Company: USB-PA
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000036104-25-000016
Chunk: 24

Company: US BANCORP \DE\
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1
Chunk 24
---
writing activities. Use of such information is regulated under the Fair Credit Reporting Act (“ FCRA”), and the FCRA also regulates reporting information to consumer reporting agencies, prescreening individuals for credit offers, sharing of consumer reports between affiliates, and using affiliate credit data for marketing purposes. Similar state laws may impose additional requirements on the Company and its subsidiaries. In January 2025, the CFPB published a final FCRA-related rule that prohibits the inclusion of medical debts in consumer reports and prohibits a creditor’s use of medical debt to determine credit eligibility, absent a specific exception. There are currently two lawsuits filed against the CFPB disputing the validity of the final rule and a preliminary injunction has been granted by the court. Consequently, the effective date of the final rule has been stayed until June 15, 2025. In addition, a notice of proposed rulemaking to revise the FCRA was also published in December 2024, with comments to the proposal due in March 2025.

The federal banking regulators, as well as the SEC, CFPB, CFTC, and related self-regulatory organizations, regularly issue guidance on cybersecurity that is intended to enhance cyber risk management among financial institutions and provide timely information to investors. A financial institution’s management is required to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cybersecurity incident. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations if the institution or its critical service providers experience a cybersecurity incident.

The Company and its subsidiaries are subject to increasing numbers of regulatory notification and disclosure requirements related to cybersecurity. As of April 2022, banking organizations, such as the Company and USBNA, are required to notify their primary federal regulator within 36 hours of a computer-security incident that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores or transmits, which has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. Similarly, the Office of the Superintendent of Financial Institutions in Canada requires Federally Regulated Financial Institutions to report qualifying technology and cybersecurity incidents under the provisions of the August 13, 2021 Technology and Cyber Security Incident Reporting Advisory.

Consumer Protection USBNA’s retail banking activities are subject