Company: BANFP
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-030159
Chunk: 17

Company: BANCFIRST CORP /OK/
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 17
---
 would not be applicable to the Company, BancFirst, Pegasus or Worthington.

NASDAQ has adopted listing standards mandating the recovery or “clawback” of excess incentive-based compensation earned by a current or former executive officer during the three fiscal years preceding the date the listed company is required to prepare an accounting restatement, including to correct an error that would result in a material misstatement if the error were corrected in the current period or left uncorrected in the current period. Each listed company is required to have a compliant policy governing recovery of erroneously awarded compensation as required by the new listing standards. The Company has adopted a compliant policy governing the recovery of erroneously awarded compensation as required by the listing standards, which is filed as Exhibit 97 to this Form 10-K.

The scope, content and application of the U.S. banking regulators' policies on incentive compensation continue to evolve. It cannot be determined at this time whether compliance with such policies will adversely affect the ability of the Company, BancFirst, Pegasus and Worthington to hire, retain and motivate key employees.

Cybersecurity

Federal agencies have issued statements regarding cybersecurity. Financial institutions are expected to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures, to reliably authenticate customers accessing internet-based services of the financial institution. Management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial 

 10 

institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. Failure to observe the regulatory guidance could subject the Company, BancFirst, Pegasus and Worthington to various regulatory sanctions, including financial penalties.

In the ordinary course of business, the Company, BancFirst, Pegasus and Worthington rely on electronic communications and information systems to conduct operations and to store sensitive data. They employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. The Company, BancFirst, Pegasus and Worthington employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of their defensive measures, the threat from cyber