Company: BANC-PF
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001628280-25-009438
Chunk: 258

Company: BANC OF CALIFORNIA, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 258
---
 The techniques used by bad actors change frequently, may not be recognized until launched, and may not be recognized until well after a breach has occurred. If one or more of these events occur, this could jeopardize our clients' confidential and other information that we process and store, or otherwise cause interruptions in our operations or the operations of our clients or counterparties. In addition, the U.S. banking regulatory agencies adopted a rule requiring us to notify the FRB within 36 hours of any significant computer security incident, and in July 2023, the SEC adopted rules that require reporting on Form 8-K of material cybersecurity incidents. Several states and their governmental agencies also have adopted or proposed cybersecurity laws. Privacy laws in the State of California and the State of Colorado, for example, require regulated entities to establish measures to identify, manage, secure, track, produce, and delete personal information. The occurrence of cyber-attacks may require us to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through our current insurance policies. If a cyber-attack succeeds in disrupting our operations or disclosing confidential data, we could also suffer significant reputational damage in addition to possible regulatory fines or client lawsuits.

We provide internet banking services to our clients which have additional cyber risks related to our client’s personal electronic devices and electronic communication. Any compromise of personal electronic device security could jeopardize the confidential information of our clients (including user names and passwords) and expose our clients to account take-overs and the possibility for financial crimes such as fraud or identity theft and deter clients from using our internet banking services. We rely on and employ industry-standard tools and processes to safeguard data. These precautions may not protect our systems from future vulnerabilities, data breaches or other cyber threats. Losses due to unauthorized account activity could harm our reputation and may have a material adverse effect on our business, financial condition, results of operations, and prospects.

Our security measures may not protect us from systems failures or interruptions.

While we have established policies and technical controls to prevent or limit the impact of systems failures and interruptions, there are no absolute assurances that such events will not occur or that the resulting damages will be adequately mitigated. 

We rely on communications, information, operating and financial control systems technology from third party service providers, and we may suffer an interruption in those systems. 

We outsource certain aspects of our data processing and operational functions to third party