Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 100

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 100
---
, as a servicer, to perform the Company’s servicing obligations or any act or omission on the Company’s part that involves willful misfeasance, bad faith, or gross negligence. For certain investors and certain transactions, Truist may be contractually obligated to repurchase a loan or reimburse the investor for credit losses incurred on the loan as a remedy for servicing errors with respect to the loan. The Company may be subject to increased repurchase or indemnity obligations as a result of claims made that the Company did not satisfy its obligations as a servicer. The Company may also experience increased loss severity on repurchases, which may require a material increase to the Company’s repurchase reserve. While the number of such indemnification claims has been small, these could increase in the future.

Truist faces substantial risks in safeguarding personal and other sensitive information.

Truist’s businesses are subject to complex and evolving laws, rules, and regulations governing data privacy, data protection, and cybersecurity, particularly with respect to the privacy and protection of personal information of individuals. Individuals whose personal information may be protected by law can include the Company’s clients (and in some cases its clients’ clients), prospective clients, job applicants, teammates, and the employees of the Company’s vendors, and other third parties. Complying with the laws, rules, and regulations applicable to the Company’s disclosure, collection, use, sharing, storage, and other processing of personal information can increase operating costs, impact the development of new products or services, and reduce operational efficiency. Any mishandling or misuse of personal information by the Company or a third-party affiliated with the Company could expose the Company to litigation or regulatory fines, penalties, or other sanctions.

Additional risks could arise from the failure of the Company or third parties to provide adequate disclosure or transparency to the Company’s clients about the personal information collected from them and the use of such information; to receive, document, and honor the privacy preferences expressed by the Company’s clients; to protect personal information from unauthorized disclosure; or to maintain training on data privacy, data protection, or cybersecurity practices for all teammates or third parties who have access to personal information. Concerns regarding the effectiveness of Truist’s measures to safeguard personal information, or even the perception that those measures are inadequate, could cause Truist to lose existing or potential clients, and thereby reduce Truist’s revenues. Furthermore, any failure or perceived failure by the Company to comply with applicable data privacy, data protection, or cybersecurity laws, rules, or