be fully secured by sufficient collateral as determined by the FHLB. To be a FHLB member, financial institutions must demonstrate that they originate and/or purchase long-term home mortgage loans or mortgage-backed securities. The Bank is required to purchase and maintain stock in the FHLB. At December 31, 2024, the Bank had $30.2 million in FHLB stock, which was in compliance with this requirement.

Volcker Rule

The so-called “Volcker Rule” imposes certain restrictions on