Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 26

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 26
---
 or control of U.S. persons.  OFAC also maintains a list of designated persons, groups or entities that are the target of sanctions, including the “Specially Designated Nationals and Blocked Persons List.” The assets of designated persons, groups or entities are blocked and U.S. persons are generally prohibited from dealing with any such persons.  Moreover, blocked assets, for example property and bank deposits, cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC.  If the Company finds a name on any transaction, account or wire transfer associated with a sanctioned person, the Company must freeze or block such account or transaction, file a blocked property report with OFAC and notify the appropriate authorities.  Failure to comply with U.S. economic sanctions could have serious legal and reputational consequences.

Data Privacy and Cybersecurity

Various federal, state and local laws, rules, regulations and standards contain extensive data privacy and cybersecurity provisions, and the legal and regulatory framework for data privacy and cybersecurity is in considerable flux and rapidly evolving. For example, current federal laws, rules, regulations and standards, including the Gramm-Leach-Bliley Act (the “GLBA”), require financial institutions to, among other things, periodically disclose their privacy policies and practices relating to sharing personal information and enable retail customers to opt out of the Company’s ability to share such personal information with unaffiliated third parties under certain circumstances. Such laws and regulations also require financial institutions to implement a comprehensive cybersecurity program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer records and information. An amendment to Regulation S-P, an implementing regulation promulgated under the GLBA, was adopted by the SEC on May 16, 2024 and requires broker dealers and registered investment advisers to, among other things, adopt and implement an incident response program as part of their formal cybersecurity policies and procedures and report data breaches to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization within 30 days of becoming aware of such data breach. Other federal and state laws, rules, regulations and standards impact the Company’s ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. Federal law also makes it a criminal offense, except in limited circumstances, to obtain or attempt to obtain customer information of a financial nature by fraudulent or deceptive means. The Company and its nonbanking subsidiaries are also subject to rules